0
votes
0answers
33 views

Does using (dot) instead of . or (at) isntead of @ really give any protection for addresses not getting harvested? [duplicate]

After reading this post: http://academia.stackexchange.com/q/55612/34428 I asked my self, is this really the deal about it? I mean... It just looks stupid in my eyes that one is expecting a ...
2
votes
1answer
97 views

TLS Session Tickets: What is the risk of a disclosed server ticket key?

So there is this TLS Session resumption method using Session Tickets which transfers the TLS server secret state to the client (encrypted and authenticated with a key only known to the server) If a ...
3
votes
1answer
337 views

what order does the incremental mode of john the ripper, brute force passwords in?

I am practicing reversing md5 hashed passwords using John the Riper and was curious about some behaviour. I added the md5 hash of zaa to the top of the file with the hashes and when I ran john ...
-4
votes
1answer
171 views

is there any playground for brute force? [closed]

Is there a site where i can make an account and run my brute forcer to check it for infinite attempts? Something which does a HTTP request and no javascript submit.
1
vote
1answer
73 views

Protecting users with browser extension. Is it possible, if the machine is already infected?

Assume a trojan acquired admin privilege on a Windows 7 machine. How easy is it for the trojan to replace/hijack/modify a browser extension without user knowing it? Is it possible? I am thinking of ...
0
votes
1answer
119 views

x.690 universal class tags implementation reference

Can anyone with enough knowledge of X.690 tell me where can I find the official reference implementation for the universal class tags for X.690. (For example: For TLS we can reference RFC 5246.) When ...
0
votes
3answers
243 views

How can i prevent my phone from spying through sms

Recently while reading up a article over here ,The following were the summary : hacking suite dubbed Smurf Suite, it can hack any mobile by sending an encrypted text message So based on the ...
2
votes
3answers
171 views

Is it possible for a web page to log your keystrokes?

Is it possible to have a web page in Chrome open, and it can run a web app of sorts on the webpage, and have that web page log your keystrokes?
1
vote
1answer
201 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
0
votes
0answers
53 views

Encrypt a file before being copied

I am working on a program that will prevent data theft. I want to encrypt every file that is being copied to an external drive before it is actually copied using a symmetric encryption. Is it ...
1
vote
1answer
97 views

(Theoretically) intercepting GCHQ's smartphone exploit

In the lastest Snowden interview, it was revealed that GCHQ used an exploit sent via SMS to gain access to smartphones, and that this 'exploit' goes unnoticed to the handset user. I was wondering if ...
1
vote
1answer
68 views

Encryption strategies for multi users access revisited

This is a follow up to this post: Encryption strategies for multi users access in production systems I don't see how this can work given the second bullet point: Kc is stored on the computer n ...
1
vote
0answers
159 views

Best way to implement secure client/server communication in Python

For a college programming assignment I have to implement a secure communication protocol between a server and one or more clients. Upon instantiation of the server program, a file is generated, call ...
-1
votes
2answers
62 views

Prevent fake gateway device attached to PC's network card

Office. Several PCs with Linux. Internet is limited on gateway level, so nobody could do POST-requests over HTTP. We prepared several measures to prevent data leakage on infrastructure level, but ...
2
votes
2answers
77 views

Isn't ssh-copy-id exposing to a brute force attack?

It is a common knowledge, that using keys to authenticate ssh users is more secure than using passwords. However, even with password login disabled, when running ssh-copy-id I am still asked for user'...
-1
votes
2answers
242 views

Things to look for a backdoor in web application source code (.PHP, .JS, etc files) [closed]

I am in the process of adding functionality to a web application and I will be receiving some source files (PHP, JS, and CSS) from a hired external developer. These files are not obfuscated or ...
3
votes
3answers
317 views

What does a switch do against a packet sniffing attack?

I have heard that using switches in my network helps prevent against a packet sniffing attack but how does it help prevent the attack?
4
votes
3answers
397 views

Is gzipping content via TLS allowed?

