2
votes
1answer
43 views

How do I securely store passwords in my database? [duplicate]

Creating a database for a small question and answer platform and need a way to attribute or create a password protection scenario for the user table.
2
votes
4answers
2k views

Outbound DDOS attack from a centos server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
1
vote
6answers
4k views

Is this authentication scheme secure?

I want to authenticate a client of a webpage and make sure it is a particular user. Let say that we already agreed on a particular hash (SHA256, actually, which I think is secure enough for this) and ...
1
vote
8answers
3k views

How to avoid reveal password in a form?

I've recently discover that if you use inspect element to see the source code of the Html, you can change this <input type="password"/> to <input type="text"/> then you can see the ...
1
vote
4answers
6k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
1
vote
3answers
10k views

How do I hide files inside an image without using any steganography tools?

I want to hide files inside a picture. The files may be music or video. Is it technically possible to do this? If so, how? I searched on Google to find methods. Please suggest some methods for ...
1
vote
4answers
711 views

Protecting yourself from a malicious VPN

I am connecting to a VPN server that has been compromised and is under the complete control of an attacker. The virtual network itself contains numerous attackers waiting for a new target. What ...
1
vote
4answers
527 views

Are there vunerabilities with this authentication mechanism?

I am trying to come up with a way to implement token-based authentication for a REST API without the need for SSL. The goal here is to avoid sending any sensitive information across the wire. I was ...
1
vote
1answer
632 views

Poodle - possible to protocol downgrade if SSLv3 is disabled but still have SSLv3 ciphers enabled?

My title pretty much sums it up. If I have: A server with the SSLv3 protocol disabled BUT still have SSLv3 ciphers enabled. Would that mean that a protocol downgrade attack can still occur?
1
vote
3answers
1k views

VPN only for a specific software

In our company we have a software which requires a VPN to be connected in order to properly work. However that is not the only software we use here. The problem is that other software get way slower ...
1
vote
5answers
1k views

Why do we use passwords on sites? [duplicate]

I don't have passwords for my personal sites. To sign up a user pick their username and enter their email. There is a logout button if the user wishes to log out. To log in you enter your email and ...
1
vote
5answers
261 views

Can I convert a public key to a private key?

I am using pgp4usb for encryption and decryption. I accidentally deleted it but I still have my old (public) PGP key. Is it possible to import it and use it again as my private key? The key is ...
1
vote
3answers
1k views

When to use SSL ? / When to send passwords via mail?

Self-Proclaimed Experts are quick to say that for every time a password is being transmitted from a webserver to a user and vv, you need to use SSL. Because there will be people each time trying to ...
1
vote
2answers
9k views

Why does OpenSSL not include AES-256-GCM? [closed]

I'm trying to implement AES-256-GCM in Ruby. Ruby's OpenSSL wrapper library and aead library both clearly seem to believe that OpenSSL itself supports this. However, neither 0.9.8r (which I had ...
1
vote
3answers
1k views

How to find the OS of the target machine

I am new to this field. Currently I am using Linux OS and my question is how can I find the OS of another machine to which I do not have a direct access. I am interested in any possibilities which ...
1
vote
2answers
468 views

Signal listening

Is there a way to know if someone listens to signal I produce (air signal as well as signal on network)? Is there a way to know if the signal was listened along the way until the signal is reached to ...
1
vote
4answers
14k views

How is HTTP PUT and DELETE methods insecure, if they really are? [duplicate]

If I really need to use these methods, how do i make sure they are secure? Edit: Is there a link or source where I can see how to make sure that 'PUT' and 'DELETE' methods are not able to delete or ...
1
vote
2answers
2k views

What justification is there for Comcast to block SMTP port 25 outbound from residential service?

Within the last week, Comcast seems to have started blocking port 25 outbound from their residential internet service. I can sort of understand why they might justify blocking it inbound as perhaps ...
1
vote
5answers
2k views

What is Non-Repudiation of content? How can we combat it?

Can anyone explain precisely the term of non-repudiation of content (eg. of email)? What sort of security requirement is used to combat this? Perhaps a digital signature? This is how I understand ...
1
vote
1answer
320 views

Why does SQL not escape/sanitize by default?

First, since there is no SQL stackexchange I am not sure where the best place to ask this question is (I debated between here and programmers.stackexchange). If this is the wrong place, please move ...
1
vote
3answers
533 views

A service that claims beyond army level encryption

I would like to understand if this service is as safe and good as it claims to be: https://unseen.is This is what they say: ... Many other services that offer encryption keep the key, but ...
1
vote
3answers
2k views

What is “download-new.com”?

This strange site came up as the second result in a google search for itunes. http://download-new.com/apple-itunes/ (Although the url in the result read itunes.download-new.com.) Embarrassingly, I ...
1
vote
1answer
2k views

Hacked site - encrypted code

Couple days ago I gave noticed that almost all php files on my server are infected with some encrypted code and in almost every file is different. Here is the example from one of the files: ...
1
vote
5answers
87k views

How to effectivily block torrents on my network?

Hie, As per my network policy, we have to block all torrent traffic from network. To do this, I used to block all ports above 1024 on my firewall/proxy devices. But due to this, many other ...
1
vote
4answers
315 views

What configuration will allow another computer in the internet to probe my computer's ports?

