1
vote
0answers
2 views

Verifying cryptographically signed files when the key has been revoked

This is mostly a question out of idle curiousity. If I use my private key to encrypt a hash of a file today, forming a signature, and distribute that signature with the document to someone they can ...
3
votes
1answer
6 views

CSRF expiring before form submitted

I have a very long web form that could take hours for people to complete. The problem with this is when people take too long the CSRF token expires before they're done and when they hit submit they ...
0
votes
0answers
3 views

Stun scripts/webRTC IP leaks

Hi I've been looking at webRTC and stun scripts in general and their ability to bypass VPN's. And have a few questions i hope someone can help me with. 1) Since using openVPN and other VPN ...
0
votes
0answers
14 views

WEP password cracking

I was testing WEP password cracking on my router. I had set a thirteen character password ("TESTING123456") and tried these commands: airmon-ng start wlan0 Then i started airodump-ng using this ...
0
votes
1answer
20 views

Is it neccessary that website certificate must have site URL?

While working on a scenario, I got the error message "Server's certificates doesn't match the url". Is it necessary that the certificate given from the website must have its URL? Is it necessary that ...
-1
votes
1answer
22 views

How to audit an Active Directory only knowing its IP address?

Is it possible to audit an Active Directory only knowing its IP address? In my job, they provide me with the Active Directory IP addresses and ask me to check whether the passwords issued by the ...
2
votes
2answers
10 views

How to create a secure nonce for WSSE

I need to connect to a REST API using a WSSE header for authentication. Since WSSE still uses the weak SHA1 I believe a good nonce is important. I found very different implementations: * ...
1
vote
2answers
18 views

Public/private key auth and VPN

If a server uses public/private key authentication to access SSH, will there be any advantage of restricting the access of SSH over VPN? This link describes both approaches to solve brute force ...
1
vote
1answer
347 views

Asian websites don't use HTTPS

In America and Europe, HTTPS is quite popular, but in most Asian countries it isn't. The majority of China, Japan and Korea's top websites don't use HTTPS. Why don't they use HTTPS? EDIT: Are they ...
0
votes
0answers
8 views

Sharing DUKPT BDK with a partner

Assumptions: We have devices out in the field injected with keys derived from our one and only BDK. The devices encrypt data using the injected derived key. All our devices connect to our server ...
1
vote
0answers
8 views

Understanding Derived Unique Key Per Transaction (DUKPT) & Key Serial Numbers

I have a number of questions regarding Key Serial Numbers (KSNs) in DUKPT: KSNs are 8 - 10 bytes long. Older implementation are 8 bytes whereas newer ones are 10 bytes. Do I risk being incompatible ...
-1
votes
0answers
12 views

Devices enabling remote access and bluetooth connections

Are there any major security risks associated with using a device for remote access to a workstation computer while at the same time enabling blue-tooth internet sharing on the device? Thanks ...
0
votes
1answer
31 views

Store and protect details for software licenses

Assuming that a license can be a key (XXXX-XXXX-XXXX-XXXX), a file (license.xml or whatever), or a login for a dashboard on the vendor website, how would be a standard way to store and secure those ...
1
vote
1answer
38 views

Why do phishing sites use images instead of just copying the HTML?

Why do phishing sites use pictures of the full site (e.g., they took screenshot and broke it up) instead of just copying the real HTML and modifying the target for form submission of ...
1
vote
0answers
14 views

For attackers looking to launch arp spoof on a target, does the attack have to happen in real time?

I was surfing the web at 3 in the morning and I got a warning which seems to indicate a MITM attack. Does this mean the attacker was able to passive sniff my activity in real-time in order to launch ...
-4
votes
1answer
34 views

Is it true that breaking into the https padlock settings on a web page is easy to do?

