10
votes
3answers
652 views

How secure are sha256 + salt hashes for password storage [duplicate]

I started reading about password hashing recently on multiple sites like this page on crackstation and others, and for what I have understood, I should avoid using hashing algorithms like md5 and sha1 ...
1
vote
2answers
143 views

How can the Equation Group HDD firmware malware help bypass FDE?

There is currently a lot of discussion going on across the Internet about the "Equation Group" family of malicious hard disk drive firmware. One thing that has me wondering is the claim that ...
2
votes
1answer
341 views

802.11 Authentication/Association and WPA/WPA2 authentication (Four-way handshake)

So I have read that 802.11 standard requires stations and APs to go through the authentication and association before communication can take place. I also know that WPA/WPA2 has its own authentication ...
1
vote
2answers
86 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
3
votes
1answer
175 views

Session Management for Private Key Passphrases in a Web Application

Use Case I would like to encrypt data in a database for a Web Application. The following requirements exist: Decryption should only be possible when a user provides a passphrase Encryption should ...
3
votes
1answer
89 views

Analyzing log files for forensics homework?

Suppose two users have done a murder at 6pm at Dunkin Donuts, I have got the hard disks on site, disk1 and disk2. How do I identify the time and order of each user's activities on the hard disks? ...
3
votes
1answer
249 views

Klein and PTW wep attack

I'm working on an implementation of Klein's wep attack. For that, I've set up a router with wep encryption and collected 50,000 unique IVs from it. I tried only calculating K[0], meaning - the first ...
0
votes
2answers
43 views

ENCASE Forensic: Detect if someone ran CCleaner or CleanUp software

I have Encase. and I'd like to know where can I find if someone ran CCleaner Or CleanUp software to erase evidence.
1
vote
1answer
20 views

AES subkey generation operations order

I am preparing for my Information Security state exam. There is a question in preparation sheet that asks about order of operations to generate subkey for AES algorithm. Operations listed: XOR with ...
2
votes
0answers
27 views

How to encrypt and authenticate large amounts of data with NaCl

In a current project the NaCl-library crypto_box function has been used to encode and crypto_box_open to authenticate and decode data. However the library does not seem to support de- / encoding of ...
0
votes
4answers
255 views

How to secure MySQL database usernames and passwords within a php file? [duplicate]

I am working on a PHP website and my researches showed that it is entirely possible that the server can get hacked and the PHP files may get exposed. I store the MySQL DB Username and Password within ...
1
vote
1answer
113 views

Does VPN remote port forwarding compromise the anonymity of the VPN user?

An anonymous VPN service will typically assign the same public IP address to many VPN users. This procedure ensures that a connection cannot be traced back to the VPN subscriber: behind the veil of ...
-3
votes
1answer
49 views

How can I access a site using a VPN, without them knowing that I am using one? [on hold]

I'd like to register for a website that offers services that aren't available in my location. I signed in using the VPN a few times but then they banned me. Any way around this problem?
4
votes
2answers
925 views

Does a TMSI change often enough to prevent tracking?

A company called Path Intelligence has a product called Footpath which uses the TMSI, WiFi MAC address, and bluetooth MAC address to track phones as they move through stores. However, I don't see ...
0
votes
1answer
34 views

Disable a specific services in Windows 7 [on hold]

I am using a Windows 7 and I want to Disable some Services, How can I do this? For my machine only? For some machines inside the Active Directory I can control? For all machines inside the Active ...
0
votes
1answer
13 views

Is it safe to mount luks over cifs?

I have a server with a .img file this is encrypted with luks(aes-256,plain64,xts,sha512) Is it safe to mount this image over cifs(samba), or does doing so risk exposing the volume password or master ...
0
votes
0answers
8 views

OpenAM 12.0 IDP SOAP based SLO not working on https [migrated]

I am trying to configure OpenAM with my own certificate having alias other than "test" as per the document http://docs.forgerock.org/en/openam/12.0.0/admin-guide/index/chap-certs-keystores.html over ...
43
votes
9answers
19k views

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
10
votes
2answers
554 views

PKI solution vendor selection

What would you look for in a (X.509-) PKI solution, and why would you look for that, given the following constraints: Available programming/sw-engineering know how is limited (ie, "OpenSSL with a ...
0
votes
1answer
22 views

Why Use IPSEC AH vs ESP?

I am refreshing my understanding of IPSEC. IPSec is an IETF defined set of security services that use open standards to provide data confidentiality, integrity, and authentication between peers. ...
7
votes
7answers
3k views

eCPPT vs. OSCP Certification

I am a soon to be college student. I am looking to become certified in pentesting for both personal interest as well as to be able to have something that would look good to future employers. Both ...
17
votes
3answers
3k views

Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial?

As far as I know, in order to securely delete the hard drive's contents, one should fill it with zeroes or, for added security and harder recoverability, random data first and then all zeroes. In ...
4
votes
3answers
2k views

What risks are involved in exposing our home computers over the public internet?

I'm currently running a webserver from home accessible on the public internet via a static IP. What kind of risks are there in doing so? From what I understand, the setup will not allow connections ...
16
votes
3answers
2k views

Server for School Coding Assignments

An introductory C++ course is offered every year in our university. In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...
7
votes
2answers
639 views

Does DNSSec have any benefit if used with IPSec-enabled IPv6?

I'm not sure if the RFC's support a IPSec-only implementation of DNS, but if it does, what does that mean for DNSSec? Is DNSSec an IPv4-only technology?
21
votes
2answers
2k views

If DNSSEC is so questionable, why is it ahead of DNSCurve in adoption?

