0
votes
2answers
164 views

Can someone scan a website from a remote address and steal users login information?

Suppose I have a website such as www.myforum.mysite.com, can an attacker sit down and listen to or scan my forum and get everyones username and password when they try to log in to my forum or site? ...
6
votes
1answer
261 views

Google Chrome & Spear-phishing

I've been trying to find some information on how Google Chrome detects phishing pages that are not already in their blacklists. The most relevant information that I've found from Google itself, ...
3
votes
3answers
600 views

Strange GET requests to my Apache Web Server?

A few days ago, my Apache web server was hit with get requests, many of which had strange escape sequences. Can someone read the following sample log entries and explain what the person tried to do, ...
2
votes
4answers
234 views

Should both user ID and Password be masked for online banking?

Is there a best practice for security purposes requiring masking of both User ID and Password for online banking? Is there any rationale for or against masking both?
19
votes
1answer
513 views

CSS based attacks

I'm currently working on a plugin for a CMS which should allow content editors to write inline style tags. I'm looking for advice / links on how inline styles could be abused. Part of the reason ...
3
votes
2answers
105 views

How to ensure two messages are from the same party

I need to verify that two messages, that came over distinct channels, come from the same origin: without knowing anything about the origin beforehand the channels are one-way, only one message may ...
1
vote
1answer
137 views

Is there a known vetted alternative to this key-exchange protocol?

I have three participants: A client A in possession of the public key Kpub A login server S in possession of the private key Kpriv Game servers B (B1, B2 etc) S and all B may share a finite number ...
1
vote
1answer
73 views

How to protect integrity of resource files in a white-box attack context?

In a white-box attack context (e.g. PC, tablet, smartphone), there is no trusted entity, which can be used to guarantee some reasonable security. TPM is not considered a solution because it is not ...
16
votes
2answers
1k views

Hosting an “IP Rental” address. Is this common, safe?

I have a supposed opportunity to get in with an individual with advertising and a side business of his, renting IP addresses. He has asked me to set a dedicated DSL account at my house. Is there any ...
16
votes
4answers
4k views

Why use OpenID Connect instead of plain OAuth?

I just started to use OAuth 2.0 as a way to authenticate my users. It works great - I just use the identity/profile API of each provider to get a validated email address of the user. Now I read about ...
6
votes
2answers
522 views

Why do embedded systems store server's public certificate in ROM?

In the home automation scenario, smart gateway can bridge the many smart devices with Internet. In many cases, a server's public certificate is stored in the embedded system's ROM during ...
1
vote
1answer
84 views

VM Guest network security with NAT?

Supposing I have an untrusted guest VM (e.g. I'm running a cloud data centre). If I set the network connection up to use NAT, the guest can still access the internet. But what's to stop them accessing ...
1
vote
2answers
183 views

How should I diagnose a macintosh laptop running OS X Lion 10.7.5 automatically booting at 12:00:09 sharp every night?

Using the "Console" app within OS X and viewing the "syslog" file I can see the user shutdown their laptop (it was a HALT operation) around 10:22PM. For some reason, 9 seconds after midnight ...
3
votes
2answers
520 views

Can unencrypted email be read or altered while it is in transit?

If email is not secure while in transit, exactly how can it be read by unintended parties? Can an attacker read SMTP traffic while it is between the sender and recipient?
2
votes
1answer
146 views

Where can I find resources to help me implement a key server?

I would like to implement a fairly basic but nonetheless robust key server for generating and managing symmetric encryption keys. Are there guidelines or best practices out there that I should peruse? ...
5
votes
2answers
455 views

Why are signatures considered a valid authentication method?

Why are signatures considered valid methods if identification when paying with a check or credit card? For that matter, what do those credit card readers do with my signature when I sign them? Are ...
3
votes
6answers
181 views

Should user IDs be implemented in online banking?

How common is it for a bank to request you to make a user ID as well as password when banking? Should they simply use a pre-determined number such as your credit-card, or are there advantages to have ...
14
votes
2answers
2k views

How does non-ephemeral Diffie-Hellman key exchange become compromised in SSL when the RSA private key is leaked?

From my understanding, one of the major reasons we recommend Diffie-Hellman Ephemeral (e.g. DHE or ECDHE) over non-ephemeral DH, for SSL / TLS, is that compromise of the RSA private key (i.e. private ...
2
votes
4answers
1k views

What can and can't a malicious DNS do?

I have been thinking of using http://tunlr.net/ for accessing "geo-IP banned websites" like netflix. However, I have my concerns about safety of using some third party DNS server for everything. So, ...
3
votes
3answers
272 views

Best security practices for software development and release?

I am trying to figure out a way to limit access and also to establish processes to avoid any and all of my team members to compromise our entire production system. We have a team of 10 developers, 1 ...
4
votes
2answers
351 views

Is there a risk in sending the username in a password reset email?

We're using a CMS that has a password reset function that works according to best practices out of the box. Passwords are stored as salted hashes Forgot Password works like this: User enters ...
2
votes
3answers
1k views

Have the police placed a bug on my line [closed]

As a pretty dedicated anarchist, rule-breaker and malcontent, I often find myself at odds with the British police. I have been the subject of 3 searches (that I know of) over the last 8 months ...
1
vote
1answer
305 views

How do I secure my network with an open wifi?

I have a business with an open Wifi router for my customers, I was wondering if I put the wifi router on a different subnet would help protect my wired network?
2
votes
2answers
242 views

Can you protect corporate email on personal phones without the option of wiping all personal data?

Our company recently announced a new IT policy that requires encryption of any personal smartphone used to connect to the corporate Exchange server. As far as I can tell, they're using Exchange ...
2
votes
1answer
698 views

Possible to safely send money via Paypal on public wifi networks?

