0
votes
1answer
85 views

How can clicking a link in a Facebook users news feed compromise their account [closed]

I've been confused about how it is possible to compromise a Facebook user's account simply if that user clicks a link. Recently a friend of mine on Facebook posted a series of links to what appeared ...
0
votes
2answers
117 views

How does HTTP Basic Auth persist across pageviews?

I am familiar with the basic workings of HTTP Auth, but how does it keep track of authentication between page views? I see there is no cookie created when the initial authentication takes place.
0
votes
1answer
51 views

Can two parties sign each other's certificate and exchange without CA?

Is possible (and practical) for two users to create their own self-signed SSL certificates, exchange these certificates (perhaps in a face-to-face meeting), and then communicate with each other ...
0
votes
2answers
717 views

how can I stop someone from watching my internet history? [duplicate]

I use someone's wifi network. Is there anyway to stop him by getting my browsing information or can I somehow hide my browsing history from him?
0
votes
1answer
352 views

How secure is split tunneling on a VPN?

What protocols get encrypted and go through the VPN? Is it just port 80 and DNS traffic that does not go through the VPN? Does this impose any security risks by running a split tunnel? Making the ...
0
votes
1answer
99 views

Mobile authentication

I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/userfriendly. I've been looking around ...
0
votes
1answer
102 views

Security of starbucks gift card redemption feature

Someone sent me a Starbucks gift card. The email contained a redemption link, and that redemption link ended in a long secure hash, much like those on github secret gists. Clicking the redemption ...
0
votes
1answer
73 views

How should I validate an API key for a web service deployed via iframe?

I'm working on a small web service that provides some functionality that can be embedded in a web page with an iframe. As this is a subscription-based service, I'd like to be able to manage who can ...
0
votes
1answer
103 views

Gmail Voicemail Encryption

I want to listen to my voicemails in a secure but convenient fashion. I plan do this by having my PBX encrypt the voicemail using openssl aes 256 cbc with salt and a single static password. The ...
0
votes
1answer
49 views

Are there any exploits in Movable Type that allow the attacker to delete the movable type files?

I'm a developer for a web site; we have a small blog powered by Movable Type that we added a few years ago. The blog doesn't get a lot of traffic or attention; we just noticed a couple of days ago ...
0
votes
1answer
29 views

From a deployment and OPS perspective, should a S/MIME signing and encryption key have different expiration dates?

Assuming the client supports different keys, what is some rationale that should be considered for signing and encryption keys? The encryption key needs to be present on each device that is used to ...
0
votes
2answers
81 views

In addition to using strong hash algorithms, what is a good “password requirement”? [duplicate]

Assuming the use of bcrypt/scrypt: Would it be a good idea to "require" a password of at least 12 characters, also mentioning the possibility of using long passphrases, instead of your typical ...
0
votes
1answer
74 views

Is it possible to create a SMIME only PKI that *can't* be used for SSL?

Assume I have a Root CA that I want to share with hostile untrusted 3rd parties. Then constrain this root using specific EKUs at the root. OID=1.3.6.1.5.5.7.3.4 ; Secure Email Next, ...
0
votes
2answers
68 views

What type of probing sends GET /“ data ” to a server?

During monitoring of webserver logs I've stumbled upon those standard probings for wordpress exploits etc, like No route found for "GET /wp-login.php" (uncaught exception) No route found for "GET ...
0
votes
1answer
1k views

Kali Linux /etc/shadow encryption type used by default?

I know that shadow's file hash follows this syntax: $id$salt$encrypted Where ID is the algorithm used: $0 DES $1 MD5 $2a Blowfish $5 Shadw-256 $6 SHA512 My shadow: ...
0
votes
2answers
53 views

Is it secure to use email to add content to a website?

I have a website running a social network Buddypress. Users leave comments on other users "walls". What I would like to do is to allow users to reply to each other inside the email client, without ...
0
votes
1answer
120 views

Choosing the Path in IT Security [closed]

I graduated last year from an Informatics and Security degree program. This program was taken in a Canadian college. It equipped me with the basic security knowledge in all fields; networks, systems ...
0
votes
1answer
573 views

How is the new “Dyer” malware bypassing SSL?

