1
vote
0answers
7 views

How does Putty derive the encryption key in its .ppk format?

I have been doing some reading on the mechanics of managing RSA key pairs, during which I learned that OpenSSL by default derives the encryption key by using MD5 on the passphrase (bad!) without any ...
2
votes
0answers
15 views

If I connect to VPN through proxy, who can see what?

I try to understand what happens when I use an HTTP(S) proxy in my OpenVPN client configuration. What's the advantage of an HTTPS proxy over plain HTTP? In any case the encryption takes place on the ...
0
votes
2answers
23 views

How can I strip sensitive data out of a Wireshark log report?

I have a sync app that doesn't work and the developer asked me to try and perform a sync with Wireshark capturing the data and send the Wireshark log to him. I noticed that Wireshark saves sensitive ...
2
votes
1answer
10 views

What method could a white-box attacker use to track the deletion of memory / files?

A rather theoretical question: Assuming there is memory with a malware inside it. The malware's goal is to detect if a legit application is about to delete contents of the memory. If recognized, the ...
0
votes
0answers
10 views

JSSE recommended cipher suites

In the wake of POODLE I am reviewing the configuration of a number of Tomcat servers running on the JSSE connector. In order to work out what ciphers JSSE supported I wrote a little snippet that ...
1
vote
0answers
11 views

Communication between two open endpoints, is this secure enough?

I'm building a (very simple) tool to communicate between two servers. I started by asking if there was a better alternative than making a home made scripts and we came to the conclusion that for ...
2
votes
1answer
16 views

Steps for building a good File Encryption on Android

I want to be able to build a good file encryption on android for a cloud app. The files used are mainly pdfs, pngs, docs, audio, video, etc (all sorts of files). Edit: My constrains are that it ...
1
vote
2answers
15 views

Is it possible to detect the type of key required when connecting to a wireless network?

So I was wondering if I could determine if a wireless network is asking for a specific type of key such as WEP/WPA ect? Or if it just takes the one you give it and processes that?
1
vote
1answer
27 views

Stored Cross-Site Scripting Without Parentheses or Spaces

I'm testing a commenting application that takes a link of the form http://google.com and puts it in an href tag as so: <a rel="nofollow" href="http://google.com"> The resulting comment is ...
4
votes
1answer
65 views

How secure are the FIDO U2F tokens

Google and Yubico just announced the availability of cryptographic security tokens following the FIDO U2F specification. Is this just another 2FA option, or is this significantly better than solutions ...
0
votes
2answers
43 views

I'm wondering how I hide my identity online well

what are the different ways to become anonymous. Is quicksilver a good email for that? What are the different options? I know about proxies, Tor, and VPNs. Should I do all three? I like computers but ...
3
votes
1answer
16 views

Reset Windows trusted certificates store to its default

Over the time I have installed several additional trusted CA certificates to Windows trust store, sometimes because an app pushed me to do so, some other times for development and testing. Is there ...
2
votes
2answers
55 views

it is possible to decrypt HTTPS with the (private, public) pair if it uses DHE?

Assuming you have a PCAP file with HTTPS traffic and having the key pair (private & public), it is possible to decrypt the traffic if it uses Diffie Hellman Ephemeral? Using openSSL lib for ...
1
vote
2answers
17 views

Moving Services to the Cloud

Our company has made the decision to switch from an internally hosted Jabber-based chat system to a more modern, cloud-based chat solution. Hosting our own chat servers and software presented the ...
2
votes
0answers
17 views

Is Bluetooth's “advertising” mode more secure than “discoverable” mode?

I understand that there are many security issues associated with Bluetooth's "discoverable" mode, and have avoided it where I can. However new features of many systems (e.g. Apple's ...
0
votes
0answers
58 views

How did he get my telephone number?

