0
votes
0answers
9 views

How do I convince others of the importance of password management?

I just got married, and my wife and I are in the midst of combining finances, etc. We set up a joint bank account and the first thing I do during the account setup phase is generate a 16-character ...
0
votes
0answers
15 views

Prevent MITM between custom phone app and local server

We're building a Wifi enabled device. The device will be installed locally on each client's office and people in the the small office will connect to this Wifi enabled device, They will send/receive ...
0
votes
1answer
23 views

Is VM per service a reasonable server security model?

Let's say I am hosting several services on my server, for instance, email and a web page. I am concerned that the web server software may have unknown vulnerabilities in it, which will allow an ...
1
vote
1answer
12 views

Are there any known breaches of the .NET AppDomain isolation?

.NET AppDomains provide several levels of isolation for untrusted or partially trusted code. The AppDomain sandbox is widely deployed in ASP.NET and Silverlight, although only the latter of these is ...
2
votes
1answer
27 views

How to create TLS SHA256 certificate request

One of our business partners is requesting us to use a TLS SHA256 certificate to connect to their APIs. I am not sure how to generate these requests. I have used openssl in the past to create these ...
0
votes
0answers
18 views

No internet access using Airbase

I'm using Airbase to set up a rogue wireless AP, but when I go to connect to it, I can connect to the AP, but I can;t get on the internet. Here are the commands I'm using. Can anyone tell me what I ...
0
votes
1answer
41 views

XSS with a torrent

Is it possible to XSS using a BitTorrent tracker. I have been hearing that you can use a torrent to perform XSS. Is it possible ? If so whats the general idea ?
0
votes
1answer
16 views

WPA2 Protection (books?)

I have recently read this article: http://www.tomshardware.com/reviews/wireless-security-hack,2981-5.html. It gives an excellent basic insight on how WPA work. However I want to learn more, I want to ...
0
votes
0answers
32 views

What lessons learned can be gained from the Sands Casino hack?

I'm looking for a concise summary of what was done right, and what lessons could be learned with the Sands Casino hack. One take away that I saw is the need to audit for, and purge locally cached ...
1
vote
1answer
16 views

FireFTP security

I've just installed the FireFTP plugin for Firefox, I have been using Adobe Dreamweaver's FTP up to now but wanted to try something different. When I opened it up and saw all of my computer's files ...
1
vote
1answer
23 views

SSH: What's the difference or interplay between /etc/ssh/[host files] and ~/.ssh/[public key]

I'm new to SSH after a decade of dabbling with Ubuntu and other Linux builds. Today I successfully setup SSH, but I had a few hangups and headaches along the way. Although the system is now running ...
1
vote
0answers
50 views

someone may be doing something nasty

I have an ssh server. earlier toady, I was about to login to my server, when I got a message that said something along the lines of "Someone may be trying to do something nasty" and indicating a man ...
0
votes
1answer
21 views

Diceware & Database hosting

I'm currently setting up a new SQL database with DotEasy as my Hosting/Database provider. I've heard a lot about Diceware being one of the best methods of creating a really strong password, so I ...
0
votes
0answers
19 views

Webserver Stress Tool [on hold]

Can you recommend me a stress tool for my web server? I'm running debian 7 with webmin (VPS), currently i'm using apache,mysql,ssh,fail2ban. I also have scanned my server with nessus and LSAT without ...
8
votes
0answers
35 views

Why can't we bypass DNSSEC

DNSSEC is a suite of security extensions to enhance DNS security. (e.g.: avoid cache poisoning) However I was wondering how does the resolver know that the next NS will use DNSSEC? E.g.: Someone ...
0
votes
1answer
44 views

Do I need dedicated firewall? [on hold]

I have two servers in the datacenter. FreeBSD <--> Windows Server FreeBSD configured as a gateway for Windows Server. What is the best: FreeBSD has only firewall. All services are on the Win ...
1
vote
2answers
62 views

Protecting the BIOS from malware [on hold]

The BIOS operates at a lower level than the OS, so antivirus software cannot scan it. Is there any other security software that we should use to protect the BIOS?
1
vote
3answers
52 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
0
votes
0answers
35 views

Windows Server 2008 R2 - SHA2 based Cipher Suites

I am currently in the process of upgrading the SSL certificates for various websites that I manage from SHA1 to SHA2 compatible certificates. To date we have always used 'RSA' as the key exchange ...
5
votes
1answer
66 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
0
votes
3answers
259 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
4
votes
2answers
130 views

Why does the first call to DecryptUpdate in AES-CBC return 16 fewer bytes?

While decrypting a file by CBC mode of AES algorithm, the output length is 16 bytes lesser than that of the input length. For example if you pass a buffer of 512 bytes it decrypts 496 bytes. It ...
5
votes
2answers
603 views

Facebook POST request capture

I have been trying to test a sniff on facebook POST request forms using wireshark (filtered HTTP). At login form, I would try login, and then check wireshark and see that no packet was captured. ...
1
vote
2answers
89 views

How can I find out who is behind a Mac address?

I was connecting a bluetooth device to my tablet and noticed that when scanning for the devices one "device" was actually a Mac address. We (me and my husband) have been under a hacker attack already ...
1
vote
0answers
49 views

How to recreate the Freak attack?

