-1
votes
3answers
120 views

Best way to securely send passwords from an application to a user operated server

I have the following situation: A user sets up a server that will have to receive login details. Other users then create accounts and login to this server. All this happens only over LAN. I'm ...
1
vote
2answers
130 views

How to set X-FRAME-OPTIONS where 3rd Party frame is required to be loaded?

We have set the set X-Frame-Options in the header as ALLOW-FROM same origin but there is a requirement to open below page from some 3rd party website. Do you see security issue here? HTTP::header ...
3
votes
1answer
48 views

Interviews with staff members about privacy and security policies relevant to their positions

I am currently working to help a bunch of small pharmacies remain compliant and one of the requirements is: Interviews with staff members about privacy and security policies relevant to their ...
0
votes
1answer
75 views

Locking down Amazon RDS table data

We are using MySQL Amazon RDS. The instance is encrypted, and also only available via SSH from the production server EC2 instance. One of the things we are trying to do is give access to some ...
1
vote
1answer
45 views

Authorize the access ability to a user in Oauth 2.0?

As far as i known, the protocal OAuth2.0 will bring the access ability from the resources owner(A) to the client. But in the scenario here, I wonder if it is possible to authorize the access ability ...
31
votes
13answers
8k views

Is a server infrastructure fundamentally possible which the smartest person can't breach?

TL;DR: Perhaps I've gone overboard with my question's detail, but I wanted to be sure the question was clear since the topic seems very broad. But here it is. The word "smartest" is meant ...
4
votes
3answers
580 views

Does Gmail's 'preview' feature for documents in the browser prevent malware?

I'm concerned about opening attached Word documents and other files (images, PDFs, etc). Gmail has a feature that previews these in the browser for you in a popup, without leaving the Gmail screen - ...
3
votes
1answer
171 views

PCI Compliance SAQ-A-EP or SAQ D

Our eCommerce wesbite attracts less than 5000 CC transactions each year and we do no store any CC information in our backend or systems but transmit them to our third party provider. We also use a ...
0
votes
0answers
66 views

How can I protect a mobile application from LogJam?

I develop a two-factor authentication app on iOS and Android and I recently noticed that they run perfectly fine against a local dev server that is vulnerable to LogJam. Is there any way to secure ...
12
votes
1answer
189 views

Where is the best place to get descriptions of malware?

I'm looking for a source of descriptions of 1990s to early 2000s malware; I have searched for a very long time yet found very little. I require information such as payload activation dates, files ...
5
votes
2answers
230 views

A compromised USB

Assuming that a given USB drive is compromised(infected), what's the best way to deal with it? I mean, obviously, the solution is to nuke(format) the drive. But for that, the device needs to be ...
0
votes
1answer
45 views

Is there any problem using empty salts with PBDKF for this purpose?

The aim is to generate a secure key for symmetric encryption. I have a master password, from which I want to generate the key for symmetric encryption, in order to encrypt other passwords. The idea ...
7
votes
3answers
144 views

Automatic detection of a compromised web server

I'm trying to figure out if it is possible to automatically detect the the fact that the HTML or javascript files on a server have been tampered with or changed by an attacker. Our website, say ...
6
votes
1answer
1k views

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
4
votes
2answers
212 views

Can TLS provide integrity/authentication without confidentiality

It was a bit surprising that Wikipedia has switched to TLS because we all know it's public information available to anyone, but I suppose that the real purpose for that is to provide ...
8
votes
1answer
339 views

where did they get my Gmail address?

I pointed my browser at the website of a web developer I barely know, and the page returned was his home page, with the message "Welcome myname@gmail.com!" Whoa. Where did it get my Gmail address? ...
1
vote
1answer
302 views

Envelope Encryption with asymmetric keys vs KMS

In Envelope encryption a symmetric secret key is used to sign the data and then another key is used to encrypt the secret to produce an encrypted secret key. The encrypted messages is packaged with ...
1
vote
3answers
51 views

What is a typical defense mechanism/setup against flooding back-end sql calls?

I'm interested in figuring out what is a typical scenario of preventing the following attack scenario: Back-end has as SQL server. Front end a simple "Hello World" HTML that passes an input (say user ...
1
vote
0answers
168 views

Teamviewer webclient does not use https

Using fiddler, I noticed that the traffic generated by the teamviewer webclient is plain http. Is that a security concern given that teamviewer themselves claim that https is used?
2
votes
1answer
91 views

Choosing token over session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and sent ...
2
votes
1answer
159 views

Bi-directional authentication in OpenVPN

I have an OpenVPN gateway setup. A CA was created on the same server with Easy-RSA. Each OpenVPN client has its own certificate-key pair issued with the abovementioned CA. Server has its own ...
0
votes
0answers
20 views

What is the goal of sign a key in BrowserID certificate?

I'm learning about the Mozilla Auth. it has an implementation of SRP protocol in https://github.com/mozilla/fxa-auth-server/blob/master/docs/overview.md and his client; example is ...
0
votes
1answer
109 views

Discovered a security flaw in a company, what to do? [duplicate]

While playing with a site I have discovered a huge security problem. The thing is, if I tell them about it they might question what was I doing in the first place. I was trying to hack my friends ...
10
votes
2answers
2k views

Firewall on smartphones

PCs communicate with the help of ports,eg. HTTP communication takes place over port 80. Due to the nature of these ports, an open port is an avenue for an attack. That's where firewalls come in. The ...
0
votes
0answers
63 views

Facebook app permissions

According to an answer to this question : Bypass app permissions, I changed by curiosity the application permission of Facebook and Messenger for the camera to always ask. I'm using CyanogenMod 12.0. ...
0
votes
1answer
67 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
1
vote
2answers
475 views

What is this URL Injection piece of code mean?

