The tag has no wiki summary.

learn more… | top users | synonyms

37
votes
7answers
4k views

Why do mobile apps have fine-grained permissions while desktop apps don't? [duplicate]

Androids apps use fine-grained permissions for security reasons, iOS apps (afaik) do it as well. Windows 8.1 applications don't have a permission schema like that, all Linux versions which I have ...
4
votes
1answer
32 views

What security problems does copying .Xauthority to another user present?

If I want to use a GUI application with another user (example: webbrowser), I can copy the .Xauthority file to that given user's home then I can "su - user" and start the GUI app. Question: but what ...
5
votes
2answers
124 views

Prevent a desktop client application from abusing an API access token obtained through OAuth2 on behalf of an application

I have the following use case: I want to write a desktop application that makes use of a third-party API (e.g. Dropbox) This API requires an access_token to be sent to the server with each request. ...
0
votes
1answer
43 views

Does Linux and Mac OSX have built-in Credential/Password Managers with API access? [closed]

Does Linux and Mac OSX have built-in Credential/Password Managers with API access like Windows has with its CredMan (CredWrite, etc). It would be preferrable if they could be used without the need to ...
1
vote
1answer
111 views

Is it “cross-platform attack” if first OS is not attacked at all?

I am analyzing a mobile application, which has embedded files(Worms) to attack a desktop OS. But this application does not do any harm to the mobile platform. Mobile is just a medium to deliver ...
0
votes
0answers
20 views

What user interface is most useful to users who use PGP Key Splitting, or other Shamir-based keys?

I am developing an application that uses Shamir-based key splitting, and am looking at various products and am looking for a user-friendly, possibly dynamic graph that helps users build and manage key ...
1
vote
1answer
77 views

How do I secure X server against spyware in a GUI application?

Suppose you have a GUI application, that potentionally may be too curious about your environment, such as the list of window titles. How do I limit application's ability to enumerate windows, capture ...
-1
votes
1answer
151 views

Which hardening methods are used in large linux desktops environments (i.e. Goobuntu)? [closed]

Im courious to know about how these large enterprises secure their linux desktop as Google does with ubuntu LTS. I am the only user at home with linux on the desktop and had already created some ...
0
votes
1answer
129 views

Securing login form in a desktop app

I currently have a desktop application which requires the user to have a username and a password. These credentials are stored on a webserver (myserver.com), so when he types the username and the ...
7
votes
4answers
197 views

Same-origin policy for desktop application?

The same-origin policy is one of the most important security feature in our browser. It basically provides sandboxing for our applications which is protecting our users. Desktop application can read ...
0
votes
1answer
173 views

Can a VM be used as a home computer?

Our old computer is getting replaced, and I want to secure the new computer right from the get go. So I figured if I install something like VirtualBox first thing, I could then create one very ...
6
votes
2answers
171 views

Why are apps for mobile devices more restrictive than for desktop?

Application devlopement for mobile devices is generally more restrictive, i.e. the apps runs in a sandboxed environment, they have many limitations when accessing the filesystem, etc. compared to ...
2
votes
5answers
506 views

running firefox as unprivileged user on Linux

On a typical desktop (with no listening services such as Apache, SSH, ...) it seems to me, the browser is the most exposed application and a potential security compromise (and even more so with Java ...
0
votes
2answers
321 views

Which Antivirus Software used to remove virus Rootkit.Sirefef.Gen?

My System has affect Rootkit.Sirefef.Gen Virus. So i want to know which antivirus software is used to remove Rootkit.Sirefef.Gen virus file.
10
votes
3answers
636 views

Should a hostname ever be considered a secret?

I've been told in the past that you should never give out the host names of computers on your network. I can't think of any reason why this would be the case. Could someone tell me if they should be ...
8
votes
4answers
309 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
4
votes
3answers
528 views

Application to monitor software activities

I am doing black box testing on a software which is installed in my local machine. I want to analyze and see the list of files and registry entries that software create/modify/delete. Basically ...
-1
votes
3answers
2k views

How to effectively save database password inside desktop application?

Suppose we are in the field of desktop applications which need to store their data in a database. How do I store the password for this database avoiding the most obvious mistakes, which are: 1) hard ...
4
votes
2answers
454 views

Security Scanning for Desktop Applications

Our company develops Windows desktop applications. We offer off the shelf solutions - not custom development. A potential new customer wants to add a section to our standard contract that requires ...
1
vote
2answers
246 views

What's the secure way to change UNIX permissions on a harcoded file often?

I'm writing a daemon that monitors something in the OS and flips execution permissions on a file in /run/ back and forth. The file has static contents and the file name is hardcoded in the daemon. I ...
5
votes
1answer
439 views

In the light of recent information about RarVM, can we still trust RAR files?

See: http://blog.cmpxchg8b.com/2012/09/fun-with-constrained-programming.html https://github.com/taviso/rarvmtools It would seem according to these two sources that rar files can contain custom ...
6
votes
3answers
468 views

Virtualization as a layer of security for desktop computers?

Given the amount of 3rd party plugins required to browse the web, I've been compelled to virtualize my online habits to gain an additional layer of security. There is of course some obvious ...
11
votes
3answers
1k views

Attacks against windows kiosk software

I am interested in potential/actual attacks against kiosk software. I am not talking about physical access, or specifically designed kiosk operating systems or shells, bur rather software that runs ...
32
votes
6answers
4k views

Secure Linux Desktop

I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details ...
27
votes
3answers
20k views

How does the Windows “Secure Desktop” mode work?

Can anyone explain (or provide a link to a simple explanation) of what the Windows "Secure Desktop" mode is and how it works? I just heard about it in the KeePass documentation (KeePass - Enter ...
17
votes
1answer
2k views

Passive and active attacks via X11. Is Wayland any better?

In The Linux Security Circus: On GUI isolation - The Invisible Things Lab's blog, Joanna Rutkowska describes attacks from one X11 app on another and the general problem of the lack of GUI-level ...