1
vote
2answers
338 views

Hash function with configurable length

Here's a short question: does a hash function with configurable length exist? And if not, why not? Would it be a problem?
1
vote
3answers
3k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
1
vote
2answers
503 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
1
vote
5answers
2k views

Encrypt-function inside PHP code that you have to publish

If you write a PHP application, where you have to deliver the compiled code to the customer, how could you include a functionality to send encrypted data from that application to others, and include ...
1
vote
5answers
552 views

Should I enforce a password policy on a web site?

For a commercial web site, is it important to impose some restriction on passwords to access the system? Eg. special $char, Upper and lower case, numbers, at least a minimum length... Can a CAPTCHA ...
1
vote
3answers
10k views

Is it possible to get the encryption key when you have the plaintext?

I have a question about SHA256. I know that this algorithm was used to encrypt a text, which I have. I also have the encrypted version of this text. My question is, can I somehow get to the encryption ...
1
vote
2answers
234 views

Is there any risk in posting “local info” to the Internet?

Previously when I posted a screenshot online, someone told me to erase out my usernames, computer names, domain names, etc: Is there actually a need to do so? A quick Google search shows that many ...
1
vote
3answers
676 views

What is social engineering, how does it relate to security and how can it affect my business? [duplicate]

Possible Duplicate: Is social-engineering an actual threat What is social engineering? Can you give me some examples? Can social engineering have a big impact on business?
1
vote
4answers
17k views

Netcat IP Spoofing

I am connecting to a server nc -v 192.168.0.1 1111 But I want to do IP spoofing because the server on 192.168.0.1 only accepting commands from 7.7.7.7. We are two friends, I am 192.168.1.1, and my ...
1
vote
4answers
439 views

“Who the entity knows.” I've Googled for weeks and can't find results

A lecture slide mentioned methods of authentication, one of them being. Who the entity knows. But the lecturer said it was up to me to research it. I've Googled as hard as I can but to no avail :( I ...
1
vote
2answers
2k views

Thoughts on Tiny Encryption Algorithm (TEA, anyone)?

I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites. Specifically, using the code presented at PHP-einfach.de Does anyone have any experiences / thoughts / ...
1
vote
3answers
286 views

How to (further) ensure SSH security?

I set up my Linux Ubuntu machine as an SSH server through no-ip.com and it works great. Recently I discovered the command, sudo lastb -ad -F -w which outputs a log of the most recent failed SSH ...
1
vote
3answers
235 views

Why would a replay attack be considered a threat to integrity and not confidentiality?

I came across a test where the instructions were to circle all the correct answers. I'm looking for an explanation to the answer for this question: Question: a replay attack is a threat against ...
1
vote
3answers
408 views

What would be a good set of criteria to consider a password safe? [duplicate]

Nowadays we see many websites with a "security meter" for the password. I actually think this is a great feature since it gives the final user the sense of how insecure their password could be. I ...
1
vote
4answers
386 views

HTTPS: is the data downloaded when loading a page encrypted?

So as far as I know, when you go to a https enabled website, all the data you send to that server will be encrypted with their public key, and only the server holding the private key will be able to ...
1
vote
1answer
731 views

Untrusted connection visiting https://www.opensource.apple.com/

Somebody on Stackoverflow posted some code from https://www.opensource.apple.com/ When I click this link in Firefox (36.0) it says "This Connection is Untrusted". But other people on that thread on ...
1
vote
2answers
202 views

How does iOS prevent unauthorised code from running?

I'm just wondering. How does iOS prevent someone from executing code on their device that isn't from Apple or downloaded from the App Store? Also what exactly, does a Jailbreak do to allow ...
1
vote
3answers
2k views

How to tell if my laptop is being spied on

I've been trying to determine if there is malware on my OS X 10.9.3 Mac, that is could be doing keylogging or other forms of non-destructive intrusion. Given the (not technically based) suspicion I ...
1
vote
4answers
210 views

How different should passwords be?

It seems to be generally accepted the same password should not be used for different sites or devices. How different should passwords be? For example +_^gum<JW1 and +_^gum<JW2 are very similar. ...
1
vote
2answers
21k views

How easy is it really to do IP spoofing? [closed]

I read a lot about IP spoofing but I am not sure how easy it is really to do. Let's say I am in Spain, can I somehow connect to a server in the US with an IP address that is allocated to Mexico? Won't ...
1
vote
2answers
150 views

understanding the point of VPNs

I can't really understand the concept of VPNs, since we already have various secure transmission protocols. Isn't the point of VPNs that people using its 'channels' can send encrypted data to each ...
1
vote
2answers
863 views

Is SSH secure and what are the recommended modes of operation?

Given the recent confirmation of weakened and broken encryption schemes and implementations, how does the community feel about the security of SSH? It seems there has been very little discussion ...
1
vote
4answers
2k views

Can Cross site scripting lead to database access?

I wanna know that weather a site having XSS vulnerability can lead the hacker to access database? I know that he can get the username and password from the cookie stored but can he completely access ...
1
vote
3answers
13k views

Is it possible to find who posted comment on my blogspot anonymously?

Problem Behind question : I own an blogspot site and people used to come and comment on my posts. In recent days I can see a spammer who comments anonymously on my every blog-posts. The comments were ...
1
vote
1answer
344 views

If my website does not take any user input, is there any danger in showing my code and folder structure?

First time posting here; apologies for any mistakes I've made, please edit, retag, migrate as appropriate. I have a simple homepage whose purpose is (essentially) to contain my contact info and some ...
1
vote
3answers
133 views

Are different top level domains somehow different security wise?

