4
votes
1answer
2k views

Which cross-platform password managers support encryption using a hardware token?

I am looking for a really secure password manager and I really like the fact that Password Safe supports encryption/decryption using a Yubikey programmed in challenge-response mode. Read more here: ...
1
vote
2answers
293 views

Elcomsoft Advanced EFS Data Recovery

The Elcomsoft "Advanced EFS Data Recovery" whitepaper says First the program tries to do this automatically, for example trying to extract the password from cache or system files, checking simple ...
0
votes
2answers
493 views

How to get started in information security with sales background?

I am currently a Masters student looking to change career from sales to IT, specifically Information Security. What are some good resources about finding jobs? What skills should I focus on to get a ...
3
votes
2answers
200 views

SSL Certificate Signing by a CA

Per my understanding about SSL's, a user has to send his CSR to a CA (Verisign) to get it signed, and Verisign will send the sign X.509 certificate in return. What I don't understand is what, ...
1
vote
3answers
897 views

Bibliography of attacks by port scanning techniques

I have to present a paper and make a presentation about the principal types of attacks by port scanning. What literature do you recommend to cover enough information about: types of attacks, port ...
4
votes
2answers
1k views

IPsec - when to use AH only?

As far as I know, AH only covers integrity and authentication. So, suppose that an intermediate router receives the packet with AH and not ESP. Then, can't the router open its content (<- and ...
8
votes
4answers
17k views

Reminder: Reset your password - phishing or genuine Facebook email?

An email claiming to be from facebook had the following content: Hi Andrew, You recently requested a new password for your Facebook account. It looks like we sent you an email with a link to ...
9
votes
3answers
4k views

Is LastPass' locally stored One-Time-Password recovery a security problem?

If you forget your LastPass master password then LastPass provides the possibility to recover access to your vault using a One-Time-Password (OTP) which is stored locally but is initially disabled. ...
2
votes
1answer
109 views

What is the meaning of 'adaptative' and 'over time it can be made slower' in the context of the bcrypt algorithm?

I'm reading the wikipedia definition about bcrypt but I don't understand the meaning of 'adaptative' and 'over time it can be made slower'. Can someone explain what they mean in this situation?
3
votes
2answers
935 views

Coverage of OSCP training

Is there any part related to penetration that OSCP/OSCE fail to cover in their training programs? How much will I be exposed to penetration techniques after completing OSCP/OSCE?
12
votes
2answers
6k views

What are the advantages of EV Certificate?

What are the various advantages of using extended validation (EV) certificates than normal certificates which also provide comparatively high degree of encryption like RC4, 128 Bit? I know that the ...
4
votes
4answers
1k views

Clients trust my custom CA

I'm sorry if this is a dumb question. I'm new to all this. I have a large number of users. I need to be able to generate SSL certs for various internal domain names. All of these certs need to be ...
1
vote
1answer
202 views

Editing images containing hidden information

Suppose we have an image with some hidden info behind it. If we open it in a photo manipulation software like Photoshop or Gimp, without editing it and just save it as a new image, does the image ...
5
votes
1answer
3k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
2
votes
1answer
368 views

Is DWR (Direct Web Remoting) Secure?

Is DWR considered secure, or what may be required to secure Direct Web Remoting? Are there better options for hardened asynchronous communication?
6
votes
3answers
566 views

An alternative to traditional passwords: is there some merit to this idea?

If you've got a website aimed at people that are not neccessarily technically proficient, letting new users choose their own password isn't very secure because of the simple fact that a lot of people ...
5
votes
2answers
2k views

Does the Kerberos KDC know the users' plaintext passwords?

In http://www.freebsd.org/doc/handbook/kerberos5.html section 15.7.8.3 “The KDC is a Single Point of Failure” you can read: By design, the KDC must be as secure as the master password database is ...
22
votes
5answers
2k views

Is it possible to increase the cost of BCrypt or PBKDF2 when its already calculated and without the original password?

I just wanted to know if you can increase the cost (iterations) of those two algorithms off-line. I want to increase the cost every year of my users passwords. One solution is to recalculate them ...
3
votes
2answers
370 views

Securely storing (email) lookup database

Looking for suggestions on implementing a server-side lookup table, where the key is an email address. Goal: Keep these email address private, even if data on the server is stolen. Assumptions: The ...
0
votes
1answer
143 views

why CVSS give a score of 0.66 for a full impact on CIA?

By visiting: http://nvd.nist.gov/cvsseq2.htm I noticed that the CVSS attributes the following impact values ​​for confidentiality, integrity and availability: none : 0.0 partial impact : ...
23
votes
4answers
11k views

How can I be sure Lastpass really can't access my passwords?

The recent, widely publicized security incident where millions of Linkedin were exposed reminded me to tighten up my password practices. I'm looking at several password managers now and I'm especially ...
0
votes
2answers
914 views

Enabling firewall for the IPv6 tunnel on Windows 2008 64-bit

I am currently on a IPv4 network. The IPv4 network is accessed by a router, which gives my machines IPv4 addresses via NAT. On one of the machines, a Windows 2008 64-bit machine, I have set up a IPv6 ...
17
votes
3answers
866 views

Why do rootkits hide in drivers?

A lot of rootkits for Windows (maybe even Linux?) do hide in drivers. Why is that? One reason I can think of is that using a driver they run in kernel mode and have full system access, but aren't ...
3
votes
1answer
161 views

php_register_variable_ex vulnerability question

Vulnerability I am referring to is: http://www.securityfocus.com/bid/51830 And here in more detail: http://auntitled.blogspot.com/2012/02/mini-poc-for-php-rce-cve-2012-0830.html So basically what ...
4
votes
1answer
1k views

How to backup database to comply with UK data protection act?

