0
votes
1answer
294 views

PCI requirement 8.3 - 2FA for all network access originating outside the network

Requirement 8.3: Incorporate two-factor authentication for remote network access originating from outside the network by personnel (including users and administrators) and all third parties, ...
7
votes
2answers
1k views

Similarities among all/most malicious JavaScript

I'm working on a web app that notifies users on whether or not the JavaScript that they entered is malicious. I'm using this article (Examples of malicious javascript) for reference. Is it possible ...
-2
votes
1answer
67 views

Security risk analysis software [closed]

I am looking for some risk assessment tools (preferably open source), which make the analysis of a system based on its hardware structure given as input and point out potential weaknesses of this ...
0
votes
4answers
170 views

Is 100% anonymity possible with Tor under certain circumstances? [duplicate]

Tor has guidelines that define a set of rules/techniques to assure anonymity. Some examples are browsing in small window mode so your screen resolution can't be detected, using HTTPS everywhere, and ...
2
votes
2answers
101 views

Can 3rd party JavaScript libraries access the http headers of the hosting html page

So, I have website, it uses a cookie stored in the http header of the downloaded html document to maintain the session while the end user is logged on and accessing there 'secure' data. This webpage ...
1
vote
0answers
274 views

Certificate Transparency, TLS Extension method of serving SCT's

I was curious about how to supply certificate transparency from my web server. There are 3 ways certificate transparency information can be delivered to the client's browser (Source: ...
6
votes
2answers
837 views

UDP flood from my machine, or false positive?

The company that hosts my dedicated server has alerted me to what they think is malicious traffic coming from my machine. They supplied me with graphs showing a large amount of UDP traffic coming from ...
0
votes
2answers
120 views

Encryption in case of distributed architecture

I have application infrastructure as follows - web client -> load balancer -> Apache (web server) -> Weblogic (application server). I could understand that in case of HTTPS request, SSL handshake ...
3
votes
1answer
617 views

How to securely provide SSL certs to a Docker app

What is the most secure way to provide SSL certificates (for HTTPS) to a Docker application? The approaches I've considered: The environment It's common (but obviously not required) to use the ...
1
vote
0answers
320 views

Storing Social Security Numbers in a Database

I'm developing an online application that needs the user's social security number. The application won't be processed on the web server so I'll be using an asymmetric key. So a compromised web server ...
0
votes
2answers
262 views

Website sent me my new password (after reset) in clear text [duplicate]

I was resetting my password on a website and the website emailed me a new password in plain text rather than giving me a reset link to change the password myself. I logged back in and changed the ...
-3
votes
1answer
78 views

How to find an encryption algorithm between two hexadecimal numbers? [closed]

I have several numbers that are generated by a server. They are 16 digits long and are hexadecimal. I have no idea whether or not any salting or hashing techniques were used. Can I find the encryption ...
3
votes
0answers
632 views

Performances of dm-crypt vs. ecryptfs

The only information I found about the difference of performance between dm-crypt (LUKS mode) and ecryptfs is that given that ecryptfs operates at filesystem-level, it may be slower when doing ...
2
votes
1answer
545 views

Setting node.js TLS ciphers vs observed behavior

I have a node.js server that I'm configuring for TLS 1.2. I set the following options in the config of my https server: ciphers: ...
4
votes
1answer
182 views

How long before a key is visible on a key server?

I am playing with GPGTools on a Mac and quite liking it so far, the GUI makes it nice to handle keys. I am using the default hkps://hkps.pool.sks-keyservers.net key server, to which I have uploaded my ...
1
vote
1answer
119 views

How do I track IPs my computer is accessing?

Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks ...
7
votes
3answers
394 views

Shortest SHA-3 output

I noticed in the new SHA-3 standard that it has a variable output size. Knowing that longer output is obviously better (higher entropy), what is theoretical the lower limit of the output size? Can my ...
2
votes
2answers
143 views

Is Google 2-factor “Remember this Computer” secure against adversaries with root access?