Apparently the new Dyer malware is bypassing SSL to swipe bank credentials. I read that it's using "process hooks" to hook the browsers and see the data BEFORE it is encrypted and sent to the bank ...
0
votes
1answer
130 views

Wireshark: could “Follow TCP Stream” yield an empty window? or is it a bug?

I am capturing a pop3 netcat connection (port 110) using Wireshark, on Debian linux (Kali). After filtering packets with (tcp.port eq 110) I get few packets but once I R.Click on any and click "Follow ...
0
votes
2answers
85 views

Security of this account login system

I have an idea to implement a account system using email and passwords for games. Im intending to have the account creation and forget password systems on a webpage. So if users will have to access ...
0
votes
1answer
169 views

Block specific packets/sequences of packets to remove disturbing client “feature”

Recently, one of my client-server application started to disturb me with some very annoying "notifications". Basically, what happens is that the remote server sends a few packets to my client, which ...
0
votes
1answer
52 views

ACL managed with roles

I have resources in an application. Further I have a table holding all resources and for every resource what role is allowed to access it. I also have defined a Table holding all uses that are ...
0
votes
1answer
570 views

ECC Public Key length differs from bit representation

A 256 Bit ECC key-pair (256 Bit is supposed to be the length of the public key) generated with OpenSSL using this command from the manual: openssl ecparam -name secp256k1 -genkey -noout -out key.pem ...
0
votes
1answer
127 views

SNORT alert for Trufflehunter SFVRT 3:29312:1

I am seeing this Snort alert show up multiple times a day, but my Google-foo is failing me, as I can not find any information about this alert on the internet. Can anyone point me in the direction ...
0
votes
1answer
99 views

Beating CSRF using Tokens

I am new to web programming. I read an article where they advised to use tokens as a hidden field in forms and match that token at the server end to detect non-legitimate requests. I am wondering what ...
0
votes
2answers
353 views

honeyd is still a good alternative?

I've been investigating to deploy a honeypot for research purpose, Honeyd seems like the most popular and adequate option to my needs, but it seems too old, the last version of this software was ...
0
votes
2answers
93 views

how long do lowercase alphabets-only passwords have to be to match more complex ones? [duplicate]

Lowercase-only passwords are convenient for phones since we dont hit shift or go to characters page(each which is as much effort as hitting a character in my Android devices). But how long would a ...
0
votes
1answer
458 views

TrueCrypt alternative (encrypt partition)

I need to encrypt a partition, truecrypt could use keyfiles, (images and other) Is there any other encryption tool with GUI which can encrypt entire partitions and not only files/folders?
0
votes
1answer
171 views

Security risk among shared wifi users [duplicate]

I understand that the shared users on a wifi can see each other's HTTP traffic using proper tools. Is it possible for shared users to read HTTPS traffic or encrypted traffic like TOR ?
0
votes
1answer
169 views

Hipaa Compliant Server

I have an instance in Amazon EC2 and need to be HIPAA compliant. I have two questions, Should I need to do a block level encryption of the database storage. Should I need to encrypt sensitive data ...
0
votes
1answer
54 views

Identity theft from ubuntu machine? [closed]

Recently my debit card information went to another hand, and he/she started to using it until my bank reports that there is an overdraft. I use Ubuntu 14.04 machine. I am sure I am not a victim of ...
0
votes
1answer
85 views

Is a PCI scan required for LAN outer firewall with no open ports?

I have recently been trying to get my company ip addresses scanned with Comodo HackerGuardian. My website needed some adjustments to ssl but after they were made it passed the scan. As we also have a ...
0
votes
1answer
182 views

Is it possible to avoid PHP string validation with malformed UTF-8 string?

Some of the old PHP string functions for example explode() are working with UTF-8 strings, but they don't work properly on malformed UTF-8 strings. Is this a security issue? Is it possible to avoid ...
0
votes
2answers
114 views

For a computer client, is physical security the most important measure?

