A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

learn more… | top users | synonyms

8
votes
1answer
898 views

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

The default usage of HttpClient and HttpWebRequest .NET classes is setting Credentials property and then asking the class instance to perform an HTTP request. If the target requres Basic authorization ...
1
vote
1answer
70 views

What network protocol is Crashplan using?

I have been using CrashPlan for a while internally (i.e. local backup server). I would also like to setup off-site backup but my experience is that I have to forward a port from the router sitting at ...
2
votes
4answers
638 views

Are custom protocols insecure?

So, I know rolling your own security is ill-advised, but for simplistic things like communicating with a home server, say, updating a grocery list, is a custom protocol fine? It won't be doing ...
0
votes
0answers
35 views

Payment Application Integration - Encryption or HMAC

Doing an integration with an online payment provider. Payment provider will be making a web request to my server to provide some information about the basket content. On my end there's no payment ...
0
votes
1answer
43 views

Basis Authentication Protocol: a concrete attack

Below is an informal protocol narration of a simple authentication protocol. A sends to B a signed hash of message M, B's name and a nonce N. B knows that the message M is intended for him, that it ...
2
votes
2answers
165 views

How does the SSL connection protocol work with self-signed certificate?

I'm using the self-signed certificate, but I don't know how this protocol works. I connect two apps with a socket SSL and it works fine. The server is a Python app and the client is an Android app. I ...
0
votes
2answers
298 views

What service could penetrate my Firewall via UDP on Port 17275?

Has anyone monitored various requests from all over the world on Port 17275 via UDP? My firewall logs show huge amounts of such requests from lots of different IP Adresses. I can't find any ...
0
votes
1answer
87 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
0
votes
2answers
67 views

What are the alternatives to ECDSA for an authentication protocol?

In an authentication protocol, S has a public/private key pair known to C, and S and C have established a secure channel (for example, using DH or ECDH, or any other key exchange protocol). C wishes ...
-1
votes
1answer
836 views

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

I am making a presentation to the class about "SSL 2.0 deprecated protocol" and I really have no idea how this exploit is used or how the attacker can use this vul. I understand the impact of this ...
1
vote
2answers
54 views

Is it possible to implement a secure game without having a reliable arbiter?

N players are playing a perfect information game (the kind of game where everyone knows moves of everyone) by making moves by turn (P1, P2, ..., Pn, P1, ..., Pn, ... till the game will finish). Game ...
1
vote
1answer
328 views

What is the different between CMP and SCEP protocol?

What is the different between CMPV and SCEP protocol? Which one is better ?
3
votes
4answers
247 views

What's the need of multiple implementations of SSL/TLS? [closed]

I've been reading about SSL/TLS and I was surprised when I saw the amount SSL/TLS implementations that exist. wikipedia. So, is there really a need for all these different implementations? Wouldn't ...
4
votes
3answers
2k views

Safe to expose Active Directory via LDAPS externally?

We currently access Active Directory via LDAPS internally for authentication and user data retrieval. Is it common, or safe, to expose this publicly over LDAPs? Addendum 1: Our business case, ...
5
votes
2answers
1k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document. In ...
4
votes
1answer
132 views

Are the SSL Digital Security Certificates based on Kerberos Network Security Protocol

I just want to know if digital certificates use the kerberos session key algorithm.
1
vote
2answers
60 views

What cryptographic protocol is appropriate for the case where user needs access to a binary and encrypted configuration files?

This is a very newbie IT security question... I have to quickly implement a solution for our application that works like this... We have a binary executable that is given a configuration file. I need ...
3
votes
1answer
161 views

How to fix this broken crypto protocol?

I am considering a protocol where you upload a one time pad to a server, using public key encryption and then the result (using the pad) is sent back in plaintext: Alice uses Bobs RSA public key to ...
5
votes
1answer
2k views

What block ciphers and algorithms are now safe? [closed]

I work for a large non-US based international organisation. Regarding the recent leaks about the NSA breaking most encryption on the internet, we now know the US and UK governments are actively ...
1
vote
1answer
62 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
0
votes
2answers
129 views

What TLS and SSL protocols should I have turned on

I am using Explorer as my browser. What do I have to have on regarding the TLS and SSL protocols. There are several of each one.
6
votes
4answers
361 views

Are there a standard method(s) for me to give someone else read-only access to my data?

Are there a standard method(s) for me to give someone else read-only access to my data? There are several situations where I may want to give a few people read-only access to some data, but I would ...
14
votes
6answers
6k views

How to implement multi factor authentication using a token generator?

I'd like to implement multi factor authentication on a few projects. Now the first factor would be username and password, for the second factor I would like to use a token generator. These tokens ...
1
vote
2answers
54 views

What steps remain for a robust, neutral and surveillance-proof Internet? [closed]

Recent leaks about widespread NSA surveillance have brought privacy and security to the forefront of the public consciousness as we strive to determine best practices in governance for the Internet ...
21
votes
3answers
5k views

Preventing artificial latency or “Lag Hacking” in multiplayer games

There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
5
votes
3answers
17k views

Four-way Handshake in WPA-Personal (WPA-PSK)

Can someone explain to me in what consists the Four-way Handshake in WPA-Personal (WPA with Pre-Shared Key), which informations are being sent between AP and client, how is it possible to find the AP ...
24
votes
3answers
17k views

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? I know that DHE-RSA is (in one sentence) Diffie Hellman signed using RSA keys. Where DH is used for forward secrecy and RSA guards against MITM, ...
6
votes
1answer
1k views

What does chacha20-poly1305@openssh.com mean for me?

