6
votes
2answers
469 views
Is it better to hash n*x times in sha1 or n times in sha512 on the client side?
I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...
4
votes
4answers
376 views
mathematically / theoretically, what is the chance that 2 different inputs would have the same results of 2 different hash functions?
mathematically / theoretically, what is the chance that 2 different inputs would have the same results of 2 different hash functions?
As an example, i will use 2 weaker hash algorithms, the MD5 ...
7
votes
4answers
338 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
7
votes
3answers
1k views
Alternative approaches to using DMZ for securing communication to and from external web server outside firewall
I am a software developer with little network security knowledge and almost no knowledge of the current network architecture for the environment I work in. If I had any, I still would not want to ...
3
votes
2answers
541 views
OAuth User revoke token
I haven't read it myself but a colleague told me that the end-user can revoke his/her OAuth token. I searched but I couldn't find enough docs on:
is this true / is the end-user the one to revoke the ...
0
votes
4answers
420 views
Protecting yourself from a malicious VPN
I am connecting to a VPN server that has been compromised and is under the complete control of an attacker. The virtual network itself contains numerous attackers waiting for a new target. What ...
3
votes
1answer
257 views
What kind of nefarious deeds can IP address Spoofing be used for? [duplicate]
Possible Duplicate:
What security risks does IP spoofing bring?
I found this article, which seems pretty good but was written in 2003 so I'm not sure how up to date it is.
Can IP address ...
6
votes
1answer
524 views
Public key length
I was wondering if there was (and I hope there is) a standard for public key size for ECDH (Elliptic Curve Diffie-Hellman) and ECDSA (Elliptic Curve Digital Signature Algorithm) for every curve type ...
4
votes
2answers
2k views
Can DES-based hashed password be recovered if salt is known?
Can a hashed password be recovered if the hashing is done with DES based crypt function in PHP and both the hash and salt are known by the attacker?
Consider the following example:
$salt = 'mysalt';
...
3
votes
2answers
176 views
Which access rights should be chosen for doku wiki?
I'm currently making my first experiences with a CMS called "DokuWiki" (Link). This CMS needs only PHP and writes the information to files (seems to be /dokuwiki/data/pages).
At the moment I gave the ...
6
votes
2answers
2k views
Reversing an entry card - How to find out what type of RFID hardware I need to read the chip?
I have an acccess/entry card chip I want to copy for demonstrational purposes. However I am not sure how I can find out what type of RFID reader I need to get a hold of.
Does anyone have a ...
9
votes
4answers
934 views
How does System Memory Dump work?
So there are so many pen-testing tools that perform a memory dump on the system. How exactly do they work - what exactly happens ?
15
votes
2answers
828 views
Salting password with the first 8 bit of the password itself
Do you guys think salting password with the first 8 bit of the password itself will have same result as using stored salt to hash password?
[Clarification]
I am not storing salt but creating from the ...
6
votes
3answers
585 views
chosen plaintext attacks against MD5 and SHA1
According to http://tools.ietf.org/html/rfc2617#section-4.9, having the server chose a nonce but not having the client chose a nonce opens up Digest Access authentication to chosen plaintext attacks. ...
7
votes
2answers
1k views
Strange STP traffic in my network, possible MitM attack?
I live at a student dorm, where we are connected to a student network. The administrators of this network have forgotten to disable STP broadcast on non-infrastructure ports.
Periodically, I lose my ...
6
votes
2answers
285 views
Design proposals for enhanced security for parts of Internet, e.g. for banking?
There is some recent discussion of some sort of "multilevel" internet, with e.g. a level defined for banking in which access is only granted after special authentication with "true names", special ...
4
votes
4answers
374 views
How secure is SSL?
Is it not true that SSL can be decrypted by simply having listened to the network activity of a PC on a network? (for example, from the first time a random PC connects to a coffee shop, and keep ...
2
votes
2answers
157 views
Which private-key encryption should I use for server to server communication?
I am tempted to write my own which covers:
Checksum to ensure data is not tampered with.
Long and multiple rotating keys so that it is (practically) impossible to decrypt.
Will use /dev/random for ...
7
votes
4answers
982 views
when people say a file has a checked md5 hash, what exactly does that mean?
ok I was just reading this site: http://www.zdnet.com/blog/bott/stay-safe-online-5-secrets-every-pc-and-mac-owner-should-know/3542?pg=4&tag=mantle_skin;content
and thought of something I always ...
7
votes
2answers
1k views
For LUKS: The most preferable and safest cipher?
I'm about to encrypt two of my hard drives using LUKS, since I can't really do it myself I use the guide on the Arch Linux wiki (which can be found here). In an example in the guide the cipher ...
9
votes
4answers
777 views
Can .htaccess and .htpasswd really protect me?
I want to set up a kind of personal wiki where I can store various sensitive information. However to make it 100% portable and and just plain convineant, I want to put it on the Internet. I'm sure at ...
9
votes
2answers
631 views
Is there any advantage of bcrypt over multiple iterations of SHA-x/MD5?
I know that a good password hashing algorithm should be slow. MD5, SHA256, etc. are fast. So I've been adding multiple iterations of SHA-256 hashing to my web apps (around 50000). Getting the hash of ...
5
votes
2answers
972 views
Can I block the true IP address using X-Forwarded-For header in IIS?
All the traffic gets to the IIS server through a proxy, I cant block or white list IPs, because all the traffic comes from the proxy's IP, Can I use the X-Forwarded-For header with IIS?
1
vote
1answer
99 views
Challenge Response across several hops
This is a follow-up question to "When should I use Message layer encryption vs transport layer encryption".
