0
votes
1answer
16 views

How server knows about the client_write_key to decrypt the client message?

I have a question regarding the TLS handshake. As of my reading I came to know that master_secret will be derived from pre_master_secret shared by client as follows: master_secret = ...
-1
votes
0answers
24 views

About Arp attack [on hold]

we have the suspect of MITM attack but we are not sure. So I install XARP on the computer. The log is clean but one computer of the net have a very higth value in the coloumn how often seen. It's ...
0
votes
1answer
35 views

Connected to my server through VPN. Should I change my key?

I am using an SSH key to connect to my server (I've got Pageant to authenticate my key) and I forgot that I had the VPN on so I connected to the server (SFTP) while I was on it. Should I change my ...
0
votes
0answers
28 views

Unable to view USB Hard drive contents after lock(read-only access)

My work laptop has PGP Desktop 10.3 and when I connected my USB flashdrive it prompted me to Encrypt or Lock. Given the information on both of these options the only choice I had in order to access ...
0
votes
0answers
48 views

What is the right strategy for me to develop a paid public wifi?

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...
3
votes
0answers
40 views
+100

Right way to use the TPM for full disk encryption

I'm currently setting up a BitLocker equivalent using a TPM and LUKS. I've got the basics right and I'm able to measure the boot process and seal the FDE key using the TPM. Every time the sensitive ...
-7
votes
0answers
55 views

How to spoof browser fingerprint? [on hold]

I need some JavaScript code to spoof the following browser information to make a fake fingerprint: Limited supercookie test Hash of canvas fingerprint Screen Size and Color Depth Browser ...
1
vote
1answer
46 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
1
vote
0answers
26 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
0
votes
1answer
98 views

Is this company's claim to have solved MITM attacks true?

The Daily Mail reported in Dec 2014 about a company that claimed to have solved the MITM attack. Can someone explain how this is possible or what the difference is from TLS?
0
votes
0answers
28 views

InitializeSecurityContext takes 45 seconds to come out

For an expired certificate sent by a server, the InitializeSecurityContext function takes more than 45 seconds to come out with SEC_E_CERT_EXPIRED. Is there any configuration to avoid this much ...
0
votes
1answer
13 views

How can I check the integrity of a file with GPG?

I plan on running several servers with bitcoind and other things. How can I do file check with GPG key? I did the following: first I downloaded the file I want to check over a secure connection: ...
-1
votes
0answers
20 views

Recover encryption key from Windows

Ok, So last night my Windows 10 Laptop crashed and was stuck in a repair boot loop and after troubleshooting and restarting and so on, the best course of action was to reset my PC. So as I was in ...
0
votes
1answer
52 views

Strange symbols in Firefox address bar with https

Why are there dash marks through the https portion of this address? Is this a feature that's supposed to further accentuate that this is unsecured https? I just thought it was a graphical glitch ...
0
votes
0answers
20 views

AES256 nopadding vs PKCS7Padding

I was looking over AES Crypt's Java lib which seems like a secure AES encryption software and I noticed that they are using nopadding. Can somebody explain to me what the benefit of using nopadding as ...
-3
votes
1answer
76 views

Is it possible for a school to see what you're doing when connected to their WiFi? [duplicate]

Let's say I connect to my schools WiFi, and I log into Facebook. Could they see my login information, my messages and what not? I know they could see what applications you are using, but I'm still not ...
0
votes
1answer
43 views

Decrypting binary code from a base64 string

So, this online discussion function use decoded account names in every post, along with that they call "logging data", an example of this can be: Loggin data: 10878 Encoded account info: ...
3
votes
1answer
65 views

Fear regarding session tokens

I have read recently that sessions work as follows: Your credentials are checked. A token is generated and stored on server side, eg UUID, and this token is given to the client where it is stored ...
2
votes
0answers
18 views

Are deleted offline calendar events in Android actually deleted?

When an Android app deletes a calendar event in a local (offline / non-synced) calendar, does Android's Calendar Storage (com.android.providers.calendar) actually delete the event or does it just flag ...
0
votes
2answers
58 views

Setting up a secure VM and protecting host network

I'm an intern doing research on different honeypots, and I'm planning to test a few on a VM. However, I'm on a company network and would like to have my VM as secure as possible. I've read that VMs ...
-4
votes
0answers
27 views

“DNS not found” when connecting to a public wi-fi spot [on hold]

Trying to connect to a public free wifi spot (eg. in Starbucks) on my os x and on my Win10 laptops, after I click "connect" on the appropriate wifi network name, the "connected" icon appears, which is ...
0
votes
0answers
17 views

Virtualbox wipe drive on exit

In Virtualbox, is there a way to wipe the virtual drive of a Guest OS upon exiting/shutting down that OS? If not, is there any other way to reaching that goal without doing it manually?
61
votes
4answers
7k views

Does Microsoft's “Password Ban” list insecurely store user passwords?

Supposedly, Microsoft is banning common passwords, and their list will dynamically update: Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. ...
5
votes
0answers
53 views

SSL Certificate MITM Attack for Expired Domains

Let's say I have a domain name, like mysupercoolproduct.com. I buy a 2 year SSL certificate for it, and then I am negligent and the domain gets snatched up by someone else. I still have a valid SSL ...
2
votes
5answers
66 views

Is it beneficial to run the browser from a different user account for personal devices?

