Beefy Boxes and Bandwidth Generously Provided by pair Networks
Welcome to the Monastery
 
PerlMonks  

Re: Re: Essential CGI Security Practices

by dsheroh (Prior)
on May 17, 2002 at 18:12 UTC ( #167380=note: print w/replies, xml ) Need Help??


in reply to Re: Essential CGI Security Practices
in thread Essential CGI Security Practices

I wouldn't go so far as to say that "Invalid login" fails to buy any security - it prevents users from trivially determining whether a username is valid or not, thus significantly increasing the search space for a brute-force attack. Not a silver bullet by any means (not even a very shiny one, really), but still enough to be significant in many cases.

(Yeah, escalating delays are good, too, but a little trickier to implement in an environment, such as CGI, where you can't reliably maintain state.)

  • Comment on Re: Re: Essential CGI Security Practices

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://167380]
help
Chatterbox?
beech testing in the sidebar
beech *me* me *me

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (5)
As of 2017-03-28 23:35 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?
    Should Pluto Get Its Planethood Back?



    Results (343 votes). Check out past polls.