0
votes
1answer
74 views

How does the DNS-spoofer know the original destination of the packet?

It's perhaps my lack of deeper knowledge of how the DNS, NAT or TCP works, but I have been thinking about the following scenario and can't figure out the following problem which arises in DNS-spoofing ...
0
votes
3answers
92 views

Two factor authentication(Mobile)

Consider such two factor authentication on web site: say when user enters username/password on web site - and receives SMS on mobile phone number. For attacker to access this he must know your ...
0
votes
1answer
96 views

Mechanism used for offline authentication of software

To prevent user from downloading bootleg copies of software , users often have to enter a string of hexadecimal numbers which would be used to authenticate the user. I think the basic idea would be ...
0
votes
1answer
69 views

Is there a great cheap or free site for the CISSP exam? [closed]

CCCure is not free and many others that are recommended on the site are not free....any suggestions?
0
votes
1answer
30 views

Security risks of allowing customer to use his own domain for a hosted SaaS application

As a SaaS hosting, we are considering allowing customer to use an alternative domain to access his SaaS environment. Default domain owned and hosted by us: customersubdomain.ourdomain.com ...
0
votes
1answer
59 views

Default Encryption - A Panacea or Placebo

I wrote this on LinkedIn - Discrete Discretion My first question is: Is it accurate to say that default encryption is a placebo? Will default decryption only make end-users think they are secure ...
0
votes
1answer
92 views

Why use one URL for all “pages” on my site?

I have heard that I should (A) use one URL for all "pages" on my site, such that what page is shown is determined by the session state, and (B) don't use an extension like .php. One curious fellow ...
0
votes
1answer
30 views

Secure keyboard entry with JavaScript or Flash?

Is it possible to perform secure keyboard entry (similar to what is offered in the OS X Terminal app) using only web technologies and/or Flash? If not, is there any way to more broadly guarantee ...
0
votes
2answers
37 views

To release as Open Source for Audit or to Keep “in house”

For cryptography, it is considered good practice to release the code so others can audit it...is this also true for penetration testing software?
0
votes
1answer
32 views

PKCS#12 File - security impacts when imported in Web Browser or Windows Store?

When a PKCS12 file is imported into a Web browser or Windows store the user is prompted for private key password. How does the browser or operating system manage this password? Is it secure?
0
votes
1answer
71 views

Web app and database on same server, what is benefit of encrypting database data?

If a web app and a database are on the same server, what is the security benefit of encrypting database data? Obviously passwords should be hashed either way. I assume that if an attacker can ...
0
votes
1answer
57 views

What could be the possible exploit for android adware vulnerability?

I have read about the adware vulnerability here. An adware is a software that automatically displays or downloads advertising material like banners or pop-ups when a user is online. I have seen many ...
0
votes
1answer
60 views

Proprietary cards [closed]

I was recently reading about automotive fare collection systems and came across loyalty card systems. In these systems, if I understood correctly, each passenger has a card in which a value, not ...
0
votes
1answer
65 views

How is PayPass/payWave secure when PIN is required after presenting the card to the contactless terminal?

The popular claim is that a chip-and-PIN payment card is more secure than a card with magnetic strip because the card data is hidden deep inside the chip and the ATM or POS terminal sends the entered ...
0
votes
1answer
30 views

length of a session key in EC?

In elliptic curve cryptography what should be the length of session key? Is there a specific metric to choose one, or are they randomly generated? I was studying one paper about defence against a ...
0
votes
1answer
43 views

From a security perspective, why not a screenshot api for browser? [closed]

I mean a javascript api for capturing a renderered html page, or current viewport, and dump content onto an image. While there are obvious attacks, such as taking screenshot of sensitive information, ...
0
votes
3answers
70 views

How to learn IP range from inside company

I'd like to block all users from inside Company X from visiting my website. However I don't work at Company X. Is there an efficient way to learn what the IP is when people inside Company X access the ...
0
votes
1answer
50 views

How secure is internal data on the internet with IP authentication?

I am a app developer and working with another software group at my MEGACOMPANY. Said group wants to put confidential information on the internet and they are very happy with their authentication ...
0
votes
1answer
60 views

Signature scheme using RSA and SHA512

What do you think about this signature scheme using RSA with 4096 bit keys? Being R pseudorandom padding, fixed length (4096 - 512 bits): RSApriv(R || SHA512(M)) I know that it's not as secure as ...
0
votes
1answer
66 views

On my MacBook, is my user password now the Achilles heel of disk encryption?

From a cold boot, the only password needed to unlock the primary encrypted volume on my MacBook's SSD is just that of my main admin user. This was not always the case; it used to be that I could ...
0
votes
1answer
42 views

Could it be insecure to suggest linking accounts to other identity providers based on their email address?

Let's say I have a site where users can log in with Google+ or Twitter. Now imagine a user called Bob going through the following steps: Sign in to my site using their twitter account. I request ...
0
votes
2answers
63 views

Current standard of authentification

What is the current standard of authentification? I thought it is server and client authentification. But I typed for e.g. https://www.google.com/ and checked the packages in wireshark. And there ...
0
votes
3answers
86 views

When to set security questions for a web application?

For enhanced security, we can use security questions and use them as a means for users to reset forgotten passwords or as an additional means for authenticating. When would we be the right time to ...
0
votes
2answers
56 views

How does RealVNC Enterprise Know My System Credential?

