3
votes
2answers
181 views

How do credit cards with chip+pin securely allow recurring transactions?

In Europe most cards use a chip+pin system to secure the card information. You put the card in te machine and enter a PIN number to decrypt the card information which is stored on the chip. ...
4
votes
8answers
375 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
3
votes
3answers
460 views

“Web of trust” for self-signed SSL certificates?

SSL certificates, generally speaking, use a "chain of trust" model - a trusted certificate authority (CA) gets proof that a company such as Amazon owns amazon.com and issues an SSL certificate. ...
1
vote
0answers
106 views

Allowing third-party clients to authenticate with an app server

I'm working on an app that is planned to be licensed to OEMs, who would in turn offer it as a service to their users.  We would host the app server and the OEM would optionally host the app's web ...
0
votes
1answer
280 views

what type of attack does LOIC do? [closed]

I have used LOIC (Low Orbit Ion Cannon) earlier . Today i was reading on wikipedia that there are many types of dos attacks , namely SYN attacks , HTTP flooding ,UDP flooding ,etc and two questions ...
0
votes
3answers
172 views

Has personal computing security gotten better or worse in recent years? [closed]

I have a lot of experience with software as a developer, and am trying to move from newbie to more informed about present-day security. Everything I uncover makes me feel that personal computers have ...
3
votes
1answer
174 views

Access rights management in large companies

I'm wondering how large companies with tens / hundred of applications are handling access-rights for their users. From what I've seen, it's a nightmare that never ends, and it requires full-time ...
1
vote
2answers
213 views

Are Internet Explorers “Tracking Protection” able to prevent AddThis canvas fingerprinting?

A paper on web tracking mechanisms identifies the web-tracking company AddThis as a major user of canvas fingerprinting. Are IE:s Tracking Protection, provided Tracking Protection Lists including ...
-1
votes
3answers
144 views

Help me catch someone red handed on our server.

I first tried to log in this morning and our password was changed on our ubuntu server. I contacted our server support and they told me that I had just been fat fingering the password. I thought it ...
21
votes
3answers
2k views

How is Google Chrome managing authentication to sites?

In Chrome, every tab is its own process. Yet, logging in to a site, say, Facebook, persists across tabs. For that matter, in many cases, it persists across OS reboots. This seems inherently very very ...
-1
votes
1answer
564 views

Open list of adult websites for child internet [closed]

Looking for any open and dynamic list(blacklist) of adult,dangerous,+18,sucide,drugs etc web resources to filter it in intranet for children security in internet
-1
votes
1answer
1k views

Someone borrowed my phone and Im scared its hacked [closed]

I am from Australia and I use a iPhone 4. Today, a young guy asked to borrow my phone, since he was out of credit and since I was trying to be a good samaritan, let him borrow my phone (also we were ...
15
votes
3answers
2k views

Can anyone recognise this sudden influx of malformed HTTP requests?

Starting around 3 weeks ago, my site started getting a lot of strange and recurring http requests from my users. I'm familiar with malicious scans which happen on a daily basis, but these requests ...
-1
votes
3answers
91 views

Can I safely use my own statistics to assess password strength on number of times a password is used?

Lets assume I want to give my hypothetic 10mio users userbase a good feedback on their password strength. Besides the classical entropy tests and top500 list of bad passwords, I might want it to be ...
0
votes
1answer
94 views

I store my passwordstore.org data in the cloud. Are my passwords safe?

I use pass to manage my passwords and sync this manually to a private git repo in the cloud. I believe this is safe because the repo is not public and, more importantly, the data is GPG encrypted. ...
3
votes
1answer
103 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is ...
2
votes
2answers
155 views

Get the browser history without using a browser

I would like to get the browsing history of a computer in my network (without running that web browser), is it possible?
0
votes
1answer
126 views

Makecab.exe at boot. is it malicious?

, I am trying to find out why this process appeared during 2 boot occasions. Autoruns does not show it anywhere. It appeared when I uninstalled google chrome and malwarebytes. The prefetch file for ...
0
votes
2answers
115 views

Is Pentesting now all about running Tools? [duplicate]

is Pentesting now just about running tools like Nessus and creating a report based on it ? and not actually exploiting anything on your own based on the Agreement ?
1
vote
2answers
518 views

HTTP Authentication with bcrypt done right

I have an android app that connects to a server through HTTP (notice the abscence of S, also android means Java, so nothing I'll hardcode in my app will be unreachable). I want to store the password ...
0
votes
1answer
118 views

how can i bypass close_notify in ssl in firefox? [closed]

i am trying to login to my yahoo mail, but no avail. i recently discovered after monitoring some traffic that the dumb yahoo server doesn't send a close_notify response but just acts ignorantly and ...
0
votes
2answers
140 views

Blocking access to social media on Windows

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something ...
0
votes
3answers
150 views

is it possible to upload infected pictures to a website?

I have a small website on which users can upload several types of files: images, zip files ... (except .exe files). Suppose a user uploads via the front end interface of my website a picture which is ...
-2
votes
1answer
80 views

protect files on webserver, allow only internal use

I have a website and it has an audio player to play music files, the music files are hosted in a public directory. Since they are they anyome can point there and use the files on their website. Is ...
29
votes
2answers
3k views

If I sign someone else's key and later decide it was a bad idea, is it possible to un-sign it?

Let's say that I sign someone's key and then later decide that was a bad idea - either it was a bad idea at all, or I should have signed it with a different level of trust. Is it possible, both in a ...
2
votes
3answers
120 views

Concerned with Tails vulnerabilities

Regarding this: http://www.forbes.com/sites/thomasbrewster/2014/07/21/exploit-dealer-snowdens-favourite-os-tails-has-zero-day-vulnerabilities-lurking-inside/ Apparently, even the version of Tails ...
1
vote
1answer
312 views

Is it safe to expose MongoDB ObjectID to users (e.g. in URI)?