Is being online all the time the root of all evil, when it comes down to private computer clients security? Would a not-always-connected-to-the-internet system, solve most of our problems? In a ...
0
votes
1answer
98 views

How can I tell if my ISP account password is encrypted?

How can I be sure my ISP encrypts my account password? I found out accidentally that mine did not. I had called to report an interruption in service, and in the process of "troubleshooting", the ...
0
votes
1answer
146 views

Router level filtering on home network [closed]

I want to block some part of a website or some videos from dailymotion or other site video sites. Type of network I have 7-8 devices(PCs, Mobiles, iPhones & tablets) all connected to a router ...
0
votes
1answer
569 views

copy protection (or licensing) mechanism for an android app

I am trying to implement a copy protection (or licensing) mechanism for an android app. The app is not distributed through Google Play or other online market and instead it is distributed through ...
0
votes
2answers
499 views

Heartbleed check for mobile and mobile apps

I have run a heartbleed detector from Lookout on my Android phone. It says: The version of openSSL is affected by the heartbleed bug but the vulnerable behaviour is not enabled. What does it ...
0
votes
2answers
51 views

Manipulating data during a MiTM

I'm trying to learn some attack methods by myself and I have hit a wall where I can't find any information. I have successfully performed an ARP MiTM between 2 systems and I am able to sniff the ...
0
votes
1answer
39 views

Multi flows snort rule

Is it possible to write a snort rule that match on 2 different flows? For instance on a communication from host-a <--> host-b that happen at the same time as a communication on host-a <--> ...
0
votes
2answers
204 views

How do gift card resellers prevent sellers from re-using pin and card numbers

There are multiple gift card reseller sites that buy your gift cards and resell them at discounted price. I was wondering how these sites prevent sellers from reusing the pin and card number after it ...
0
votes
1answer
62 views

Executing external process from Java security

What are security implications of executing external processes using Java ProcessBuilder/Process? Example: Runtime rt = Runtime.getRuntime(); Process proc = rt.exec("processExecutable"); InputStream ...
0
votes
4answers
2k views

What are the advantages/disadvatages of hashing over encryption?

I know that hashing is a one way function and encrypted messages could be retrieved if you know the corresponding key to which you encrypted the message. Other than the ability to retrieve, what ...
0
votes
1answer
41 views

Is a government entity capable of establishing a secure virtual currency system? [closed]

After reading about BitCoins, I can't help but contemplate the idea of the a government withdrawing paper money and bringing all currency transactions digital, via a bitcoin-like method where every ...
0
votes
3answers
92 views

man in the middle question

I've been wondering about this scenario for a while but I cannot fully understand how it works. Say I am sitting in a cafe on my laptop with wireshark, the cafe has an open WiFi connection. Is it ...
0
votes
1answer
172 views

Using a virtual machine for increased layer of privacy (w/ tor)?

One of my friends told me that running tor in a virtual machine Linux and then passing it through a proxy on the underlying Windows would provide in his words great security. Is this true?
0
votes
1answer
57 views

What files would I be able to view as localhost?

If I was able to view any page on a website as localhost using SSRF, what files should I check for? I checked to see if I could view robots.txt normally, and I couldn't, but using SSRF, I was able to. ...
0
votes
2answers
131 views

Nmap reporting the status of a port as both opened and closed

If I do not define any range (or if the range is large like a hundreds of ports), Nmap is returning ports as opened. However, if I put a smaller range or just scan a specific port, it says it's ...
0
votes
1answer
136 views

Understanding cryptography practically [closed]

So I am interested in computer security, cryptography and security protocols. Thing is, everything I read is about theoretical usage of protocols, but how do those things work in real world? Is there ...
0
votes
2answers
95 views

Encryption in Linux: covenience and security [closed]

I was using TrueCrypt until recently, until one of two options has happened: either it was discontinued or its web-site truecrypt.org was hacked. Any option implies that I don't trust it anymore. So ...

15 30 50 per page