0
votes
0answers
3 views

Does SFTP cost more to implement than FTP?

This is a two part question. How does the implementation of SFTP differ over FTP? (Account Creation, Setup of connection) Is it more expensive (in terms of time/cost) to do so? In this scenario I ...
0
votes
0answers
7 views

I currently have a downed laptop. I want to install Tails on my Android flash card so I can use it as a boot card on the laptop

Does anyone know how to install Tails on an sd card from an Android tablet? Thanks
0
votes
0answers
7 views

Options to do regarding a hacked twitch stream with a known twitter, used email and (maybe fake) name

In short, a friend of mine under DzyDzyDino's stream. I contacted him and together we were able to obtain a bit of information. First, though, the overall situation. I managed to contact him via ...
1
vote
1answer
20 views

Security implications of using an algorithm to lengthen and salt passwords before using them?

I have created a JavaScript bookmarklet which, among other things, base64 encodes my plain-text passwords combined with information from the site's domain name. The idea is that base64 output is ...
0
votes
0answers
5 views

PGP key transision: Strong RSA subkey under weak DSA masterkey?

I have a DSA/ElGamal 1024/2048 PGP key and want to migrate to a stronger set. I see two options but I'm unsure which is smarter. a) Keep DSA 1024 Masterkey, generate 4096 RSA subkey b) Ditch the ...
0
votes
1answer
10 views

ISO27001: Scoping Definition for Data Hosted on Cloud

I'm trying to define a scoping definition, as required by ISO27001, for a company that offers advice to customers based on health-related data. The strength of this company is its advice that offers ...
7
votes
1answer
34 views

How could Firefox password manager talk to Chrome password manager?

I recently installed Firefox and realised that it was able to successfully import all passwords that were stored in Chrome. I had been using a sync passphrase in Chrome and I expect it to store the ...
0
votes
0answers
20 views

Surveillance cameras go offline every 30 minutes or so

I'm setting up a 4 camera security system with an Anran Digital Video Recorder (Model NVR6008T), and keep having the cameras go offline approximately every 25-30 minutes. They stay offline for ...
0
votes
1answer
24 views

What are all these connection attempts in my firewall log?

I've read many similar answers, but they all dealt with machines that were running publicly accessible services. In my case, I have a (newly installed and fully patched) Ubuntu machine that is used as ...
0
votes
0answers
7 views

Is there any guideline to configure Mutual Certificates Security(MCS) using WSIT-Security for Glassfish-Metro WS?

I am building a WebService using Java with Metro WS-Stack and looking for a guideline to learn the concept and configure the practical usage of it on NetbeansIDE. Any leads on this?
0
votes
0answers
16 views

How Do Botnets Leverage LAMP stacks and Web Servers?

I understand MySQL databases, PHP, HTML forms, etc. And I also understand that basic botnets rely on client bots that communicate with a central command-and-control server. However, if someone were ...
0
votes
0answers
9 views

Netfilter SNAT DNAT interaction

In this example [root@real-server]# iptables -t nat -A PREROUTING -d 205.254.211.17 -j DNAT --to-destination 192.168.100.17 [root@real-server]# iptables -t nat -A POSTROUTING -s 192.168.100.17 -j ...
0
votes
0answers
16 views

credit card skimming and protection information

please i would like to know if a skimmer could possibly add 0's, write info using card reader and withdraw from POS or ATM. All info related to this would be appreciated
1
vote
0answers
11 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
0
votes
0answers
15 views

Problem with configuring PEAP to only accept users with client certificate. (freeradius)

I'm currently trying to configure PEAP. I had no problems configuring it without the use of client certificates. But I want to only accept people who have a valid cert. However, the clients can ...
1
vote
0answers
14 views

What is the benefit of OAuth “one-time code flow (hybrid authentication)”?

