2
votes
1answer
13 views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
1
vote
2answers
24 views

What's the benefit of hybrid cryptosystem vs asymmetric for small data blocks?

It's a common belief hybrid cryptosystems are better than asymmetric only. Is that allways like that? What's the benefit of using symmetric and asymmetric encryption for small data blocks (< 100 ...
1
vote
0answers
9 views

is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question

Have a question towards the 998 bytes limitation on the esmtp header line length. We have noticed the asa is dropping emails coming from various external mail servers with the header line length ...
0
votes
1answer
57 views

TeamViewer: I'm worried the user who used my PC stole some data

How can I be sure that the user yesterday connected to my PC with TeamViewer downloaded some data with the file transfer? Does the file transfer shows a notification to say that he is downloading ...
0
votes
0answers
7 views

return list of sites with similar unique IDs (e.g. Adwords)

I have been using http://sameid.net/ to discover sites which have the same unique ID as a page in question for a number of affiliate and advertising networks. However, I am wondering if there is a ...
3
votes
3answers
77 views

How does a one liner to create passwords in linux look like?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy?
0
votes
1answer
24 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...
7
votes
2answers
242 views

Why is TLS_FALLBACK_SCSV secure against a MITM attack?

It is recommended, to mitigate POODLE, if SSLv3 cannot be disabled entirely, to make use of TLS_FALLBACK_SCSV, a signaling cipher suite value that indicates that fallback has occurred. The draft ...
2
votes
2answers
35 views

How do I encrypt external drive with Password which is compatible with both Linux and Windows?

I wanted to encrypt my external drive with password, which is compatible in both Linux and Windows. Truecrypt is an option. But the development of it is stopped few months back. I came across ...
0
votes
0answers
26 views

In buffer overflow exploit, 0x20 (space character) not appearing in memory and is replaced by null

The situation: I'm currently working on shellcode (I modified the assembly code from Project Shellcode) that runs "cmd.exe /c calc.exe". The shellcode itself works fine. However, when I use the ...
-1
votes
1answer
27 views

Making 2 yubikeys generate the same password

Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a ...
15
votes
2answers
1k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of CA's, many unrecognizable without a lookup or reference, that are trusted by default in major OS's - and while there have been attempts by the NSA and others to "hack" or ...
0
votes
1answer
43 views

XSS - Bypass this RegExp

How could this anti-xss regexp be bypassed: /<(?:\w+)\W+?[\w]/ I am working on it but I can't find a way. Just to be sure that I have understood it correctly, this regexp search for a pattern ...
1
vote
1answer
19 views

Using OAuth 2.0 without token storage

I am building a system for a product which requires Authentication and Authorization. Naturally I have chosen using OAuth 2.0 as it is a commonly used protocol and has proven to be useful. I am ...
-1
votes
3answers
57 views

what are the best security certifications for beginners with no experience in IT [on hold]

I want to make a career change from administration to IT but I have absolutely no experience and no certifications in IT. I am interested in information security and networking. So what certifications ...
-1
votes
0answers
13 views

How do I set up SSL in wampserver [migrated]

When transmitting sensitive data over the Internet its exposed to malicious users or links therefore ssl or ssh is adopted. I have wampserver in my local machine and would love help on how to set up ...
0
votes
3answers
48 views

How SplashData knows about Worst Passwords used by users annually

It is known that every reputable website stores their user passwords into their database after implementing some hashing algorithm on it, and even they don't know what the actual password of the user ...
1
vote
1answer
31 views

Can the following function be somehow exploited/used for malicious behaviour?

I am using a main Site Engine class which is constructing most of my pages. I'm using this language function to change language website for all of my pages in the start of the Site Engine class: ...
0
votes
0answers
24 views

Hidden TrueCrypt Container containing the Tor Browser Bundle

I'm considering using a hidden TrueCrypt container to keep a Tor browser bundle copy which could save bookmarks. In this case, would the TBB leave traces on the OS it started with? E.g. I use my ...
-1
votes
0answers
26 views

Facebook connecting without relations [on hold]

Not too long ago, I looked up a person I know, but share NO relation with whatsoever (person X) on Facebook, only using X's first name. Note that I only talked to X through a not too known web-chat ...
-2
votes
1answer
50 views

Given remote access to a virtual machine, how much damage could someone do to the host computer? [on hold]

Assume that it's a fresh virtual machine, with no one logged on to a service like Google or Facebook, but still connected to the internet. I'd also like to know if it's affected by the type of RD ...
6
votes
2answers
495 views

Should I change phone number and e-mail address after PayPal fraud?

I have been the victim of PayPal fraud. I hadn't used PayPal in a year and then within 9 days there were three unauthorized transactions on my account for a total of 150 Canadian dollars and 290 ...
10
votes
1answer
769 views

Why do exploit kits use droppers?

I've been looking into the structure of the online criminal underground, which consists of exploit kits, droppers, and malware payloads. What is the function of the dropper in this pipeline? Why ...
0
votes
1answer
21 views

extracting JSESSIONID from document.cookie

I was trying cookie stealing on a java and spring based web application. Normally, a cookie can be obtained through <script>alert(document.cookie)</script>, but in the above code, cookie ...
1
vote
0answers
38 views

Mobile, WebServices and SSL

So I just started dipping my feet into Security and SSL. I looked at various videos to try and understand how the magic happens and I have the general idea now. But most deal with it taking the ...
1
vote
0answers
17 views

cisco asa syn flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
1
vote
1answer
66 views

Is there any practical attack on port knocking method?

