# All Questions

1k views

### Is it a security risk to use an unknown web browser?

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I know that nobody agrees with me as there are no articles about that in Google, but it looks ...
1k views

### Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
99 views

### How to password protect a Truecrypt volume using a Diffie Hellman public key exchange?

I want to send a Truecrypt volume through email. Of course, I need to password protect it, and the recipient needs to know the password too. A Diffie-Hellman public key exchange would seem to be the ...
2k views

### Two takes on PHP two way encryption - which one is preferable?

I need to encrypt some data and have it decrypted on a later point in time. The data is tied to specific users. I've gathered two possible solutions... 1: The first one is derived from the official ...
58 views

### Security Engineering Potential Threat?

I've been working on some security engineering problems and there is no solution provided so if someone can clarify, would be great. From the point of view of security engineering, which is not a ...
100 views

### Problem with common factor in RSA [duplicate]

In the RSA key generation steps, what if two entities select a common factor to generate n (i.e. p*q1=n1 and p*q2=n2) resulting in gcd(n1,n2) <> 1 ? This will lead to a problem that everyone ...
276 views

### Where should a team store server credentials [duplicate]

Imagine we are working in a team of around 5 people. We all install new servers on a monthly base and need to find a better way of storing and sharing the server credentials ...
82 views

### Is PCI-DSS compliance required for non-credit card payment source?

We have a banking application that allows you to pay your bills (using your savings/checking account) -- including your credit card bills. However our system was set up such that you enter the credit ...
188 views

### How is chase mobile deposit verified? [duplicate]

I read this but it didn't ask the question I want answered. How is Chase Mobile Deposit Secure? What I want to know is how do they avoid accepting a Photoshopped check? When someone gives me a ...
86 views

### Vulnerability or Threat?

I have a practice question here: A business is going to determine the dangers to which it is exposed. What do we call a possible event that can have a disruptive effect on the reliability of ...
3k views

### Secure Boot on Microsoft Surface Pro 3 (or modern PCs)?

Got a Surface Pro 3 today (it's awesome BTW!) and noticed in it's EFI that it's got TPM enabled, "Secure Boot" enabled (unsure what such an umbrella/catch all term actually covers) And then in ...
342 views

### From how far away can passive RFID tags be read?

I have been told in the past that with specialized equipment, passive RFID tags could be read at 1100 feet. This seemed a bit far fetched to me, and sure enough, a quick Google search turned up ...
107 views

### Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
100 views

### is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
177 views

### Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity ...
539 views

### How is a biometric authentication system secure?

Imagine I have an application which uses a biometric based authentication (such as a fingerprint). It takes its hash and sends it to the server. The server has a copy of the hash and compares the two. ...
263 views

### Is a local account on windows more secure than a microsoft account

I am using a local account on my Windows 8 computers rather than logging in with a Microsoft account. I see no reason why Microsoft needs to know my login credentials; it feels intrusive to me and it ...
225 views

### How secure is my DPAPI Master Key if I enable biometric login?

I understand that Windows DPAPI master keys are encrypted (directly or indirectly) with the user's login password - see e.g. Does DPAPI works if a user hasn't a login password? If I understand ...
442 views

### Is it more secure to apply updates as soon as they get released? [closed]

Is it more secure to apply updates as soon as they are released, or wait to make sure the updates are not causing problems to the system. It might sound stupid but in the last few years I heard about ...
2k views

### Can 2 devices have same host-name on same network? [closed]

I can see one unknown android device on my network, but it has same host-name as my android device. QUESTION 1.Is this possible that on same network two different devices can have same host-name ? ...
7k views

### Why is “something you know” the weakest factor of authentication?

Quoting from CompTIA Security+ guide The first factor of authentication (something you know, such as password or PIN) is the weakest factor. Why? it makes sense when we say that humans/users ...
56 views

### Securely map random string to a custom charset

I'm writing a Python script to generate custom passwords based on a HMAC. I want the passwords to support various websites requirements so I want to map the HMAC output (ex: hex format) to an array of ...
2k views