With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such: This hybrid authentication flow has significant functional and ...
1
vote
1answer
14 views

Bitlocker encrypted drive access from other machines

Can drives encrypted with Bitlocker be moved to different machines and accessed as long as the password is known? For example, via an external drive enclosure? Or is the encryption tied to the ...
0
votes
0answers
10 views

Is it possible to list a directory provided it has a valid index file?

Provided you have a server running apache and a website setup with an index.html file in every directory, could you get apache to return a directory listing if your website was configured to display ...
3
votes
2answers
41 views

Is a password protected SSH key necessary on an encrypted system?

I have a laptop running Linux encrypted using dmcrypt. To use git, I just created an SSH key, but did not password-protect it. Since my hard drive is already encrypted, is there any benefit to ...
1
vote
1answer
21 views

DROWN CVE-2016-0800 Patch Missing on Centos 7

My security admin is worried that my OpenSSL version does not contain a patch for DROWN (cve-2016-0800). I ran a yum update and have installed the latest Centos 7 OpenSSL: openssl-1.0.1e-51.el7_2.5....
4
votes
3answers
39 views

Do I need a new CSR for a certificate renewal?

I want to renew my expired certificate I'm using in Tomcat for SSL. Other posts indicate that to renew my certificate I need to create a new CSR and obtain a new certificate and import into my ...
0
votes
1answer
33 views

during change of IP address - adware infection

I have a puzzling situation. I have build a small site for a friend which I am hosting together with other site I have. His domain is registered with a certain company which is also an ISP provider. ...
0
votes
0answers
26 views

Symmetric/Asymmetric/Hashes Strongest to Weakest & Rounds

I am well aware strongest to weakest in terms of hashing, however, I have been reading about rounds to do with hashing. Also, discovered symmetric/asymmetric e.g. AES, Twofish etc have rounds also. ...
0
votes
0answers
23 views

iframe basic auth or token security

We have two sites, both are trusted. On site1 we store the username and password for the user for site2. We make api calls on site1's backend to site2 via basic auth (all over HTTPS). I know this ...
0
votes
1answer
28 views

What does it mean by rendering image in php? [on hold]

I just saw a webpage, when i requested it, it showed me every content except image, then it did a POST request to a file named render-image.php and after that image was appeared. What does it mean? I ...
-4
votes
1answer
35 views

Need help identifying cipher (hash type?) [on hold]

This is it: c6dd657d235344b4fcbf5ba88a47550d6992d16e It probably contains coordinates. Not sure tho.
0
votes
0answers
9 views

Weird problem on airbase-ng

The situation is pretty simple, I'm trying to create a rogue AP, am I missing something? No matter what I do I get the same error message: I tried using different bssid and essid's with the ...
-2
votes
1answer
29 views

How can I see mobile version websites on PC/Mac while using a privacy secure browser such as Tor [on hold]

Tor doesn't recommend downloading plugins to enable mobile site viewing... So is there any other "secure" browser that'll let me see mobile sites securely?
10
votes
6answers
1k views

How should high net worth individuals secure their financial accounts?

I try to follow account security best-practices (strong random passwords, password manager, multi-factor authentication, etc.) but I still find myself worried about potential compromises to my ...
1
vote
0answers
64 views

How to check for vulnerability against WPAD / HTTPS attacks?

As described at New attack bypasses HTTPS protection on Macs, Windows, and Linux | Ars Technica, there is a newly identified attack at wifi hotspots etc that can expose the URLs you use even if they ...
-4
votes
0answers
31 views

decryption https traffic from a mobile app [on hold]

I'm looking for to decrypt https requests from an mobile app. I have been using charless and fiddler to fetch some requests made in the app but am receiving errors : SSL certificate error.
0
votes
0answers
34 views

is there an equivalent of setgid bit on windows?

Is there a possiblity on Windows to have an executable that always runs with the process privileges of the owner and not the one that starts the executable?
0
votes
0answers
38 views

Firewall source and destination IP validation

For an external firewall interface, why is it a good idea to validate that the source IP address was initiated from an internal IP, or why it originated from an external IP? If, hypothetically, the ...
2
votes
1answer
43 views

What are read state and write state in SSL connections?

