0
votes
1answer
136 views

Is image meta-data copied when taking an iPhone Screenshot?

If a photo is taken using an iPhone, the image file can carry date, time and location information. If this original image is then screen shot, would this original information be copied with the screen ...
13
votes
2answers
2k views

Onion routing vs crowds

I have been studying about computer security and at some point i came across the terms of onion routing and crowds. From what i have understood they are very similar in their usage (interchangeable). ...
1
vote
2answers
558 views

Token-based authentication - what's a good token length?

What's a good token character length for a token-based login? Currently I'm using the following code: <?php $token = bin2hex(openssl_random_pseudo_bytes(16)); Is 16 sufficient or should ...
3
votes
2answers
102 views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

I need to discuss how to mitigate the risk of services which are vulnerable despite being patched (typically because they are not maintained by the vendor anymore, or because the vendor does not want ...
3
votes
1answer
64 views

How to evaluate the security level of session ID generation?

For a few weeks we observed a collision in session ID generation, resulting in two operators independently connected to a test web application sharing the same session. We investigated the issue and ...
4
votes
1answer
177 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
0
votes
0answers
37 views

How can LPWA get implemented

I have been reading about computer security and at a point it mentioned Lucent Personalized Web Assistant (LPWA). Though I think I understood what it can offer, it doesn't say anywhere how/if a user ...
1
vote
2answers
221 views

Should I update my SHA-1 certificates? If so, how?

Q: Should I update my SHA-1 certificates? If so, how? Recently I noticed the "https:" has a red strike-through and warning in Chrome, but only on certain websites. Apparently this has been ...
1
vote
1answer
80 views

What kind of attacks do Javascript WebWorkers protect against?

What kind of attack are prevented by running code submitted by the user in a Javascript Web Worker? Do they prevent attacks like XSS, or is it better to use some other sandboxing method to protect ...
4
votes
2answers
292 views

Comparing the 2FA Vendors

If we need to choose a vendor for the 2FA in our environment, what are the features that we should look for? Our selection process depends on the functionality and usability they provide. But when I ...
1
vote
3answers
304 views

Large amount of foreign IPs hitting out firewall, is this automated scans or are we under attack?

I just got put in charge of a network. In the logs on our firewall I noticed that we had a large amounts of machines trying to connect to port 53 as well as about a dozen other ports. Are these ...
1
vote
2answers
245 views

Is HTTPS required when there's no sensitive data in the site

I'm currently building a B2B e-commerce site for a client using WordPress. We sell industrial machinery ranging in the upper $100k-$400k price range. My client would like to have their financing form ...
3
votes
1answer
156 views

How bad an idea is intentionally using short RSA keys for signing CloudFront private-content URLs?

While pondering a question on SO about efficiently generating signed private-content URLs for CloudFront I decided to check what sorts of savings could be found by using a shorter RSA key. With the ...
1
vote
2answers
119 views

Could I ever be legally required to decrpyt user information? [closed]

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal ...
3
votes
1answer
95 views

String Comparison Timing Attack in Plain English

Could someone please tell me what a string comparison timing attack is in simple terms? I have Googled this, but all the explanations are very technical. Also, is this attack an better than a brute ...
6
votes
2answers
187 views

Questions regarding Rakshasa

Regarding Jonathan Brossard's Hardware Backdooring is practical talk at Def Con 20 in 2012: What does the developer mean by "The payload is booted via Networkboot"? How does the bootkit (a ...
9
votes
2answers
313 views

Do I need to use the cipher command with a newer SSD to erase files?

I've used Eraser in the past, and recently became aware of the cipher command in Windows 8. Specifically, with the /w flag: /w removes data from portions of the volume it can access and have not ...
2
votes
1answer
226 views

Is it safe to use .netrc files to store credentials for tools like curl or ftp?

The .netrc file can contain username and password credentials for various sites, to allow simpler invocation of tools. For example curl with the -n option will read credentials from the file, for the ...
1
vote
2answers
921 views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
3
votes
1answer
51 views

Question about email app in Python and security

I've managed to get my tiny little app to send an email with a click of a button using this code (this is just the email part): http://pastebin.com/nR5g28ct But to avoid some error, I had to allow ...
1
vote
2answers
83 views

Mobile Phone security - help finding security/privacy review/discussion [closed]

I'm in the market for a new phone, and was wondering which modles/operating systems are the best to protect privacy/security. I don't use social media, so won't have Facebook/Twitter,etc. I am fairly ...
1
vote
1answer
168 views

Key derivation inside secure container of HSM

I have to implement custom key derivation function which basically works as follows: I have encryption key K in secure container of HSM. K can't be exported and the only way how to use it is through ...
0
votes
1answer
173 views

I need to transfer user's private key (RSA) to my App. Is file sharing a good solution?

I've asked a similar question here earlier iOS: Is it ok to store a RSA private key (use to decrypt text) in your application document directory? However, the person recommend me to use keychain ...
0
votes
2answers
62 views

How to steganograph ownership information into members uploaded images?

Considering a social website where members upload images which at times can be very similar - is there a way that images can be 'branded' steganographically with (salted+encrypted) text that ...
1
vote
0answers
72 views

How to inform other sysadmins their email encryption is broken [closed]

Does anyone have a good template email to use to send to remote system/mail/security administrators to alert them to the fact that emails to them would not be getting through either at all or securely ...
4
votes
1answer
62 views

Cipher usage by end users and browsers

How do I check in apache logs as to what cipher end users / browsers are using ? Are there other tools to achieve the same to get a result in percentage ? related link: How can I determine the ...
3
votes
1answer
1k views

How to encrypt the data such that only the user (owner) can decrypt them

Here is the system: The client side of our system generates confidential data that needs to be encrypted. Only the user should be able to read them, by that, I mean that even us who managed the data ...
8
votes
4answers
2k views

Fake UserAgent visitor attack?