Earlier this year a neighbour of a friend of mine passed her their telephone. It was a man calling, claiming that she had talked to him once 5-6 years earlier. The man frankly gave her the creeps, ...
1
vote
2answers
42 views

Facebook security

I check my security settings (from my Facebook acc.) from time to time, and sometimes I see there are IP addresses which logged into my account but don't belong to me. When I look in the web who is ...
0
votes
1answer
26 views

Floppy disk partition showed up when USB Flash drive inserted

For one of my course's midterm lab portion, the professor provided us flash drives to put our project in. Everyone had their named labeled on one, so she gave me the last one left out, which had a ...
-1
votes
2answers
69 views

Is it dangerous to use hamachi

In the Minecraft community people are firing up hamachi with Minecraft servers, but over all is a public hamachi dangerous for the host and all the users using it?
0
votes
1answer
57 views

Should I use HMAC in this situation

I need to store a big message encrypted on a server. What I am about to do is: Encrypt the message with a AES key; (Authentication) Hash the message with SHA512 and encrypt the hash with RSA priv ...
15
votes
3answers
745 views

What is the difference between “key length” and “bit strength”?

On occasion, I hear the terms "key length" and "bit strength" used interchangeably. Are these the same things? Or are they different?
1
vote
4answers
127 views

Is 3DES outdated for message authentication code computing?

I am working in IT department of a bank, currently we use 3DES to compute MAC of packet, is that safe enough using 3DES? Should we use any other more modern algorithm?
0
votes
2answers
56 views

/tmUnblock.cgi in access.log but not in error.log (no one 404 error is normal?)

I recognize when an attacker tries to reach something like "/phpmyadmin" or "/mysql" or other URLs like these, because I can see the 404 errors in error.log (nginx). Now I'm worried because in ...
1
vote
1answer
27 views

Javascript file detection

One common technique I use is xor bruteforcing on binary data. In this case, I would like a heuristic approach to determine whether or not any possible candidate plaintexts are javascript. This rules ...
0
votes
2answers
85 views

Does Google catches and keeps users typing patterns [on hold]

Does Google catches and keeps users typing patterns for identifying purposes? for example when I'm logged in my Google account and Searching for things Google records my "Typing Pattern" like typing ...
0
votes
0answers
28 views

Encryption algorithm keySize restriction in JSSE 7

I have an application which uses SSL (JSSE Implementation). Currently from my client side, the "Client Hello" message suggests a list of cipher suites that consists of both 128 & 256 bits key ...
2
votes
0answers
30 views

CRL check for TLS client certificate on Linux?

I run a web service. Clients authenticate using a TLS Client Certificate issued by a 3rd party CA. All certificates include the CRL distribution point, but do not support OCSP. How do I configure a ...
-2
votes
0answers
18 views

GLPI - Looking for assets management tool [on hold]

I am looking for a assets management tool and I found GLPI; http://www.glpi-project.org/spip.php?article61 . Now I am not sure how secure this tool is. My important aspects are: / User ...
2
votes
2answers
431 views

Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?

Is TLS_FALLBACK_SCSV going to be the fix for servers that wish to keep SSLv3 enabled? If not what actions are being taken, if any, that address the vulnerability besides disabling SSLv3?
0
votes
1answer
52 views

Is automatic login with full disk encryption a risk?

I use full disk encryption on Linux and wonder whether there is any security risk ob having automatic login on the Linux itself. In case somebody breaks the encryption of the drive, they can read all ...
-7
votes
2answers
88 views

Person has no persona on the internet yet runs a business [on hold]

Original Question: There is this older person (60+yrs) who is runs a business with internet presence yet when I do am internet search on him nothing pops up, not even photos!! How do I find out if he ...
0
votes
2answers
71 views

Recovery plan in case of lost Android smartphone with Google Authenticator?

