1
vote
1answer
11 views

Why would I ever not want CSRF protection?

While I can see some of the overheads of CSRF protection (generation of token, validation of token, extra work to implement), I can't see any reason why you would ever not want it. Is there ever a ...
0
votes
1answer
15 views

How can a coffee shop block VPN connections?

So I am at a coffee shop and trying to connect to my VPN (the VPN is configured just fine) but the service seems to be disabled by the coffee shop's network. How can a coffee shop block VPN ...
0
votes
1answer
10 views

VLANs, Subnets and a sensitive database server

I have a sensitive database, and two categories of employees Category A and Category B. Category A does not require access to the sensitive database while category B does require access to the ...
0
votes
0answers
12 views

Local Server Management

I just started a new software development company, We are using Windows Server, with Wamp installed on the machine. The machine is connected to a router and we have 10 employees. But only 5 of them ...
0
votes
0answers
20 views

Static php code vulnerability finding tool in python [on hold]

I am looking for a tool in python to find php code vulnerabilities. I think RIPS is best but it has some disadvantages. It cannot find vulnerabilities in OOP (PHP code). Please suggest a static code ...
0
votes
0answers
19 views

Are AliPay password rules making it easier to guess a password?

I recently went to change my password at AliPay, and found out that there are a few restrictions on the password: It can only be digits It must be six digits It can not consist of consecutive digits ...
1
vote
0answers
31 views

CryptoLocker master key

I am struggling to understand how it is possible to decrypt files encrypted by the TeslaCrypt ransomware using the master key their creators provided. As far as I know, ransomware encrypts files ...
1
vote
1answer
58 views

Why do credit cards have bigger security than debit cards?

So, I was getting another account at the bank, and there were all kinds of variety and options. To cut the story short, that bank worker and me started to talk about my options over debit card and ...
6
votes
1answer
376 views

How do “Confidence images” on my bank's login page improve security?

My bank recently changed their login process to show a preselected image which they label a "Confidence image" - ostensibly to allow a human website user to authenticate the bank's website as not ...
0
votes
0answers
18 views

Sha1Sum kali linux 64bit

I got a new computer and now I want to dual boot Windows 8 with Kali Linux but whenever I download the ISO or torrent from their /downloads/ section I get the wrong sha1sum. I've tried using fciv to ...
1
vote
1answer
19 views

Varnish non-https connection back-end server

I'm using a HTTPS connection for my webshop to have a secure connection for my users, but now I would like to add Varnish for faster pageloads but which doesn't support SSL. So the idea to still ...
0
votes
1answer
17 views

IDEA and DES cipher suites support in TLS 1.2?

As per the following RFC IDEA and DES suites are removed from TLS 1.2 https://tools.ietf.org/html/rfc5469#section-1 https://tools.ietf.org/html/rfc5246#section-2 Still I have seen couple of servers ...
-1
votes
1answer
46 views

Accidentally click a phishing link, is it dangerous?

not sure is this the correct place to ask a question like this. I had accidentally clicked a link from my email, it bring me to a strange website that with a very long URL. After Googling for some ...
1
vote
0answers
10 views

AWS-S3 Signed URL Security concern

When you create a pre-signed URL for your object, you must provide expiration date and time. The pre-signed URLs are valid only for the specified duration. Anyone who receives the pre-signed URL can ...
0
votes
0answers
14 views

PGP Encryption with Full Disk Encryption [on hold]

What is PGP Encreyption? I want to know about Full Disk Encryption?
-3
votes
0answers
22 views

what subject can I start to study for CEH? [on hold]

sqli XSS explotation database information gathering nmap,nessus,zend scanning vulnerabilities xploits metasploit cryptography operating system etc languages programming such as c++,php,JS,python,etc. ...
0
votes
0answers
20 views

Is a password or passphrase needed with a keyfile backup to decrypt

In my search for an encrypted NAS i have come across a few products that talk about backing up the encryption key and storing it in a safe location. My question is if this backed up keyfile is enough ...
0
votes
3answers
44 views

Why should you generate SSH keys on client devices?

