5
votes
4answers
1k views

Is it a security risk to use an unknown web browser?

The more I read about TLS, the more I get convinced that the browser is the weakest link in the chain. I know that nobody agrees with me as there are no articles about that in Google, but it looks ...
7
votes
1answer
1k views

Why does every site makes me acknowledge cookie usage? [closed]

In the last year or so every other site on the net started showing different kinds of notification that they're using cookies and I should be aware of it. The sheer number of different sites doing ...
1
vote
2answers
99 views

How to password protect a Truecrypt volume using a Diffie Hellman public key exchange?

I want to send a Truecrypt volume through email. Of course, I need to password protect it, and the recipient needs to know the password too. A Diffie-Hellman public key exchange would seem to be the ...
6
votes
1answer
2k views

Two takes on PHP two way encryption - which one is preferable?

I need to encrypt some data and have it decrypted on a later point in time. The data is tied to specific users. I've gathered two possible solutions... 1: The first one is derived from the official ...
0
votes
1answer
58 views

Security Engineering Potential Threat?

I've been working on some security engineering problems and there is no solution provided so if someone can clarify, would be great. From the point of view of security engineering, which is not a ...
1
vote
1answer
100 views

Problem with common factor in RSA [duplicate]

In the RSA key generation steps, what if two entities select a common factor to generate n (i.e. p*q1=n1 and p*q2=n2) resulting in gcd(n1,n2) <> 1 ? This will lead to a problem that everyone ...
6
votes
4answers
276 views

Where should a team store server credentials [duplicate]

Imagine we are working in a team of around 5 people. We all install new servers on a monthly base and need to find a better way of storing and sharing the server credentials ...
1
vote
4answers
82 views

Is PCI-DSS compliance required for non-credit card payment source?

We have a banking application that allows you to pay your bills (using your savings/checking account) -- including your credit card bills. However our system was set up such that you enter the credit ...
0
votes
3answers
188 views

How is chase mobile deposit verified? [duplicate]

I read this but it didn't ask the question I want answered. How is Chase Mobile Deposit Secure? What I want to know is how do they avoid accepting a Photoshopped check? When someone gives me a ...
1
vote
2answers
86 views

Vulnerability or Threat?

I have a practice question here: A business is going to determine the dangers to which it is exposed. What do we call a possible event that can have a disruptive effect on the reliability of ...
8
votes
2answers
3k views

Secure Boot on Microsoft Surface Pro 3 (or modern PCs)?

Got a Surface Pro 3 today (it's awesome BTW!) and noticed in it's EFI that it's got TPM enabled, "Secure Boot" enabled (unsure what such an umbrella/catch all term actually covers) And then in ...
2
votes
1answer
342 views

From how far away can passive RFID tags be read?

I have been told in the past that with specialized equipment, passive RFID tags could be read at 1100 feet. This seemed a bit far fetched to me, and sure enough, a quick Google search turned up ...
1
vote
1answer
107 views

Is it safe to store important data in an encrypted access token?

Is it safe to store important data in an encrypted access token? For example, instead of storing access tokens in a database, not storing them at all and putting their associated data into them before ...
0
votes
2answers
100 views

is Digital Signature vulnerable on the Internet?

We all know about how Digital Signing works. I just have some questions about vulnerability risk. At first, As I know, the Signature and the Data are separated and we can split the document into two ...
1
vote
1answer
177 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity ...
6
votes
6answers
539 views

How is a biometric authentication system secure?

Imagine I have an application which uses a biometric based authentication (such as a fingerprint). It takes its hash and sends it to the server. The server has a copy of the hash and compares the two. ...
9
votes
1answer
263 views

Is a local account on windows more secure than a microsoft account

I am using a local account on my Windows 8 computers rather than logging in with a Microsoft account. I see no reason why Microsoft needs to know my login credentials; it feels intrusive to me and it ...
4
votes
1answer
225 views

How secure is my DPAPI Master Key if I enable biometric login?

I understand that Windows DPAPI master keys are encrypted (directly or indirectly) with the user's login password - see e.g. Does DPAPI works if a user hasn't a login password? If I understand ...
2
votes
3answers
442 views

Is it more secure to apply updates as soon as they get released? [closed]

Is it more secure to apply updates as soon as they are released, or wait to make sure the updates are not causing problems to the system. It might sound stupid but in the last few years I heard about ...
0
votes
2answers
2k views

Can 2 devices have same host-name on same network? [closed]

I can see one unknown android device on my network, but it has same host-name as my android device. QUESTION 1.Is this possible that on same network two different devices can have same host-name ? ...
22
votes
5answers
7k views

Why is “something you know” the weakest factor of authentication?

Quoting from CompTIA Security+ guide The first factor of authentication (something you know, such as password or PIN) is the weakest factor. Why? it makes sense when we say that humans/users ...
0
votes
1answer
56 views

Securely map random string to a custom charset

I'm writing a Python script to generate custom passwords based on a HMAC. I want the passwords to support various websites requirements so I want to map the HMAC output (ex: hex format) to an array of ...
3
votes
1answer
2k views

How to check a public RSA key file [closed]

Inside a shell script I want verify public RSA file. All I want to do is that find a way to check this file is a genuine public key file, nothing else. Can I ask experts here what are the ways I can ...
0
votes
0answers
94 views

Exposing pm.status_path

Do you think it's dangerous to publicly expose PHP-FPM pm.status_path? It displays "Pool Status", "Active Processes status" and "Idle Processes status", showing Script path and Request URI.
3
votes
1answer
258 views

How to sign and encrypt mail using openssl?