On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows: su FirefoxUserName -c 'firefox' ...
1
vote
0answers
36 views

Make my SSH I treat like VPN more anonymous

I have a VPS (although I could easily upgrade to a dedicated server) which I use as a "poor man's VPN" by tunneling through it. My aim is to improve this server so anyone attempting to track me has ...
1
vote
0answers
68 views

Decryption with two-way authentication

We have a Customer who wants his sensitive user-data stored with an encryption. These are the basic requirements: Sensitive user-data is stored in a database using encryption A remote-attacker who ...
4
votes
1answer
58 views

TLS/SSL Certificate - Key usage and encryption

So I'm looking at google.com's SSL certificate and do not understand a few things: I totally get that it ensures the identity of Google's webserver, but don't understand how it proves anything ...
-4
votes
0answers
40 views

Explain this jQuery in simple terms [on hold]

What does this line of code mean? jQuery("#HiddenReferral").val(jQuery(location).attr('href'));
1
vote
0answers
19 views

Does NSURLConnection on iOS support HSTS?

I have an app for iOS that uses NSURLConnection to retrieve things from a server. Will enabling HTTP Strict Transport Security (HSTS) on the server have any impact on the app? Will it refuse to ...
6
votes
2answers
1k views

How does HSTS stop MitM attacks?

I know that until a few years ago, someone could set up a fake wireless AP, and use something like SSLStrip to lure the victims into connecting to insecure versions of the major websites, such as ...
-1
votes
0answers
20 views

How do I setup openssl s_server to support ECDH-RSA-AES256-SHA cipher? [on hold]

I need help to make a certificate/key and command line to execute the server.
1
vote
1answer
27 views

Does HSTS inlcudeSubDomains directive include subdomains on all levels?

I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So ...
3
votes
1answer
41 views

Why is data quality important for privacy?

"Outdated personal data" is number 8 on the OWASP Top 10 Privacy Risks, and also the OECD Privacy Principles mention that data should be kept up to date: Personal data should be relevant to the ...
0
votes
1answer
19 views

How can I determine the common cryptographic suites I need to enable on my browser for common websites?

How do I determine the common cryptographic suites I need to enable on my browsers (I use IE11, Firefox/Nightly 49, Chrome 51) running on Windows for common websites, for eg, www.google.com, ...
2
votes
1answer
41 views

How to manage employee OpenPGP keys?

I am trying to create a secured policy for storing and maintaining keys between users of my company. I am rather new to OpenPGP and thus need some advice. Currently, the idea is: Generate a master ...
32
votes
5answers
5k views

Should I trust a website which uses a HTTPS certificate using SHA-1

I am on a website where I need to pay for something. This website has the following warning in the top left: This site uses a weak security configuration (SHA-1 signatures) so your connection ...
0
votes
0answers
54 views

Is there a ransomware variant that checks for file's magic numbers to encrypt?

Is there a known ransomware-variant (Cryptolocker, Cryptowall etc.) that before encrypting the files checks for their magic numbers? Lets say that there's a Word file, that had its file extension ...
1
vote
1answer
40 views

DOM based XSS: jQuery(“#HiddenReferral”).val(jQuery(location).attr('href'));

DOM based XSS has been reported by Burp Suite and showed this query as vulnerable: The application may be vulnerable to DOM-based cross-site scripting. Data is read from location and passed to ...
2
votes
0answers
24 views

Yubikey with gpg2

I recently purchased a Yubikey 4, which is working great for U2F and a static password, but I'd like to use the PGP Smartcard functionality as well, so I connected the Yubikey to my computer and ...
2
votes
1answer
42 views

Having malicious code stored in your DB

Let's say that there is a website which has an input field from which the input is saved to a database and then displayed somewhere else on the website. Is it safe to only sanitize/escape the ...
1
vote
1answer
84 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
0
votes
2answers
63 views

Is cellphone based (tethered) Wi-Fi hot-spot hackeable?

When we have Wi-Fi router and and somebody is connected to it, they can access its settings by visiting 192.168.1.1 or some other address. If password for router access is weak then router can be ...
-4
votes
0answers
74 views

Why does this registry key keep getting recreated even if I delete it?

When I open my registry editor I see this: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ...
1
vote
0answers
10 views

Error Running command shell :TimeoutError Operation Time out

I am Testing a Payload linux/x86/meterpreter/reverse_tcp in my Test Linux network to Exploit, I got a Meterpreter Session by Metasploit using it, I tried several commands like getuid, cat and all ...
0
votes
3answers
177 views

Disadvantages of using same key for encryption and decryption in symmetric cipher?

In a symmetric cipher, the same key is used for encryption and decryption. What are some disadvantages of using the same key?
0
votes
1answer
37 views

XSS to overcome HTML entities

In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of ...
1
vote
0answers
19 views

SSH certfificates generated on server user-creation + login scheme secure?

I'm sketching on a way to harden and automate server login using ssh-keygen with certificates where certificates, valid for e.g. 1 week, are generated on a trusted server and can be used to both ...
0
votes
0answers
13 views

Testing framework that can run external tools [on hold]

Can you recommend a testing framework that can run external tools like msf, sipvicious, nmap or similar tools and collect the results?
0
votes
1answer
39 views

Deploy intranet application with SSL certificate

My company has an intranet application build on the WAMP stack - Windows / Apache / MySQL / PHP. This application is installed on a server at each customer's site, and is accessed via LAN IP address. ...

15 30 50 per page