Looking at all the people who question the viability of DNSSEC, it's no wonder that the adoption rates are so poor. However, what about DNSCurve? It supposedly fixes all the DNS security and privacy ...
1
vote
1answer
50 views

RC4 encryption of torrents safety

Torrent clients offer encryption of traffic using RC4, and people consider this, like, very safe to hide traffic information from ISP. Now since I have a website with SSL encryption, I know that RC4 ...
0
votes
2answers
47 views

Is TLS v1 really secure for VOIP and video calling?

Many applications are still using TLS v1 for video conferencing and VOIP calls. Is TLS v1 really secure for video and voice & video calling? or can some one can easily snoop your sessions with ...
1
vote
1answer
50 views

Security concerns of browser injected JS

To employ end-to-end encryption, I am using a small tool that encrypts contents that is then posted and stored on our servers. While there are several concerns on client based encryption, I think it ...
0
votes
0answers
31 views

Weird drive popped up randomly [migrated]

I just had a random drive pop up as I was doing a defrag on my hard drives (windows 8.1) and I have no idea what it is or what it does. It's called: "\?\Volume{5a1f49..." what is it and is it harmful ...
18
votes
2answers
39k views

Security comparsion of 3DES and AES

Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)? I need to use encryption for my projects to store and secure sensitive information ...
2
votes
2answers
98 views

Are hashes of hashes used for password storage in practice? Why/why not? [duplicate]

A naive developers might store a password in the database directly, which would then be compared directly with the password sent from a client. A more security conscious developer might instead store ...
0
votes
0answers
6 views

Can you find the search space? [migrated]

Let A is a random number and has 512 bits.we make B from A and B has 1024 bits.Process of B is following: C=f(A) that f is hash and C has 160 bits.Then C pass in a parallel manner 7 different hash ...
0
votes
2answers
93 views

LUKS HDD Encryption crack [on hold]

I need help. I actually encrypted two mouths ago my external HDD with LUKS but know i have lost my password. I am so depressed because, all of my life is on this HDD. Is there any possibility to get ...
1
vote
0answers
49 views

Resource on Torrent poisoning

Can someone explain how torrent poisoning attacks work ? I am looking for some tutorials on how to do it ? What are the countermeasures that someone can use to defend themselves against it ?
0
votes
1answer
22 views

Guidelines for time for encryption key regeneration

I am looking at using a third party key distribution protocol. I do not have much details of the internals itself. However I am required to configure the time for regeneration of the (128 bit ...
3
votes
1answer
50 views

Password security when connecting to ldap with rails application

How do you store a username/password securely in a rails app when using it for many ldap searches? The connection in the app requires ldap_bind_authenticate(Net::LDAP.new, username, password) ...
5
votes
3answers
124 views

In a monitored network, can the admins tell if Tor is being used?

I'm not asking if Tor is secure, I'm asking if an observer can know you are using Tor? For example if a persons ISP or company network monitors traffic would they be able to determine with certainty ...
2
votes
1answer
265 views

What do Msgsrvr and Scientia-ssdb do?

I'm having a task in a computer security class in school where I'm supposed to scan a host for open ports in order to find out what services are being run there. I have found out (among other things) ...
4
votes
3answers
432 views

How can I recognize and find file(s) dropped by malware?

Suppose I am doing malware analysis. How can I recognize if, during the analysis process, a piece of malware dropped a file in my system, and if so, the path of the file? What are the procedures, ...
0
votes
1answer
87 views

Solution for Protocol Downgrade Attacks

I have a Protocol Downgrade Attacks on my website, i have seen the solution to be as TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks refer link :- ...
3
votes
2answers
300 views

What stops an SSH server from MITMing logins?

When I read this question about what gets signed with the private key by the client I wondered: What stops the following scenario from happening: A client connects to an SSH server. The SSH server ...
5
votes
0answers
59 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
2
votes
2answers
160 views

How to store derby database encryption key in HSM?

The Derby Database supports encryption with a key or password. Traditionally this key is stored in the file systems, now I am looking to store and protect this key in the HSM instead, but I couldn't ...
5
votes
2answers
94 views

Is using a self signed certificate safer than a free ssl certificate? [duplicate]

I have a personal website/email server, basically for my own self learning use. I am using CACert (http://www.cacert.org/) for my SSL certificate as advised in a tutorial. I have no clue about ...
0
votes
2answers
82 views

Sniffer attack on mobile

I have Nokia lumia 625. And a guy hacked it using sniffer. That's how much I know about it. He has access to all my online texts(eg. Whatsapp, messenger etc) . and also to offline carrier text ...
9
votes
4answers
7k views

How is Tor secure?

If Tor is open source and thus its process of concealing your IP is known, then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
-1
votes
0answers
28 views

How can I debug a running process on my computer? [on hold]

Using GDB can I debug a process ID to see where a particular variable is stored in memory? Consider that: I'm running a javascript game which is running in my browser, and I'm on Kali Linux. Can I ...
0
votes
1answer
47 views

SafeBrowsing domain vs. url distinction

Does SafeBrowsing actually work with the URL paths or does it only look at the domains? If it is just the domains, does it also look at the subdomains or are the results for example.com and ...
2
votes
3answers
55 views

How can I avoid buffer overflows when programming an Android app? [on hold]

I'm just starting out in Android and I've gotten my head around general programming within Android, but I've recently started trying to research security within Android. What coding practices would ...

15 30 50 per page