After the installation of RealVNC on a Windows computer, the default login username and password via VNC is the same as the system username and password. Can anyone tell me how RealVNC can access such ...
0
votes
1answer
36 views

Obtain X.509 Certificate Fingerprint from Certificate Info

I would like to obtain the SHA1/MD5 fingerprint of an X.509 certificate in order to compare it with the one presented by a server before connecting. However, I currently don't have access to the ...
0
votes
1answer
55 views

Security of host computer and network with Tor

I'm considering running a Tor (non-exit) relay on my personal Ubuntu 14.04 computer at home (which also has my personal data on it). I wanted to know if I should have any concerns about the security ...
0
votes
1answer
44 views

How to manage Cisco ASA series without management cable? [closed]

How can I manage my Cisco ASA device without the management cable? I have not set it up at all, but I have physical access to it.
0
votes
1answer
93 views

How could one defeat Webtrackers

I was just wondering why some pages refuse to load completely while surfing with no-script Plug-in when I don’t allow specific Java scripts. I was wondering if there is some way to hold the tracker ...
0
votes
3answers
126 views

Decrypting SSL over a Mobile Network

I work for a large company and we are trying to judge the safety of some proprietary information that is being sent and received in a new application we are developing. After our initial testing we ...
0
votes
1answer
52 views

SSL over self-implemantation of RSA?

I currently write a client application which communicates with a PHP server. The application itself requires valid user credentials and get all of his information by doing POST requests to the PHP ...
0
votes
1answer
104 views

Using AES in CTR for TCP/IP based network connections - need to encrypt the IVs?

For AES based encryption on TCP/IP connections, I am guessing I have to do the following: Have the 2 parties share a common key, assuming I am doing AES-128 then a sequence of 16 bytes. Ideally the ...
0
votes
1answer
63 views

SSH stealing files from client?

Is it technically possible for a ssh server to steal files from a connected client?.
0
votes
1answer
388 views

ADFS 2012 R2 (3.0) JSON web token validation

Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building: The web app (there are two .NET & Angular) ...
0
votes
1answer
28 views

Getting a DEP exception when trying to call SetProcessDEPException(false)

I'm demonstrating an exploit for an old app. On Windows XP SP3 32bit (EN), the address of SetProcessDEPPolicy() is usually 0x7C8622A4. I have that version of Windows (in English as well) and I've ...
0
votes
1answer
82 views

IP whitelisting as two factor authentication method for server access under PCI DSS

In the answer to my question: Two factor authentication for web application under PCI DSS gowenfawr stated: I have seen other methods used for 2FA than those you mention; IP whitelisting and ...
0
votes
1answer
63 views

Two factor authentication for web application under PCI DSS

PCI DSS 8.2 is stated as follows 8.2 In addition to assigning a unique ID, ensure proper user-authentication management for non-consumer users and administrators on all system components by ...
0
votes
1answer
61 views

Perfect Forward secrecy in TLS session

I am looking at packet captures of perfect forward secrecy for cipher "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256". Per definition of PFS, after initial client and server hellos exchanged, both sides ...
0
votes
2answers
72 views

How to block spammers from using my public email api

I am working on a web application which allows users to share stuff on a web-page by clicking on an 'email to friend' link; similar to what extole is doing here ...
0
votes
1answer
43 views

Segregating network systems and functions [closed]

I want to segregate network systems and functions so that if an attacker hacks in one area, he can't necessarily reach others. What should be the recommendation when information from one network is a ...
0
votes
1answer
50 views

WEP man in the middle

my workplace is currently using a wireless router that is secured using WEP. If I connect a laptop to the wireless router with a cable, would someone that has cracked the password still be able to ...
0
votes
4answers
44 views

Will my existing VoIP phone work if I install TOR?

I currently don't use TOR and I have VoIP - a physical phone using a provider's VoIP service over my Internet connection. If I install TOR, will I still be able to make and receive phone calls with my ...
0
votes
1answer
24 views

How to make sure that only files I generated pass?

I have the following situation: I have an app on a User device, and my main server. The app can send the main server pdf-files and jpg-files. Now my problems are: -> What is the best way for the ...
0
votes
3answers
65 views

How to integrate AAA and otp

We have AAA services enabled in our organization (about 1000 clients). We want also to add otp (one time password) service. What are the main security concerns about integrating them. Is there any ...
0
votes
1answer
87 views

Can I get rid of storing user secrets by using OpenID, and what do I need to store?

What information do you have to keep about a user to be an OpenID consumer? I want to use OpenID to let users register and authenticate on my system. So while I'm at it I want to not duplicate ...
0
votes
1answer
238 views

Can I determine actual orgin of spoofed text message?

Can I determine the actual sender of a spoofed text message? I received a text message yesterday that appeared to come from one of my contacts, but he did not send it. I contacted my carrier (Verizon) ...
0
votes
1answer
36 views

Can we share a folder across regions for PCI Users

We need to be PCI compliant for a small setup. We need to share a folder which should be accessible by other regions as well. We have Private MPLS Connection. PCI users will be having only READ ...
0
votes
2answers
136 views

Is it safe to store encrypted volumes on cloud syncing services?

A recent discussion on another website prompted a proclamation that storing (TrueCrypt, LUKS, DMG, etc) on cloud sync services like Dropbox is unsafe, since a version history is kept of each file, and ...
0
votes
1answer
66 views

Why do private networks use both X.509 and User/Password authentication

For example, the school network I am on requires both a name & password to log in along with having its X.509 certificate installed in my browser. Why does it need both? Shouldn't name and ...
0
votes
2answers
36 views

Using bcrypt in chrome extension [closed]

I am developing a chrome extension for this non profit. Im also working on the server side component as well. Im not a full time developer so most of my knowledge has simply come from years of ...
0
votes
1answer
58 views

Looking for a way to encrypt/decrypt data using a generated key that works in Windows and Linux

I am looking for a way to encrypt/decrypt data on windows and linux platforms. The data gets encrypted in windows and the same data needs to be decrypted on linux/windows and vice versa. I understand ...

15 30 50 per page