OpenSSH just introduced a new protocol, chacha20-poly1305@openssh.com, which combines the two algorithms from DJB: ChaCha20 and Poly1305-AES. It was inspired by a similar proposal for TLS, which ...
0
votes
1answer
112 views

How to extract the top-level of protocols into the csv file by using tshark command?

Here is what I tried: tshark -r test.pcap -T fields -e ip.proto > output.csv But this can only show all the protocols in the csv files. I want to show only the top level of protocol numbers such as ...
3
votes
4answers
772 views

Can we prevent a man-in-the-middle attack with symmetric-key cryptography?

Suppose that Alice signs the message M = "I love security" and then encrypts it with Bob's public key before sending it to Bob. As well known, Bob can decrypt this to obtain the signed message and ...
1
vote
1answer
52 views

Protocols that are highly resistant to code injection attacks ? [closed]

After reading about language based security, it seems protocols that are defined using context-free or regular grammars are highly resistant to code injection attacks. Are there any good security ...
2
votes
0answers
80 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
1
vote
1answer
83 views

The need for created timestamp in tokens

In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is ...
10
votes
3answers
728 views

Is off-the-record style encryption possible with email?

The instant messaging world has off-the-record encryption - which means you get authentication, encryption, and forward deniability. Key material is published after a session ends such that an ...
2
votes
1answer
263 views

Using Diffie–Hellman key protocol to create a safe secret key

Let's say, I have a friend far from me and I want to send some secret messages to him. I have to say, I'm pretty newbie in security. That's why I'm wondering, does the Diffie–Hellman key exchange ...
-1
votes
3answers
474 views

China CCTV System UDP protocol isn't working

My boss is trying to invest on a CCTV solution that he orders from China, his idea is to market it here after we fine tune the process and configuration and make a few tweaks of our own. It consists ...
1
vote
1answer
2k views

POP3S vs POP3 with STARTTLS

Can you tell me if there are any differences between POP3S and POP3 with STARTTLS? What's the safest? Are there any known attacks? If you could choose about them, which would you pick?
1
vote
1answer
92 views

Two way delegation?

I am looking into using the X.509 for mutual delegation where mutual delegation is bi-directional where an entity can only delegate a task or a set of permissions to another entity if the latter is ...
15
votes
2answers
6k views

The inner workings of iMessage security?

This is a very interesting article about the iMessage technology used in Apple's very popular communication devices. So far, there has not been much technical details released by Apple. Hopefully ...
1
vote
2answers
994 views

Sending Syslog/SNMP information over the internet using standard UDP port 514

I'm looking into monitoring a Windows VPS by sending Syslog messages to a Synology NAS, which can generate email alerts and such. I also would like to use SNMP to generate health stats, and see trends ...
10
votes
2answers
405 views

How do new security and cryptography techniques/protocols avoid the chicken-and-egg problem?

. . .better solutions have been proposed and will be worth considering once they have withstood the test of time (i.e. “5 to 10 years in the field, and not broken yet”). -From Thomas Pornin's ...
1
vote
1answer
397 views

Wireshark detecting suspicious messages through jabber protocol, It says it is from my website, no idea what it is

I was doing a network scan on my computer with Wireshark and came up with something very suspicious: I found a stream with the jabber protocol. I do not have a jabber server set up nor do I have any ...
1
vote
1answer
173 views

xmpp ssl cipher negotiation

Does anyone know how ssl ciphers are nogitiated via the xmpp protocol. When I capture packets, I see: <starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/> There is no hello server/client or ...
75
votes
9answers
13k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
0
votes
1answer
165 views

Is it safe not to encrypt ping packets them?

I am running encrypted communication with ping tacked on after decryption and deserialization is complete. I.e. incoming data -> split into packets -> decrypt -> deserializer -> actual message or ...
3
votes
2answers
927 views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks ...
20
votes
2answers
659 views

Aviation security - Lessons to learn from PlaneSploit

A somewhat related question has already been asked (What would one need to do in order to hijack a satellite?), only at a more abstract level. Now we have a presentation by Hugo Teso from n.runs AG ...
3
votes
3answers
3k views

Disabling SSL v2 and weak ciphers on client PC's

Is it a requirement to also disable SSL v2 and weak ciphers on client PC's? I have seen quite a few posts for disabling them on servers, but nothing about a regular client PC, say, running Windows XP ...
2
votes
3answers
1k views

Uploading files through an HTTPS web application

We have a client facing web site. A certificate is required to land on the login page, where upon you then need a username and a password to further login. System has Apache servers acting as load ...
2
votes
0answers
84 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...