On.Security

Developing secure software is a challenge. Writing really secure software is a real challenge.
Here are the articles which touch different security aspects of software, from “what cipher suites are not to be used with TLS”, to certain more or less novel things under ‘Security Research’ subcategory

MMOG. RTT, Input Lag, and How to Mitigate Them

January 25, 2016 by “No Bugs” Bunny

The game of Client-Server

Quote:

For fast-paced games, there is one big problem with the flow shown on this diagram, and the name of the problem is “latency” (a.k.a. 'input lag')

Another Quote:

No, better bandwidth doesn't necessarily mean better latency

Filed under: On.SecurityFraud PreventionOn.ProgrammingNetwork Programming

Read more

On Cheating, P2P, and (non-)Authoritative Servers from "D&D of MMOG" book

November 9, 2015 by “No Bugs” Bunny

Card Cheater

Abstract:

Any successful MMOG faces cheaters, and currently authoritative servers is the only way which enables fighting them.

Quote:

Two things are infinite: the universe and human stupidity; and I’m not sure about the universe. — Albert Einstein

Filed under: On.SecurityFraud PreventionBook: D&D of MOGs1st beta of Vol. VII-IX

Tagged With: Servermultiplayer
Read more

Addressing the Delayed Message Attack in Wireless IoT Environments

September 14, 2015 by “Sergeant Major” Hare

Delayed-Message Attack Cartoon

Abstract:

Delayed-Message Attacks can Represent a Real Threat if Left Unchecked

Quote:

Prevention/mitigation of the Attack is easy, but it needs to be taken into account at the application level.

Filed under: On.SecurityResearch

Tagged With: IoTTCP
Read more

Client-Plus-Server Password Hashing as a Potential Way to Improve Security Against Brute Force Attacks without Overloading the Server

August 10, 2015 by “Sergeant Major” Hare

Hash of the Hash

Abstract:

Client-Side password hashing (in addition to existing server-side hashing) can improve resilience to brute-force attacks.

Quote:

Even if client-side is 10x slower than server-side, it leaves us with 10x improvement which is certainly a good thing to have

Filed under: On.SecurityResearch

Tagged With: CryptoPassword
Read more