3
votes
2answers
272 views

Is it possible to share BitLocker decryption keys between multiple TPMs?

The TPM specification mentions that some keys are migratable, i.e. transferable to another TPM. Does this mean that it would be possible to share (transfer) a BitLocker decryption key between several ...
3
votes
2answers
768 views

What to do with expired certificates as a CA?

This and this answer says that "once a certificate has expired, the CA ceases to keep track of its revocation status". I'm trying to learn how OpenSSL works as a CA. If I have a revoked expired ...
12
votes
2answers
673 views

When performing a PenTest against a WAF-protected site, what should a Pentester know to enhance the Test-Quality?

I'm running a WAF infront of a bunch of Webapps and we have the Apps regulary tested, and we want to improve our Tests by presenting some kind of livelogs to the testers. What informations, from ...
3
votes
4answers
466 views

Would a predefined shared secret key be good here

I'm a software developer working with hardware devices that are deployed on the field. Every now and then, I would need to update the hardware's firmware (upgrades, patches, etc) I'm thinking of now, ...
0
votes
4answers
6k views

How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]

If I really need to use these methods, how do i make sure they are secure? Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
8
votes
2answers
9k views

What are the security implications of enabling UPnP in my home router?

I found port forwarding entries in home router that I haven't manually configured. Is that because of UPnP? Are applications simply able to tell the router to forward ports on their own? Are there ...
3
votes
1answer
479 views

Is Torrent safe for sharing legitimate files (file verification)? Does it use SHA1 or SHA256?

Let's assume that a legitimate torrent file has been safely and successfully downloaded over HTTPS and perhaps even OpenPGP verification was used to verify the integrity of the torrent file. How good ...
4
votes
4answers
415 views

Is a short sudo password ok?

On a server I control, I have disabled password logins (public key only), but still need to enter my password to access sudo. This is becoming cumbersome, as I use a long, automatically generated ...
7
votes
4answers
258 views

Alternatives to the “open PC” security model

Today, PCs (laptops, desktops, etc.) generally work under what I'll call the "open PC" security model. Users have full, system administrator/developer-level access to their own machine. Users can ...
5
votes
2answers
119 views

Serving data from an encrypted database over an encrypted connection

There is encrypted data in the database (asymmetric FYI). It is to be viewed as decrypted on the website. The data can be sent to the client as encrypted to be decrypted on the client's computer, or ...
3
votes
2answers
159 views

Is there a Security/Privacy risk in storing computers' hardware thumbprint?

I'm asking this because according to this article , Microsoft collects much less information than actually exists for Windows licensing (e.g. only 10 bits for MAC addresses, 6 for CPU serial number ...
4
votes
1answer
500 views

BitLocker with Windows DPAPI Encryption Key Management

Disclaimer: I realize that I posted this question on ServerFault, but I have not received any response there. I am hoping that this forum might be a more appropriate place to post this for a ...
19
votes
5answers
6k views

Can HTTPS server configured without a server certificate?

I have noticed that, a HTTPS connection can be set up with the server configured to use a certificate, and when additional security is required, the server can ask the client to provide a client ...
10
votes
5answers
781 views

Is there any security benefit of not using email services recently associated with PRISM?

After the recent disclosure of several major email providers cooperating with NSA, is there any real security benefit of not using these email services and choose some alternative instead? Such as ...
3
votes
1answer
105 views

Certificate Hostname Mismatches - Why do they matter?

So, I am implementing some X509 certificates in a backend service where we have our own self-signing process to allow different nodes (out of our control) to receive our blessing (as a CA of sorts). ...
8
votes
1answer
584 views

Is it possible to recognise and prevent MitM attacks on devices which use self-signed SSL certs?

I use both Linux and Windows at work on a large enterprise LAN. The majority of the network configuration is out of my reach. Certain SaaS applications that are hosted locally on the enterprise LAN, ...
-2
votes
2answers
164 views

What Digital Fingerprints Does a Browser Leave Behind?

I've been drilling down in granularity for this question: Besides IP addresses, how else could one be identified? and I'd like to focus upon the internet browser. What are the digital tracks an ...
1
vote
3answers
181 views

How can someone access data that I am requesting when I use HTTP?

I have heard that HTTP use plain text communication. If it is so how can a hacker or someone tap it. From my little knowledge I know that if we sent a request to a web server it replies back to us ...
4
votes
2answers
3k views

How is storing an API secret key in plaintext (in a database) secure?

The answers to this question Is it okay for API secret to be stored in plain text or decrypt-able? are somewhat unsettling to me. I'm trying to wrap my mind around how storing a secret key in ...
-6
votes
3answers
189 views

What are ports? [closed]

I just wanted to know what are ports. Can someone explain to me what a port is?
0
votes
1answer
215 views

Preventing DoS in Ajax Calls

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not. We have this URL exposed : https://mydomain.com/validateId?id=<user ...
4
votes
2answers
3k views

Faster methods for decrypting a TrueCrypt disk, esp. knowing the algorithms used

I encrypted (with TrueCrypt) all my hard drives and had the passwords stored in an encrypted file on my USB disk. The passwords are all (except one) 50 character randomly-generated ciphers, there's no ...
1
vote
3answers
489 views

NTLM security and password complexity

A client that allows to respond to the server with LM and NTLM, with a password which is simple,, is it insecure. Isnt a more secure way is to have all the communication with NTLMv2 scheme? and in ...
-2
votes
2answers
235 views

Changing User Account Type - User to Guest - File Deleted [closed]

One of our staff PC has a problem, the scenarios: Specs: (Alias Names) Company Name: Contoso Staff PC under Domain Alpha PC Name: Contoso1-PC Local Users are: administrators and john User profiles: ...
1
vote
1answer
273 views

Small encrypted network setup [closed]

Several partners and I have just started a small business and we would like to employ a good secure setup from day one. This is a problem however as there are many piecemeal packages, and I am stuck ...
9
votes
3answers
4k views

Why would a remote desktop connection harm my PC?