I need to send a certificate from the mobile phone to the server. Regardless of all the ...
5
votes
2answers
688 views
How does openid implement Single sign on?
I'm wondering which security model is behind the OpenID. Is it anything like kerberos?
8
votes
6answers
472 views
What is preventing the widespread common use of MAC-type systems?
Overall question
what is preventing the uptake of MAC systems such as SELinux/AppArmor in corporate and desktop computing environments?
Why don't you think it isn't already widespread?
I do not ...
3
votes
4answers
169 views
Attack where browser URL appears valid
I remember reading about an attack where the "location bar" in a user's browser displays a valid URL (e.g. https://www.paypal.com/), but the traffic is really being directed to or intercepted by an ...
2
votes
2answers
1k views
LDAP vs MySQL for Usernames and Passwords
I understand the LDAP databases are more secure, but is it always necessary to use LDAP instead of MySQL for usernames and passwords?
43
votes
3answers
16k views
What's the difference between SSL, TLS, and HTTPS?
I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
2
votes
1answer
373 views
How do Cisco devices identify routers?
Our network administrators forbid the usage of private routers in our college. They bought new Cisco equipment (routers, switches) which detect routers and automatically ban them (it disconnects the ...
12
votes
2answers
663 views
Can Windows malware harm a Linux computer when it's executed with Wine?
I am an (Ubuntu) Linux user. Sometimes, I have to use Wine for running Windows executables.
I would like to know if Windows malware (virus, trojan, worm,...), i.e. malware that was not intended to ...
1
vote
3answers
1k views
Ignoring broadcasts to 10.0.0.255 using iptables
I'm trying to drop logging packets that are destined for 10.0.0.255 by using the following rules:
$IPTABLES -A OUTPUT -d 10.0.0.255 -j DROP
$IPTABLES -A FORWARD -d 10.0.0.255 -j DROP
It ...
1
vote
1answer
417 views
Nonce construction for CTR mode (Mcrypt)
Edit: I'll put up this more clearly.
By the most simplest form, I'm asking that if I AES encrypt in CTR more with Mcrypt (using PHP), can I create the "IV" by just simply reading 16 bytes from ...
12
votes
5answers
1k views
Android API/development security pitfalls
What are the most important security issues that developers of Android apps need to know about? What are the biggest pitfalls or kinds of vulnerabilities that they need to watch out for? One ...
6
votes
4answers
1k views
What are the best ways to fake a web server
I was wondering if anyone had some insight into the best way to fake a web service response rather than setting up a web server. For instance, while doing dynamic analysis of malware it's useful to ...
12
votes
3answers
811 views
What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?
Why can SHA-1 be considered a secure hash function? That's something I still wonder about.
I understand the concepts of why modern asymmetric algorithms are deemed to be secure. They are founded on ...
72
votes
3answers
43k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
1
vote
2answers
171 views
TCrypto - Comments about design decisions I made?
I have pushed some code to GitHub to demonstrate the usage of symmetric key encryption in PHP. It is a small key-value storage library and it (optionally) offers ability to encrypt the stored ...
3
votes
3answers
93 views
Question on information retrieved from systems that could potentially lead to exploits
Usually it is advised, when one wants to secure an application, to "provide" as little information, or better yet, no information at all to unauthorized (possibly malicious) users. I'm thinking of ...
3
votes
2answers
496 views
When should I use Message layer encryption vs transport layer encryption
Basically I will be having to secure a connection between different hops. Therefore even if TLS is widely known to be the best in class, I am wondering that in such a case message based encryption ...
0
votes
1answer
145 views
Safer k128 key schedule
Can someone explain to me how safer 128's key schedule works? there are many parts that make no sense because they were not described at all in the paper (pages 3 and 5 in the pdf).
The second ...
11
votes
4answers
1k views
Security of passphrase-protected private key
If an attacker obtains a private key that was created with no passphrase, he obviously gains access to everything protected with that key. How secure are private keys set up with a passphrase? If an ...
4
votes
2answers
295 views
Cell phone voice mail hacking
The news has been filled recently with the allegations that News of the World employees hacked into the voicemail inboxes of celebrities and crime victims. What flaw was exploited to accomplish this, ...
5
votes
1answer
271 views
Asynchonous Linear Feedback Shift Register : test vectors
Well I've been working on coding LFSR structures for my research projects.
Being able to find sources on the subject, I've been able to test a single LFSR with different initialisation and TAP ...
11
votes
3answers
2k views
Three-Factor Authentication for Windows
This HowToGeek article...
http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/
...got me thinking.
Is there any software (or combination of software) that ...
5
votes
1answer
430 views
Is the DES “mangler” function invertible?
The DES symmetric cipher is based on a Feistel network operating repeated on 32-bit halves of the 64-bit block. The usage of Feistel means that the "mangler" function used does not need to be ...
2
votes
1answer
584 views
iOS/Android authentication and security
Here is what I am trying to do and can anyone provide some best practice advice for authentication and security?
Each user will have their own private database on the cloud. He will have his local ...
11
votes
1answer
3k views
Does Windows really still use unsalted MD4 for password storage?
I find it quite difficult to believe that the passwords in Active Directory for Windows 2008 R2 are still stored using the unsalted MD4 (aka "NT Hash") algorithm.
Can it really be true?
I've been ...
4
votes
1answer
114 views
testing for 'Dangling Cursor'
While reading the updated Top 25 exploits in the Common Weakness Enumeration I came across an exploit that I was not familiar with. It is numbered CWE-619: Dangling Database Cursor.
I was wondering ...
3
votes
3answers
618 views
Paypal IPN, SSL and man-in-the-middle attacks
Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back.
First, if my server connects ...
