-2
votes
1answer
336 views

Cross-checking Driver's License Against DMV Using MySQL DB or PHP Script? [closed]

Ok, so I am coming into this a little blind on how to go about allowing this app to store and check one's driver's license ID against the DMV or some other government agency. Basically, everything ...
3
votes
2answers
964 views

Pattern based password cracking

I need to select a project for this semester. I'm a second year uni student in Ethical Hacking and Countermeasures. My idea was to see if using some kind of pattern based password cracking can be more ...
6
votes
3answers
4k views

OAuth2 authorization - save token in the cookies or in the session?

I'm a security newbie. I'm implementing oauth on my site and I want to ask where I should save my access token: cookies session (will be fetch from the server via ajax request) I have backend ...
1
vote
3answers
362 views

Using public/private key without signed certificate

I am working on a java program and I am now working on its network security. I want to use a secure connection since it transfers a lot of sensitive information. On all security guides it is mentioned ...
-1
votes
4answers
2k views

Secure communication between server and client [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
5
votes
2answers
2k views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
2
votes
1answer
803 views

Extracting the GPG userid from the Public key file?

Is it possible to extract userid from GPG public key? I got public key only and want to know to whom it might belong. I find one possible workaround — to publish this information on keyserver — it ...
11
votes
2answers
4k views

What is the purpose of changing the default SSID?

Yesterday I got a cable modem, and on the back of the modem there is a small sticker with the name of the default SSID, which looks like Vendor-A11 and the default Pre-Shared Key, which is a long ...
1
vote
3answers
388 views

Sharing passwords through email can be considered insecure?

I'm responsible to create new accounts for some services on my job. Some of these service do not allow password change by the user, so in the case the user wants to change its password, he would need ...
1
vote
1answer
916 views

How to check executable code signing signatures?

How can I see all code signing signatures an executable has? I know that requests for a tool are usually considered as opinion based, but I really can't find one and I don't expect many answers. ...
1
vote
2answers
48k views

SSL Handshake failed

I’m working on windows desktop application which is created using C++ (IDE : Qt creator). It has login panel, where i do user validation via https connection using openssl 1.0 library. Application is ...
4
votes
1answer
139 views

Dangerous to open a unix socket within www root?

My web server is chrooted into /var/www, and its contents are available over the network. One of my web applications needs access to a unix socket, and so that socket needs to be somewhere in ...
0
votes
1answer
106 views

Public Key Cryptography : Key length

While symm. crypt. has around 256 bits of a key, why does public key crypt have a key that is much longer (1000's) ???
3
votes
3answers
418 views

ASLR: why do only 12 bits change on 32bit system?

I've been reading the posts here about bypassing ASLR. On 32bit systems this appears to be trivial but I was surprised to see how trivial. It takes mere seconds to bruteforce ASLR address'. The reason ...
0
votes
2answers
2k views

What is the incident Plan and Disaster recovery plan for Fire

My boss is asking me to prepare the fire incident Plan(IR) and Disaster recovery plan(DR), and how can we determine it is IR / DR. I am no clue on those issue. What should I do?
0
votes
0answers
20 views

Protecting client's data over the wire [duplicate]

I'm writing some security software, and don't want anyone to be able to intercept data as its passed from client->server, and server->client. The best way to do this is over HTTPS via SSL. However, ...
0
votes
0answers
31 views

Are longer passwords more secure? [duplicate]

There are more and more sites claiming that long passwords which are chained words are not only easier to remember, but also more secure then short but obscure ones. Don't get me wrong: I totally get ...
3
votes
3answers
2k views

PCI DSS - only one primary function per server

The PCI DSS says that a server can have only one primary function and i'm a little confused over what it means by 'one primary function' we have a webserver with database - web pages and email is ...
18
votes
2answers
4k views

Describe an example of indistinguishability obfuscation or functional encryption

As described in Perfecting the Art of Sensible Nonsense, a major breakthrough in cryptography research was published in the summer of 2013: Candidate Indistinguishability Obfuscation and Functional ...
4
votes
5answers
373 views

Using unique email address for online signups?

After reading the recent social engineering of a user's twitter handle, I started thinking about ways to improve my own online security. We can only do so much too protect ourselves because at the ...
1
vote
2answers
1k views

What is best way to encrypt a blob with public key?

I need to encrypt byte arrays blobs fields of approx 50k to 100k each in .net with a public key then store in SQL/Server thendestroy original data. When the data is retrieved by the ultimate owner, ...
0
votes
1answer
214 views

What is the best way to generate a password/pin like string using brute force method? [closed]

I have a string of 7 characters. I'm supposed to generate all the combinations. But some combinations are more likely than others, I would like the more likely ones to be generated first. If I ...
2
votes
1answer
1k views

www-data is sending rogue mails through sendmail. How do I find the source?

So I have a Ubuntu server hosting a PHP-based web site for me. Some of the services rely on sendmail being configured. I have set it up to send through my GMail account. As of yesterday ~19:00 CET, ...
0
votes
3answers
608 views

Secure uploading file

I have file uploaded system in my php project. What I make at uploading: 1) Check file extension and file mime type. 2) If extension and mime type are allowed types, I save file outside of ...
1
vote
3answers
218 views

Where do suspect requests from logged-in users to my website come from?