I will be away for 1 month and during that time period I will have Internet access only via public wifi networks. I tried finding on the net tutorial on how to safely access and handle paypal ...
4
votes
1answer
2k views

Credit card data security - hashing, truncation and encryption

A question with a similar title has been asked before, but it doesn't answer my specific question here. PCI DSS permits storage of truncated and encrypted data, or hashed and encrypted data. It ...
8
votes
2answers
6k views

Safety of publishing last 4 credit card digits in age of fast computing?

How safe is it to make public the last four digits of a credit card? Credit card numbers have a specific format. Digits tell you what type of institution issued the card, what bank issued the card, ...
4
votes
4answers
1k views

Does a commercially available self destructing HDD (set in BIOS) exist?

Does a self destructing HDD (physically destruction) that will destroy after a certain time exist, or when I use some software to initiate its self-destruction? I guess it need to be set in BIOS or ...
2
votes
3answers
4k views

No single quotes is allowed, Is this SQL Injection point still exploitable?

The SQL phrase looks like this, "SELECT * from XX where id = '" + id + "'" The id variable comes directly from the GET parameter named id. And the Java web app explicitly disallowed single quote. ...
2
votes
1answer
210 views

Why isn't TLS just called SSL v 4.0?

SSL and TLS seem to be somewhat interchangeable. So much so that they are generally lumped together ("SSL/TLS") when referring to HTTPS and other services. Its almost as if TLS is version 4.0 of SSL. ...
2
votes
1answer
229 views

API authentication without Oauth2 server

I have an API that needs user authentication. It is the same way Google authenticates when you use their API to access user data. I really don't want to setup an oauth2 server and I want user to login ...
2
votes
1answer
248 views

How to manage passwords in a multi-tenant surrounding?

I am building a multi-tenant application in a shared database model. I would like to encrypt sensitive data so that only a particular tenant could have access to his data. What is the best mode to ...
3
votes
2answers
230 views

How can I create a secure password?

I know the standard tricks, create a long password, numbers, symbols, capital letters, etc. My questions is how do I judge password security. I heard different tricks to make secure passwords. For ...
0
votes
1answer
556 views

Man-in-the-middle attack over an encrypted channel

I learned recently about man-in-the-middle attacks and came up with this question. Let's say we have two computers who try to communicate over the network. Each computer has an encryptor and a ...
-1
votes
1answer
893 views

personal studies to become a security expert [closed]

I'm a little late, I'm 21 always been interested in IT and this past year I've looked here and there for computer security, but I don't have a diploma. I never had any idea on what to do in my life ...
2
votes
2answers
138 views

If a user visited a malicious website a year ago, should we nuke from orbit to be safe?

A Microsoft Security Essentials virus scan just finished on one of our computers and it shows two potential threats in Internet Explorer's temporary internet files: Web page with Black Hole Exploit ...
3
votes
1answer
277 views

Auditing, accounting, logging, and accountability… What's the difference?

Let's first look at the book Microsoft Windows Security Essentials: ... the three As (AAA) of security: authentication, authorization, and accounting ... they combine to contribute to reliable ...
0
votes
1answer
207 views

How does does the “Sign out all other sessions” feature work in Gmail?

In Gmail, at the bottom of the screen if you click Details it will show you your recent account activity and there's a button to sign you out of all other sessions. How does this work? Are they ...
0
votes
0answers
629 views

Is it safe to connect mobile devices to rental cars? [duplicate]

Many modern cars feature Bluetooth connections and USB ports that allow passengers to connect them with mobile phones and digital music players (and smartphones, which serve as both). Is it safe to ...
22
votes
9answers
3k views

Is encryption in HTTPS done by the browser or by the system?

This may be a common sense question, but I am not able to find any documentation on this after searching on google for a long time When browser makes a HTTPs request, does it encrypt the data then ...
4
votes
2answers
100 views

How to be sure content was generated on a specific software?

I am developing an open source software. This software generates content that is sent to a server for publishing. Anyone can get this software and generate content. The API for publishing at the ...
6
votes
1answer
138 views

How to encourage responsible disclosure (and react appropriately otherwise)

As a conscientious programmer, I put security as one of the core requirements of every product I develop. To prevent flaws from being introduced, I promote a culture of awareness (e.g. make sure that ...
18
votes
2answers
11k views

Disabling/Destroying CCTV/IP Cameras with Lasers?

@D3C4FF has asked a great question and I would like to follow up on that. Basically he had asked whether "[...] an attacker can identify if a CCTV camera is on/operational without direct physical ...
1
vote
2answers
525 views

Asynchronous vs. Synchronous authentication process

I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database). I'm at the stage where I have to design the authentication and I had a question about ...
-2
votes
1answer
629 views

LophtCrack version 6.0.12 is not auditing my Administrator password [closed]

I am using LophtCrack on my Windows 8 OS. I was testing my password strength and the problem I am seeing it is not working. It doesn't reveal my Admin password, I've run the process for half an hour. ...
25
votes
2answers
6k views

Is there any way to tell if CCTV is on or not?

Is there any way that an attacker can identify if a CCTV camera is on/operational without direct physical access to the cable/camera? If it is on, is there any way an attacker can tell if its being ...
2
votes
2answers
759 views

Allowing user to access password protected website without disclosing the password

A friend of mine has the following problem. She is an accountant and her clients frequently give her their login credentials so she could download their accounting data from various financial ...
6
votes
3answers
344 views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
-1
votes
1answer
215 views

After salting my passwords, are they protected against dictionary attacks? [duplicate]

I use sha1() to hash my users passwords, but recently a friend told me that if someone get the hash then they could use dictionary attack and he recommended using salts. I implemented a random salt ...
1
vote
1answer
3k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed ...

15 30 50 per page