Currently I am trying to recreate the Freak attack on a virtual machine. For this purpose I set up a Linux Mint 17.1 system with Apache 2.4.7 (with a self signed certificate) and OpenSSL 1.0.1f. I ...
2
votes
0answers
28 views

Are there any Distributed/mesh-like/P2P VPNs? [migrated]

I have my personal VPN, connecting several devices so they can have fixed IP addresses on an always-reachable network (as long as they are connected to the Internet). This is necessary for me, since ...
0
votes
0answers
24 views

How exactly BitDefender Box achieve its “security” ? Should i trust them? [on hold]

BitDefender Box is a hardware from BitDefender company that acts as AV to all devices connected to network and can be a router too, but they disclose very little about how they achieve their ...
1
vote
0answers
9 views

OBKG on smartcard with PKCS#11

I have a new smart card with an on board PKCS#11 module and operate in a Win 8 environment. Like many cards, it can generate its own key pairs for enhanced security (only the public key can leave ...
1
vote
1answer
61 views

Storing encryption key in a cookie?

I have a website issue that I am addressing by storing an encryption key in a cookie. I want to describe my issue and my solution, and see if someone smarter about such things than I thinks this is a ...
0
votes
1answer
24 views

bell lapadula model and composite services

I am studying the security of composite services. The Bell-Lapadula model is useful for access control. Can I use this model for access control in composite services? The security level of each ...
0
votes
1answer
24 views

Boot Attacks possible on encryption keys used in virtual machines

Is it possible for an attacker to restore passwords or encryption keys that one has used in a virtual machine the same way like restoring keys that have been used in a standard system applying a boot ...
-1
votes
1answer
51 views

How to test if my server is secure? [on hold]

I'm using a debian7 VPS for hosting my websites. I have only installed webmin, apache, mysql, SSH and a wordpress website. I always update my packages and wordpress version. What is the best (free) ...
47
votes
2answers
2k views

How to publish scanned documents anonymously?

I was thinking of the following question for a long time and did not find a lot of material* in the web and nothing at all on Security.SE. I think its a very interesting question as it covers ...
1
vote
3answers
62 views

Methods to have multiple Anti Virus installed on one machine

I am running Windows 8.1 Pro, Ideally I would like to have the top 5 Anti Virus installed but I am aware it is not advised as they can clash with each other. I was wondering if there is a favoured ...
8
votes
2answers
597 views

Should password reset tokens be hashed when stored in a database?

Passwords are hashed so that if someone gains access to a database of passwords then they won't know what the actual passwords are and so they can't log in. If I can get a valid password reset token ...
24
votes
4answers
3k views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
0
votes
1answer
15 views

Any Value in an AIA Extension in a Certificate Issued by Root CA

While most documentation I've read states that there is no requirement to have the AIA extension in a self-signed Root certificate (logical enough), I can't find anything that tells me not to do so in ...
0
votes
0answers
32 views

startups - securing data and applications on laptop [on hold]

I am starting an organisation of web development. I owned some laptop(s) for same reason. Employee can carry those laptops at home. But when they will be login to system in office, they can have ...
1
vote
1answer
47 views

Android email encryption [on hold]

Is there a reliable (in terms of security), open-source application for handling (send/receive + en-/decrypt) encrypted emails on Android? Something like TextSecure for emails. I just found a command ...
0
votes
0answers
25 views

On firefox behind corporate proxy, intercepting on WebGoat using burp Suite error [migrated]

i'm following a tutorial on hacking web application WebGoat using burp suite I've downloaded webGoat which now runs on port 8080, set up burp suit and the browser connection as in the pictures, but ...
1
vote
1answer
51 views

How could honeypot be vulnerable?

We've been hacked for the 2nd time without knowing how/who did it. Luckily we were able to shutdown everything! We're trying to deploy Honeypot to be in control of what is going on from our local ...
0
votes
0answers
26 views

Is it possible to lock guest VMs (or processes) to sticks of physical RAM to prevent row hammer attacks?

I was wondering if it is possible through some means to isolate processes (or preferably guest VMs) to physical sticks of RAM. This would be to prevent row hammer like attacks from using physical ...
0
votes
1answer
41 views

Suspicious wifi networks from distant places and hotels

When I check my Macbook's network settings, I see some unfamiliar wifi networks from distant places like famous hotels. It's impossible to connect to those networks because I've never been to those ...
0
votes
0answers
33 views

Are there any regulations regarding password storing schemes in the EU or US? [on hold]

I'm interested in the existence of regulations (mostly EU, but US is also relevant) that particularly state some minimal requirements on the schemes used for storing passwords, applicable for ...
-2
votes
0answers
24 views

What is the most secure way to stream video? [on hold]

If the privacy is primary, when video is streaming from RPi surveillance camera to only one user, what is the best protection of transferred data, which encoding and which protocols are suitable? ...
3
votes
1answer
81 views

Deleting credit card information after every transaction

There have been many reports of hackers compromising credit card information in the databases of online shopping websites. Will deleting my credit card information from my account after every ...
-1
votes
0answers
23 views

Split Wireless Card For Fake Access Point? [on hold]

I'm trying to make a fake access point. Here are the steps I'm taking. How can I split my wireless card, so I have one half being the Access Point, and the other half leading to the internet. Is this ...
-3
votes
0answers
22 views

verification code problem, can't continue on my Yahoo inbox [on hold]

Please help. I can log in with my Yahoo but it needs a verification code to continue to my inbox and I've lost my phone.
1
vote
3answers
218 views

Is browsing http sites insecure?

So for example this site, security.stackexchange.com, when I look in my browser it doesn't say that it uses https and it does say that my connection is not encrypted. The same goes for, say, ...
-6
votes
0answers
29 views

Public and private key geerating in C Code source ? [on hold]

I'm looking to a public and private pair key with C ( like this one in the link below ) , is there any one have the source code of it ? any help would be appreciated ! Thank you . Create RSA public, ...

15 30 50 per page