If so why is the difference? I've tried to google it but nothing relevant was found.
1
vote
2answers
13k views

How can I monitor traffic of devices on my WiFi? [closed]

I have my kids cell phones attached to my router. What can I install to view what they are browsing and the media they have? I want to make sure my kids are safe
1
vote
3answers
583 views

What about fuzzy passwords? For “correct” entry within a margin of error?

I'm wondering if a fuzzy password system would be in any way beneficial to users, or worth implementing. The idea would be that a certain margin of error is acceptable for allowing the user to log ...
1
vote
3answers
259 views

Is a web application being built on an open-source platform less secure because it is open-source?

With the recent news that microsoft are releasing the source code for their ASP.NET Web API and web pages 1 I'm wondering, Does having access to the source code of the underlying libraries a web ...
1
vote
3answers
159 views

Hash algorithm that provides less than 10 bytes

I know it's insecure, but I need to for number of profile; I need a hash algorithm to provide less than 10 bytes.
1
vote
2answers
139 views

Is this spam SMS containing an audio file dangerous?

Yesterday I received a group text message from a number I don't know and opened it by mistake. I was in a group chat with two other people, one in Pennsylvania one in Massachusetts. The message body ...
1
vote
3answers
246 views

Deep Packet Inspection SSL : How DPI appliances prevent certificates warnings?

How Deep packet inspection (DPI) tools prevent from certificates warnings through decrypt and re encrypting packets ?
1
vote
3answers
275 views

Using a stolen certificate on a server

Yesterday I asked the following question regarding what would happen if you placed a stolen certificate on your own server and edited the 'host' file so that the DNS name matched: Could a stolen ...
1
vote
2answers
109 views

Protocol for secure communication over HTTP

Inspired by this hot question: Is there any reason to block HTTPS? Is there a way to setup an own server and encrypt all normal requests in the request body? So for an outside person it would look ...
1
vote
3answers
864 views

Can websites tell whether that I am visiting them using the same device?

Assuming that I am browsing a website ( say: Amazon.com) using Private/Incognito mode, and I clear my cookies, and have VPN turn on. Will the website still be able to identify that my device has been ...
1
vote
3answers
216 views

Is a normal user allowed to view site's CSS sheet

I am looking at IDS (intrusion detection sensor) logs where some one tired to get a .css sheet through a URL. Ex: www.site.com/CSS/Main.css - which throws a CSS sheet in the form of text file. Is ...
1
vote
2answers
1k views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
1
vote
2answers
146 views

Is there any security in locking down a router by MAC address for wired clients?

At our office we have a router on the table, and the powers that be want to lock it down by MAC address to stop people from plugging in cables for other computers i.e. intruders. Given that resetting ...
1
vote
2answers
2k views

SSLStrip vs HSTS

I've heard about the new SSLStrip and how it is able to bypass HSTS. Where can I find an article that talks about this? How does this work? Where can I download it? Moxie's website has not been ...
1
vote
2answers
212 views

With RSA, can one ensure that two entities will not have the same private key?

With the RSA encryption algorithm, is there any guarantee that two different entities will not be given the same private keys?
1
vote
3answers
271 views

As a non-security professional how should I respond when told my site is insecure?

We have a website, and somebody wrote us an email claiming we are insecure! What should I do
1
vote
3answers
301 views

Create live USB that hides IP address from foreign government

I may have to visit family in a few months overseas. Unfortunately, the local government of the area my family is from has gotten more corrupt and vicious. I am compelled to go here and may need to ...
1
vote
3answers
10k views

Intercepting wifi traffic

So people always talk about how if you use http over a shared wifi hotspot, people will be able to see your unencrypted data, but I have never been able to make the direct connection from a network ...
1
vote
3answers
153 views

Why does changing physical router not warn of possible man in the middle attack?

Situation I swapped out a dead router at home today. I setup the new router with the same SSID and encryption settings. The devices on my network acted like nothing had happened and are happily ...
1
vote
2answers
981 views

Is exploit researching different from penetration testing

I'm confused by some terminology - reverse engineering seems to me to be pretty similar to exploit researching. I mean if you can reverse one program probably you will be able to find a vulnerability, ...
1
vote
3answers
331 views

What is the safest way to copy a file from an untrusted system?

Scenario: There are two computers running GNU/Linux, U and T. U is untrusted and T is trusted. A non-executable file F (which may however have been infected with malware) resides on U. (For ...
1
vote
5answers
899 views

Authenticate user without knowing their password

I'm working on a project where each each user will have a public/private RSA key-pair. Users will be able to send encrypted messages to each other using the each target user's public key so that only ...
1
vote
3answers
11k views

How long is a 2048-bit RSA key? [closed]

On stackoverflow: '2048 bits, or 1400 decimal digits' http://stackoverflow.com/questions/11832022/why-are-large-prime-numbers-used-in-rsa-encryption On Wikipedia: 'RSA-2048 has 617 decimal digits ...
1
vote
2answers
93 views

VCS to manipulate returned trees to prevent leaks? [closed]

I am wondering if there is any system that would change source code trees in subtle from version control systems in ways that are hard to discover (i.e. whitespaces at the ends of lines, perhaps even ...
1
vote
1answer
504 views

Use brute force to mitigate brute force

Just an idea I had, and I am sure there is a lot of material about this subject, so I am looking for a pointer as to where I can find more information. My idea is this... When storing a password in ...

15 30 50 per page