So I have these few compression directives at http level in nginx: gzip on; gzip_http_version 1.1; gzip_vary on; I read that this should be avoided because of CRIME/BREACH attack, is this correct?
4
votes
2answers
400 views

How should I block unwanted domain names? [duplicate]

I have noticed that someone pointed his domain to my dedicated IP address and now my website can be viewed using his domain name @ example.com . This can hurt my SE Traffic and SEO in many ways. How ...
2
votes
0answers
290 views

NXP NTAG 21x/Desfire password protection and Original signature, protects against cloning?

Hi i saw a few threads about NFC NTAG against cloning and NTAG Desfire , i just want to find out if NTAG 21x with their "New" password protection and "Original Signature against cloning" really does ...
1
vote
1answer
90 views

DHCP Exhaustiation / Rogue DHCP interrupted by real DHCP NACK

I was trying to run a Rogue DHCP Server which should cause a MITM attack. I did the following Exhaust the real DHCP Server using DHCPig (worked) Run a Rogue DHCP Server using the auxiliary/server/...
2
votes
2answers
396 views

password grant without client secret?

I'm struggling to decide what to do to get an access token from a mobile app. I'm sure this has been covered before, but I can't find it. I've enabled resource owner credentials grant on my oauth2 ...
3
votes
1answer
40 views

Systematic exploitation of software components [closed]

My question is rather generic. People are likely to downvote the question and admins will be tempted to close it at off-topic etc. But, I couldn't help myself asking the question to seek some fruitful ...
2
votes
2answers
80 views

Could PKE be used as a better alternative to SRP for authentication?

If I understood SRP correctly, its weakpoint is during the registration of a user when sending the verifier to the server. Let's say the Server knows the PubKey(User) of the User and the User knows ...
4
votes
1answer
291 views

OpenSSL 0.9.6a PRNG algorithm weakness: How to exploit?

I saw an OpenSSL security advisory for Openssl 0.9.6a Recently a cryptographic flaw in OpenSSL's built-in pseudo-random number generator (PRNG) was pointed out to us by Markku-Juhani O. Saarinen , ...
1
vote
1answer
192 views

C# LDAP Injection

Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor? For example: DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
2
votes
1answer
205 views

Explanation of the XTS Encryption Mode

I've found many information about operation modes such as ECB, CBC, CTR, OFB and CFB. These modes are described precisely, but I'm not able to find information about XTS. The Wiki article is the only ...
0
votes
0answers
34 views

Operability as a usability characteristic

ISO 25023 standard decomposed usability into six characteristics, one of which is operability which is further decomposed into operational consistency. Can anyone explain to me what does operational ...
2
votes
1answer
86 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
1
vote
2answers
93 views

preventing reflection attack

I was reading the solution to the reflection attack and have some confusion as to how Alice would know Bob is a liar and isn't really Bob. 1. Alice initiates a connection to Bob 2. Bob challenges ...
-4
votes
2answers
102 views

What's the best way for remote desktop control (100m away)? [closed]

I have two desktop computers with one located far away from the other. I want to use remote desktop control on pc1 to watch videos from pc2. Currently I use teamviewer via LAN(wifi), but it is ...
0
votes
2answers
179 views

Question - “D3 (js) allows you to bind arbitrary data to a DOM”

I have a security-related question with regards to d3.js D3.js essentially allows data to drive dynamic charts etc, among other features. The "d3js.org" landing page mentions "D3 (js) allows you to ...
0
votes
0answers
122 views

Appropriate uses for wildcard certificates

I have a client that wants to use a single Wildcard certificate purchased from a third party CA for the purpose of Server Authentication when connecting to and from AD LDS using SSL and for routing ...
-4
votes
1answer
107 views

Will Kaspersky or BitDefender work on Hyper-V? [closed]

