-2
votes
2answers
182 views

Could a network host and process programs while securing against piracy?

Consider an ideal service hosting network, which: Lets programmers: Publish a program in such a way that it can't be retrieved. Associate a program with a wallet. Specify a cost per request and ...
3
votes
2answers
181 views

Crypto software: overwrite sensitive buffer

Is it common to implement crypto software in such a way that sensitive buffers are overwritten before free'ing memory? For example when they contain a private key or the plaintext message.
2
votes
2answers
417 views

Does Google 2-step verification protect user from session hijacking?

After signing in Google 2-Step verification scenario, user should enter verification code which sends to his mobile. Without it, he couldn't access to Gmail account. Consider an attacker does session ...
2
votes
2answers
245 views

Does my brokerage/bank use poor password security measures?

I'm no expert. Could someone please tell me if I'm overreacting? After the Heartbleed news broke, I changed a lot of passwords. Here's what I discovered when changing the password on my all-in-one ...
0
votes
1answer
232 views

“No hack no fee” pen-testing agreements [closed]

A common theme in security engineering is that perfect security is impossible (or at least highly unlikely). Consider Johnston's Infinity Maxim: There are an unlimited number of security ...
-3
votes
2answers
163 views

What makes iOS more secure than other phone OS [closed]

Let's start off with an example. Here in Canada, credit card companies cannot upgrade you credit card limit. You need to make a request, that will then get analyzed and then, depending on your status ...
-1
votes
1answer
124 views

How can I get confirmation of new security problem in struts2?

I just read about this new struts2 security problem. I want to tell our developers to patch it, but I wish for some more sources first. The only source he cites is in another language. I guess I ...
3
votes
4answers
332 views

Robots.txt and admin areas

I'm using some popular commercial forum software and to help secure the admin area more I have changed the name of the admin folder; however I was wondering, with regards to robots.txt if I go ahead ...
2
votes
1answer
693 views

SmartCard for private keys - personal usage

I've just found my notebook has a SmartCard reader. Would it be wise/possible/practical to buy a single SmartCard, transfer my private key on that (somehow), and use it as my primary private key ...
3
votes
1answer
103 views

Forensics in the cloud

I recently did a university module on digital forensics and learned a lot about the process, and techniques, of digital forensics investigations. We didn't actually cover the cloud although I couldn'...
20
votes
9answers
2k views

How to get top management support for security projects?

I am facing an issue regarding security projects, for example: last year we bought an antivirus licence for 500 (end point security), and made a policy in order to force everyone to install it, ...
1
vote
2answers
267 views

Is wiping memory at code/end good practise?

Sometimes passwords/hash/keys & other private information is stored in variables and hence in memory/RAM during code execution. while some situations (i.e. Linux Kernels see here Is there any ...
2
votes
1answer
181 views

IKEv2: Why is it important “that each side sign the other side's nonce”

I am currently diging deep into the IKEv2 protocol. In the description of the Authentication (RFC5996, p. 48), the following statement is given: "It is critical to the security of the exchange that ...
-2
votes
1answer
129 views

Spyware for feature phones

There are a lot of spywares for android and ios smartphones. Are there spywares for feature phones ? I am using this samsung phone, which is basic. I am wondering if somebody who has access to this ...
38
votes
6answers
5k views

PHP files browsable: is this a vulnerability?

I have a friend who has a website developed in PHP on which we can browse all his files one after one (of course, we can not read the content of the PHP files). Do you think this is a security hole? ...
3
votes
2answers
263 views

Does having a separate e-mail account only for security, increase security?

In this article about increasing the security of LastPass the author suggests: For additional security, you can have LastPass send security-related emails to a special security email address ...
3
votes
3answers
250 views

Letting users pick up where they left off…without logging in (is this bad form?)

I have a Grails app I'm working on that allows users to fill out a fairly lengthy application form. One of the requirements I've been given is to NOT require users to log in or create any sort of ...
3
votes
2answers
2k views

Google Accessed My MSN Account!