Not sure if I should report it here, but within my website I collect each request in DB, and from time to time view these records. Among data collected are user agent, reqested url, referrer (i.e. ...
6
votes
2answers
1k views

Does enabling EnableLinkedConnections pose a security risk?

As shown Microsoft's TechNet, network shares that are mapped by logon scripts are shared with the standard user access token instead of with the full administrator access token. Here's the gist of it: ...
5
votes
1answer
138 views

How should certificates be shared between a proxy and a frontend?

At work, I've been asked to look into creating a reference topology for a WebSocket chat application, which includes a proxy between the web-facing frontend server and the backend. At the moment, I am ...
4
votes
2answers
235 views

Is it a good or bad practice to fake user agent?

I'm using a mobile browser. I found a program that can fake my User Agent (UA), so I changed to something else. Is this good practice or bad practice in terms of preserving privacy?
0
votes
1answer
50 views

Procedure of tranmission of original virus [closed]

If website A is having a video with a virus, then if we watch that video through another website B (like dirpy dot com or getaudiofromvideo dot com), is there mechanism for the virus from website A ...
4
votes
4answers
203 views

How safe is password based key derivation in the case of long password?

I am encrypting files inside a device and store it. So I need to maintain the same key throughout the life cycle of the device. For key derivation I use EVP_bytestokey() of OpenSSL. The problem in ...
2
votes
1answer
1k views

Any security risk with raising client_max_body_size nginx?

i was wondering if there is any securitiy risk involved with raising the client_max_body_size in nginx from 1MB to 20GB?
4
votes
1answer
382 views

Why does COMODO have 5 root certificates on a new Apple laptop?

Why does Apple include 5 COMODO root certs in OS X? There's "AddTrust {Class 1, External, Public, Qualified} CA Root" and also "COMODO Root Certificate". Why isn't one enough, if it's owned by a ...
2
votes
1answer
239 views

How sharing location via web actually works? (It gets my exact house address)

I know that this could be a repeated question, but I'm freaked out right now, Maybe Im old or out of the 2015 technologies, but i just visited this page: http://whatismyipaddress.com. As I know, ...
3
votes
0answers
56 views

Does DNSSEC still have the “enumerate all names in zone” problem?

According to Wikipedia: DNSSEC introduces the ability for a hostile party to enumerate all the names in a zone by following the NSEC chain. NSEC RRs assert which names do not exist in a zone ...
12
votes
6answers
5k views

Is (safe) encryption over compromised line impossible?

I realize something like this would be the holy grail of communications security and have never heard anything to suggest it has been done. Am just wondering. A lot of mathematicians and computer ...
2
votes
2answers
145 views

Malicious programs that takes advantages of Windows vulnerabilities [closed]

I was wondering if the majority of the viruses and worms are created to exploit vulnerabilities of the Windows system (not a third party app), also I would like to see a report. In Windows a normal ...
-2
votes
1answer
48 views

A collection of tests and demos for security headers and TLS configurations [closed]

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/) I want to build a ...
2
votes
1answer
205 views

Rootkits, Bootkits detection and protection and Firmware alteration

I was hacked in an extremely intrusive manner in late 2013. Ever since then, not a day has passed where I don't think about this. A lot. My question has to do with the likelihood of the attackers ...
3
votes
2answers
180 views

Guid salt - string vs bytes[]

Recently I got into passwords hashing (SHA256, HMAC-SHA1, PBKDF2, etc.) and one "statement" I've been reading over and over again, stuck in my mind and I can not find a satisfying answer. "When we ...
1
vote
1answer
138 views

What should I do when I found a strange email on my phone?

Today I found a strange email (not sended, just a draft) on my android smartphone, and this is not good. The screen was on standby and when I pressed the on/off button to see the clock, I found a ...
2
votes
1answer
52 views

Are there any examples of when personal email data can be brought into a lawsuit involving a corporation?

If users bring their own device (BYOD) and they have corporate Exchange (or Goodlink email) on that device, could the other email accounts on that device be open to a legal search? Would the SMS ...
4
votes
1answer
176 views

gray hat hacking 4th edition question

Example Using find.c Using find.c as an example, how would this manual source code auditing process work? We need to start with user data entering the program. As seen in the preceding ITS4 output, a ...
2
votes
0answers
128 views

Metasploit pattern not working for buffer overflow for SLMail 5.5 [closed]

I'm trying to do a buffer overflow on SLMail 5.5. I see where EIP is when I send 2606 A's to the program using my script. However, I cannot get the Metasploit pattern creator to work. I want to use ...
1
vote
2answers
132 views

If I write an nmap job into crontab from PHP code to run background, how can I get the status of the nmap cronjob?

I am trying to write a php code test to write an nmap scan (with parameters) scheduled into crontab file. While the nmap is running I would like to get the status of that specific nmap scan. For ...
1
vote
1answer
99 views

Is it complicated to deploy my own CA?

We want to implement a free solution to sign digitally internal documents. No legal value of this sign are requested. We want to consider to deploy an internal CA. Why is it always said that keeping ...
1
vote
1answer
108 views

NMap for getting machines connected to a network switch [duplicate]

I am currently exploring Nmap for its capabilities. Can anyone tell how can Nmap be used to query the machines connected to a network switch?
1
vote
2answers
134 views

Unable to “trust” self-signed certificate

I am currently running a setup that interfaces with many appliances running HTTP servers (running on Windows Embedded). The connections I use are HTTPS connections. My problem is, every time I open ...

15 30 50 per page