5
votes
3answers
35k views

Someone keeps using my email address. What to do?

I have had a GMail ever since it was created, so it's an email address that is easy to remember, but also easy for somebody else to get confused with. Since I'm not going to post my email address ...
1
vote
1answer
61 views

If a site says its API for login can't be made available for “Security Reasons” should I be worried

Stack Exchange API 2.2 is finally out, (Yay!) Reading through the linked blog post, i notice the line: Login methods that don’t use OAuth can’t be made public for security reasons. Is this ...
1
vote
0answers
229 views

Is my approach to anonymous certificate based HTTP(s) authentication and secure private messaging sound?

I'm trying to work out a somewhat anonymous secure messaging system, and was hoping someone could validate my overall approach. Keep in mind, this all takes place over HTTPS. Authentication While ...
1
vote
1answer
906 views

SSO via HMAC and shared key. Can this be improved?

Given an authenticated user on A.com, we want to redirect the user to B.com so that she'll be immedaitely authenticated. The scheme I'm considering is very basic: A.com and B.com both share key S. ...
0
votes
1answer
189 views

International bank transfer, what is safe to share?

Okay, so I am selling a smartphone, to the guy who lives in UK, or that is what he says. So for the money transfer he asks me these things. Name Bank Name Account Number Iban Swift Code. Is it ...
3
votes
1answer
162 views

HTTP security headers on non HTML (images, JavaScript, etc)

Let's say, the HTTP security headers below are applied to all HTML pages of a site: HTTP Strict Transport Security (HSTS) X-Frame-Options (XFO) X-XSS-Protection X-Content-Type-Options Is it OK to ...
8
votes
2answers
1k views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
10
votes
4answers
570 views

Does my UI need to be secure if my API is?

I'm working on a project that is creating two new, separate web modules (possibly even on different servers) to support a new web application, with one serving up a static JS-based UI and the other ...
1
vote
0answers
105 views

how to implement 4-legged authentication for mobile application?

I have a REST web service which already implements oauth authentication mechanism via browser. I would to expose my API to a number of mobile clients programmed by third parties. In this scenario 4 ...
3
votes
1answer
432 views

WPA2 enterprise credentials involved in encryption?

Since encryption keys are session-based in WPA2 enterprise, if person A obtains person B's credentials, will person B's encryption key still be safe? Is there any way person A could use person B's ...
8
votes
5answers
2k views

Forensic research: What OS to use [closed]

I have been given an assignment from my school, in wich I have been given a Virtual image of a compromised system. The first thing I need to do is setup a environment to wich we can mount the image. I ...
1
vote
0answers
65 views

How do I determine whether a Linux-based router still has the default password? [duplicate]

My goal is to check if the password used by admin is the default password. I work on a Linux-based router. I know the password is stored as a hashed value in /etc/passwd. In generic Linux machines, ...
2
votes
1answer
2k views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
0
votes
1answer
659 views

What is an offsite facility as per PCI DSS requirement 9.5.1?

PCI DSS Version 3.0, Requirement 9.5.1 says that we have to store media backups in a secure location, preferably an off-site facility such as an alternative or backup site or a commercial storage ...
0
votes
1answer
206 views

Key-Exchange Algorithms VS Local Key Generation?

I was wondering the difference in term of Security, Computational cost and Network overhead between the use of : A Key-Exchange Algorithm (e.g. Diffie–Hellman) to set up a symmetric key. The ...
0
votes
2answers
1k views

What could be the reason for the high traffic on the local network? [closed]

In our small company we have very high traffic outbound from local network to server which is getting blocked, and slow downs our server respond time. Especially at night. I am not security ...
0
votes
2answers
678 views

What are the Standard Practices for Securely Storing Encryption Keys in Databases

I have a requirement for storing multiple symmetric encryption keys in a database. What I want to know is, are there any standard, accepted practices for storing these keys in a database ? To add a ...
0
votes
3answers
505 views

How to hide the sensitive data from the developer of the application and the DBA of the database

I have simple situation, we are in IT center and I need to develop a simple one form 4 fields that contains a salary field, I need the programmer of our IT center could not know the salaries of other ...
1
vote
2answers
101 views

Hardware Dependent Encryption [closed]

I am looking for a Linux based encryption system (like Truecrypt) that has the ability to do the following: Encrypt a partition or external drive that it can only be read from the same computer ...
-2
votes
1answer
92 views

websites with vulnerabilities INFO [duplicate]

Websites like http://www.cvedetails.com/ http://www.securityfocus.com This websites show information about vulnerabilities and exploits, which other sites are similar?
0
votes
1answer
3k views

Is ASP.net More Secure than PHP in GENERAL? [closed]

In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps? I ask this because ASP.net has many ...
2
votes
1answer
658 views

How should IPSec be configured to provide a protection at least as good as my current Stunnel configuration?

