0
votes
0answers
9 views

Identify encryption algorithm for .enc files

I need to identify the encryption algorithm used to encrypt some files. I have the key, but I can't decrypt it using OpenSSL, because I don't know what algorithm was used to encrypt it. Is there any ...
1
vote
1answer
9 views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? "v=spf1 include:_spf.google.com ~all" "v=spf1 include:spf.mandrillapp.com ~all" "v=spf1 include:servers.mcsv.net ~all" ...
0
votes
1answer
14 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
0
votes
0answers
25 views

Should I be concerned at the lack for transparency by Microsoft which quietly added 17 root certs?

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange. Is anyone aware ...
1
vote
1answer
20 views

What's RSA and ECC's role in TLS 1.2? [duplicate]

I'm trying to figure out what is RSA and ECC used for in TLS 1.2 cipher suites. Let's take TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 for example, communication between server and client would look ...
-4
votes
2answers
34 views

Is it possible that the person I write to will see the email before I write to him?

Is it possible that the person I write to will see the email's content before I reply to him? If I got an email and I answering that email, is there any feature that can cause my reply to be seen by ...
1
vote
1answer
20 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
2
votes
0answers
26 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
5
votes
5answers
522 views

How much is the entropy of a randomly generated password reduced if I regenerate until I get a password I like? [duplicate]

In many of the answers and comments on the well-known XKCD #936: Short complex password, or long dictionary passphrase? question, the importance was stressed of generating the password randomly, and ...
1
vote
1answer
34 views

Is there a Service to setup a Honey Pot URL to collect user IP + other data?

Being the paranoid user I am. I always think I have an infected computer with trojans or malware or prying eyes to my work computer. I was wondering is there a service that lets you create a honey pot ...
1
vote
0answers
25 views

Machine compromised [on hold]

Recently, one of our GUI based jump box (ec2-instance) used for deployment to other ec2-machines got compromised, and was used for DDOS attack to other sites. Amazon reported abuse for the same. On ...
1
vote
0answers
21 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...
-5
votes
0answers
45 views

what algorithm is this?

can you tell me what algorithm is used here , i have several examples but i can not find out what algorithm is used? 076a720f-67e6-4dd9-b9f2-38464e10d6ac = 35246 ...
1
vote
1answer
29 views

Extract public information from p12 without having the password

I know this question was already asked here but unfortunately there are no satisfactory answers. Please correct me if I'm wrong, but if I have an p12 file the following two situations are possible: ...
2
votes
1answer
29 views

is x509certificate signed by ca is valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate, but when it was signing CA cert was valid to 2015-06-30'. So my question is, Is today ...
1
vote
1answer
25 views

DMZ and Mail servers

I've seen a few DMZ related questions here in the past, but wanted to ask one directly related to email. I've done some research on this, but wanted to ask the forums opinion. I know it's best ...
2
votes
1answer
77 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, ...
-1
votes
1answer
25 views

Tor website HPKP (key pinning) failure

I'm currently facing a key pinning error when trying to access the torproject.org website with Firefox. Is anyone facing the same problem? Does anyone know if they changed their certificate? If not, ...
1
vote
0answers
39 views

How do overlay network nodes communicate without IP addresses?

I've been reading about how Tor and I2P use cryptographic addresses to send messages to other nodes, but how does this work? I looked through the documentation for each and neither is very clear on ...
4
votes
1answer
28 views

Estimating the cost of implementing security measures

Are there good resources or good practices on how to estimate the cost for implementing security measures in a company? My purpose is to justify to management that they need to spend this amount to ...
1
vote
1answer
33 views

Password-less authentication using corporate Active Directory on external (internet) site

I need to restrict access to an external site so that: users who are in the corporate network have full access to the site's functionality, those who are not - only limited functionality. In the ...
1
vote
1answer
25 views

run runas in a shell

I'm playing with a Windows 7 VM that I own. I started a reverse shell with ncat as listener. I can run commands except runas. Whenever I try to switch to another user I got prompted for the password ...
4
votes
3answers
83 views

Is compiling untrusted code safe?

I'm curious about compiling with gcc/g++/clang with the assumption that headers and implementation files are user-provided, but not the build configuration. (i.e., no cd lib && make) What if ...
2
votes
0answers
22 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to sign a file today, forming a signature, and distribute that signature with the document to someone they can then use my ...
4
votes
2answers
23 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
0
votes
0answers
5 views

Stun scripts/webRTC IP leaks

Hi I've been looking at webRTC and stun scripts in general and their ability to bypass VPN's. And have a few questions i hope someone can help me with. 1) Since using openVPN and other VPN ...
0
votes
1answer
76 views

WEP password cracking

I was testing WEP password cracking on my router. I had set a thirteen character password ("TESTING123456") and tried these commands: airmon-ng start wlan0 Then i started airodump-ng using this ...
0
votes
3answers
223 views

Is it neccessary that website certificate must have site URL?

