0
votes
4answers
459 views

Password Hashing Without a Unique Salt

I have a question about password hashing. This is not a question about the the BEST POSSIBLE method of hashing passwords, but rather a more utilitarian question about what is sufficient to hash a ...
4
votes
2answers
193 views

How can I validate time-sensitive data is coming from a mobile app, and not being forged?

In our application, a user selects answers to questions. Their score is based on the time spent answering each question down to a tenth of a second. The server is responsible for calculating and ...
1
vote
2answers
108 views

What cryptographic protocol is appropriate for the case where user needs access to a binary and encrypted configuration files?

This is a very newbie IT security question... I have to quickly implement a solution for our application that works like this... We have a binary executable that is given a configuration file. I need ...
0
votes
1answer
223 views

Dangers of PHP uploading word docs into a quarantine

I plan to write a PHP script which will allow web users to upload MS Word formatted docs. Here are the precautions I am taking: Filenames will be created by me (something like YYYY-MM-DD.doc) Files ...
1
vote
3answers
121 views

Issuing password information by phone [duplicate]

We have a confidential portal for clients. Historically they have been identified face to face in person and handed a unique token number that is associated with their email address and allows them ...
2
votes
4answers
1k views

how secure is rsa encryption for a web login without https?

I have a server running rstudio. This is basically a web application, and it is currently only accessible over the local network. The web app takes your Linux username/password in order to log you in,...
4
votes
1answer
413 views

XSS via PDF when Content-Disposition: Inline?

There are kind of two questions here: Is it possible to have XSS in a PDF file when the Content-Disposition: is "inline"? If it is possible, does the pdf get access to the cookies for that domain ...
4
votes
1answer
1k views

One-Way Data Transfer Cable

Is there a cable that physically only supports data flow in one direction (out)? The idea here is to put this on a system that can only export data so that there is very minimal risk of the ...
3
votes
1answer
191 views

Can I reencrypt my GPG private key with more password rounds?

As noted elsewhere, SSH private keys can be reencrypted (in different formats) with more rounds of iteration in the password-derivation function. Is there a way to do something similar for an already ...
-2
votes
1answer
818 views

Website starting up on PC boot [closed]

today i boot my PC when i got home & a russian website about games & naked chicks openen up instantly during general boot of the desktop. I thought "WTF", shut down my PC and restarted it. ...
-3
votes
1answer
59 views

major US cybersecurity laws/policies since 2000? [closed]

I am reading Cybersecurity and Cyberwar by P.W. Singer, and trying to tie the subject in with a government class project. I am looking laws and policies regarding cyberspace or cyber security, passed ...
0
votes
1answer
78 views

Is it safe to use the Keccak Algorithm to create the Key for a Serpent cipher?

I like to store some configuration but would encrypt them with the Serpent cipher. Is it safe to do this? When not, what is a better solution?
5
votes
5answers
1k views

Am I safe if I run untrusted applications inside a Virtual Machine [duplicate]

I have some untrusted software. I plan to run them on a guest Windows 7 on my host Windows 8 OS using Oracle VirtualBox. In the worst case, will only my guest OS be affected? Can the hacker access ...
-1
votes
1answer
1k views

What are the disadvantages of WPA2? [closed]

What are the technical disadvantages with WPA2?
3
votes
1answer
140 views

Similar products to MS EMET [closed]

Following the weekend announcement from Microsoft regarding the vulnerability in IE I have been looking at additional security defences for our endpoints. I've read some technical documentation and ...
2
votes
1answer
440 views

DTLS Session Keys life time

I have a UDP client application that is long-lived: Ideally, it keeps streaming to a server forever. I'm using Datagram Transport Layer Security (DTLS) to secure the UDP communication. How often ...
0
votes
2answers
201 views

Is it safe to use a ECDSA public key as a password seed for GCM/AES?