In case if I decide to test them or just don't want install them on a physical machine. I mean usual versions of antiviruses, not specially designed for virtual machines. Also interesting if I can ...
4
votes
2answers
9k views

SSL3 error when requesting connection using TLS 1.2

I've come across several hosts that throw SSL3 handshake errors even though I explicitly request TLS 1.2. Why is this? Am I using the openssl client wrong? $ openssl s_client -tls1_2 -connect i-d-...
2
votes
3answers
80 views

Is it possible to change code of website through an embedded image [duplicate]

say I allow my users to embed images that others can view, then the user rewrites the image to be a PHP file for instance. Would that pose a security risk of him injecting something into my code?
8
votes
4answers
332 views

School's computers auto-login and can run .exe's

Before this semester, to use any computer across campus, you had to log into Windows with a username and password. This semester, when the computers start up they auto-login to an account (with let'...
3
votes
3answers
1k views

TCP versus UDP resilience to DDoS

I am building a service that I can implement equally well with either TCP or UDP. If I use TCP, I expose vulnerability to SYN flood and other attacks on TCP protocol. If I use UDP, it will be harder ...
1
vote
1answer
91 views

Is originating number tied to an SMS from a mobile phone?

I've been working with an SDR (software-defined radio) as part of a computer security class project. We've been wondering if, let's say a mobile phone associates with the SDR (which is operating as a ...
11
votes
4answers
433 views

External Vulnerability Scan of DMZ

We currently have an internal and external vulnerability scanner setup in my organization. This morning our external scanner was going through a new external DDoS protection service instead of ...
1
vote
1answer
45 views

Trying to get a grasp of approximate risk level of CMS admin logins over http

Forgive me for a potentially obvious question--and I know the safe answer is "Always use https!"--but I'm trying to get a grasp on how necessary it is to use https for anyone accessing the backend on ...
2
votes
1answer
181 views

What is the entropy of a password made with pwgen?

pwgen is a unix utility that generates "memorable" passwords randomly. The man page says the entropy is lower than truly random passwords with the same specification. What is the actual entropy of a ...
0
votes
1answer
33 views

PGP Key Servers Verification Mail? [duplicate]

Why do existing PGP key servers not perform e-mail verification? Wouldn't it help the problem of authenticating of public keys? By e-mail verification/confirmation I mean a single e-mail sent to the ...
2
votes
4answers
91 views

PCI-DSS 3 SAQ - uncertain of level

We are having a debate internally about which SAQ we need to fill in for PCI - our QSA questionnaire says D (and I tend to agree) but company director says SAQ C from reading the guidelines. The way ...
2
votes
2answers
136 views

Best hash for indexing and searching encrypted data

I would like to be able to do database look-ups on a set of data based on one of the encrypted fields. My understanding of the best practice for accomplishing this is to store a hash of the data I ...
4
votes
2answers
697 views

Smart cards for user authentication - is configuration of PIN complexity important?

In our company domain we are now able to login to Windows using a smart card plus a 4 digit numeric PIN. The same smart card is used to sign e-mails too. My understanding is that authentication to ...
1
vote
1answer
145 views

Using dnscrypt on a public hotspot with a captive portal

What strategy shall I take if I wanted to use a dnscrypt with a public hotspot that requires login through a captive portal? Such hotspots require DNS settings to point to their servers (via DHCP) so ...
5
votes
3answers
201 views

Best practice for home router configuration

Having read about the large number of routers infected by Wifatch, I've realised I don't know how to check whether my router has been infected with this or more malicious malware or what I'd do about ...
0
votes
2answers
119 views

Forensics live data collection

The SANS institute recommends to perform a RAM image before trying to collect data from live systems (SANS Link). I'm also following an online training where the trainer collects live data (processes ...
5
votes
4answers
133 views

How does a CSRF logout pose a potential threat to a website?

Websites like SuperLogout logs the user out from several websites at one go. I want to know in what way does this pose a potential threat to the users of the website? How can this be combined with a ...

15 30 50 per page