I found some articles online that explained that https settings are easy to crack. If this is true, is there no way for us to keep our browsing private? I use Tor and used to have JonDo before it ...
2
votes
3answers
60 views

Securely storing bank account details in database

I am developing a service that will involve the direct debit of customers' accounts on a routine (weekly, monthly, etc.) basis, and so I'll need to store their information (BSB/routing number and ...
0
votes
1answer
13 views

Mystery URL in iftop

So this may be more appropriate for serverfault, but it seems like it belongs here. I was watching iftop on a server I control that can send data to arbitrary sources but can theoretically only ...
0
votes
0answers
15 views

Decrypting SSL traffic for Security Onion at or before the interface

I have Security Onion installed and doing full packet capture on my home network. I also have a firewall (pfSense) which does my routing. I have Security Onion sitting just behind my firewall and ...
1
vote
1answer
10 views

Security Assessment v/s Security Engagement Breakdown

I had this couple of threads in here which talks about security assessment v/s risk assessments, but here the idea is completely different. Suppose, I had to breakdown qualitative tasks from the ...
0
votes
1answer
37 views

Is this a secure hash “Function” for integrity?

I was wondering what were the posible security (not efficieny) issues with this hash "function": Although not an actual function, this method turns a message of any length into a message of fixed ...
1
vote
2answers
24 views

How can I use the free version of Burp to identify input HTTP urls for my site

I want to create (and update ongoing) a list of input vectors for my site, including forms (GET and POST etc). I am new to pen tesing, and have been pointed at Burp (free). I have Spidered my site, ...
1
vote
1answer
14 views

Why has my OpenPGP key been duplicated on expiry change?

I've published my OpenPGP key publicly on the MIT key server. Later I realized I needed to set the expiry date to an earlier date than the one the (sub-)key was published with. I managed to do this ...
0
votes
2answers
20 views

Does splitting RNG into “private” and “public” entropy sources reduce risks of compromise?

I'm reading s2n's docs (https://github.com/awslabs/s2n) where it is claimed that: https://github.com/awslabs/s2n#compartmentalized-random-number-generation The security of TLS and its associated ...
0
votes
1answer
11 views

FIPS 201(-2): Central requirements for PIV?

I was recentely asked in the comments on some details on tamper-proofing of a smartcard in question. The term "FIPS-201" was used to specify what kind of details was needed. I understand that FIPS ...
3
votes
1answer
42 views

Why is logjam rated as “None” for confidentiality impact in CVSS?

The CVSS score for Logjam is (AV:N/AC:M/Au:N/C:N/I:P/A:N). As noted in that nice dynamic image interpretation, the Impact metric "Confidentiality" is described as "None" (C:N). But the ...
0
votes
0answers
16 views

Thinktecture IdentityServer security review

Has an independent security review been performed for Thinktecture IdentityServer, for design and code? Alternatively, does IdentityServer address the threats discussed in RFC 6819, OAuth 2.0 ...
1
vote
0answers
32 views

Why use oddly compiled ELF files for Linux malware?

I ran file on some Linux malware ELF files that I've acquired over the last couple of years. I noticed some oddities: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, for ...
3
votes
2answers
23 views

Malware: extract private keys from smartcard?

We all appreciate smartcards because they secure private keys so they don't get exposed to the world. But in a production-environment it's often the case that smartcards are staying inserted for a ...
1
vote
1answer
81 views

Why do some programming language API's not support private key passwords?

Two questions: I've recently started building a basic Go web-server, and noticed that the API for starting a TLS web-server does not support a symmetrically encrypted private RSA key. The API is ...
1
vote
1answer
28 views

Secure connection between two clients with shared secret

I am creating a system where there are multiple clients, each of which has a secure connection to a central server which could pass out shared secrets to each of them. I could be wrong, but I am ...
2
votes
2answers
52 views

Is writing to /dev/null secure?