I just received a notification from Microsoft that my Microsoft account has been blocked because it's been accessed by an IP address that's never accessed it before. I received this notification as a ...
1
vote
0answers
43 views

DTLS CertificateVerify doubt

In DTLS 1.2 RFC 6347, section 4.2.6: CertificateVerify and Finished messages have the same format as in TLS. Hash calculations include entire handshake messages, including DTLS-specific fields: ...
3
votes
2answers
432 views

What should I do when I need to store passwords for usage in 3rd party software?

I have a desktop WPF application which authenticates with Dynamics CRM 2011. I ask for the username and password of the user and use them to connect to Dynamics CRM 2011 using CrmConnection.parse("url=...
1
vote
3answers
4k views

Can you export a report from OWASP Zap based off a individual website?

I have a list of 30 websites I have scanned. I need to pull out a report for each individual website. Is it possible to do? Right now I am just running a report and getting the results for all 30 and ...
2
votes
1answer
758 views

Is the following code seeding OpenSSL's PRNG necessary, superfluous, or harmful?

As I was going through Crypt::SSLeay, preparing it for the next release, I noticed the following code, written way before my time, ... int rand_bytes_read; static int bNotFirstTime; char buf[ 1024 ];...
3
votes
2answers
387 views

What's a good time period before refreshing CSRF token of the user session?

I am using a form token to prevent CSRF attacks. Those tokens are stored and tied to a user's session. Now I want to refresh the token only every N minutes or hours so that the user's don't experience ...
2
votes
0answers
310 views

Ruby OpenSSL vs Linux openssl [closed]

I have a difficulty reconciling Ruby's OpenSSL library with the standard Linux command line openssl. What I'm trying to do here is encrypt the string mysecretstring with the password foobar but first ...
-4
votes
1answer
243 views

Most secure SSH server [closed]

Which SSH server (compatible with Debian Wheezy) has the fewest (if any) exploitable security bugs?
2
votes
2answers
757 views

OpenVPN seamless migration from 1024-bit RSA to 2048-bit RSA keys

The company I work for has a few OpenVPN servers used by over 200 employees. The servers were deployed a few years ago using the default easyrsa settings and now we want to upgrade to stronger ...
0
votes
2answers
657 views

Check if i'm using a filtered network [closed]

I would like to know if the connection in my office is filtered, because i cannot access Faceboook neither Youtube but i can access google with no problems, but Tor i can access all the websites. i ...
6
votes
3answers
3k views

Is it good idea to rely on Mifare UID for security/authorization reasons?

Several systems rely on using UID of smart card for identification/authorization. For example database stores list of smart card UIDs and corresponding privileges. Given that today there exist cards ...
0
votes
1answer
6k views

Use SSH config file with Putty [closed]

I'm using SourceTree (a Git GUI) which uses PuTTY as SSH client. I need to push some code into a repository for which I need to tunnel through SSH to do so. The trouble is, the repository and SSH ...
0
votes
0answers
184 views

Reverse proxy and corporate PKI

Here at OU=PKI we've been requested to issue a certificate with CA capabilities to install it in our reverse proxy, so that it could issue trustable certificates for every single web. (SSL ending) ...
1
vote
1answer
8k views

Understanding the details of SPI in IKE and IPsec

I'm currently learning IKE and IPsec for an exam. I have a lot of information on how Security Parameter Indexes (SPI) are used in both protocols, but I'm having some problems figuring out the ...
0
votes
1answer
6k views

How to install Metasploit on Mavericks + MacPorts? [closed]

I would like to install Metasploit on an hardened OS. For this purpose I chose Mavericks just because I'm able to harden this OS pretty far. I would like to install Metasploit with MacPorts because ...
-2
votes
2answers
685 views

How to avoid session sharing inside the same network

I was thinking about a situation to avoid session sharing or hijacking, validating the IP the user logged in against the ip that is accessing any page after log in. It was working until I figured it's ...
1
vote
1answer
380 views

Is hashing a DLL useful to protect from DLL hijacking?