### How to check a public RSA key file [closed]

Inside a shell script I want verify public RSA file. All I want to do is that find a way to check this file is a genuine public key file, nothing else. Can I ask experts here what are the ways I can ...
94 views

### Exposing pm.status_path

Do you think it's dangerous to publicly expose PHP-FPM pm.status_path? It displays "Pool Status", "Active Processes status" and "Idle Processes status", showing Script path and Request URI.
258 views

### How to sign and encrypt mail using openssl?

I am trying to send and encrypt mail using openssl. So far, I figure I should use theese commands: cat ${content} | \ openssl smime -encrypt -inkey lib/me.crt -aes256 -subject "$titre (cs)" -to ...
1k views

### How does SSO enhance security?

The following quote is from the CompTIA Security+ guide: Single sign-on enhances security by requiring users to use and remember only one set of credentials for authentication. How is that ...
82 views

### PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
781 views

### What is TCP spoofing?

I know about IP spoofing is it the same thing? The question originated from the question Is TCP more secure than UDP?
140 views

### nmap crashing embedded-system in strange way

I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand: On the system port 80 is open and 79 is closed. nmap -p 79-80 -T5 -A ...
1k views

### Is TCP more secure than UDP? [closed]

I am referring to confidentiality not integrity. are there any security features that UDP lack compared to TCP? According to this paragraph While TACACS uses UDP port 49, TACACS+ uses TCP port 49 ...
280 views

### How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
492 views

### Lifecycles of a computer virus

According to what I read there are four phases: - Dormant phase - Propagation phase - Triggering phase - Execution phase I however am having trouble finding a chronological order in how these events ...
3k views

### What are the risks of using Tor browser? [duplicate]

Are there any risks to using Tor browser? Does it make you more prone to being hacked, since a majority of hacker community is using Tor?
116 views

### PCI Compliance - Encrypted Mobile Apps

My company (health care) went through a PCI audit and needs to solve some major issues. Our branches collect CHD on paper and saves them to a network drive as a pdf that our corp office accesses to ...
106 views

### What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
87 views

### using commonName for DNS vs subjAltName

According to http://stackoverflow.com/a/26195101/569976#comment41093099_26195101 "[Using the DNS name as the common name is] deprecated by both the IETF and CA/B Forums, and it should not be done. ...
103 views

### Are Hyper-V Memory Snapshots secure/encrypted?

When dealing with encryption tools (TrueCrypt, Bitlocker and any successors) the passwords are always somewhere in memory. Therefore when there are memory dumps on a hard disk, for example in the ...
175 views

### With RSA, can one ensure that two entities will not have the same private key?

With the RSA encryption algorithm, is there any guarantee that two different entities will not be given the same private keys?
96 views

### Reconnaissance countermeasures

I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated. ...
99 views

### How would one go about setting up a system with security in mind? [closed]

I run a standard laptop at home (dual-boot Fedora 20 and Windows 7; the Windows side is almost never used). Soon my other computer will be working again; it will have Windows 8.1 and some flavor of ...
87 views

### Securing commands

For a project I'm working on, I need to securely send commands between servers. These commands should not be able to be altered, and there should be some security about not being able to just keep ...
337 views

### How is Cross Site Flashing performed?

I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there ...
103 views

### Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
502 views

### Shellshock and PHP fastcgi

I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?
81 views

### Pivoting through XSS

I'll start off by saying this is a purely academic question; I'm trying to fill some gaps in my knowledge. If a website is vulnerable to XSS, and the target host is another machine that can browse to ...
114 views

### How can I compute the value of the ASP.NET forms authentication cookie?

How can I compute the value of the ASP.NET forms authentication cookie?
182 views

### Is OWASP ESAPI .NET Edition really used? Is this project still alive?

I have just seen that the last release has been pushed out in 2009 and that raised my doubts.
566 views

### Know certificate signing algorithm of a remote site using OpenSSL

I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl. To start with I tried to see the cerificate using following command, but it also does not show up ...