This question concerns the type of 2-factor authentication implemented by Google Accounts. The response to this question describes securing transfer of the secret key via a secure cookie. But what ...
2
votes
1answer
36 views

Host Based Prevention System definition

I'm a little bit confused about what a host-based intrusion prevention system is. In order to better understand this concept, I'd like to introduce you a case. Let's say someone designed the ...
5
votes
3answers
199 views

Authy: Does multi-device mode imply that all keys are stored on their servers?

My understanding is that if you use Authy, without backups/multi-device options, none of your account keys are stored on their servers. It all resides on your single device. Ie, even if Authy ...
1
vote
1answer
51 views

How do I get the subject public key from a PKCS7 message?

Quoting RFC4562, Cryptographic Message Syntax (CMS), section 5.6. Signature Verification Process: The recipient MAY obtain the correct public key for the signer by any means, but the preferred ...
2
votes
1answer
270 views

Reasons why there are no web based unified email clients (with OAuth2)?

There are plenty of mobile applications that you sign into with different accounts to retrieve email, contacts, and calendar (such as CloudMagic), and a couple desktop clients (such as Inky). Yet I ...
2
votes
0answers
40 views

Let users sign in with eIDs - do I need government authorisation? (scope: all nation-states)

I've decided to launch a crypto-basic income system. Crypto UBIs are pretty popular now. For me, it seems like an open nation-state ID should exist by now (2015). However, Mike Hearn, Bitcoin ...
4
votes
1answer
73 views

When using FDE, is there any OS/software allowing to get back from hibernation without requiring the disk encryption key?

This question is a spin-off the following one: Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt). In this question, an answer quoted the following message (the ...
1
vote
1answer
118 views

What are the privileges of shell spawn by a shellcode?

After I see some examples of shellcodes in various exploit examples they try to spawn a shell. I want to understand why after spawn the shell have privileged access? Doesn't the shell should ...
1
vote
3answers
90 views

Is using my phone number as a pin for a phone a security risk?

I just did a factory reset on my smartphone to see if it might fix issues with battery life. I configured a phone number as the lock screen code so I have a code that's both long and easy to remember. ...
2
votes
2answers
88 views

Verification code within mobile phone applications

In most phone applications with two factor authentication I noticed that the verification code is usually 6 digits long. I wonder why 6 digits are needed - we already know that the user is associated ...
0
votes
1answer
74 views

Is it possible to setup a rogueAP that indicates it is encrypted with WPA2 but in fact is open?

I want to create an exact duplicate of an existing access point that use WPA2 AES (CCMP) for encryption so that the clients will automatcally be connected to my AP.So I uesd this command airbase-ng ...
5
votes
3answers
318 views

2-Factor Authentication vs Security Questions

I have an account with a bank that has additional security option. When it does not recognize a device being used to access the account, it will either: Prompt with 1 of 3 security questions Send a ...
6
votes
1answer
434 views

Are encryption keys wiped from RAM before hibernate, or how to do it (Luks and Truecrypt)

Using Linux, I have system and swap/hibernation partitions encrypted with LUKS, and data partitions encrypted with Truecrypt, and I am wondering when I put my laptop to hibernation if the encryption ...
0
votes
1answer
74 views

Should I block users from viewing SQL files?

I've been told it's wise to use .htaccess to block users from viewing .sql files etc. Looking for advice on this. If I block user access, will this affect my admin-side ability to write to sql? If so, ...
-4
votes
1answer
94 views

Time-based password change [closed]

I have created this script and it runs great, but important questions remain. Is this script useful and secure? Does it have any possible problem or weakness? root@010010:/# ls -la ...
5
votes
1answer
141 views

Kaspersky Lab malware faking. How worried should I be? [closed]

Well most probably we will never know the truth, but anyway: Beginning more than a decade ago, one of the largest security companies in the world, Moscow-based Kaspersky Lab, tried to damage ...
3
votes
1answer
148 views

How can Heartbleed checkers determine if a site is vulnerable?