In private network (as in using a private IP address space) at a cloud provider, other customers have access to the same private network. I have secured the communication between many hosts and ...
0
votes
1answer
1k views

Hash the signing key of an authentication token in database

I have clients which are all browsers. All clients render just a single page application getting data from a Web API. The design of the API follows REST principles. I use token-based authentication ...
3
votes
1answer
1k views

Clamav can't detect encoded virus files

I have a PHP sheller file (like c99 file) but it's Encoded ( with this functions: eval(gzinflate(base64_decode("7P3rehblahblah)) ) and the clamav virus scan can't detect it. How i can detect virus ...
7
votes
3answers
24k views

Detecting(and locating) rogue DHCP server on a local area network

How would we detect and locate a rogue DHCP server on our local area network?
0
votes
1answer
126 views

Encryption key generation performance

A question for cryptography experts. Imagine we have a conceptual Notes.app: There are notes (title|content) stored as AES-256 encrypted strings Application has to present a list of all notes ...
0
votes
1answer
1k views

Cookie+session based CSRF protection

Consider the following scenario: 1. When user visits a webapp, server:     a) initialize the session;     b) generates CSRF token;     c) ...
2
votes
2answers
3k views

Username and password stored under form data in Chrome Dev Tools

When I record the network tab in Chrome Developer Tools when logging in to my site I find that the username and password are stored in plaintext under form data. You can also find it in Safari, ...
3
votes
3answers
1k views

Advantages of multiple valid CSRF tokens

As far as I understand there are two approaches to perform CSRF protection: 1) CSRF token per session - the token is generated once per session. This is the easiest way; 2) CSRF token per request - ...
-1
votes
1answer
248 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
2
votes
5answers
207 views

Why can't just any program use his own file-system-access-system?

This may sound stupid for everyone who knows more than me about the UNIX-System and security in software: Imagine you have a program trying to cause harm by deleting files. You just do something like ...
2
votes
3answers
501 views

Malware getting root access via “sudo” and “sudo -s”

Actually, I'd like to ask 3 questions. But since they are very related, I'll ask them all here. I use Ubuntu 12.04.4. Situation 1: I use Terminator, in one of its terminals I launch sudo iotop ...
2
votes
0answers
177 views

Duration of torrent activity and ISP tracking [closed]

The only reason I use BitTorrent is to download Linux distros, Open source apps and large documentation files. My ISP contacted me once and warned me: Ok, you aren't downloading anything illegal ...
0
votes
1answer
324 views

How CDN operator will decide content fo me if i am using google public DNS [closed]

As i saw most of the internet is being load balanced even at DNS . And DNS load balancers takes decision on behalf of client's DNS . So I Am just curious to know if i will use 8.8.8.8 as nameserver in ...
3
votes
1answer
480 views

Is it bad practice to add an encrypted private key to source control?

I understand that it is bad practice to add passwords and secret tokens to source control, with obvious implications arising if you are working on an open-source or related project. Rather, you ...
2
votes
2answers
339 views

Does the .net mvc/iis stack support whitelists for bidirectional authentication for SSL/TLS connections?

I'd like to limit access to some of my REST api, such that only bidirectional SSL/TLS connections are accepted, where the "other side" matches a detailed, restricted, whitelist. Is this something ...
3
votes
2answers
185 views

How can I ensure that Dropbox is using only its folder?

I'm using several cloude storage services, like Dropbox. Each have windows app for its synchronization, and this app actually can read anything from my disc, not just files from its 'synchronized' ...
1
vote
1answer
2k views

Can you generate Diffie-Hellman parameters quickly [closed]

I am working on an android project for school and I am supposed to do a DHKE(Diffie Hellman Key Exchange). Everything works well, the problem is that it takes a lot of time (really a lot) to generate ...
1
vote
2answers
254 views

Problems with undefined password requirements [duplicate]

An annoyance of mine is when websites try to force me to use characters or a password policy that makes it difficult for me to remember (e.g. a number, lower-case, upper-case, special char, 5 - 10 ...
0
votes
1answer
90 views

How to prevent malware to know when removable devices are plugged in

The question is clear, I'm a programmer and wrote a software to disinfect the USB devices when they got the malware which hides the files and creates a shortcut of the virus . Using this soft we can ...
0
votes
1answer
217 views

When using keyfiles with TrueCrypt how does the file size and/or number of files affect the difficulty of breaking into the container?

I'm looking at setting up an encrypted container with TrueCrypt (surprise) but I'm not sure whether I should use multiple files or if a large file would make any difference. Does the file size or ...
1
vote
2answers
168 views

Internet monitoring and DNS encryption

If someone hides their DNS traffic by encrypting it with a service such as OpenDNS's DNSCrypt, would you still be able to see which URLs they're viewing? Also, if that person uses HTTPS 100% of the ...
61
votes
10answers
18k views

Bad practice to have a “god” password?

Is it bad security practice to have a password that will allow you to access any user account on a website for support purposes? The password would be stored in a secure manner and would be super ...
0
votes
2answers
233 views

Any reason to use bcrypt, pbkdf2, scrpt for other things than passwords? [closed]

Let's say I want to hash some data, using SHA256, in order to prove I know something. Maybe it's my secret ID for something. In the real of passwords we have moved from hashing -> hashing+salt -> cpu ...
4
votes
1answer
229 views

Weird condition in blind SQL injection point, substr() is valid for exactly two chars

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table. (It's running MySQL 5.X with PHP) So I'm using this to retrieve all ...
0
votes
1answer
669 views

Ensuring security in Token url authentication

I am trying to make provision for resetting password if the user forgets his password. What I did is make a html page(say email.html) where the user will enter his email address. When the user submits ...
6
votes
3answers
320 views

Why do GUI terminals allow the pasting of control characters?

Given that control characters are usually not rendered, but they are given a special meaning in most terminals, what reasons are there for terminal apps to continue to support copy-pasting of control ...
2
votes
4answers
3k views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
0
votes
2answers
97 views

What is the meaning of “Key Deletion” operation?

In the context of Key Management and encryption/decryption, what does "Deleting a Key" mean exactly? What are the implications of "Key Deletion", in terms of: Decryption of the old data (i.e. data ...
0
votes
1answer
163 views

How to log packets which are allowed by SNORT?

Suppose i have not written rule for a type of attack in SNORT; It is obvious that it wont show any alerts. I wanna develop a system wherein i capture packets that SNORT allows n do further processing ...

15 30 50 per page