I was wondering, how can I bypass the port knocking method. Is there any public vulnerability or method for attacking port knocking services? For example: I know an SSH port is behind a port ...
0
votes
0answers
11 views

logging of data traffic to follow cyber law [migrated]

I have connected my ubuntu 14.04 computer to a "mirrored" port on my firewall, so that I can see all traffic on the network. I use this today to see who uses our bandwidth with NTOPNG. but since I ...
0
votes
1answer
82 views

Identify an unknown type of hash [on hold]

I've come across an unknown type of hash value which looks like this: AAAAAATOM2KIII+kbR/Dqw3TLTw4PHsGPZft2c+b93rImFIuAQ== The corresponding hex string is: ...
-4
votes
1answer
24 views

Question regarding Oauth and https [on hold]

Whats the difference between Oauth protocol and https protocol?
0
votes
0answers
18 views

Establish IPSEC Tunnel between two Ubuntu 12.04 PCs over LAN [migrated]

I have two ubuntu 12.04 32 Bit PCs between which I want IPSec Tunnel to be setup. I have setup ipsec in both systems and ipsec verify runs fine on both. Since I have no prior experience of openswan, I ...
5
votes
1answer
1k views

How do I stop attack on my email id from hackers?

We have an email id, info@<ourdomain>.com This email id is being hacked frequently and mails are sent from this email id, Following is the example of one such email. From: ...
-4
votes
1answer
50 views

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection [on hold]

Is there any way to hack the password of my neighbour WPA-PSK and WEP connection of WI-FI without using a keylogger. I tried a lots of softwares and efforts but unsuccessful. Can any one suggest. I ...
-1
votes
0answers
24 views

are companies in singapore required to comply with PCI? [on hold]

How long can CC info be kept by the company? Can only keep the last 4 digits of CC info with name of card owner?
1
vote
2answers
48 views

SSL Certificate Trust Model

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a ...
0
votes
1answer
34 views

Can the aproximated date on which a given Encryption Algorithm will become prone to brute force be predicted?

I have a very elementary understanding about encryption so this question may have false assumptions, Lets take an encryption algorithm that is impractical to break through bruteforce with today's ...
1
vote
1answer
62 views

How long can a pkcs#8 passphrase be?

A program is using a private key to read messages. To improve security, besides randomness, I'm trying to create the longest passphrase that makes sense. How long should it be? After which amount of ...
2
votes
2answers
56 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
-5
votes
1answer
37 views

Requirment for encryption algorithem to be secure/safe [on hold]

When we call encryption algorithem safe/secure? I can list following: is not possible to find key from cipher text is not possible to find plain text from cipher text Resistant to brute-force ...
-1
votes
1answer
35 views

Can I used the command line to disable settings in Yosemite that have made my Mac visible?

Recent changes to my machine as the result of an upgrade to Yosemite (OS X 10.10) have made my machine visible on Bluetooth and Bonjour, where it was not visible before. Is there a command line way ...
0
votes
0answers
15 views

IIS 8.5 TLS 1.2 not working [migrated]

I have Windows 8.1 with IIS 8.5 and have run the script from http://www.hass.de/content/setup-your-iis-ssl-perfect-forward-secrecy-and-tls-12 to enable TLS 1.2, but Qualys SSLLabs says my server ...
0
votes
1answer
29 views

Encrypted NAS where only clients know the (decryption) key

Is there an implementation of a file-sharing network protocol where the server has no idea what data is being stored, but can serve the encrypted files to clients that will decrypt them on-the-fly (if ...
1
vote
0answers
26 views

Read SSL Certs with user process

I am running my own server, on which I have different services (Nginx etc.). All these (internet) services are / should be secured with SSL (offcialy signed). The key files / certificates are located ...
-2
votes
0answers
5 views

Cycript iOS Runtime Manipulation [on hold]

How to change the label in an ios app using Cycript?
0
votes
1answer
57 views

How will Gmail be able to detect SPAM and display ads when emails are encrypted end-to-end?

Context Google is making end-to-end encryption easier to use. SPAM How will they be able to perform SPAM detection when the email is transmitted and stored encryptedly? I suppose that if the SPAM ...
1
vote
0answers
52 views

How to use Intel Ivy Bridge's RNG? [migrated]

I read that Intel Ivy Bridge processors provide a RNG (RdRand). But how do I use this? My CPU E3-1270v2 does not provide a RNG flag. flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr ...
1
vote
1answer
52 views

Can Facebook login to my app?

This sounds maybe like a stupid question, but I'm wondering myself if this is theoretically possible. Let's say I'm using Facebook login in my app. If the login is successful I get I get back an ...
2
votes
2answers
67 views

Security concerns with iframes

Are there any security concerns I should be aware of, if I want to give users the ability to embed iframes(for things like Youtube videos) in their generated content on my site. The user generated ...
0
votes
0answers
20 views

some Concerns about security in online merchants sites [on hold]

I want clarification regarding some concerns about online merchants : is there some standard classification for online merchants ? how can you recognize if the site is real or fake ? through using ...
0
votes
0answers
29 views

Using HMAC when sending data through an untrusted server

I have a set up like this: Payment Server (PS) <> Front End (FE) <> Client JS. I need to get some data from the Client JS to the PS, without the FE being able to modify it and have PS prove ...

15 30 50 per page