Two peers already exchanged their ECDSA (curve secp256k1) public keys using a secure channel. They want to establish an authenticated encrypted channel between them. They will use CCM mode and with ...
17
votes
3answers
12k views

Is the HTTP TRACE method a security vulnerability?

I saw many posts here on this site dishing out advice on disabling HTTP TRACE method to prevent cross site tracing. I sought to do the same thing. But when I read the Apache documentation, it gives ...
7
votes
3answers
2k views

How to access directories disallowed in robots.txt?

While scanning my website with uniscan it found my robots.txt file which disallows access to /cgi-bin/ and other directories, but they are not accessible in browser. Is there a way to access the ...
1
vote
2answers
88 views

Does it make sense to log accepted traffic on firewall?

Assuming a firewall is properly setup, only allowing determined traffic and dropping everything else, what relevant information (if any) could I get from the log of the accepted rules? From the ...
0
votes
2answers
137 views

Can website see my payment information?

So I decided to purchase a service in website which only accepts payments where I need to enter my debit card information. Now connection is secured with TLS 1.0, so no 3rd party can observe my ...
1
vote
1answer
410 views

How to use a Blind SQL-i keyword?

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return. Blind SQL Injection: [+] Vul [...
0
votes
2answers
3k views

How to scan a website using Nessus with login credentials

I have scanned my website using Nessus.But I need to scan it as logged in user since most of the urls are accessible only if we are logged in.How can I set website login credentials in Nessus?
3
votes
1answer
98 views

Can we detect malicious redirections by retrieving the webpage's headers? [closed]

Is it possible to know if there are URL redirections (to malicious websites) by retrieving the HTTP request and response headers of the legitimate website ?
-3
votes
2answers
73 views

Partial/Missing Privacy Policy? [closed]

I'm having a heck of a time with a new LG TV. I'm trying to contact LG support via email - a form on their web site which requires one to agree to a privacy policy. When I click Read Policy (near the ...
1
vote
2answers
132 views

Forced to use using 2-Step Authentication to keep online profiles safe?

I am starting to see a majority of services, websites, and social networks offering the 2-step Authentication like crazy now to protect their users. Also, after reading how the Twitter Account N was ...
2
votes
1answer
181 views

encfs and passwords

I notice that encfs fails to mount a filesystem when a wrong password is entered. However, this capability of detecting whether a password is right or wrong can allow brute-force attacks to be ...
4
votes
1answer
590 views

How are PGP/GPG private keys stored?

The default format in which SSH private keys are stored is notably fairly insecure against bruteforce attacks. This question provides a very nice solution to the problem by encrypting SSH private keys ...
1
vote
1answer
160 views

Is nc -l unexploitable?

Suppose I want to set up a server as a test, and I want it exposed to the Internet, giving any IP access. It could be for any reason or no reason. I don't want it to be at risk of a buffer ...
-1
votes
1answer
422 views

Security Awareness Training Ideas [closed]

Does anyone have any solid recommendations for deploying and maintaining security awareness training? I am not looking for a specific vendor but I am trying to gain insight about how the material is ...
2
votes
1answer
834 views

Using OpenSSL v1.0.1g, am I creating SSL certificate or TLS certificate?

So confuse right now between SSLv3 and TLSv1.2, I tried to find some answer on the Web but didn't seems figure it out so I am asking you guys. Is using the latest release of OpenSSL make me creating ...
-1
votes
2answers
501 views

What are the security risks for a business that has an insecure email system [closed]

For instance if the email system uses POP3 legacy protocol and SMTP but is not encrypted, yet the business continues to use it for daily purposes both internally and externally, what could be the ...
0
votes
1answer
93 views

A demonstration of the most basic form of a data breach or similar attack

I am currently working on my bachelor thesis regarding cloud security and found this neat article describing the "Notorious nine" written by the CSA: The notoruios nine I am looking to try out some ...
0
votes
1answer
487 views

How to combat and prevent a lpcloudsvr302 and bk-coretag.js Virus?