While working on a scenario, I got the error message "Server's certificates doesn't match the url". Is it necessary that the certificate given from the website must have its URL? Is it necessary that ...
-1
votes
0answers
33 views

How to audit an Active Directory only knowing its IP address?

Is it possible to audit an Active Directory only knowing its IP address? In my job, they provide me with the Active Directory IP addresses and ask me to check whether the passwords issued by the ...
2
votes
3answers
18 views

How to create a secure nonce for WSSE

I need to connect to a REST API using a WSSE header for authentication. Since WSSE still uses the weak SHA1 I believe a good nonce is important. I found very different implementations: * ...
1
vote
2answers
27 views

Public/private key auth and VPN

If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force ...
1
vote
1answer
2k views

Asian websites don't use HTTPS [on hold]

In America and Europe, HTTPS is quite popular, but in most Asian countries it isn't. The majority of China, Japan and Korea's top websites don't use HTTPS. Why don't they use HTTPS? EDIT: Are they ...
0
votes
0answers
8 views

Sharing DUKPT BDK with a partner

Assumptions: We have devices out in the field injected with keys derived from our one and only BDK. The devices encrypt data using the injected derived key. All our devices connect to our server ...
1
vote
0answers
11 views

Understanding Derived Unique Key Per Transaction (DUKPT) & Key Serial Numbers

I have a number of questions regarding Key Serial Numbers (KSNs) in DUKPT: KSNs are 8 - 10 bytes long. Older implementation are 8 bytes whereas newer ones are 10 bytes. Do I risk being incompatible ...
-1
votes
0answers
13 views

Devices enabling remote access and bluetooth connections

Are there any major security risks associated with using a device for remote access to a workstation computer while at the same time enabling blue-tooth internet sharing on the device? Thanks ...
0
votes
1answer
35 views

Store and protect details for software licenses

Assuming that a license can be a key (XXXX-XXXX-XXXX-XXXX), a file (license.xml or whatever), or a login for a dashboard on the vendor website, how would be a standard way to store and secure those ...
2
votes
1answer
54 views

Why do phishing sites use images instead of just copying the HTML?

Why do phishing sites use pictures of the full site (e.g., they took screenshot and broke it up) instead of just copying the real HTML and modifying the target for form submission of ...
1
vote
0answers
20 views

For attackers looking to launch arp spoof on a target, does the attack have to happen in real time?

I was surfing the web at 3 in the morning and I got a warning which seems to indicate a MITM attack. Does this mean the attacker was able to passive sniff my activity in real-time in order to launch ...
-4
votes
1answer
38 views

Is it true that breaking into the https padlock settings on a web page is easy to do? [on hold]

I found some articles online that explained that https settings are easy to crack. If this is true, is there no way for us to keep our browsing private? I use Tor and used to have JonDo before it ...
2
votes
3answers
81 views

Securely storing bank account details in database

I am developing a service that will involve the direct debit of customers' accounts on a routine (weekly, monthly, etc.) basis, and so I'll need to store their information (BSB/routing number and ...
0
votes
1answer
16 views

Mystery URL in iftop

So this may be more appropriate for serverfault, but it seems like it belongs here. I was watching iftop on a server I control that can send data to arbitrary sources but can theoretically only ...
0
votes
0answers
21 views

Decrypting SSL traffic for Security Onion at or before the interface

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and ...
1
vote
1answer
13 views

Security Assessment v/s Security Engagement Breakdown [on hold]

I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the ...
0
votes
1answer
45 views

Is this a secure hash “Function” for integrity?

I was wondering what were the posible security (not efficieny) issues with this hash "function": Although not an actual function, this method turns a message of any length into a message of fixed ...
1
vote
2answers
31 views

How can I use the free version of Burp to identify input HTTP urls for my site

I want to create (and update ongoing) a list of input vectors for my site, including forms (GET and POST etc). I am new to pen tesing, and have been pointed at Burp (free). I have Spidered my site, ...
1
vote
1answer
14 views

Why has my OpenPGP key been duplicated on expiry change?

I've published my OpenPGP key publicly on the MIT key server. Later I realized I needed to set the expiry date to an earlier date than the one the (sub-)key was published with. I managed to do this ...
0
votes
2answers
22 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
0
votes
1answer
13 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
3
votes
1answer
45 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the ...
0
votes
0answers
19 views

Thinktecture IdentityServer security review [on hold]

Has an independent security review been performed for Thinktecture IdentityServer, for design and code? Alternatively, does IdentityServer address the threats discussed in RFC 6819, OAuth 2.0 ...

15 30 50 per page