I'm developing a RESTful API using MongoDB as the backend. The easiest thing to do programmatically would be to simply use MongoDB's _id field in the URI, such as: ...
1
vote
2answers
65 views

Sign contents of entire computer?

If I travel abroad and am concerned that when I land in the foreign country they may try to install a digital keylogger, does this work as a potential solution: If I sign my entire computer's hard ...
0
votes
1answer
115 views

What Linux software can I use to explore entropy of a file?

I've heard of tools that could be used to graph entropy of a file. Is there a graphical Linux program that I could use for this job that would let me conveniently explore which blocks of a file have ...
0
votes
1answer
67 views

Identifying stream cipher algorithm based on encrypted content

Is it possible to identify the algorithm used for the stream cipher based upon analysis of an encrypted stream?
5
votes
0answers
75 views

What's stopping DANE? [closed]

As I understand it, DANE (RFC 6698) is a promising candidate for addressing issues with current TLS Trust Anchors (i.e. Trust Anchors). My attempt at explaining the issue: Currently, CAs are ...
1
vote
1answer
61 views

Preventing tracking in browsers by setting HOME directory

Following worked on Ubuntu 12.04 using chromium and firefox browsers. I ran following command on terminal for both firefox and chromium browser HOME=/tmp/tmpdir firefox Both browsers promptly ...
0
votes
2answers
107 views

Broadband security question

I have a fixed line broadband connection at home. This morning when I tried accessing Google or Facebook through my browser (Google Chrome) I got a webpage asking me to update my flash player. I found ...
1
vote
1answer
216 views

Etterfilter file-contents injection

On the etterfilter(8) man page, there is a section about the inject() function, which takes the contents of a file and injects it in a packet, or as its own packet when coupled with drop(): ...
0
votes
1answer
529 views

PDF Digital Signature [closed]

I got free certificate from Comodo and installed on my Windows. Now I'm trying to sign PDF document using this certificate, but get message: "signature validity is unknown": Why is this? How I can ...
2
votes
4answers
563 views

Does the SSL termination happen with the ISP or a mobile service provider? [duplicate]

Is it true that when I connect to a site over HTTPS , my mobile service provider or the ISP gets to snoop in the communication? Can they play MITM?
1
vote
3answers
2k views

How to tell if my laptop is being spied on

I've been trying to determine if there is malware on my OS X 10.9.3 Mac, that is could be doing keylogging or other forms of non-destructive intrusion. Given the (not technically based) suspicion I ...
1
vote
2answers
64 views

CLI API that requires plaintext user details

I've been tasked with writing a module for my company to interface with an external api. This api has a syntax similar to ssh where I have to incorporate the user details as well as the host address ...
1
vote
2answers
239 views

Identifying suspicious encrypted traffic [duplicate]

Firstly, I welcome a better title for this question. I admit I'm a security novice. I'm trying to determine whether I have malware and what that malware may be doing. Using Wireshark, I see several ...
1
vote
1answer
2k views

Web app with iframe and user - how to deal with session?

We have application which will be in iframe. Partner sites can use our application - put iframe in their sites. Partner site has users with money, who will use our application in iframe to buy items. ...
2
votes
1answer
86 views

Is there any difference for OS fingerprint technique used in Nmap inside -A and -O?

Is there any difference between the technique or algorithm used from Nmap to guess the OS between the option -A and -O? If not, why -O option requires root privileges but -A that it is doing at least ...
0
votes
1answer
110 views

Designing and implementing a secure epayments system with RESTful API

I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few ...
0
votes
1answer
124 views

Windows - Revoked Binaries

I find it hard to believe that the majority of Windows system files aren't signed. I don't know whether my disbelief comes from naivety, or because Windows is used within secure environments worldwide ...
-1
votes
2answers
176 views

Content sniffing XSS attack?

As a part of work, I've come across content sniffing, and i understand web apps can be vulnerable to xss because of it. There is another post, regarding content sniffing and xss, but didnt quite ...
2
votes
1answer
58 views

Browser - what gets saved to the disk

We run scraping jobs on behalf of users. We use webkit-gtk as browser to do the scraping. Each job is executed as a separate process So as not to mix user data we have isolated following data per ...
5
votes
2answers
206 views

Security sanity check

A company whose services I'm trying to integrate uses this protocol: An AES key is embedded in an Android library. To authenticate itself, the library sends a SHA1 hash of the key over plain HTTP. ...
1
vote
2answers
201 views

What Can I Do While I'm Waiting for “Chip and Pin” Credit Cards?

For the second time in 8 weeks, one of my American Express (AMEX) card numbers was stolen. I do use the card online, but only at reputable (and SSL/TLS enabled sites). I use it in the real world, ...
2
votes
1answer
119 views

Would it be possible to add additional files to a password protected zip 2.0 file

So the scenario is this: I don't have the ability to determine/recover the master password for a production system that uses zip 2 archives. However, I need to be able to add new files to existing ...
0
votes
1answer
59 views

Is encrypting and subsequently sending a known clearext string after a Diffie-Hellman bad design?

I'm writing a small protocol that relies on a DH handshake, generation of a shared secret, and subsequent AES encryption/decryption using that generated secret. I want to add a built-in test message ...
2
votes
2answers
150 views

What problem does ECC seek to fix compared to RSA?

Elliptical Curve Cryptography (ECC) is one of the newest encryption schemes to challenge RSA cryptography. What problem does ECC seek to fix compared to RSA? Would you have any qualms with using ECC ...

15 30 50 per page