-1
votes
1answer
15 views

combining imperfect random number generators for shuffling an array

Shuffling an array to create a random stream for encryption is well known. The weakness is in the security of the random number generator that performs the shuffling. But is it true or likely that the ...
-1
votes
0answers
28 views

How Does AES Encryption Work? [on hold]

I'm looking for conceptual but semi-detailed step by step explanation of the AES encryption process, from plain text to encrypted text. The explanation should assume knowledge of basic programming ...
0
votes
0answers
16 views

What else can we now do with the new GCC5 to improve codebase hardening [on hold]

Noting the recent question: What is the most hardened set of options for GCC compiling C/C++? Is there anything else that can be shared regarding the new version of GCC, v5 for 32/64bit targets. I'd ...
0
votes
2answers
51 views

Is it possible to take back the control from an MITM in progress? [on hold]

I heard that MITM also involves DNS poisoning, which basically tells the Net to take a different route than it was supposed to go.. (I'm not sure if my interpretation is correct..) Given there is an ...
2
votes
1answer
30 views

Ability to determine which PGP public keys a message has been encrypted for?

Is it possible to determine, given a PGP message that you can already decrypt, to determine which other PGP keys that message has also been encrypted for?
0
votes
1answer
16 views

Would an IM app server holding user's messages long after the content was delivered be an issue of personal data protection? [on hold]

Take a IM app like WhatsApp. If I send a message to another user while their client is offline, the server holds the message and then delivers it when the receiver's client goes online. It even has ...
2
votes
1answer
20 views

Security of reading articles via an RSS reader

Would a site or blog owner know who is reading their site if the visitor is reading it with an RSS reader? Can they get the IP of the person? Say I had a Netvibes account with RSS feeds, can the site ...
0
votes
0answers
21 views

antivirus/anti-malware vs rootkits on Windows [on hold]

As I read about rootkits I wonder how well the current antivirus vendors are with detecting them. Does anyone know of a site with a current comparison test? For example, this ...
0
votes
0answers
37 views

someone attack my wireless [on hold]

02/27/2015 15:30:03 sending ACK to 192.168.2.3 02/27/2015 15:26:11 sending OFFER to 192.168.2.2 02/27/2015 15:25:10 sending OFFER to 192.168.2.2 02/27/2015 15:25:10 sending ACK to 192.168.2.3 ...
0
votes
0answers
23 views

Choosing a SSL Certificate Issuer [duplicate]

I am going to buy a new ssl certificate that supports SHA2 algorithm for our web services. Web services will be used by variaous java clients written in java6, java7 and java8. We have got a ssl ...
8
votes
2answers
664 views

Question About HTTPS Security [duplicate]

I recently read about how HTTPS work and I have some questions to clarify. Pardon me if this sounds silly but I just need to get this clear. Correct me if I am wrong. I got to know that as part of ...
1
vote
0answers
26 views

Imported CA certificate to Firefox Browser not working [migrated]

I created Certificate Authority (CA) according to Ubuntu help using openssl. After creating a certificate for Apache2 and adding to certificate to it, I want to import it in Firefox. In the end of ...
3
votes
0answers
21 views

How do I request a certificate from CEP / CES on a Microsoft CA on OSX or Linux? [migrated]

This article describes how to request a certificate from AD CS (Active Directory Certificate Services) from a non-domain joined windows computer. I would think the same principals apply to non ...
-2
votes
0answers
33 views

are there commonly known risks of PHP generated email? [migrated]

In the following code, an email is sent via PHP, Apache, and Linux. A comment from a website user, $comment, and her $emailFrom address, are obviously potentially of an unknown nature. Do these fields ...
-2
votes
0answers
19 views

How i can secure authentication with php? [on hold]

I have an identification with id and password , after the user enters the ID and password, then script php search in the database ( mysql) if the id and password exists in the table. Can you tell me ...
3
votes
2answers
126 views

Do WebGoat style XSS attacks still work?