Charity has a server in their office onto which they backup a database with sensitive information. They want to get rid of this server. Is there a cost effective solution that would allow them to ...
1
vote
1answer
181 views

Is the javascript browser tool at printfriendly.com secure for my browser

I use Win Xp Home with SP3 and am pretty aware of security problems. I use Palemoon 12.1, a version of Firefox optimized for windows. I usually use printfriendly bookmarklet to create printable pages ...
3
votes
2answers
741 views

How does DNS Changer malware detection work?

This malware directs your computer to use DNS servers under control of the badguys. These DNS servers were taken over by the FBI. They were replaced with clean ones, to prevent service disruption, but ...
3
votes
2answers
491 views

Mitigations for Windows clients that don't support OCSP Nonces

Windows 7 clients (and older) don't support NONCES, a key feature used in securing the revocation check. Without a NONCE a MITM could replay a previously signed response and alter the validation of ...
1
vote
3answers
547 views

Linux mcrypt security

I just installed 'mcrypt'. When I try to encrypt some file with DES using the command 'mcrypt -a des myfile', I am prompted for a passphrase with a maximum character count of 512. > mcrypt -a des ...
19
votes
8answers
16k views

Why do people still use/recommend MD5 if it is cracked since 1996?

It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996 Therefore we suggest that in the future MD5 should no longer be implemented in ...
1
vote
2answers
576 views

Password entropy question

Is password entropy only mean that its long and look/or random, or there is something else, if the password 50 random numbers will it had high entropy or not
8
votes
4answers
10k views

What do key size and block size mean in cryptography?

Can some one simply explain the meanings and the difference between symmetric key and block size. Why 64 block size not safe any more and they increase it to 128 (AES,...,Serpent)? And what about key ...
31
votes
8answers
4k views

Is it safe to use leakedin.org?

leakedin.org claims to offer a service checking if your LinkedIn password has been stolen and whether it has been cracked. The website claims that it's pure Javascript, that is your password won't ...
2
votes
3answers
5k views

How should I defend against TightVNC brute-force attacks?

How should I defend against this type of attack? This is a tightvnc logfile excerpt from a linode cloud server running Ubuntu 12.04 (Precise) with the ubuntu-desktop package added to the bare server. ...
1
vote
4answers
2k views

Writing file shredder

I want to write a simple file shredder in c++, i.e. a program that deletes a file so that it is not recoverable. Would the following be a secure and correct way to do that? (1) Open the file with ...
1
vote
2answers
136 views

How do i use a guessable ID for authentication

This question doesn't fit well in many categories but hopefully someone's run into it before. I'm developing a web api that will interact with a physical device. Each new physical device has it's ...
11
votes
2answers
908 views

Security quiz for developers

Does anyone know of a short security quiz that could be administered online, to test the security knowledge of a developer? I'm looking for something simple to administer and simple to grade, ideally ...
4
votes
2answers
846 views

Detect what is running on an open port?

I have a wireless camera in my network. Running nmap on the camera, I discovered that the port 1010 is open but I could not find what it is used for. I looked in the administration pannel and did not ...
5
votes
2answers
226 views

Recommendations for documenting security code review

How should I document the results of a security code review? Does anyone know of any resources for reviewers that provide guidance on how they should document their findings? Maybe a document that ...
1
vote
1answer
212 views

Limiting database security

A number of texts signify that the most important aspects offered by a DBMS are availability, integrity, and secrecy. As part of a homework assignment I have been tasked with mentioning attacks which ...
5
votes
2answers
791 views

Class.forName injection and constructor invocation

If a Java-based webpage takes a user-supplied parameter and instantiates an object using Class.forName(parameter) What's the worst possible consequence? The attacker does obtain stack traces. After ...
8
votes
2answers
4k views

What are the variables of AES?

AES is a standard encryption routine that can be used consistently across multiple languages, assuming all the variables match up. My question is, what are the variables. I am aware of the following ...
2
votes
3answers
9k views

Database field type for password storage?

In the past I used varchar(255) for storing hashed passwords (no salt). Is this still enough? Or are longer fields required?
3
votes
2answers
1k views

Is my current method of handling session cookies insecure?

I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security. Each user can have several accounts. For ...
14
votes
5answers
4k views

What is a good practical (and sane) way to manage all your passwords for online sites?

I am just a mere mortal that wants to have a somewhat secure way of managing all my passwords. This is something that I have been putting off, but since LinkedIn decided to give away one of my ...
3
votes
1answer
348 views

Find malware in browser extensions

How can I check if an extension/addon consist of malware code? Is it easy to detect if it collects sensitive data (like spyware), logging keystrokes and so on? Can AV recognize malware extension as ...
2
votes
1answer
93 views

Are there negative influences in the Web of Trust? If not, are there theoretical alternatives?

Suppose I encounter a trusted PGP key that isn't really who they say they are. I don't want to sign their key and promote that entity. Can I somehow show my dissidence from the trust that everyone ...
1
vote
1answer
804 views

LFI or RFI from XSS?

Could XSS lead us to the Local File Include or Remote File Include? I read article that it's possible to upload shell via XSS vulnerability, but I still have no idea how it had been achieved.
3
votes
1answer
510 views

Is the Netscape SMIME extension still required in a certificate?

Every Windows 7 host has a Trusted Root certificate from Entrust that has the "Netscape Cert Type" extension (see image) I'm comparing inter-operable S/MIME extensions and see a pretty diverse set ...
5
votes
6answers
13k views

Using Python for security [closed]

I love using Python for the scripts I need and for work. But I really want to learn Python for network security since I will start a NS course next year. My question would be how would it be the best ...

15 30 50 per page