0
votes
1answer
24 views

Is there a way to securely lockdown a website to an Iphone?

So with a typical website, perhaps the fastest and most effective (arguably) way to secure the site is to add a simple .htaccess and restrict by ip addresses: .htaccess DENY from ALL ALLOW from ...
2
votes
4answers
167 views

How is security of server's RSA private key is ensured?

We repeatedly hear news of hacking of passwords from PW database (server side) but nothing about hacking of server's RSA private key (not asking regarding finding p and q for a given public modulus ...
1
vote
1answer
52 views

Email sent to people with my name in the from section, but not my email address

I have had a couple emails sent to people who have sent me an email in the past (in my inbox, but who are not necessarily on my contact list). They have my full name in the from section, and in the ...
1
vote
0answers
32 views

Understanding Java Security Providers

I'm hoping to use the below issue we came across recently to better understand Java's security providers, ciphers and encryption in general. We got the following error during an SSL Handshake (using ...
0
votes
2answers
54 views

Lock And Unlock Files Using USB Key

I am looking for a way to make a set of files only able to be read when a USB key is plugged into the system. For example, if I have FILE A on my C drive and I try to open it, it will say something ...
12
votes
6answers
2k views

Is XSS a server-side or client-side vulnerability?

My colleagues claim that XSS is a vulnerability on the server side. I always thought that this is a client side vulnerability. Which one of us is correct, and why?
1
vote
1answer
93 views

Evil PHP code I need help analyzing

I found on my server something like this at the beginning of my php files: <?php ...
3
votes
2answers
155 views

How Securely Store Sensitive Data on Mobile Appliation

i want to develop a mobile bank app (windows phone, android, ios) that interact with bank channel. first time when user opens application the key exchange process begins and at end of this process a ...
0
votes
1answer
18 views

Is thread's auto-login from email implementation secure/good user experience?

As far as I can tell thread.com log their users in automatically based on a token in their emails, appended to the URL. e.g https://www.thread.com/1234logmeintomyaccount-forexample This is a really ...
2
votes
2answers
86 views

Who can actually see the password when I accidentally used ftp instead of sftp?

It has been said that if we accidentally use ftp instead of sftp, people can actually see the login name and password in pure text form, and it is very bad. But who can actually see it? Will it be ...
3
votes
1answer
20 views

Which actions does the GnuPG “Certify” capability permit?

Of the following three actions: Certifying / signing other people's public keys. Generating a revocation certificate. Adding & revoking subkeys. ... which ones does the Certify capability on a ...
0
votes
1answer
42 views

How does this wordpress XSS work?

There is a new Wordpress exploit in wp-includes/formatting.php $textarr = preg_split('/(<.*>|\[.*\])/Us', $text, -1, PREG_SPLIT_DELIM_CAPTURE); General problem here is that they try to parse ...
0
votes
1answer
34 views

What is the difference between YARA and CLAMAV?

Can any one explain the difference between YARA and ClamAV ? Are they just two different ways of writing AV or Malware signatures ?
-3
votes
1answer
24 views

PHP get_file_contents & curl [on hold]

These two are the functions can capture remote address, for example this is a social network site example.com/user?privacyemail.php, this site is containing email of user or some kind of private info, ...
1
vote
1answer
16 views

Wildcard DNS entry from a security PoV

We are going to release our new product which will have customers create their own subdomains. This requires having a wildcard DNS on our main domain (We have no other options, right?) Are there any ...
-2
votes
0answers
35 views

Wireshark and Playstation 3 [migrated]

Im looking to capture all network traffic when playing my ps3 and find the external IP addresses of other players in my servers or game. Im wondering if this is possible ? if so how?
2
votes
4answers
103 views

Is converting `<` to `&lt;` sufficient to prevent execution of JavaScript from arbitrary HTML?

This is kind of a bar-bet question. An acquaintance of mine has made the claim that, given an arbitrary glob of HTML, it can be completely prevented from executing JavaScript if, before slapping it ...
0
votes
2answers
30 views

cross-signed end-entity certificates: usage in apache/openssl/gnutls

A previous question, What is the use of cross signing certificates in X.509? described cross-signed certificates well. I have a situation where the clients trust CA1 xor CA2, and both need to reach a ...
2
votes
1answer
30 views

What is 0xXXXXXXXX.asc.sig and how can I generate this?

When I am exchanging PGP keys with someone, I receive the regular 0xXXXXXXXX.asc file and regularly receive a file called 0xXXXXXXXX.asc.sig. What is this file? How can I generate one and send it ...
0
votes
1answer
58 views

Clicked link on fake email which appeared to be from friend [duplicate]

I receieved an e-mail which at first glance appeared to be from a friend, I clicked on the link provided without thinking as we would often exchance links to sites. The link went nowhere i.e page not ...
2
votes
2answers
28 views

Email Encryption

I'm hoping someone can point me in the right direction. If I wanted to implement email encryption within an organisation what would be the best way? I've been searching the web tonight but all my ...
16
votes
2answers
2k views

Can JavaScript be used to capture the user's screen?

Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework? (I do not need code examples: I am mainly asking to form an opinion about the security ...
0
votes
0answers
37 views

Why is the public key extracted from the CSR different than the one extracted from the associated certificate?

I am playing around with pyopenssl. I am trying to extract the public key from a CSR and to check if it is the same than the one I find in the associated certificate. There is a small difference ...
4
votes
1answer
104 views

What is the best way to store password in memory (RAM) in Java?

Imagine there is a login form in Java application. We need assign usename and password to variables. Moment after we can Hash or HMAC password and keep it just for authentication step (no caching). ...
2
votes
1answer
39 views

Do I need to save the IV generated to the database?

