-2
votes
0answers
5 views

How to use Tor “on” and “off” at the same time with Chrome?

I want to use both Tor "on" and "off" in chrome. As for example one tab of chrome with tor "on", and another tab or directory of it as "off". Is it possible?
0
votes
0answers
6 views

Azure AD B2C vs Auth0

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison ...
-5
votes
0answers
16 views

how to DDOS a server with DDOS protection and get away with it?

i need info about this just for learning
1
vote
1answer
4 views

Is it ok to append the nonce/iv to the ciphertext when using AES GCM?

I want to use AES GCM to encrypt data at rest. When retrieving the data, I want to make sure that the key is valid and the data has not been tempered with. Can I store the nonce/iv along with the ...
0
votes
0answers
3 views

PTRACE_TRACEME Process stopped

I'm trying for fun to exploit a code which uses ptrace to prevent debugging. This executable is suid, therefore thre's no use in cracking it. It have also the stack segment executable. It is made for ...
-2
votes
0answers
27 views

What is this virus doing?

So I created a small Windows VM to make a template out of and opened it up to RDP. I created a really easy password when I made the VM so, lo and behold, within three days of it being online it was ...
-2
votes
3answers
34 views

Is there something other than “if” and “else”

There are many ways for protecting a password like using strong algorithms like SHA-512, using salts, encrypting the database where the password is stored, packing the license file with UPX etc and ...
-1
votes
0answers
15 views

Encrypt password with salt

Can anyone explain why formula 1 is safer than formula 2?I don't get it even I get the answer. According to 2, it says as s is in plaintext form, the attacker can decrypt the password by (y.s). ...
0
votes
0answers
12 views

How to decrypt SSL data on a considered-to-be-compromised host?

I have a package which I want to encrypt on my machine and send it to another remote machine. If I use asymmetric encryption, I must have the private key on the remote side. However, I don't trust the ...
-4
votes
0answers
35 views

Virus vs Worms vs Bacteria

What is the difference among virus and bacteria and worm? According to my understanding, virus spread over files and worm spread over internet. However, i don't know much about bacteria. How does ...
1
vote
1answer
12 views

Sensitive files in the Cloud: Automated mounted TrueCrypt volume

My current setup currently I'm using Boxcryptor Classic 1.x (still compatible to EncFS) to mirror some files with SyncBack Pro into the virtual Boxcryptor-Harddisk. Those get then encrypted by BC ...
1
vote
2answers
17 views

Packet Filter vs Application proxy

http://postimg.org/image/b1w3bujnv/ I don't understand the highlighted part in red. Firstly,Why is a packet filter is enough in a situation where traffic is busy? Secondly,Isn't application proxy ...
0
votes
2answers
58 views

Is there a civilian friendly indicator of stored password safety?

As I understand it, by using one-way encryption we can protect stored password data in the event that they are stolen. Broadly speaking, password data can usually be cracked by guessing so the ...
0
votes
1answer
13 views

Application proxy structure & funtions

http://postimg.org/image/76newirnv/ For application proxy, Firstly, what does it mean "A proxy is something that acts on your behalf"? Can anyone give a more detail explanation about proxy? I read ...
-10
votes
0answers
25 views

Please delete this post, sorry for any inconvinience

hghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhghgjhgjhgjhg ...
2
votes
2answers
141 views

What is the exact problem if a website has an SHA-1 certificate?

There was a recent question about trusting (or not) a website showing an SHA-1 certificate. I would like to know whether I understand the actual issue correctly. The dangers are (a) that someone ...
0
votes
2answers
21 views

Stateful Packet Filter structure

http://postimg.org/image/o1ojanqq3/ For stateful packet filter, Firstly, why is cannot see application data being one of the disadvantages of Stateful Packet Filter? Secondly, how can stateful ...
0
votes
0answers
6 views

CoAP over DTLS duplication of epoch and seq no

I am currently looking at the DTLS overhead when running CoAP and found a strange thing. DTLS record layer header, 13 Byte, consists of: { content type, 1 Byte version , 2 Byte epoch ...
-1
votes
0answers
11 views

Cisco any connect home wifi use

While Cisco Any Connect is logged into VPN on my work computer over my home private wifi...can web searches made on an iPhone that is also connected to the same private wifi be monitored by the VPN ...
0
votes
0answers
18 views

shared hosted web server used as forward proxy

When setting up personal anonymous forward proxy server, different hosting can be chosen. In the case of shared hosting, web server, transformed into proxy server, shares it's IP with hundreds of ...
1
vote
1answer
21 views

Can I be identified across different access points to same ISP?

