All Questions

2
votes
0answers
246 views

How do I convert from this weird John/Asleap format to lc (for HashCat)?

I'm trying to setup a system for pen-testing. I'm using the FreeRadius-WPE patch to collect Challenges/Requests from people who connect to my spoofed AP instead of the actual network. Here is the ...
2
votes
0answers
85 views

Main difference between Yahalom and Needham-Schroeder key exchange protocols

I am just wondering what is the main difference between the Yahalom and Needham-Schroeder key exchange protocols? Which protocol uses less computational power?
2
votes
0answers
62 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
2
votes
0answers
179 views

OpenSSL vs NSS from FIPS-140-2 and Suite B perspective?

Does anyone know of any work/papers/articles comparing the relative strengths and weaknesses of NSS and OpenSSL? EDIT: In case there aren't any existing documents/articles, I would certainly ...
2
votes
0answers
63 views

Is it safe to remove these groups from the Local Security Policy area?

I'm trying to edit a particular section inside the Local Security Policy snap in and I'm wondering if I really need to give all of these groups (I think they're groups) permissions. Based on this ...
2
votes
0answers
344 views

how to prevent ASCII Encoded / Binary String SQL injection in Codeigniter

I am using CodeIgniter for two years and I am digging into penetration testing nowadays. I think that ActiveRecord does good job for preventing sql injections, but i have following questions: I want ...
2
votes
0answers
121 views

Passphrase generator and strength & recovery time estimator. Right strength and randomness?

Questions about the strength of pass phrases frequently popup, as does: how to generate a strong passphrase? I tried to combine both in a tool. The free tool also includes recovery time estimations ...
2
votes
0answers
101 views

Grant permission to read java home from untrusted java code

I'm loading untrusted code at runtime and for this reason I'm also writing a custom SecurityManager. This untrusted code however lazy-loads some JRE classes that I do not want to block. Would it be ...
2
votes
0answers
186 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
2
votes
0answers
101 views

Shorewall stopped policies - routeback

Here goes a very specific question about the insides of Shorewall and Iptables in general. Shorewall supports configuration of "Stopped Policies" using the file routestopped, which defines the ...
2
votes
0answers
270 views

iCloud backup - which keys are transferred to Apple?

The iOS data protection implementation and the implementation of iTunes backups are both reasonably well documented, on a high level by by apple, and much more detailed by third parties. However, I'm ...
2
votes
0answers
107 views

What is the purpose of “Variant” LMKs?

What is the purpose of "Variant" LMKs? The JPOS project (http://jpos.org/wiki/HSM_basics) gives this description: To make things more secure HSM's use variants. A variant is a hex value for ...
2
votes
0answers
188 views

Thales HSM LMK keypairs: 00-01, 02-03, 08-09, 10-11, 12-13

In the Thales HSM documentation, 40 LMK keypairs are listed but the following keypairs are not shown in the keytype table: 00-01 02-03 08-09 10-11 12-13 Am I correct in thinking that the ...
2
votes
0answers
593 views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
2
votes
0answers
169 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
2
votes
0answers
59 views

What flexibility does a “Third party gamma” offer to U-Prove deployment?

The U-Prove SDK has the following comment: (link) // 1: CA-RA split (a party trusted by the issuer provides the gamma value) Given that the Gamma value (if provided) overrides the Attributes value, ...
2
votes
0answers
84 views

In U-Prove, what is the purpose of “Pseudonyms”, “Committed”, and “Scope” values and how are they used?

U-Prove allows for anonymous authentication and authorization without the involvement of an IdP. When a client generates a presentation proof 3 values can be optionally included, but I can't find ...
2
votes
0answers
266 views

Emacs and EasyPG not performing public key encryption

I have a file which I edit and encrypt following this guide : http://emacs.wordpress.com/2008/07/18/keeping-your-secrets-secret/ I'm a noob as far as security goes and thought that the point of ...
2
votes
0answers
110 views

SAM Card deployment best practice

As part of my current project we will be deploying smart card readers containing SAM cards for decryption purposes. The deployment process involves a third party software integrator who will control ...
2
votes
0answers
282 views

Security Onion:snorby alerts shows all local nerwork source IP(public and private)

I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
2
votes
0answers
100 views

Is the GTK or MIC in the unencrypted portion of a WPA protected frame?

In order to decrypt traffic you must have all 4 portions of the WPA Handshake. In WPA protected data frames, is there an unencrypted portion of that frame that has some sort of identifiable value to ...
2
votes
0answers
192 views

Snort Parallelization Techniques and its effect on DDOS detection capability

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
2
votes
0answers
133 views

Determine deployed 802.3x encryption/authentication protocols? Or, why can't I access Eth0?

Is there any means to identify deployed 802.3x authentication protocols on a wired interface (eth0) under Windows 7 (CLI), or from wlan0 on a *NIX based system? The scenario is as follows: I am a ...
2
votes
0answers
82 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
1
vote
0answers
41 views

Sticky keys on RDP

A recent report on page 18 states that: [black hats] have even leveraged [systems administration tools] as a means of maintaining additional persistence via setting “sticky keys” for RDP sessions. ...
1
vote
0answers
12 views

Clear EFS Cache at Set Interval

My boss wants to set up encrypted file shares using EFS on Windows Server 2012 R2 Boxes accessed by Windows 8.1 clients. I've been able to set the default DRA, issue certificates in test cases and so ...
1
vote
0answers
44 views

Build only OpenSSL crypto?