Most tutorials for setting up SSH recommend generating the keypair on a client machine. Why exactly is this? Assuming your communication lines are not compromised, and you delete the private key from ...
1
vote
0answers
13 views

Decoding Viewstate of asp page

I already searched for an answer, and saw that the view state should be base64 encoded. However I used fiddler to try and decode it and the answer I get back is a string of strange characters. Here is ...
0
votes
0answers
21 views

Some Windows servers do not seem to have RSA certificates. What is wrong?

Some Windows Server 2012 machines have certificates. Some do not. I am running this command: Get-ChildItem -Path Cert:\CurrenterUser\My | Where-Object { $_.PrivateKey -is [System.Security....
-1
votes
0answers
17 views

RSA Encryption parameter not work [on hold]

I try to encrypt with RSA algorithm with the parameter p=2353 q=3167 e=13 d=1145605 and the encryption field even on small number. the parameter hold all the condition. why it field, what wrong with ...
3
votes
3answers
28 views

what are security precautions to ask clients who send a USB or CD?

We're launching a tender for a big project, and some of the businesses who want to make an offer are asking if they can send some brochures together with a USB stick or CD-Rom. Since we're trying to ...
2
votes
1answer
31 views

Security Vulnerabilities and Risks for an Information only website (XSS)

My website is an information only website and all the information on it is available to all those who visit the website. There is no sensitive data. And we do not store any user submitted data nor ...
0
votes
1answer
11 views

Microsoft Edge Cache Data

On CCleaner in Windows 10, there are options for Microsoft Edge, which I do not use for browsing the web. Deselecting the option to clean for MS Edge significantly speeds up the process, but I am ...
0
votes
0answers
24 views

Hashing sensitive data in request

We have set the https connection, between the client and server. The problem is that security guys, showed us it is possible to intercept the data using rogue invalid certificate (user must accept it ...
1
vote
1answer
34 views

What's the impact of a simple certificate serial number?

As a result of following internet guides slightly too closely, my company's internal PKI now has an intermediate certificate with the serial number "10 00". Comparing to other certificates, where the ...
1
vote
0answers
27 views

What are simple things I can do to protect my digital identity?

I have taken a big interest in securing my digital info and feel like I have addressed many typical problems. For example: I've gone to full disk encryption on my android phone and linux laptop. My ...
3
votes
0answers
35 views

Can Restarting An Infected Computer Make It Worse?

I seem to remember that rebooting a potentially infected Windows PC before removing the malware may allow it to take advantage of early boot up states that may be vulnerable if the security measures ...
0
votes
0answers
36 views

Reverse TCP Shell not working on separate network [on hold]

I made a Reverse TCP Shell in Metasploit. Set the LHOST for my Local IP: 10.0.0.27 Then set the port for 4444. When I run it on my network and it works. I transfer the file to another network. Run ...
3
votes
3answers
68 views

Does revealing two factor codes reduce security?

If I were to publicly display the 6 digit code from my google authenticator, would my account security be diminished beyond it's valid life time? What if it were the code and the time it was ...
0
votes
0answers
14 views

OpenSSL Generate ECDH Public Key

I am trying to use the OpenSSL command line to generate a ECDH public key that meets the following specifications: Use a Base64 encoded X.509 SubjectPublicKeyInfo structure containing a ECDH ...
0
votes
1answer
18 views

Bypass bcrypt max input

I was reading this question regarding bcrypt max password length. Is there a preferred method or way to allow user passwords to be unlimited length? Or at least much higher? Is there an alternative ...
0
votes
1answer
27 views

Is stolen client side certificate a valid concern for SSL communication? How to build an automatic revocation system?

In the context of server to server communication, we do TLS/SSL with client certificate authentication. So the communication looks like the following: service_a on Host_A (as the SSL client) --> ...
-4
votes
1answer
23 views

How to change user agent string on Tor to see mobile sites?