I want to make sure that the dynamic link libraries used by my application can't be replaced with other libraries of the same name, in order to inject malicious code. Therefore, I thought about ...
2
votes
5answers
289 views

How do big companies ensure that other people don't register a new top level domain with their name?

For example today there are ".codes", ".farm" and ".vaijes" newly available. How do big companies like google, facebook, twitter, .. keep sure that they are the first who register their name on the ...
-1
votes
1answer
48 views

OpenSource considered harmfull?

What would you think about military strategist who is publishing full plans for all of important infrastructure? I think that person will be stupid. Can be this analogy case with OpenSource? Here is ...
0
votes
1answer
52 views

Is there a general name for this sort of cryptographic protocol?

Is there a general name for this sort of cryptographic protocol? If so what sort of assymetric/symmetric encryption functions tend to be used for this protocol?
1
vote
1answer
2k views

What is the point to the IPEK in DUKPT?

I'm trying to understand the DUKPT (Derived Unique Key Per Transaction) system used for PIN devices, but I'm getting hung up on the IPEK. This blog post has an image where the sequence is: BDK (...
5
votes
3answers
912 views

How are private keys stored on disk?

I have a public and secret key pair in my .ssh folder. How is the secret key being stored on disk? What I mean is .. Is it possible for someone to hack into my computer, steal the secret key and use ...
16
votes
3answers
2k views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
2
votes
1answer
396 views

Challenge Response Login Authentication with Password Salt

I want to implement a challenge-response login authentication for my web application. My understanding is that the server has to send back the password salt for the user so that the user can ...
2
votes
1answer
313 views

Understanding Hearthbleed attacks [duplicate]

In order for a Heartbleed attack to happen and for someone to grab the SSL private key and even spy they have to be on the local network with a router, switch or server, correct? Or can this be done ...
0
votes
1answer
997 views

Detect possible router attack attempt

I have huge problem with my router: Sagem F@st 3202. Here are some Security log events: Inbound Traffic | Blocked - Default policy | TCP XX.XX.XX.XXX:80->XX.X.XX.XX:51707 on ppp0 [...
4
votes
2answers
840 views

Retrieving CSRF token cross-domain using JSONP, risky?

Looking at this previous question, the answer suggests that using a GET request to retrieve a CSRF token in order to make a POST is a legitimate method of preventing CSRF attacks. I have two websites,...
2
votes
2answers
1k views

Which hashing algorithm is ideal for use on the web? [duplicate]

I am new here, and have poked around the site looking for an overview of which hash algorithm to use on the web and why. It seems to be the consensus that SHA-256 or other SHA-2 family algorithms are ...
2
votes
1answer
2k views

Is there a maximum allowed key size in the USA?

I've heard that using encryption outside military use has been illegal for a long time in the USA. However, I've also heard that when the regulation was updated, limits were put on encryption strength ...
13
votes
1answer
17k views

SSL Certificate framework 101: How does the browser actually verify the validity of a given server certificate? [duplicate]

Sorry I know this is a complete noob question and at the risk of posting a somewhat duplicate topic. I have a basic understanding of public/private key, hashing, digital signature... I have been ...
1
vote
3answers
303 views

How can I add a layer of security to cleartext passwords and SSL?

I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is. I know that most people believe that sending cleartext username/passwords ...
1
vote
1answer
227 views

App permissions to access hardware “at any time without your confirmation”

On Android applications now some applications say that they want access to things such as speaker or camera "at any time without your confirmation". I wasn't sure if this meant that it does not ...
3
votes
2answers
780 views

Random token and email confirmation key of 10 chars sufficient?

I have a function that returns random unguessable keys with the following characters: a-z A-Z 0-9. I have set the key length to 10 and I am using that for my form tokens to prevent CRSF and I will be ...

15 30 50 per page