The ISP I use at home also provides access points in cafés etc. Can they, for example with my MAC address, match my identity when I'm using one of these access points to when I'm at home? And what ...
0
votes
0answers
29 views

What kind of hash is in JSON of “Bing image of the day”

I just found the json output of Bing image of the day, here it is: http://www.bing.com/HPImageArchive.aspx?format=js&idx=0&n=1&mkt=en-US I saw a "hsh" json object, and after I checked ...
-1
votes
0answers
21 views

HMAC Signature Based authentication for REST APIs

We are building publicly available RESTful APIs for eCommerce where clients can place logistics requests with us. We want stateless authentication on these APIs. While on-boarding, every client will ...
0
votes
0answers
17 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
0
votes
1answer
29 views

Virus Warning after clicking on a Google search results link

When researching a high school project on the guillotine, my daughter googled: quillotine quotes One of the top results was: topfamousquotes.com/quotes-about-guillotine/ Apparently she ...
0
votes
2answers
51 views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
0
votes
0answers
23 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses As answered here:Good ...
1
vote
0answers
14 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
-1
votes
0answers
20 views

Key Management - general question

I have a little question regarding the wonderful topic of "Key Management". Let's imagine I would use a service like AWS Key Management. According to their API documentation one can easily decrypt a ...
0
votes
0answers
23 views

Monitoring what is being done on your PC when TeamViewer is used?

How can I watch what someone is doing on my PC while they are logged in on TeamViewer?
1
vote
0answers
16 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. ...
0
votes
0answers
35 views

Best way to store SQLite password offline?

I'm developing a Windows application that uses SQLite, and I want to encrypt it (there is some sensitive information). The trouble is that one of the application requirements is that it must work ...
0
votes
1answer
27 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
0
votes
0answers
12 views

accessing file through an RDC or sharing across network more secure?

Question: Which is more secure? The Goal: Billy works in an office that is setup on a domain and needs to create files then have a different department access them. Option 1: Billy rdp's into a ...
0
votes
0answers
19 views

Privacy concerns for personal data shared between Facebook and Amazon

I was looking for a tablet from my home PC on Amazon and sometimes I find Amazon ads on Facebook which contain suggestions related to my search criteria; I never worried too much as I thought the ...
0
votes
0answers
18 views

Attaching orphaned/stageless session meterpreter

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects ...
1
vote
0answers
14 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
0
votes
0answers
17 views

How can I authenticate securely to an internal website from an iPad without an strong password?

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities: Credentials stored in the iPad (like Gmail credentials). Using ...
2
votes
1answer
20 views

May HSTS block access to your site when you renew your SSL certificate?

I've thinking in using HSTS in my sites but I don't understand that you need to sync the HSTS timing with the time when the certificate is going to be renewed or not. Can I use safely a static time ...
3
votes
1answer
37 views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
1
vote
2answers
51 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
0
votes
1answer
29 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
0
votes
2answers
53 views

Nmap says host down, but host is up

I am using nmap 7.12 on Mac OS X. I haven’t been able to find a solution to my issue. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP ...
1
vote
1answer
34 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
2
votes
1answer
31 views

What are the security implications of enabling CORS for images?

The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
2
votes
1answer
24 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
0
votes
0answers
18 views

OpenSSH password based authentication in the enterprise?

TL;DR How common is.. Using password based authentication on servers to login over SSH reusing the same password other places. Even if this is an unprivileged user it is still valuable I think. ...
-4
votes
0answers
53 views

What kind of encryption/encoding is this? [duplicate]

Unknown encryption/encoding: ...
1
vote
1answer
21 views

What protects HDCP keys in software?

I (somewhat) recently stumbled across HDCP (high-bandwidth digital content protection), a protocol that encrypts movies and other media "on the wire". Now there are of course tools to play blu-rays ...
0
votes
0answers
14 views

How can I test my SSO connection without having access to the Identity Provider?

I'm trying to set up an SSO connection using Auth0. My app is set up as the Service Provider (SP), and it needs to work with PingFederate as the Identity Provider (IdP). I don't have access to an ...

15 30 50 per page