0
votes
1answer
11 views

Can identification imply authentication in biometrics system?

I know the difference between Identification and Authentication, which are basically claiming who you are and proving that claim. In terms of a system, they are username and password in general. But ...
0
votes
1answer
19 views

Can we safely distribute password protected .p12

I have a password protected .pfx and I would like to know if it safe to share it on GitHub. The intention is to ensure that companies can trust a dll of the Tweetinvi open source library. The DLL is ...
0
votes
0answers
5 views

How to best manage multiple applications using the internet with Firewall

Im not new too Linux (Ubuntu 14.x) however I must admit that I have never bothered with a Firewall until now. Im currently using Ubuntu's inbuilt firewall (UFW) with a graphical plugin (GUFW), which I ...
0
votes
1answer
7 views

Replace certificates simultaneously on remote servers?

A third party server sends us signed messages that we verify. When its certificate is about to expire, the third party generates a new key pair and sends us the new certificate. At some point, the ...
0
votes
0answers
7 views

How do I know which subkey GitHub is using for signing?

I added my gpg subkey to GitHub today and noticed that regardless of which subkey I export, the PUBLIC KEY BLOCK is the same. I have since found this post, that explains why: is-it-possible-to-export-...
2
votes
1answer
31 views

How dangerous is leaking knowledge about existence of objects which the user is not allowed to access?

It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a ...
10
votes
6answers
1k views

Is anti-Brexit petition system trustable?

In the last days I hear often about the petition to (pratically) "repeat" the Brexit referendum and I noticed that it is an online petition. I noticed that the "sign petition" form just requires name,...
-4
votes
0answers
27 views

How do I decrypt this unknown cipher text? [duplicate]

I got this unknow cipher text. Can you solve this? This looks like encoded PHP with base64/str_rot13/gzinflate eval. nI31RZG+Rxb1RZGzRMfsOdNql2K9RsesRLDVOdNqnLWtOdNqRtJtRtm1RZG8OdNrmxb1R/...
18
votes
4answers
3k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
0
votes
0answers
27 views

Creating a port snooper/sniffer

Is it possible to create a program, that monitors a traffic to a specific port, be it reserved or used defined? This is because I want to create a system that traps the attacker in a honeypot. That ...
2
votes
2answers
43 views

Is it safe to manually patch security bugs in an outdated system, that is no longer supported?

How do I manually patch security bugs safely without damaging the system for information security purposes on my Ubuntu system that I am running on my Nook Simple Touch (2011 Nook)? I need to find ...
-2
votes
1answer
28 views

Decrypting keys at the software application level

Does anyone know what the most common method of decrypting data is? I.e., if something is hashed and not decrypted at the firewall, how is it usually decrypted within a system? Is it integrated into ...
1
vote
1answer
57 views

Why, after a certain character limit, are larger passwords labeled as “weak” on some sites?

On many sites we see an indicator if our password is weak, or strong, to give us a good indication to go with that password, or not. I've been noticing on some sites, that after x amount of ...
0
votes
3answers
33 views

Are there any security advantages to forcing a password-character limit on reset, but allowing unlimited character in password-login?

I was resetting a password a few moments ago, and I was given a character limit of around 10 characters to make a secure password with. After resetting the password, I went to enter my password, and ...
-3
votes
1answer
17 views

Why is MITRE not changing CVE entries that are clearly incorrect?

Why is MITRE not changing some CVE entries that are clearly wrong. I have deeply analysed and highly tested some specific vulnerabilities. The CVE reports of them are in some cases inconsistent, ...
0
votes
1answer
36 views

Do these packages indicate nefarious activities?

Being security paranoid, I could help but notice that in my autoremove list that there were two packages I did not immediately recognise and was immediately suspicious of: The first one was ...
3
votes
1answer
73 views

What does Obama's phone say about Android and phone hardware?

The recent article Goodbye Obamaberry, hello Obamadroid describes the decision to move Obama's phone from the Blackberry to the Samsung Galaxy S4. The Galaxy 4S is of course an old, foreign phone. ...
0
votes
0answers
9 views

STUN Binding Requests

When looking at network logs using Snort, I've noticed I receive STUN Binding Request informational alerts when certain websites are visited. For example, when going to investopedia, I've noticed DNS ...
-5
votes
0answers
10 views

What's RSS Validity Checker?

i'm trying to exploit XXE in challenge ! it's about XML External Entity [RSS Validity Checker] can someone tell me about this vulnerability <html><header><title>XXE</title>...
-3
votes
2answers
52 views

Need to learn information security [on hold]

I want to learn about information security so I need some good sources to help me and learn that. I'm still a beginner.
-2
votes
0answers
61 views

virus via facebook [on hold]

So, if I opened the 'tag notice' on Facebook through the Safari browser on my phone, is my iPhone contaminated with a virus now? It opened a new tab which I closed immediately as I saw the weird text.
0
votes
0answers
68 views

A JSE file was downloaded after clicking a notification on my Facebook account [duplicate]

I got a notification on Facebook that says "Finn mentioned you in a comment". After clicking the notification a file was downloaded on my phone. I found it unusual because when you click a ...
3
votes
1answer
21 views

Is using PGP/MIME or PGP Inline more secure?