I recently came across a computer that was infected with a lpcloudsvr302 and a bk-coretag.js Virus. I did some research about the two Viruses and realized that their is no reliable source that helps ...
3
votes
1answer
411 views

Are DSA keys breakable?

Are the DSA keys breakable? If so, what is the maximum key size that is breakable with the latest technology ? Why are DSA keys not used during authentication? Can we use DSA keys for encryption?
12
votes
2answers
2k views

Do any OpenBSD protections mitigate the damage from Heartbleed?

OpenBSD provides a list of substantial protections against exploits inherent to the OS. Most of these features are not found in other operating systems, or at least are not turned on by default. The ...
0
votes
1answer
146 views

Tablet / phone app security in unsecured networks

Although reluctant to use my laptop on unsecured networks, I at least know that without me launching any processes or logging into certain web pages, that I will not be sending any credentials over ...
10
votes
2answers
3k views

LastPass Grid Authentication vs Google Authenticator which one is more secure?

[Being a LastPass user] recently I moved to Google Authenticator instead of using Grid Authentication as a 2-factor security. For me, finding and filling letters from such a dense matrix is a rather ...
2
votes
1answer
292 views

ARM TrustZone with Normal and Secure World

I am new to Security testing and I am working on a 64-bit ARM server. We are using ARM TrustZone technology. Is it possible for me to check if I am in the Secure world or the Normal world? How do I ...
0
votes
1answer
347 views

BurpSuite: Anonymity

Are the attacks being performed using burpsuite detectable? If yes, how should we stay anonymous/secure while conducting web application reconnaissance?
-2
votes
1answer
161 views

Vulnerability in Internet Explorer [closed]

An attacker could host a specially crafted website that is designed to exploit this vulnerability through Internet Explorer and then convince a user to view the website. This here being remote code ...
173
votes
3answers
13k views

What is the purpose of “gibberish” comments posted to my blog?

Fairly frequently, the contact form on my blog gets comments that look similar to this (each field represents a text box users can enter into the HTML form on the blog): Name: 'ceguvzori' Email: ...
6
votes
1answer
109 views

Decline any custom ssl certificate in a mobile application

Consider the following scenario. Eve creates an access point in a public place. Alice connects to the AP via mobile phone and starts browsing the Web. Eve redirects Alice to a registration page and ...
2
votes
1answer
857 views

How do application specific passwords work in Google accounts? [duplicate]

I turned on 2-step verification and had to setup an application specific password for Outlook. I noticed the password generated is actually weaker than the one I had before turning on 2-step ...
0
votes
1answer
147 views

Is there a secure DNS provider? [closed]

Is there a secure DNS provider? Kind of alternative to DNSCrypt.
4
votes
2answers
205 views

What to do if a vendor does not assign a CVE for an acknowledge vulnerability?

We found a security vulnerability in a widespread product of big IT company (the company is listed as a CNA here: http://cve.mitre.org/cve/cna.html#participating_cnas). We notified the company, they ...
1
vote
2answers
841 views

Assigning cPanel MySQL Privileges

When I log into cPanel, I go to create a new MySQL Database with the wizard. Usually, it is recommended to assign the database user with all of the permissions from Insert, Update, Alter, Execute, etc....
9
votes
2answers
3k views

Claim Based Authorization vs Attribute Based Access Control

Is there a difference between Attribute Based Access Control which is usually associated with XACML and Claim Based Authorization which seems to be a term coined by Microsoft? Is the latter simply ...
0
votes
1answer
487 views

Can I use crypto.getRandomValues to create a private key?

In the window.crypto spec: http://www.w3.org/TR/WebCryptoAPI/#RandomSource-interface It says explicitly: "Do not generate keys using the getRandomValues method. Use the generateKey method instead."...
-9
votes
2answers
211 views

Why does a business need to secure its email system? [closed]

Why is important for a business to secure its email system?

15 30 50 per page