I don't know if it's considered or not to include a single piece of code that might be malicious. But recently my site was a victim of some URL injection. I was wondering if anyone can tell me what ...
3
votes
3answers
399 views

Bypass app permissions

I'm annoyed and actually scared by all the permissions that I have to grant the applications that is running on my Android phone. Is there is a way to bypass them ? Let's say my microphone. My ...
1
vote
1answer
36 views

Is it secure to have an iPad app run a webDAV server on localhost without authentication?

I have two iPad apps running on the same device. One is hosting a webDAV server on http://localhost:8080 without any authentication (the server is active whilst the app is foregrounded, and for a few ...
0
votes
1answer
113 views

BitLocker : Update Volume Master Key and meaning of “keyed” vs “re-keyed”

Note: Below are some information from searching around the Internet. To skip to my main question, go to the last line of this post. I've been searching around on how to change the Volume Master Key ...
4
votes
2answers
84 views

Is it a good practice to use certificates as a mean of client identification in a cloud environment

My software system is running a cloud infrastructure where having Linux machines VPN into OpenVPN gateway is a setup requirement. Also, there may be cases when software on the aforementioned Linux ...
2
votes
2answers
689 views

Determine salt length from hash

I am writing a basic Unix password cracker in Python that would work for MD5, SHA-1 and SHA512. I know that the salt in MD5 correspond to the 2 first chars of the encrypted password, and thus I ...
0
votes
0answers
29 views

How to test rootCA for issue subCA certificate

Can I check rootCA for issue subCA test certificate before issue real subCA cert? If rootCA issue test certificate and revoke immediately, then all operation log is recorded. Do this compliance with ...
0
votes
1answer
53 views

Is there a way to sign information by when it was made? [duplicate]

Looking at this question ("Is it legal to use an online logbook?") from Aviation SE, I'm wondering if there is a way to sign information in such a way that: It ensures that there was a certain time ...
1
vote
0answers
52 views

Low-resolution account enumeration with Office365

I am interested in the intersection of account enumeration and single sign-on. Often, there will be SSO-only and non-SSO users alongside each other in an application, and in terms of improved ...
2
votes
2answers
93 views

Confidentiality and privacy

I understand that the confidentiality aimed at protecting access to the system data, while privacy aimed at protecting access to the person data. Now, could we consider anonymity as a ...
-1
votes
2answers
289 views

Run our own Certificate Authority for internal use only: safe or not? [duplicate]

According to the guide at How to Run Your Own Certificate Authority, my organization have a plan to issue our own digital certificates for internal use only (the managers will sign PDF documents to ...
3
votes
1answer
231 views

Getting a certificate warning for one email but not another

When I log into outlook.com using Chrome browser, I get a certificate warning for one account but not another. One says my connection is private, the other says it "may not be private". Here are the ...
1
vote
0answers
123 views

How to know which extension or software is causing ads in Chrome? [closed]

Starting yesterday, I noticed that something weird is going on with my laptop. After unlocking my laptop I found that the empty Chrome pages that I opened are getting redirected to ads. I am running ...
2
votes
2answers
202 views

UDP sockets open on all ports

I'm on osx. netstat -an -f inet gives me a bunch (around 10) of entries like these: ... udp4 0 0 *.* *.* udp46 0 0 *.* *.* ... In my ...
-3
votes
1answer
165 views

How to see all incoming and outgoing traffic of other nodes while on a LAN?

I've got two computers. A & B. While sitting on the computer A how can I see the incoming and outgoing traffic of computer B? Or can I? Note: Please try to answer in a non-technical language as ...
1
vote
1answer
169 views

How to wipe disks before encryption with dm-crypt if CBC or XTS is used internally?

First, please forgive me if I'm posting this question to the wrong community. Feel free to migrate this post to the right community if I was wrong. I'm quite new to whole disk encryption (but not ...
0
votes
0answers
19 views

Is Android WLAN MAC Address vulnerable? [duplicate]

What can a person do if he/she has WLAN MAC Address of my Android Device? What can be done to save my personal information?
3
votes
1answer
210 views

Vulnerability of Java software

The JAVA software provided by Oracle is a security mess. But what exactly, in that software package is the most vulnerable. If someone install it and disables the Java plugin in the browser, will he ...
1
vote
1answer
77 views

Best way to ensure integrity of encrypted data which is kept in a public place

I need to keep sensitive data in a de fact public place (i.e. with a user, e.g. in a cookie) and only there (no copy or hash of that data should be kept on the server). The data was encrypted AES/CBC ...
-3
votes
1answer
106 views

How to sell a new idea – “100% secure communication”, feedback wanted [closed]

I have thought of an idea (new product) to have 100% secure communication between 2 parties and would like your feedback/ideas on how to sell it. Oh, before you start that there is no such thing as ...
0
votes
0answers
58 views

Secure HSM connectivity, direct or LAN?

What would be considered a better and secure setup for HSM: A direct connection to the server (point-to-point) Having it in the LAN and configuring VLAN?
4
votes
3answers
590 views

Password security with short passwords

I know that a long password is a good password. However, some sites require short passwords e.g. exactly 8 characters long. Under those limitations, what is a good method of creating and memorizing a ...
1
vote
1answer
368 views

Security characteristics through ISO 25023 standard

Could you please help me to clarify the following: ISO 25023 standard divided security into the following 5 characteristics which are: Confidentiality characteristic (divided into) -----> Access ...
0
votes
1answer
84 views

Impact of sharing the private key with a third party for snooping SSL traffic

I am trying to understand the impact of sharing the private key with a third party for snooping SSL traffic. Below are my thoughts, please correct and add if some more impacts are there: One clear ...

15 30 50 per page