The SSL handshake contains the change_cipher_spec. When this change_cipher_spec is received, the pending read state is copied to current read state, and when change_cipher_spec is sent, the pending ...
4
votes
1answer
44 views

Why is `cd` restricted in rbash/restricted bash?

The bash manual says: A restricted shell behaves identically to bash with the exception that the following are disallowed or not performed: Changing directories with the cd builtin. Why ...
3
votes
3answers
35 views

What are the limitations of Content Security Policy?

I'm wondering what this new technique will not protect us against. As I see it, since inline scripts are disabled (and I assume that includes javascript: links) then it solves the issue of covert ...
1
vote
2answers
45 views

Is it required to end the session after closing the browser without logging out?

Should the Session ID generated after logging in be marked invalid when the user closes the browser without logging out? Could this be a security flaw? If yes,is it possible to exploit this?
1
vote
0answers
23 views

BIOS flash possible?

Not sure if it's the right forum to post this but have been modifying the BIOS of my Asus N551VW (which is a skylake laptop (I7-6700HQ) with an AMI Aptio BIOS) and I'm ready to flash it. Problem is, ...
0
votes
0answers
15 views

IP authetication, usage stats and bad house-keeping [on hold]

If a content publisher using IP authentication stores overlapping or duplicated IP ranges in its access management systems are accesses, clicks, etc. counted multiple times?
2
votes
1answer
79 views

Does removing password improve security?

I use a large assortment of software, each requiring it's own password. Some of these applications remove the password after a failed login attempt, where others leave it populated. Does it improve ...
0
votes
0answers
37 views

Hashing with unknown salt security

First off, this question is not about password hashing, my requirements are different. In particular I fully agree that salts are not useful for adding cryptographical complexity in password hashes, ...
0
votes
1answer
26 views

How to securely access web api from Html5 Website

So the thing is I have created a Asp.Net web api and am using oauth to secure the access. The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
0
votes
1answer
20 views

Security pertaining to Client-side validation

One of my websites has a webpage wherein it has a button/link named 'BACK'. Anyone clicking on this button/link will redirect user to HOME page of the application. Now if the user change the URL on ...
1
vote
1answer
55 views

What's the difference between SSLv3 being deprecated and SSLv2 being prohibited?

I've been working on some security docs for a database at work - a quick guide on how to create a JDBC connection over TLS for this. The docs I have mention that while it supports SSLv2, SSLv3 and ...
-1
votes
1answer
62 views

Best option for DDoS protection on DigitalOcean server?

I would not like to use CloudFlare since they effectively act as a man in the middle and handle unencrypted data. Is there a CDN that mitigates the security risks that CloudFlare imposes? If not, is ...
0
votes
0answers
4 views

pushing changed bitlocker password from ad [migrated]

Can we do anything about getting the bitlocker recovery password pushed to active roles from ADUC. Active roles gets the key from ADUC if the machine is formatted and encrypted but not when the ...
0
votes
0answers
16 views

Are WebSphere portlet actions always CSRF protected

I noticed that the WebSphere portlet container generates action URLs containing an ID, which seem to change every time I reload the page. Usually action URLs are used as form submission targets. ...
0
votes
0answers
3 views

How to extend token expiring time if user is not active for a set period using JWT? [migrated]

Given an example here for a normal web app. Traditionally, we use session and set timeout = 30 minutes. if session expires we will redirect user to login. (Expired time will be extended when user/...
-1
votes
0answers
30 views

DNA Encryption and Digital Signature [on hold]

I am working on DNA based encryption.Does using DNA encryption for digital signature is better to achieve non repudiation than conventional techniques
2
votes
1answer
60 views

Man in the Middle attack?

in a scenario where I have a gateway to the Internet and a switch(layer 2) connected to this gateway. I have two computers in the same broadcast domain connected to the switch. all traffic to the ...

15 30 50 per page