I see plenty of answers for what and how to use IV. But is it important to keep the IV saved for decryption? I would think so, but I haven't seen anyone saying anything about this. If you want a ...
0
votes
1answer
75 views

Open source alternatives to tamper data

I'm developing a browser(firefox) plug-in which essentially checks for malicious input. My current approach is to store all input fields sent in GET/POST requests, try to heuristically determine ...
0
votes
0answers
11 views

Sliding expiration with oauth

We are developing a multi-tenant website with an SPA front end and a rest api backend. We have a mobile version planned after the first release of the SPA. I am working on the authN and authZ piece, ...
0
votes
0answers
18 views

Federation Service to Azure with users from trusted domain.

I want to set up a website on Azure according to the following requirements and are wondering if it is even possible? As a internal team member, I must be able to login to the site with Windows ...
9
votes
4answers
2k views

Are photographs of fingerprints a security risk?

It should be trivial to get fingerprint patterns for many of the most important people in the world, as they frequently (enough) wave their hand, palms forward, to many HD cameras. Is it possible to ...
0
votes
0answers
30 views

Cyber security ontology [on hold]

I'm trying to build a cybersecurity ontology graph, starting not from scratch would be helpful. Anyone have the knowledge of an existing open cyber security ontology (taxonomy), it would be very ...
-4
votes
2answers
72 views

Which is more in demand Web or Wireless pen-testing.? [on hold]

I am familiar with both and wanted to know what company's are most interested in and will pay the most for. Please do not down vote this question, I think it is a good question for people who want to ...
-1
votes
1answer
73 views

Weird characters from contact page [on hold]

We've just recreated a contact form on a HTML webpage. We've implemented Google reCaptcha to prevents bots and spammers from abusing the form. We've received some feedback from our client, saying ...
3
votes
3answers
143 views

With HTTPS, what information would a MitM attacker be able to glean?

Consider a user accessing a site that is using HTTPS for all its traffic. A hacker is trying to use a man-in-the-middle to snoop on the user. What information can he glean? Obviously the content is ...
0
votes
0answers
24 views

IIS server get flood [on hold]

I've build one application for a company. It's a client side windows application. In that application, I am sending data to a server using a TCP port. That process is working fine. But, suddenly! that ...
1
vote
2answers
29 views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
0
votes
0answers
37 views

What's the difference between authorized_keys and authorized_keys2 [on hold]

For many years I have used ~/.ssh/authorized_keys2 file to store my public ssh key on the servers, sincd they are set up to use ssh version 2. I just found out that there is a nifty tool that ...
2
votes
3answers
179 views

Company decrypting SSL, is it common?

We've just implemented a proxy that decrypts all SSL traffic in order to classify and scan it. Naturally a lot of our users feel concerned. We're a small company (100 users) owned by a big company ...
0
votes
4answers
89 views

Basic question about why it's useful to have VPN encrypt traffic

There may be a basic flaw in my understanding of how the internet works so sorry if this is a simple question. What type of attack does VPN protect against? For example if a local area network (let's ...
18
votes
5answers
3k views

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...
5
votes
4answers
159 views

Are there any disadvantages to encrypting the password hash?

Is encrypting the password hash in database more secure than storing only the hash? Suppose we store encrypted SHA-256 result with AES instead of hash directly. Is this a good protection from a ...
1
vote
1answer
35 views

Android/iOS application security testing checklist

According to OWASP, we have a list of top ten mobile application vulnerabilities. But we are damn sure that the number of vulnerabilities on mobile apps, especially android apps are far more than ...
-4
votes
0answers
18 views

Longitude and Latitude in iOS mobile application [on hold]

I have one requirement from my project working - native mobile application "User is not in the internet connection mode, try to manually enter the address (street name, number, district, zip code). ...
52
votes
6answers
7k views

Can a lock picker slowly undermine the security of a deadbolt door?

I have a space for computers secured with a simple deadbolt. Someone keeps coming to pick the lock. While working there, I have scared them away three times. There are cameras, but not in useful ...
0
votes
0answers
29 views

How can a VPN use a virtual router and not send encrypt traffic and still be safe?

Today in networking class we were talking about VPNs. The prof got on topic of virtual routers and said that a way some VPNs work is by a client would purchase the service from the ISP and the ISP ...
0
votes
0answers
15 views

OCSP stapling: Staple just my domain/root CRT, or Combine/Concatenate including Intermediates?

I cant seem to find a specific well documented resource on this question. Should I staple just my domain/root CRT, or staple my combined crt (Combine/Concatenate file which includes my root cert plus ...
0
votes
3answers
57 views

Is there a way to make Tor network your full VPN?

Is there a way to use Tor network as your VPN, proxy or something alike? I have been gone to their website but I've seen just browser (Tor Browser), bridge, relay and exit. Is there way to tell ...
0
votes
0answers
27 views

Source code for Defense Techniques [on hold]

I just want to ask if anyone know how to get the source code of these techniques: Libverify & Libsafe: https://www.usenix.org/legacy/events/usenix2000/general/full_papers/baratloo/baratloo.pdf ...
3
votes
2answers
74 views

Choosing TLS / SSL cipher suites - What considerations are there?

Most of the advice on choosing cipher suites I find tends to be one of these forms: Here's a string to paste into your application, or Here's a list of 30,000-foot generic criteria to use ("favor ...
-4
votes
0answers
18 views

Unix access control List for Process and android [on hold]

can I take some help for my questions?
1
vote
1answer
21 views

What does “hosts-modifier” tag in VirusTotal Intelligence means?

I went through the help pages of VT and VT Intelligence, saw documentation about most tags, but couldn't find anything about the "hosts-modifier" tag, can anyone explain to me what does it mean?

15 30 50 per page