I am going through the WebGoat exercises, to refresh my knowledge of XSS attacks. Specifically, I am doing the Stage 1 XSS exercise. This exercise has a form that deliberately does not sanitize ...
0
votes
1answer
45 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
0
votes
0answers
21 views

Is iris identification a better way to protect your system than password protection? [on hold]

There are many iris scanners already launched in the market. Many are buying them and try to combine them with Computers to maximize protection. Do you think that this kind of protection is enough?
1
vote
3answers
91 views

How to make a secure communication between two applications on the same system

I'm writing a software which is divided into two separate stand-alone pieces, one is a service like application that handles all the logics, the other one is a GUI application that just works as a ...
0
votes
0answers
18 views

Can we outsource IPS and SIEM monitoring to a service provider? [on hold]

We are planning to outsource our IPS and SIEM monitoring to a service provider. My question is do they have to be PCI Compliant certified as well?. How about if they remote in our environment and ...
1
vote
1answer
18 views

Can we use same Active directory / Proxy servers for PCI and Non PCI Segment users?

Can we use the same AD server for both PCI VLAN user and Non PCI VLAN users? How about proxy, we have a Proxy but both PCI and Non PCI user's traffic are flowing through those Proxy. But we have ...
0
votes
0answers
13 views

Best practices to invalidate JWT while changing passwords and logout in node.js?

I would like to know the best practices to invalidate JWT without hitting db while changing password/logout. I have the idea below to handle above 2 cases by hitting the user database. 1.Incase of ...
-4
votes
0answers
47 views

I'm asking for input I'm not sure what's going on [on hold]

My son has not been able to download anything on his phone. We both have an LG optimus. It says that his filtering level does not allow him downloads. I went into his phone and tried to change his ...
-1
votes
1answer
36 views

Do we need to same PGP version for decryption [on hold]

Requirement: In our company Location A uses PGP encryption and sending data over internet. In Location B, we have to decrypt the file. Question is what do we require in Location B Do we need to ...
0
votes
0answers
23 views

Threats faced by IPC in multi user system [on hold]

I am learning about IPC in Linux. I see that Linux is a multi user system and the programs I start run with my privilege (so programs run with logged in user's privileges - euid). But different user's ...
-1
votes
0answers
7 views

Ensuring data security using datastore [on hold]

What are some ways to ensure the security of data which is submitted from forms on my site to a Servlet, and then stored in Google's Datastore?
0
votes
1answer
21 views

Can attackers substitute/place my queries to/from provider?

Can attackers substitute/replace my queries to/from provider? I mean I do HTTP query and its modified on provider-side so query goes modified to a server or reversal situation, when I get modified ...
2
votes
1answer
64 views

Ease of Getting Data On Self-Encrypting Drive From Screen-Locked Windows 7/8 Computer

Hypothetical: a Windows 7 or 8 computer has a self-encrypting hard drive. It is stolen with the power on, but with the Windows lockscreen on. Are there easy off-the-shelf ways to access the data on ...
0
votes
0answers
16 views

tool for passive device forensics [migrated]

Not sure if there is a tool out there but I basically would like to find a piece of software or multiple pieces of software that I could install on all my hosts within a network, for example my office ...
0
votes
1answer
31 views

Change the preferred algorythm from AES to Camellia in an existing PGP key [duplicate]

I already created a PGP key-pair in Thunderbird Enigmail on Ubuntu. Now I would like to change the key, so it uses preferably Camellia-256 for encryption. How can I change the preferred algorithm ...
3
votes
1answer
55 views

How secure are Tor circuits?

Sometime ago I was talking with a friend about security of different anonimity software kits. The most famous software we talked about was Tor. While I was talking about the triple secret used in ...
1
vote
1answer
45 views

Retrieve anonymous credentials

Background A registration process to acquire an anonymous, verified account goes like this: Registrant provides proof of individuality to a Registrar. Registrar verifies proof, ensures no prior ...
0
votes
0answers
11 views

generating public/private credentials for MS Outlook email encryption [migrated]

An app running on a CentOS 7 web server needs to receive encrypted emails sent from users of MS Outlook. Can someone please provide explicit instructions as to how I can generate or procure all of ...
0
votes
1answer
41 views

How do SSL certificates become compromised after expiring [duplicate]

I'm reading into security issues surrounding SSL, and one of that has come up is certificate expiration. The general idea is that once a certificate expires, the site is insecure. What is the ...
0
votes
2answers
23 views

Can revoked certificates be “lost” if the base CRL is updated before expiration?