When I try to connect to a remote desktop, a message appears which says something like "Make sure you trust this PC, connecting to untrusted computer might harm your PC". Why would it harm my PC? I ...
5
votes
4answers
2k views

How can I make sure the mic input of my laptop/computer/cell is not secretly scanned for keywords and sent to the government?

I would like to learn how to search a laptop/computer/cell for processes scanning the mic input. Additionally, short of physically disabeling the mic input, is there a way to make sure nobody is ...
2
votes
3answers
605 views

Should I take care when entering incorrect passwords in untrustworthy websites?

I have the problem that I usually use 4 passwords that I use quite often. I use the first two strong passwords for very important services (e.g. Email, PayPal,..), and the other two not so strong for ...
1
vote
1answer
351 views

Assuming no MITM, is Gmail communication 100% secure and private?

I sometimes have to use my personal Gmail account from my company workstation, where I know for fact they are using content-aware firewall(s) like Palo Alto, and potentially other nasty things like ...
-1
votes
2answers
5k views

How to get an NT hash from registry? [closed]

I want to manually get the NT hash from the registry (without any tool). Let's say just for the administrator. I know that it must be stored in the SAM area of the registry somewhere so I tried to ...
6
votes
3answers
1k views

Is it possible to use Greasemonkey to hack a website?

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I ...
1
vote
1answer
297 views

Fragile digital watermarking algorithms suitable for PDF embedding

I have a PDF file that I want to embed an invisible and fragile digital watermark. What are the suitable algorithms available for this task?
2
votes
2answers
586 views

Suspicious entries in MySQL database from user input forms - sql injection?

I built a website from scratch using PHP and MySQL for my residential community and our budget is a big fat '0'. Five days ago I discovered that there were 222 entries in a table in my database that ...
-1
votes
1answer
478 views

Protect against Tamper Data add-on

When it comes to uploading images on a website. I know you can trick the php to believe that the file is an image by changing the extension to ".jpg" from ".php". Then once the file is uploading you ...
6
votes
1answer
252 views

Is it dangerous “Powered by…” tag

Is it dangerous from a security perspective to put a line at the bottom of a website "Powered by Wordpress/Drupal/Django/WHATEVER" ? I know that certain platforms/applications have different security ...
6
votes
3answers
262 views

Buffer overflow stack adjustment

I am quite new to buffer overflows and I am practicing right now different types of buffer overflow attacks. the shellcode was not executed until it was padded with NOPs although its set properly in ...
2
votes
2answers
630 views

Linux Memory Protection from buffer overflow

I am practicing Linux buffer overflow exploitation. when trying to exploit a vulnerability in crossfire, everything works well and I get the shellcode placed in the right place, and the program flow ...
7
votes
3answers
4k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
-2
votes
2answers
81 views

Block all kind of querys from ip [closed]

I want to check my network intrusion detection system (physical intrusion like unauthorized gadgets or devices in wifi/ethernet). Until now everything is ok, but I was wondering if I block every query ...
12
votes
4answers
10k views

Remove RC4 from SSL/TLS ciphers in Chromium

Recently I started to live without RC4 within my Firefox session. Discussion about it can be found here. While it is quite easy in Firefox (Enter about:config and then rc4), I found no possibility to ...
4
votes
2answers
700 views

What is the impact of the Bluebox Android APK integrity vulnerability?

Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media. The title of the post is "Uncovering Android Master Key" - ...
-1
votes
1answer
379 views

Encrypton method that would encrypt alphanumeric data to alphanumeric data [closed]

I need efficient way(possibly as strong as AES or AES itself) to enrypt (only) aplhanumeric data and get out only alphanumeric data, using some known library (i don't want and intend to implement AES ...
1
vote
2answers
564 views

Centralize Linux System Management

We currently maintain several linux servers and are looking to employ sub contractors. However, we wan't to keep tabs on who does what on each server. Other then creating sudo accounts on every ...
1
vote
3answers
1k views

ModSecurity errors related to REQUEST_METHOD HTTP/1.1 and GET

I asked my host to switch on the log file, and it have increasing a lot since then. Its have been increasing with 700 mb for the last week. It’s filled with error messages related to Mod Security. ...
16
votes
1answer
634 views

Is there a way to verify a binary against the sources?

It seems like there is no practical way to verify the full integrity path of precompiled and packaged software? I can check the downloaded package itself by hashes, but I have no verification if the ...
22
votes
11answers
8k views

Prevent my site from being copied

Is it possible to protect my site from HTTrack Website Copier or any similar program? Without setting a max number of HTTP request from users.
9
votes
1answer
42k views

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific ...
0
votes
2answers
149 views

Check integrity of GnuPG inside of GPGTools?

Is it possible to check the integrity of the GnuPG files inside of the downloaded installation package of GPGTools? I know how to check the integrity of the .dmg file (compare the SHA1 hash), but I ...
-1
votes
1answer
239 views

How Facebook Determines User Browser Change? [duplicate]

I recently logged in to my Facebook from other PC and got notice. Please login from the PC you previously logged in. I want to know what information Facebook uses to determine this change? I changed ...
2
votes
3answers
2k views

Javascript Diffie-Hellman and AES protocols

I am using the BigInteger Javascript library to create a symmetric key using Diffie-Hellman protocol. I want to create 128,160 or 192-bit keys. After some research, I have found out that I should use ...

15 30 50 per page