So I am using Google Authenticator as my two factor authentication. I'm not a security expert, but I was thinking late last night as I was about to fall asleep: How can I login to my favourite ...
-1
votes
1answer
39 views

Exchange of encrypted files through a server

I have a thing to do, that basically bases on a server that is honest but curious. Therefore I want the server to have the public key for encryption and it will encrypt files during the process of ...
6
votes
4answers
1k views

Use cookies once stolen

I have seen many posts about stealing cookies, as a matter of fact I have taken advantage of the XSS vulnerability to send the cookie to my php through a variable in the url to a php, and that php ...
0
votes
2answers
109 views

Fake phone call

I have a problem, getting call from known numbers and when he lifts it, no one is speaking from other side! Well, the awkward part is, the call is from known numbers only, but if I ask the person ...
-2
votes
2answers
37 views

2 way encryption of a string into numerical string using random number

I have a random number like 0.323978544752212. I want to encrypt a string using this random number into to numerical string i.e. final string is like ...
0
votes
0answers
33 views

How to know different types of events and there ID's in linux

How can I know what all types of events generated by Linux. I can get this from the logs, but reading logs and noting ID's is very time consuming. All events might not be triggered. I need this ...
1
vote
3answers
38 views

Ping Input box on web server vulnerable to piped commands?

Scenario is this. I have logged into a web server as admin through the Login page in browser. it has displayed me with a home page of sorts that has an input box with a button next to it saying ...
0
votes
1answer
49 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
0
votes
1answer
34 views

IP Address when access website on Remote Computer

Can you please advise me on this, All the web sites visited on remote computer, can that be traced? I have a office computer say COMP1 and Home Computer COMP2. If i access any websites on COMP2 ...
0
votes
0answers
39 views

How do I set up SSL on my NearlyFreeSpeech site via StartSSL? [on hold]

When it comes to infosec and managing a website, I know next to nothing. What I do know is that I'd like to set up SSL on my personal website, which is hosted on NearlyFreeSpeech. My primary ...
-4
votes
3answers
76 views

Why doesn't Google Safe Browsing block the IP addresses of malicious websites?

If you visit a blocked domain name like www.thelotbet.cn from Google Chrome, Opera or Firefox, you will get a warning from Google Safe Browsing that this is a malicious website. But if you visit the ...
1
vote
3answers
55 views

Can any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA?

Any website secured using TLS can be impersonated using a rogue certificate issued by a rogue CA. This is irrespective of which CA issued the website’s true certificate and of any property of that ...
2
votes
1answer
37 views

What is the difference between a “Thumbprint Algorithm” “Signature Algorithm” and “Signature Hash Algorithm” for a certificates?

I'm a bit confused on the differences between Signature Algorithm, Signature Hash Algorithm, and Thumbprint Algorithm that are present in SSL/TLS certificates. Can someone please elaborate?
1
vote
2answers
44 views

What's the benefit of hybrid cryptosystem vs asymmetric for small data blocks?

It's a common belief hybrid cryptosystems are better than asymmetric only. Is that allways like that? What's the benefit of using symmetric and asymmetric encryption for small data blocks (< 100 ...
1
vote
0answers
12 views

is there a risk in increasing esmtp header line length against rfc5822 - asa/pix question

Have a question towards the 998 bytes limitation on the esmtp header line length. We have noticed the asa is dropping emails coming from various external mail servers with the header line length ...
0
votes
0answers
134 views

TeamViewer: I'm worried the user who used my PC stole some data [migrated]

How can I be sure that the user yesterday connected to my PC with TeamViewer downloaded some data with the file transfer? Does the file transfer shows a notification to say that he is downloading ...
0
votes
0answers
7 views

return list of sites with similar unique IDs (e.g. Adwords)

I have been using http://sameid.net/ to discover sites which have the same unique ID as a page in question for a number of affiliate and advertising networks. However, I am wondering if there is a ...
17
votes
11answers
2k views

One liner to create passwords in linux?

How do you create a readable password using bash with one line? What if i'm looking for 128 bits of entropy? EDIT By readable I mean the 94 readable ascii characters (without space). It can use less ...
0
votes
2answers
65 views

Nmap scan list of domains and provide boolean if up/down

I have a newline separated list of domains that I would like to perform an arbitrary nmap scan on (e.g. aggressive, syn) and I would like to output a boolean that indicates whether or not any ports ...

15 30 50 per page