2
votes
1answer
566 views

IPV6 Cryptographically Generated Address implementation

I am looking to an Cryptographically Generated Address (CGA) implementation in Java or in C++. Would be glad if someone can help.
3
votes
7answers
591 views

Biometric authentication in the real world

can anyone give a realistic estimation, based on real-world experience, of how much biometric authentication techniques are being used in the IT field?
7
votes
2answers
2k views

Is strong cryptography legal across the internet?

In many countries strong cryptography is outlawed. That means you must store the data of your users in such a way, that government of that country can always decrypt it. And if you don't, you are a ...
3
votes
3answers
281 views

How do you make sure a pdf is deleted after being viewed in the browser?

For things like images or html documents, cache headers make sure that the data is deleted when the browser is closed. However as PDFs are opened in a plugin, the cache headers do not seem to have the ...
11
votes
4answers
913 views

“Phishing” red flags and countermeasures

Given the recent spate of intrusions into various networks which have included compromise of subscriber identity and contact information, I figured it would be good for us to have a thread on how to ...
10
votes
8answers
647 views

iPhone Tracking debacle - risks and countermeasures

For those of you who are not familiar with the topic, a quick search will turn up a lot of hits, e.g. see the researcher's report at Got an iPhone or 3G iPad? Apple is recording your moves - O'Reilly ...
8
votes
6answers
2k views

How to securely store my passwords?

Regarding this: Are passwords in memory? So does someone have a good idea on how to securely store my passwords? The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure. I have passwords ...
17
votes
3answers
2k views

Are passwords in memory?

I have an encrypted HDD (dm_crypt). That's why I store my passwords in a simple text file. I usually copy/paste the passwords from it. Ok! Q: If I open this text file then it goes into the memory. So ...
22
votes
4answers
1k views

How do you manage security-related OCD (i.e. paranoia)?

I did a quick google before asking this, and came up with the following article, linked to from Schneier's blog back in 2005. It doesn't really answer my question though. As society has crossed into ...
4
votes
3answers
380 views

How can IT audit for installation of IIS Express?

IIS Express is a developer tool for Windows XP and higher which provides the full feature set of IIS, but without needing administrator rights. I've seen discussion by some developers who are ...
9
votes
4answers
574 views

Should I obfuscate passwords before hashing? Should I pre-hash them on the client? What about salts?

For fun, and in my spare time I'm creating a simple CMS for my own purposes (with hopes to release for wider use... later), using PHP. I'm currently working on the login scheme now, and have a few ...
6
votes
10answers
1k views

Surfing anynomously

For work I often go to China, and there I met some dissidents I would like to help. I need to upload some videos to an ftp server in Europe. I will connect through a public hotspot without ...
5
votes
4answers
483 views

Possibility of undetectable encryption system

I am not sure if it is pre-mature to ask such a question. The question is largely inspired by pondering over the question and discussions in the following link (In his answer, @Dad also raises ...
6
votes
1answer
2k views

Feistel Block Cipher

Can anybody explain, in simple terms, how Feistal Block Ciphers work. I am not a math student so I do not understand the math behind it, just would like the principles.
15
votes
1answer
3k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
5
votes
5answers
600 views

Why re-verify with CAPTCHA on failed form entry?

Is there a reason for sites to ask for another CAPTCHA verification when some other part of the registration form, e.g. the username, was invalid?
3
votes
2answers
182 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
6
votes
3answers
287 views

Can you provide loss values on security breaches?

When someone says "why do we need to spend so much money and effort on security, we need to focus on market share first and once someone finds a problem we will fix it", I would like to have a list ...
13
votes
2answers
4k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
5
votes
1answer
531 views

Reasons behind MAC Spoofing on a corporate network?

My team is inspecting some MAC Spoofing events that are triggering in our corporate environment. After talking it over with the team, this is the information that we have that is relevant.... The ...
80
votes
6answers
26k views

Password Hashing add salt + pepper or is salt enough?

Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. ...
5
votes
4answers
4k views

Brute force vs other methods of recovering passwords from shadow file

Do you know any good approach for de-hashing/actually bruteforcing hashed passwords in the shadow file? On various operating systems, any good solutions/methods/programs. Or is it better to upload ...
5
votes
3answers
2k views

Why does the ★-property rule of the Bell-Lapadula Model allow information to be stored in objects with HIGHER sensitivity labels?

I'm self-studying for the CISSP exam and am having difficulty wrapping my mind around the practical side of the ★-property rule in the Bell-Lapadula Model. I understand the mechanics of it and that ...
4
votes
1answer
586 views

How can I find a CVE ID for “No Translation Available” entries in Foundstone or McAfee Vulnerability Manager?

On a recent scan using McAfee Foundstone Enterprise (newer versions are known as McAfee Vulnerability Manager), I ran into a "No Translation Available" error. It's rather frustrating that these ...
8
votes
1answer
2k views

Howto seed the PRNG in OpenSSL properly?