Assumption Suppose I have a CA that issues a base and a Freshest CRL. I also understand the Freshest CRL to be a Delta of revoked certs in the base. I also understand that clients should pull the ...
0
votes
0answers
13 views

What is the minimum acceptable time for “Freshest CRL” to be updated?

I'm working with MSFT CA, and not sure if this behavior is the same across all CAs, but when I run certutil -CRL, the base revocation cert is updated weekly, and the Freshest CRL (the differential) ...
1
vote
0answers
33 views

Can anyone predict the scope of security in the year 2030? [on hold]

I'm just curious to know the scope of the future security in terms of compliance and cyber security. And also the way of technology growth in terms of speed, authentication and authorization and OS. ...
1
vote
1answer
25 views

P12 private key vs private key file : what is more secure?

The question is a bit tricky because they don't have the same purpose but : Do both kind of file face the same security issue concerning private key protection : password strenght ? (PBKDF2 as both ...
2
votes
2answers
76 views

Demonstrating SQL injection

I want to do a demo for a login page that is vulnerable to SQL injection for training purposes. I already tried to build one using PHP and MySQL. I commented the code sanitation to make the page ...
25
votes
4answers
3k views

Why am I getting strange HTTP requests for non-existing pages?

I am running a web server and watching what people request. I have been getting frequent traffic like: GET /phph/php/ph.php HTTP/1.1 or GET /mrmr/mrm/mr.php HTTP/1.1 Are these scans? Are the ...
1
vote
0answers
76 views

Are there any known weaknesses with ElGamal algorithm? [migrated]

I am working on a messaging system and plan to use ElGamal asymmetric encryption to protect the message contents during storage and transmission. (This would be in addition to TLS used during ...
5
votes
1answer
91 views

Prevent location being exposed through VPN

I use the Astrill VPN service to access websites that my country has blocked. There is nothing sinister going on here. Sites like google and youtube have all been blocked. This VPN service offers ...
0
votes
0answers
31 views

JSON Web Tokens vs. SAML

I don't know too much about security. Specifically, I don't understand the difference between JSON Web Tokens, SAML and OAuth 2. If you could provide some pointers and high level overview of their ...
21
votes
3answers
2k views

Superfish vs. Corporate MITM

I work for a consulting company, and I have been implementing a tool from a security vendor, which is a cloud proxy for all user traffic. It will perform malware scanning and filtering of all web ...
2
votes
1answer
25 views

How to appropriately secure a database using different db users

I was thinking recently of the steps to secure a database server. Most of us are aware how to handle the security on the application side, although a malicious user might find his way to bypass the ...
2
votes
0answers
18 views

Windows Firewall single rule with multiple IP addresses vs multiple rules with single IP address [on hold]

I've tried finding some resources to help me on my dilemma, but wasn't successful in my approach. So here goes: I am implementing an automated firewall manager for Windows Firewall which will ban ...
3
votes
0answers
28 views

How to associate an antivirus with a file to delete it wherever it detects the file? [on hold]

How to associate an antivirus with a file to delete it wherever it detects the file? I want My ESET Smart security 8 to delete a specific file wherever the file is . or not allow the file to run. ...
1
vote
1answer
29 views

add another layer of protection on top of oauth 2

My Rest API is protected using Oauth2. My main client is a native app. it's working great but there are certain calls to the API that i want to make sure that are performed from my client - meaning ...
0
votes
0answers
6 views

What Exchange permissions are given to each receive connector? (Bypass SPAM, etc) [migrated]

Exchange has a list of permissions that are assigned to each connector based on the checkbox selection below. Here are an example of some SMTP headers that are used internally (in routing) to ...
3
votes
2answers
96 views

Explicitly prohibit an intermediate CA certificate on OpenSSL

How do you explicitly not trust a particular certificate (especially, CA certificate) for OpenSSL? On NSS-based applications, one can install the cert with trustarg p: prohibited (explicitly ...

15 30 50 per page