I am trying to send and encrypt mail using openssl. So far, I figure I should use theese commands: cat ${content} | \ openssl smime -encrypt -inkey lib/me.crt -aes256 -subject "$titre (cs)" -to ...
10
votes
4answers
1k views

How does SSO enhance security?

The following quote is from the CompTIA Security+ guide: Single sign-on enhances security by requiring users to use and remember only one set of credentials for authentication. How is that ...
1
vote
1answer
82 views

PCI Compliance for attachment in email

I am wondering if they are any PCI compliance issues around users of a service sending email with attachments that may or may not contain sensitive information through said service? As an example, if ...
0
votes
1answer
781 views

What is TCP spoofing?

I know about IP spoofing is it the same thing? The question originated from the question Is TCP more secure than UDP?
1
vote
2answers
140 views

nmap crashing embedded-system in strange way

I'm trying to find out what nmap-commands crash an embedded-system. In the process I can see behaviour that I don't understand: On the system port 80 is open and 79 is closed. nmap -p 79-80 -T5 -A ...
-5
votes
2answers
1k views

Is TCP more secure than UDP? [closed]

I am referring to confidentiality not integrity. are there any security features that UDP lack compared to TCP? According to this paragraph While TACACS uses UDP port 49, TACACS+ uses TCP port 49 ...
-1
votes
3answers
280 views

How to determine if someone is scanning my server?

How is possible to determine if someone make requests with tools for pentesting? Is there any linux command?
3
votes
1answer
492 views

Lifecycles of a computer virus

According to what I read there are four phases: - Dormant phase - Propagation phase - Triggering phase - Execution phase I however am having trouble finding a chronological order in how these events ...
1
vote
1answer
3k views

What are the risks of using Tor browser? [duplicate]

Are there any risks to using Tor browser? Does it make you more prone to being hacked, since a majority of hacker community is using Tor?
0
votes
2answers
116 views

PCI Compliance - Encrypted Mobile Apps

My company (health care) went through a PCI audit and needs to solve some major issues. Our branches collect CHD on paper and saves them to a network drive as a pdf that our corp office accesses to ...
1
vote
1answer
106 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
2
votes
1answer
87 views

using commonName for DNS vs subjAltName

According to http://stackoverflow.com/a/26195101/569976#comment41093099_26195101 "[Using the DNS name as the common name is] deprecated by both the IETF and CA/B Forums, and it should not be done. ...
1
vote
0answers
103 views

Are Hyper-V Memory Snapshots secure/encrypted?

When dealing with encryption tools (TrueCrypt, Bitlocker and any successors) the passwords are always somewhere in memory. Therefore when there are memory dumps on a hard disk, for example in the ...
1
vote
2answers
175 views

With RSA, can one ensure that two entities will not have the same private key?

With the RSA encryption algorithm, is there any guarantee that two different entities will not be given the same private keys?
1
vote
2answers
96 views

Reconnaissance countermeasures

I have a lot of XMAS/NULL/SYN packets (+-1000 packets/day/server) from same IPs (+-120 differents IPs from anywhere) on multiple servers. Logs and firewalls are checked daily and servers are updated. ...
0
votes
1answer
99 views

How would one go about setting up a system with security in mind? [closed]

I run a standard laptop at home (dual-boot Fedora 20 and Windows 7; the Windows side is almost never used). Soon my other computer will be working again; it will have Windows 8.1 and some flavor of ...
2
votes
2answers
87 views

Securing commands

For a project I'm working on, I need to securely send commands between servers. These commands should not be able to be altered, and there should be some security about not being able to just keep ...
4
votes
1answer
337 views

How is Cross Site Flashing performed?

I read about cross site flashing in the OWASP testing guide. I know the difference between XSS and XSF. But what I am looking for is how attackers perform a XSF attack. How is it possible since there ...
1
vote
0answers
103 views

Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
3
votes
1answer
502 views

Shellshock and PHP fastcgi

I understand that running apache/mod_php is safe, but I havn't heard about the case of running php in fastcgi mode (via nginx/php5-fpm), so, anyone can confirm this is also safe?
0
votes
1answer
81 views

Pivoting through XSS

I'll start off by saying this is a purely academic question; I'm trying to fill some gaps in my knowledge. If a website is vulnerable to XSS, and the target host is another machine that can browse to ...
2
votes
1answer
114 views

How can I compute the value of the ASP.NET forms authentication cookie?

How can I compute the value of the ASP.NET forms authentication cookie?
0
votes
1answer
182 views

Is OWASP ESAPI .NET Edition really used? Is this project still alive?

I have just seen that the last release has been pushed out in 2009 and that raised my doubts.
1
vote
1answer
566 views

Know certificate signing algorithm of a remote site using OpenSSL

I have been trying to know the "Certificate Signing Algorithm" ( SHA1 with RSA etc.) using openssl. To start with I tried to see the cerificate using following command, but it also does not show up ...
2
votes
1answer
532 views

MVC 5 and Multiple AntiForgeryTokens: What is happening?

I have a simple login form. In it, I put an AntiForegeryToken. @using (Html.BeginForm("Login", "Account")) { @Html.AntiForgeryToken() <p> <label>Email</label> ...
1
vote
2answers
367 views

How to implement password reset functionality without becoming susceptible to cross-domain referer leakage?

I have typically implemented password reset functionality by sending a link that included something like this: http://example.com/pwreset?id=userId&resetToken=superSecretResetToken On my pwreset ...

15 30 50 per page