Vote for your question of the week #35

Question

For QotW #35, scheduled for publishing to the Security Stack Exchange Blog on 14 September, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site.

Please post any question that you feel is of worth and the reason why as an answer below. Try not to promote your own questions or answers for publicity's sake. We are looking for questions that are of great interest, or have exceptional answers. If you like a posted question then vote it up. Each week we are going to try to post about the question and its contents. Also, have a look at the blog to check it hasn't already been written about.

Additionally, if you had a favourite question which didn't get selected in a previous week, repost - it may be selected this week.

When submitting a QotW, please indicate if you would be interested in writing about it for the blog. This is a factor which we take into consideration when selecting what to blog about - we need a post we can actually say something interesting about, it shouldn't be something we've written about too much before, and it helps to have somebody interested in writing the article.

I repeat - volunteer authors are always welcome - we get a wider range of styles, and it puts less of a load on the regulars

Note to the answerers, if you dig a question, you can always submit a draft blog post about it, even if its not picked as QotW. Contact a moderator, or come and chat in the DMZ if you need more information.

Timings:

• Question and author selection: 1700 UTC Tuesday
• Draft submission: 0800 UTC Thursday to enable review
• Publication: 1200 UTC Friday.

For a list of previous proposed and featured questions, look at @Iszi's question here.

Answer 1

Dealing with excessive "Carding" attempts

In the context of throttling logins and limiting information leaks.

Answer 2

I nominate Thomas Pornin's answer to CRIME - How to beat the BEAST successor?. This is one of the most impressive answers I can remember seeing on this site.

Let's review. The question points to a announcement of a new attack on SSL in the press (the attack is called CRIME). However, the press article has no details and the inventors of the attack aren't saying anything. The question calls for speculation about what the attack might be. There's almost nothing to go on.

And here comes Thomas Pornin, who after reading the news article, comes up with an attack on SSL. He goes on to describe an attack that seems like it might well work, and one that, as far as I know, has not been publicly described before. With almost nothing concrete to go on, Thomas pulls out of his hat a new attack on SSL. Wow!

So, no matter how things work out, this is a brilliant answer. We have informed and plausible speculation about what the CRIME attack is. If Thomas Pornin's speculation is right, then this site managed to break the news first. And if Thomas Pornin's speculation is wrong, that's exciting, too -- we have a plausible new attack on SSL that we'd all better study carefully. Either way, this seems like a great topic for a blog post.

(And, no need to wait for September 14. I recommend we encourage Thomas (or someone) to write this up for the blog, as soon as possible!)