I asked this question but got logged out and can't get back in but need to ask additional Q... How can I see mobile version websites on PC/Mac while using a privacy secure browser such as Tor I tried ...
0
votes
0answers
10 views

Security Concerns of importing SharePoint Root Authority to Trusted Root Certification Authorities store

We are experiencing slowness because of SharePoint's STS certificate CRL checking. This is a known issue and there is a Microsoft Workaround for it: https://support.microsoft.com/en-us/kb/2625048 The ...
0
votes
3answers
62 views

How does one verify that a Python script is a pure math function?

I have a Python project that dynamically loads Python scripts from a set of specified directories and executes an expected function off of them (the framework expects a function name that takes a ...
2
votes
2answers
60 views

How to get help from an ISP to take down a phishing campaign?

My company is suffering from a phishing campaign. Over the last two months we have tried to issue a take down to the ISPs (publicdomainregistry.com and confluence-networks.com) – both of them seem to ...
1
vote
2answers
45 views

Does Windows “System Volume Information” folder pose a security risk in servers?

I have a Windows 10 WAMP server running, and Windows by default has a hidden folder in every partition called "System Volume Information". I can't access it because Windows denies it, but I noticed ...
0
votes
1answer
23 views

Can location apps locate a lost phone if someone switches out the SIM card?

I lost my T-mobile Galaxy S7 somewhere between the front seat of my car in the parking lot at the grocery store and the first few aisles inside the store. (None of us remember exactly if I actually ...
1
vote
1answer
15 views

Is traffic not encrypted given ERR_CERT_COMMON_NAME_INVALID?

If I am shown ERR_CERT_COMMON_NAME_INVALID, and I can see that the domains do not match (cert for *.example.com but I am visiting https://foobar.com), do I understand correctly that someone packet ...
2
votes
1answer
116 views

Why would a site demand passwords to consist of digits only?

My bank's internet banking site enforces a pretty weird policy: it does not allow you to set a password that has anything but digits in it. The only reason I can imagine is that they are using not an ...
2
votes
2answers
152 views

Information collected by Windows 10 at maximum privacy configuration

I am thinking about installing Windows 10 on a machine. However I am concerned about the information that it actually collects. I have searched a bit but haven't been able to find what information ...
3
votes
1answer
48 views

How to protect API from from malicious usage

We are developing a community portal service using Java-Spring and Angular UI. We are also going to have an Android app soon. Our back-end exposes many services via REST API. There are couple of ...
0
votes
0answers
25 views

Netcat seems to close the connection from the attack box?

I am trying a practice box, and am running into trouble stabilising a connection. I have an RFI vulnerability that allows me to run commands on an Apache server, but does not lead to an interactive ...
30
votes
4answers
3k views

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

In 2013, a Citibank employee had a bad performance review that ticked him off. The results were devastating: Specifically, at approximately 6:03 p.m. that evening, Brown knowingly transmitted a ...
0
votes
0answers
12 views

How dangerous the fact that selinux is permissive/lacking on android? what should one be wary of? [on hold]

So there is this ROM who due to some constrains has its SELINUX set on permissive most of the time. The phone has its root disabled. Now I'm not really sure what are the consequences of such a state ...
0
votes
0answers
25 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
0
votes
0answers
29 views

Data dump - realse, as insurance

Just trying to figure out the best way, to set up a data dump mechanism as a safety insurance. A timed data dump which could be only deactivated by me, and released in case of my absence (harm). And ...
2
votes
0answers
30 views

OAuth - initial log in to get API key

I've been reasearching how major web systems implement OAuth in their RESTful API. Here is how Paypal describes theirs: Basically the question comes down to the "note" part of the picture. Say ...
0
votes
0answers
20 views

Is comparing the thumbprint of a SSL certificate secure enough?

I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific ...

15 30 50 per page