I have an ASP.Net MVC 4 web application that is hosted on a Windows 2008 server. The application is secured by a custom ASP.Net membership provider. Only users who are granted permission by the admin ...
21
votes
4answers
2k views

What are spambots doing with unintelligible login attempts?

After constantly being under attack in phpBB, I created a new forum by hand, which successfully prevents spam bots from registering, and I get a report for every failed login attempt, telling me the ...
0
votes
1answer
477 views

Hashing Passphrase in Client-Side JavaScript Rather than Server-Side — Is it Viable?

Yet another salting-and-hashing-for-web-sites question has been left on the doormat of Information Security's StackExchange. The oft-mentioned approach for website password-handling is to use a ...
3
votes
2answers
14k views

Are there GPS tracker for laptops?

Are there location tracker hardware (GPS receiver) which can be fitted inside of a laptop and it sends live location data to a remote location ? If yes, how to detect such trackers ?
0
votes
1answer
212 views

Using Gmail in China triggered lots of Two Factor SMS

A friend of mine lives in Hong Kong and she travelled to China over the weekend. Whilst there, she was able to use Gmail on her Android phone without logging in again, but she had to re-login on her ...
4
votes
1answer
979 views

Are there any working proof-of-concept string comparison timing attacks?

I've tried to reproduce a string comparison timing oracle in two languages (Java and Python), but I'm not seeing any correlation in the timing based on the input into the comparison. Are there any ...
1
vote
1answer
122 views

BIOS spyware query

Is it possible that somebody who has access to my laptop can flash a new version of bios which does spying too i.e. recording keylogs, url browsed, downloaded files etc and send it to remote location ...
0
votes
1answer
321 views

NetFlow IP Spoofing/Reflection Attack Detection

Is it possible to detect IP spoofing/reflection attack via NetFlow? Thanks :)
1
vote
2answers
1k views

Is there any documentation or reviews about LINE messenger security?

I tried to find any documentation about the security of LINE messenger, but I couldn't. Is there any documentation or reviews about the communication protocol it uses, and whether or not it uses ...
4
votes
6answers
5k views

Locking IP addresses to try and improve security

(Originally posted on the work place and was suggested to post here) I know being an employee I am paid to do what my boss tells me to do, however: I am currently writing a website for my company ...
18
votes
1answer
9k views

Should I publish my public SSH key with user@hostname at the end?

In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I ...
48
votes
4answers
24k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
1
vote
1answer
100 views

Security controls to implement on a private environment

On a large project, my company is responsible of administering the internal servers where applications used within the intranet are installed. One of our sites are accessible from outside but we do ...
0
votes
1answer
140 views

Different certificate information for the same website?

Apologies for the funny title, I'll try to give a better explanation here :) I have just noticed something weird with regards to a website certificate: if I go to https://www.anobii.com/login using ...
0
votes
1answer
4k views

About password_hash() in PHP and storing (part of) its salt outside DB

So, i learned that new in PHP 5.5 is password-hash() which works much like crypt(). Which is more secure (slower) than md5() or sha1(). The result string is algo+hash+salt, which can be passed as-is ...
6
votes
3answers
2k views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
10
votes
4answers
7k views

Managing and storing lots of SSH keys in the cloud

I have a pool of cloud servers (~50) that need to talk to many other remote cloud servers (~4000) using SSH. Each remote server has its own SSH key, so we need a place to store all of these remote ...
0
votes
1answer
417 views

Why does this buffer overflow have payload &system-&exit-&BINSH

I'm following a tutorial to write a simple buffer overflow. I have (basic) knowledge of assembly, and the stack. I've written a stack based buffer overflow before and understood it. The program I'm ...
3
votes
3answers
545 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
0
votes
2answers
394 views

Any residual effects after SQLMAP has been run?

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, ...
2
votes
2answers
3k views

CentOS for security testing?

I am a QA Engineer, but have been tasked with creating a security testing platform. I have many years with Backtrack/Kali and my primary OS are Arch and Ubuntu. The Systems guys here gave me a CentOS ...
18
votes
5answers
2k views

Timing Safe String Comparison - Avoiding Length Leak

Let's say that we're building a generic timing-safe comparison function for general purpose use. Making it so that it is safe when both strings are equal length is pretty well known. However, what I'm ...
1
vote
1answer
112 views

Is it dangerous to sync my data with my personal server through unencrypted http?

Since Apple force iPhone users to use iCloud to sync contacts & calendar, I moved to a local ownCloud instance that works well. However, it would be more convenient if I could sync everywhere and ...
0
votes
3answers
2k views

Is it PCI compliant to send credit card details to the server without saving them there?

Considering I use SSL the whole process. I have an IOS client that I want to use to enter the user's credit card details. I want to do the whole charging and processing on the server side, so I send ...
2
votes
0answers
129 views

Scapy capturing Dot11 headers windows

Is it at all possible to capture Dot11 headers under Scapy in Windows? I'm thinking Winpcap, but I'm not sure how I'm supposed to do that. Any clues?
0
votes
2answers
174 views

Determining if company is considered a business associate under HIPAA?

I am trying to clearly understand the HIPAA regulations a court reporting company must adhere to. Let's say the court reporting company does not directly contract with any covered entities but does ...

15 30 50 per page