Collaborate Disseminate
When a user fails to successfully login, what information should be given back to them?
Normally, we post back "Account not found" or "Incorrect password" or "Incorrect Location" (for location restrictions). B… Continue reading For failed logins, what information should be given to users?
Is it poor practice to use the last 4 digits of a social security number as an identifier?
The last 4 digits of a person’s social are commonly used as a means of personal identification/authentication, but I can’t find guid… Continue reading Is it poor practice to use the last 4 digits of a social security number as an identifier?
Is having a longer/more complex username considered more secure than using a shorter/basic one? Would the uniqueness of a username positively impact security?
This is assuming that adversaries aren’t aware of what the usern… Continue reading Does username length/complexity/uniqueness positively impact security?
Are open redirects a security concern? Google writes that: “An open redirect isn’t a bug or a security flaw in and of itself—for some uses they have to be left fairly open.” And Google’s bounty program doesn’t view it as a bu… Continue reading Are open redirects a security concern?