I am creating an application which runs on a mobile node with Ubuntu, which does not generate enough entropy bytes to the /dev/random, and does not always stay connected on the Internet to use typical ...
10
votes
6answers
471 views

Are all security requirements expected to be testable?

Many approaches exist to define security requirements. To keep it simple, i would say to define a security requirement, one need to model the threat encountered when building up misuse cases for ...
5
votes
4answers
450 views

What do you do to protect data on a Macbook in the event of theft/loss of the device?

What setup do you recommend to protect data on a MacBook in the event of theft/loss of the device? I'm specifically interested in Macs here, rather than laptops generally, and in concrete ...
17
votes
3answers
2k views

Recommended policy on password complexity

Is there any research on how how a password complexity policy can increase or decrease the quality of passwords? If you don't have any requirements on the password then probably 90% of users will use ...
1
vote
2answers
398 views

Where can I find some “real time” discussion forums for security issues? [closed]

The place where I work was hit by the new Qakbot variant (3rd generation) a couple of days ago and it has been brutal. Unfortunately a lot of the documentation out there is from the 1st iteration of ...
1
vote
2answers
1k views

Thoughts on Tiny Encryption Algorithm (TEA, anyone)?

I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites. Specifically, using the code presented at PHP-einfach.de Does anyone have any experiences / thoughts / ...
2
votes
1answer
591 views

PCI Compliance - If am eligible to self certify - do I need to use a QSA company in this context?

Setting up a new company with ecommerce app, and looking at PCI compliance. What I need to know is if I need to use a pci security assessor to verify the answers to the self assessment questionnaire? ...
8
votes
2answers
1k views

Is there a way for a consumer to report PCI non compliance?

Is there a way for a consumer to report PCI non compliance?
19
votes
6answers
1k views

What are the good use cases for disk encryption?

I've been researching disk/file system encryption, and on the surface it seems like a good idea for a lot of things. But as I dig further, the security it offers seems more mirage like than real. ...
10
votes
7answers
3k views

Secure memcpy for pure C

Buffer overflows are nothing new. And yet they still appear often, especially in native (i.e. not managed) code... Part of the root cause, is usage of "unsafe" functions, including C++ staples ...
17
votes
5answers
7k views

Do you detect/react to DNS tunnelling?

I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
14
votes
3answers
3k views

Computationally simple, lightweight replacement for SSL/TLS

Target hardware is a rather low-powered MCU (ARM Cortex-M3 @72MHz, with just about 64KB SRAM and 256KB flash), so walking the thin line here. My board does have ethernet, and I will eventually get ...
2
votes
1answer
579 views

Comprehensive book to study about wireless technology

I am searching for a comprehensive book on wireless technology that covers in detail almost everything about wireless technology, including the related protocols, security, hacks, etc. I know it is ...
7
votes
5answers
874 views

Code Review Strategies

As per my information, there is no hard and fast rule for doing a security code review but we all develop our own strategy for the same. I was wondering if we all can share the different strategies ...
7
votes
4answers
489 views

What kind of IT security applications do you guys run on your laptop/desktop?

I know a lot of people run different security applications on their laptops/desktops. I use Little Snitch on my Macbook Pro. I like to know where my applications are sending data and where I am ...
4
votes
3answers
386 views

Information gathering before deploying a Network IPS

I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
1
vote
1answer
714 views

Securing clients side scripts

Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
4
votes
2answers
192 views

How can IA-5(1)(b) be enforced on non-Windows systems?

I have a question posted already for this issue in Windows systems, and thought that non-Windows systems should perhaps be covered separately. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing ...
31
votes
6answers
3k views

How can a system enforce a minimum number of changed characters in passwords, without storing or processing old passwords in cleartext?

In some environments, it is required that users change a certain number of characters every time they create a new password. This is of course to prevent passwords from being easily-guessable, ...
7
votes
2answers
655 views

How can IA-5(1)(b) be enforced on Windows systems?

Note: I've also posted a question for this issue on non-Windows systems. In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
29
votes
2answers
9k views

HMAC - Why not HMAC for password storage?

Nota bene: I'm aware that the good answer to secure password storage is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding. Let's say ...
45
votes
17answers
3k views

Can we still provide confidentiality when cryptography is outlawed?

In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
5
votes
2answers
300 views

Patching Mechanism and security holes

Let me clarify two methods of patching softwares and then I will go straight to the question: I am using both MAC OS X and Windows and different mechanisms of these two famous operating systems in ...
5
votes
2answers
929 views

Password History/Password policy

I'm referring to "remembered" password that the domain keeps so a user cannot reuse that password until it has expired in what was set at Password Policy on DC (W2003/W2008). Where is password ...
4
votes
2answers
149 views

Question about the SessionLock paper

Some time ago there was a big fuzz over Firesheep: by listening to wifi traffic your login session can be stolen which is very bad because now somebody can e.g. send emails on your behalf. Some people ...
2
votes
3answers
818 views

Ranking of web security conferences

I have prepared a paper to publish in a web security conference. How can I know the ranking of available conferences to know which conference is better? For example, should I look at their sponsors?

15 30 50 per page