Using Enigmail for Thunderbird, the setup wizard automatically sets itself to PGP/MIME and also disables HTML formatting. I am looking for security and have no idea which to use, though I do know HTML ...
0
votes
0answers
6 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
3
votes
2answers
52 views

How to secure communications between a web front-end and the web server when/where the HTTPS protocol is compromised?

A country in the Central Asia has issued a law enforcing all the ISPs to decrypt the transit HTTPS traffic and encrypt it with a special certificate issued by the government. Every client is to ...
2
votes
3answers
217 views

What information can you get from a photo?

Often in films about the FBI, we see that from a photo it's possible know: Name and surname of the photographer City where the photo was taken Latitude and Longitude of where the photo was taken ...
0
votes
2answers
39 views

Asymmetric key encryption that can have a public decryption key, but encryption key cannot be computed from that [duplicate]

Is there a way where I can distribute a public decryption key, but the encryption key cannot be computed from that key, so that anyone who reads one of my encrypted message, he/she can be quite sure ...
28
votes
8answers
3k views

Proving creation time/date of a screenshot

I have to produce a screenshot of a web page, and want to make sure others will know without any doubt that this screenshot has been produced today. That is, I would like to embed today's date in the ...
2
votes
0answers
12 views

hash function notations and existing cryptographic hash algorithms [migrated]

I am implementing Role-based access control by referencing the paper Enforcing Role-Based Access Control for Secure Data Storage in the Cloud. In page 6, they have mentioned to choose hash functions ...
4
votes
3answers
515 views

Is sending a password encrypted or as SHA1 any safer than clear text?

It seems to me that if an attacker can intercept my login request (sent with HTTP POST), then he can replay it later, no matter whether I try obfuscate it or not. What am I missing?
0
votes
1answer
21 views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a enterprise web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, ...
1
vote
1answer
25 views

How to implement the fix for Forward Secrecy on Debian Apache OpenSSL?

My SSL test result was an A- due to forward secrecy. I want to know how to implement the fix mentioned on this page here: https://blog.qualys.com/ssllabs/2013/06/25/ssl-labs-deploying-forward-secrecy ...
0
votes
0answers
19 views

How TLS exchange key to prevent Man In Middle Attack and sniffing? [duplicate]

I am using an SSL socket in my Qt program and implemented all requirments such as (public-key and private-key files), related libraries, and so on. Now I want to use of TLS protocol to transfer ...
0
votes
1answer
20 views

On a Linux server, is it safe to store a script containing DBI credentials in the cgi-bin of the DocumentRoot?

I understand that (at least on Linux servers) the custom is to create a ScriptAlias from a cgi-bin directory located inside the DocumentRoot (i.e. /var/www/html/cgi-bin/) to a cgi-bin directory ...
-1
votes
1answer
37 views

How Can i Bruteforce a Post-Get-Form to acquire a 6 Digit Voucher Code [on hold]

I am asking how can i Brute-force this website Website i want to Brute-force but not the User name and Password, the Code that is usually in my country found under the Cap of a Fanta Can. So i looked ...
1
vote
1answer
61 views

How to de-obfuscate a malicious payload?

I've received some spam email that led to a JavaScript file which I assume is malicious. My curiosity got the best of me so I opened the file in notepad and I'm trying to make sense of the code but I ...
0
votes
0answers
26 views

Encrypt data on mobile device by retrieving keys from server using PIN

I need to securely encrypt persistent data on a mobile device, hiding it from hacking tools. What vulnerabilities are there in this method? Encryption: user sets 4 digit PIN to "protect" data on ...
-4
votes
2answers
66 views

How to avoid WiFi attackers [on hold]

I am connecting to a WiFi network, but the signal strength is too weak and sometimes it disconnects automatically. My brother's WiFi signal is very good and the connection is fast, and he just happens ...
1
vote
2answers
66 views

Is Qubes OS more secure than running a set of activity related VMs?

I'd like to skip the argument about Linux being more secure than Windows, and purely focus on the security boundaries between Host OS and VMs. Is Qubes OS theoretically more secure than say - Windows ...
5
votes
3answers
43 views

Implications of leaving admin UI accessible to non-admin users

I am developing a system to be used internally within a company, but possibly also externally at some point in the future. From the standpoint of the system's initial users - staff, the program is ...
0
votes
0answers
49 views

Why can I login in my Facebook account with an email not the main one? [on hold]

My Facebook account was registered with a Hotmail e-mail. My secondary e-mail is an ISP e-mail. Since I remember I never had other secondary e-mail added. However today, in my laptop, I inadvertently ...
-6
votes
2answers
32 views

How to brute force this token in php, if it is possible

it is possible to brute-force this token (MD5 Hash) of the following script (PHP) in a realistic time (0,5h - 24h)? If the answer is YES, how could I do it, for example with PHP or Python? $time = ...

15 30 50 per page