I've just tested my computer with Gibson's port scan test: The test results stated that my system is "uncommon". It also said that my computer deliberately chose not to return. But I did not do any ...
1
vote
2answers
1k views

which hashing algorithm is better to use to store a password, sha256 or sha512? [duplicate]

which hashing algorithm is better to use to store a password, sha256 or sha512? I know that sha512 is more secure than sha256 but I was wondering if it has some disadvantages or it is completely ...
1
vote
4answers
278 views

My email hacked

Someone has definitely gained access to two of my alternate emails. I know this by looking at the login activity. By looking at the email logs I discovered that the IP that is always gaining entry to ...
1
vote
6answers
359 views

Can people know the server I'm connecting to despite being on SSH/HTTPS? [duplicate]

I understand that by connecting securely over SSH or HTTPS, the data that I transfer is cryptographically secure. However, can someone spying on my connection still determine the server I'm sending it ...
1
vote
2answers
4k views

Which browsers are using openssl

It is asked in stackoverflow, but I suppose maybe it is more suitable to ask here. It is said that openssl are widely used, however, as far as I know, the most popular browsers seem not use openssl, ...
1
vote
1answer
3k views

Are post requests secure?

If a post request is sent from a client on a website without SSL, is the request secure? For example, I visit a site badsecurity.com, and I login using a password: Will this password be encrypted ...
1
vote
1answer
404 views

I need a good cryptography algorithm that can be encoded and decoded

I have realized some time ago that we should not put the login/password for accessing a remote database server directly into a executable file because of the reverse engineering and memory decoding. I ...
1
vote
5answers
351 views

Secure login feature with low CPU power

I'm developing a program that contains a login function in C++. The problem is that I don't know how to develop it in my situation. I want to run the software on a raspberry pi, it only has a CPU ...
1
vote
5answers
665 views

Does shuffling a hashed password increase its security?

I am making a web app and I'm now stuck on making the login secure. I'm thinking of adding a salt to a user-inputted password and then hash it. (md5 or sha for example) and then I will reshuffle the ...
1
vote
4answers
2k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
1
vote
3answers
655 views

Danger of Path Traversal Attacks

I have setup a test application in Linux. I havent checked for paths in it, so if user enter /etc/passwd , then that file gets displayed to him. However, I want to understand what more can be done if ...
1
vote
4answers
151 views

Do technical advice sites sometimes link to malware, and if so, how should we properly research errors? [closed]

Suppose you get an error on your PC that shows up randomly, then you do a search on the internet for the error to find out how to fix it. Typically, you will get some sites that offer a solution, but ...
1
vote
2answers
345 views

Dangers of robots.txt?

During a recent scan of my website, a robots.txt file was found and in it contains Disallow: /subsite1/ Disallow: /subsite2/ In order not to show any paths in robots.txt, as I am afraid that ...
1
vote
4answers
675 views

Can a certification authority sign another CA's certs?

Disclaimer: I have low knowledge of X.509 and PKI, so I would appreciate an answer that is not entirely technical, i.e. by using real-life example scenarios.) I was searching for information ...
1
vote
4answers
2k views

Log in with email is more secure than a username?

Within the design of my web application, I am trying to now choose the final steps of the members profiles for security. *I need to choose if I should use a system which you login with a username or ...
1
vote
3answers
201 views

Simple explanation of Port Knocking

I was just referring to this article: http://en.wikipedia.org/wiki/Port_knocking The term Port Knocking, as explained here, was slightly confusing and I was feeling difficulty in getting the hang of ...
1
vote
2answers
3k views

Is cross site scripting possible with the img alt attribute?

My question is, if any characters are allowed in the alt attribute of an img tag (except for double quotes), is XSS possible? Valid image or not.
1
vote
2answers
397 views

Is a C plugin safe if I read it through an echoing parser before?

I wanted to use sharable plugins for an application. However, the plugins were extremely time critical, so I wanted to distribute them as C libraries. Now, these are not guaranteed to be safe (the ...
1
vote
2answers
1k views

Possible attack on website

I am a developer and I therefor I have very little knowledge on security. So I need some help understanding the attack on website which we launched recently for one of our client. Website is built on ...
1
vote
3answers
223 views

Where to publish security research?

I'm considering doing some research in to an attack vector which I think doesn't get enough attention. It's not an earth-shaking vector but I think I can demonstrate an attack where none have been in ...
1
vote
4answers
234 views

Is there a need to define “language safety”?

Language safety is not clearly defined while there're warnings about for instance Java. So how can you say that language is not safe while language safety is not clearly defined? If Java is unsafe ...
1
vote
1answer
262 views

uninstall and reinstall after hacking [closed]

My computer has been hacked. If I uninstall and reinstall do I loose my files? The facebook tech tried to sell me a number of pkgs ranged $149-$299 and told me that my account was hacked as was my ...
1
vote
3answers
11k views

PING BLOCKING: How to do? How to break?

I can access each page of a site through the browser (firefox). I can also see the ip and port address in firebug, but when I open cmd->ping site ->it says "request timeout". I also tried traceroute. ...
1
vote
2answers
846 views

Are there any strange things with google.com over HTTPS?

So I'm always browsing the web through Privoxy using minimum these rules: vi /etc/privoxy/user.action { +redirect{s@http://@https://@} } .chrome.google.com .code.google.com .docs.google.com ...
1
vote
2answers
1k views

Which encryption algorithms will be used to replace RSA when quantum computers become common? [duplicate]

Possible Duplicate: Are the encryptions "broken" with great computing power? I just wondered which algorithms will be used once quantum computers become common. Are there already ...
1
vote
2answers
593 views

Where can I find some “real time” discussion forums for security issues? [closed]

The place where I work was hit by the new Qakbot variant (3rd generation) a couple of days ago and it has been brutal. Unfortunately a lot of the documentation out there is from the 1st iteration of ...

15 30 50 per page