As far as I know, there is not a way to obtain OpenSSL's version from a website. Then what kind of information does a Heartbleed checker obtain so it can determine if a site is safe from Heartbleed or ...
7
votes
1answer
7k views

Why does IE11 refuse to enable back navigation caching for HTTPS?

On my website, I get this error message in the console: DOM7011: The code on this page disabled back and forward caching. For more information, see: http://go.microsoft.com/fwlink/?LinkID=291337 ...
5
votes
4answers
181 views

Does manipulating a random password significantly reduce its entropy?

Suppose I generate a password using a secure random number generator and all the available character classes. For example, c.hK=~}~$Nc!]vFp9CgE. Consider that this password may need to be used in an ...
-2
votes
3answers
77 views

Can a website that uses https be absolutely reliable? [duplicate]

Https websites cover some security requirements and certify the author, but how can we be sure that an author of such an https website is not malicious?
2
votes
1answer
278 views

Does CryptoWall needs a internet connection to encrypt my files?

Does CryptoWall 3.0 use some resource on the internet to encrypt my files? I watched this video on YouTube - in this video a tool is used to sniff network traffic and find information about ...
0
votes
1answer
48 views

Is there any security risk with a LUKS-encrypted hard drive being improperly unmounted?

I have a portable harddrive that is encrypted with LUKS. On a computer I use it on, the computer bugs out sometimes and won't let me unmount it correctly. If the computer is powered off without a ...
3
votes
2answers
90 views

Email security on a Windows phone

Let's say I set up a Microsoft account on a Windows phone and use the associated built in email client. If I send an email, would it be send in plaintext. On wifi, if someone is sniffing the traffic, ...
2
votes
2answers
317 views

Encrypt data stored in a database

I recently talked to a potential customer who wants to build up a database which contains fairly sensitive data. One of her key requirements is, that the data storeed will be encrypted in a way that ...
9
votes
2answers
2k views

How secure is PIN login to Windows?

I've just noticed that Windows 10 allow me to change my login method to PIN which is obviously much more convenient than entering my long and secure password after every startup / wake. I am just ...
4
votes
2answers
83 views

What would it take to attack or disrupt the GPS system over a wide area?

What would it take to attack or disrupt the GPS system? In other words, how feasible or likely is it for the GPS system and its network of satellites to be disrupted across a large area such as an ...
1
vote
0answers
96 views

What are the risks of adding third-party Root CA certificate into NTAuth Store?

What are the risks associated with importing a third-party Root CA certificate into the Enterprise NTAuth Store in a Windows Active Directory domain? (Except that the CA is then trusted to issue ...
1
vote
1answer
125 views

How safe is it if encrypted text is exposed?

I know that it is considered safe if both encryption algorithm and password are safely hidden. However, what if the attacker knows that there can only be a number of algorithms used. So how safe is it ...
-1
votes
1answer
94 views

Why do browsers have no built-in features to verify the integrity of downloads? [closed]

I just started a download of a large file. Checksums were placed prominently on the download page. But I just realized that I actually never made use of any of the checksums provided for download ...
1
vote
3answers
62 views

Hashing Algorithms Costs vs Sleep

I understand most of the concepts behind hashing password but this one still escapes me. I understand that you want the hash to take some time ( a couple milliseconds) so the attacker can't ...
-1
votes
2answers
51 views

Validate API caller domain (or any other related solution)

I am quite new to creating services using PHP-cURL. I want to offer some data/service to only registered domains. I know that I can identify these domains using app ID and API keys for data ...
2
votes
0answers
80 views

Do any specific steps need to be taken into account for the user's browser and browser caching for a HIPAA compliant web application?

I'm currently writing a web application that will need to be HIPAA compliant. It is very JavaScript heavy, and ePHI will be sent over an encrypted connection in the form of JSON. The transmission ...
-1
votes
1answer
355 views

Twitter phone verification while on Tor [closed]

Twitter locked me out of my account. I can log in but I can't do anything with it until I give them a phone number. I've had the account for years but they've decided now there's "suspicious ...

15 30 50 per page