I was wondering if it's at all possible to compile only the crypto functionality of OpenSSL that I want? In particular, is it possible to compile just SHA1, AES, and DH parts of OpenSSL? I followed ...
1
vote
0answers
46 views

Encryption algorithm keySize restriction in JSSE 7

I have an application which uses SSL (JSSE Implementation). Currently from my client side, the "Client Hello" message suggests a list of cipher suites that consists of both 128 & 256 bits key ...
1
vote
0answers
59 views

Hidden TrueCrypt Container containing the Tor Browser Bundle

I'm considering using a hidden TrueCrypt container to keep a Tor browser bundle copy which could save bookmarks. In this case, would the TBB leave traces on the OS it started with? E.g. I use my ...
1
vote
0answers
207 views

Windows OLE Vulnerability CVE-2014-4114 “Sandworm”

Just heard about a new vulnerability and am using the same format as the POODLE guy for this one. What is the Sandworm vulnerability? I use [product/browser]. Am I affected? Is [product] ...
1
vote
0answers
59 views

Database row level encryption scheme

I am wanting to secure some highly sensitive data in a database. This would mean that the data needs to be encrypted and remain secure for 100 years if it were to fall into adversary hands. I also ...
1
vote
0answers
46 views

Is an anonymity network like Tor viable on top of the GPG web of trust?

The web of trust is a graph where the vertices are GPG users (actually, their keys) and the edges are cross-signatures. If we put issues of owner trust aside and assume that all participants only sign ...
1
vote
0answers
31 views

Configure icefloor to prevent leaks when VPN connected

I am trying to configure icefloor firewall on OS X 10.9 so as to make sure all traffic will go through VPN. I recently notified that even with "Route all traffic through vpn" option in tunnelblick ...
1
vote
0answers
45 views

Best practices for OAuth 2.0

I understand that OAUth 2.0 really just relies on SSL to encrypt the contents of the bearer token. However, are there any other best practices one should follow when securing OAuth 2.0? I know you ...
1
vote
0answers
47 views

Are Hyper-V Memory Snapshots secure/encrypted?

When dealing with encryption tools (TrueCrypt, Bitlocker and any successors) the passwords are always somewhere in memory. Therefore when there are memory dumps on a hard disk, for example in the ...
1
vote
0answers
96 views

Breaking it gently

Let's say I've found a fundamental error with mathematics of a security package. For example, let's say I've found something similar to the Pollard’s \rho-1 algorithm that renders some of the RSA keys ...
1
vote
0answers
38 views

MVC 5 and Multiple AntiForgeryTokens: What is happening?

I have a simple login form. In it, I put an AntiForegeryToken. @using (Html.BeginForm("Login", "Account")) { @Html.AntiForgeryToken() <p> <label>Email</label> ...
1
vote
0answers
37 views

Using email to authorize access to a user's account

would greatly appreciate some advice from the experts here on this stackexchange. I'm building an application that requires access to a user's resources from a 3rd party application. This 3rd party ...
1
vote
0answers
55 views

Is it safe to store the AES passphrase encrypted with the resulting AES key?

I found out that an encryption tool encrypts and stores the passphrase entered by the user and used to generate the AES key in addition of the encrypted payload. Pseudocode: key = md5(passphrase) iv ...
1
vote
0answers
85 views

Encrypt in C# program, Decrypt in android application By RSA Keys

I used RSA Encryption for sending message between Server and client. The server program implemented by C# and the Client is an android application. I want to know is it possible a message that ...
1
vote
0answers
31 views

Google Eclipse plugin manual telling to skip security warning. What are the risks?

I'm trying to install GWT plugin for Eclipse. The Google manual says among other things Eclipse indeed shows that message during installation. The questions are: What exactly does that message ...
1
vote
0answers
77 views

Can a hacker use someone else's IP address when running a scam?

I have a friend who works on a ship currently in Accra, Ghana. We do video chats but his system is extremely slow and sluggish. There have been times where our only form of communication is IM. A ...
1
vote
0answers
18 views

version support policy for BYOD devices

In corporate environments where users bring their own devices for access to corporate resources, how can we determine which Android devices are currently supported and receiving security updates? For ...
1
vote
0answers
44 views

Repeating “Type” field in EAP expanded NAK seems redundant?

I'm reviewing the EAP RFC 3748 and I've gotten to the bit about Expanded NAKs, and the examples given there seem to contradict my understanding of the generalised expanded format discussed later in ...
1
vote
0answers
44 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? For example: I can imagine a system where a recovery key is generated, split using secret ...
1
vote
0answers
35 views

NISTIR 7966 (Security of Automated Access Management Using Secure Shell) - is there anything new?

Tatu Ylönen (the creator of SSH protocol) and two others authored a report recently, offering their views on SSH key management. I have read the report, and am struggling to identify whether it is ...
1
vote
0answers
57 views

Is it possible to encrypt Word Docs with something other than default?

AES 128-bit advanced encryption is fairly simple to break and was wondering if there was any way to use a more secure one? And if so - any suggestions?
1
vote
0answers
54 views

How to retrieve type of device starting from its public ip

Given a public ip, is there a way to retrieve what's lying behind? I mean if I use nmap -PO 159.149.xx.xxx I am able to know if the device is alive (responding to ping) and which ports are open. But ...
1
vote
0answers
31 views

Using chip and pin credit card for authentication?

I'd like to use a chip and pin credit card for authentication, that is to register a card into a system and then use it to log in (it's just a side project with no real use other than securing a ...
1
vote
0answers
50 views

NaCL: Encrypt file to multiple recipients

I am trying to understand the Networking And Cryptography Library (NaCL). Consider i have a file that i want to send to multiple recipients. PGP or S/MIME supports multiple recipients by encrypting ...

15 30 50 per page