I am working on a web-service based crypto project in JAVA. The basic idea is for the client to send a SOAP request to a servlet to encrypt data. For data transmission I am using MIME/data-handlers ...
11
votes
3answers
1k views

What can hackers do with ability to read /etc/passwd

I see on the exploit websites security analysts and hackers targeting the /etc/passwd file when showing the proof of concept. My question is, if you have a Local File Inclusion or Path Traversal ...
0
votes
0answers
27 views

Neighbors Internet Kicks My PPEOE Off

Had this problem for almost a year now, and watched it closely, my internet vianet, runs just fine till a certain wifi shows up, always Bell023 when ever this wifi shows up my modem gets it's PPEOE ...
0
votes
2answers
34 views

Brute force time estimation - random sequence

I would like to ask if there are 2^1000 possibilities to choose from, how long would it take go through them all on average? (in terms of min, hours or years) Note: This is not necessary related to ...
0
votes
3answers
40 views

Why is shared less secure than open when it comes to WEP?

According to this post, Jeffrey Tippet (Microsoft employee) writes: WEP can run in two modes: shared and open. Despite the names, shared is actually less secure than open. Because of this, our ...
0
votes
2answers
20 views

Changing the signature on a cert or creating a key file from an existing cert

I would like to create a certificate with a specific public key. I have another certificate which contains the public key I need to use, and I wish to change the signature on that certificate to a ...
-2
votes
0answers
27 views

Can't encrypt email

My friend has a problem described here: https://gpgtools.tenderapp.com/discussions/problems/18790-cannot-encrypt-an-email But the solution provided by this link did not work. What else can he try? ...
0
votes
0answers
14 views

Is the SanDisk ULLtraDIMM secure after power-down?

I found an interesting product last night called the SanDisk ULLtradDimm SSD (product page), which essentially claims drastic performance gains by plugging an SSD into a standard DDR3 memory channel. ...
2
votes
1answer
81 views

How to avoid ransomware

Malware files execute themselves after downloading them. Let's look at it from the point of view of a piece of ransomware like CryptoLocker, from Wikipedia: Crypyowall 3.0, uses a payload ...
2
votes
1answer
37 views

Issue regarding installation of SHA256 scertificate

Can anyone help me with the installation of SHA256 certificate? I have generated the certificate perfectly but there seems to be an error below: Kindly let me know why am getting the exclamation ...
1
vote
1answer
27 views

Padding of 802.11 packet with 0's in libpcap

I am trying to send probe request to Access Points.But whenever I send a probe request packet it is padded with 0's i.e I see two packets on wireshark for every packet I send : a non-padded packet and ...
0
votes
2answers
86 views

Hiding (Obfuscating) Java script

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
15
votes
4answers
3k views

How secure is Snowden's MargaretThatcheris110%SEXY password?

In an extra from Edward Snowden's interview with John Oliver, Snowdon advises that a good password to use is one such as MargaretThatcheris110%SEXY.. Also, on the Errata Security blog, Robert Graham ...
2
votes
0answers
8 views

How CERT.rsa is interrelated with PackageInfo signatures

I am a newbie in security and cryptography, but I am developing Android applications and now wanna to dive deeper into the Android security mechanisms. I am trying to understand how CERT.rsa (as I ...
27
votes
6answers
3k views

Unsubscribe safely

I have heard that is better to never click to any link in an email. Is it a bad idea to click to a unsubscribe link? What is the best way to unsubscribe to undesired mails?
1
vote
1answer
35 views

How to prepare FATCA data transmission files with open source tools [on hold]

Here is the context: to transmit FATCA data to US IRS service the IDES protocol defines the following steps sign the XML Payload.xml file with enveloping signature, SHA-256 with RSA private key, as ...
1
vote
1answer
57 views

Can Windows 8 be PCI compliant?

I am in the process of getting PCI. I am in the last step in which I would need a secure PC on my internal network. All the scans I must run are only available through a plugin in browsers for Windows ...
1
vote
3answers
102 views

Why not fix Android root exploit? [on hold]

I see many scripts for hacking Android device and getting root, critical access level. I see millions of people apply this to their devices and do not understand the risks. Why don't Android ...
1
vote
1answer
48 views

Cloud-based IM protocols / services saving messages encrypted on server which is decryptable only by user?

I am looking for a cloud-based (i.e. not end-to-end) secure IM protocol or service. The first one comes to my mind is telegram. Here is a quote from telegram's privacy policy: Cloud Chats ...

15 30 50 per page