1
vote
3answers
132 views

Can Google Chrome read/scan my ProtonMail inbox page?

If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
1
vote
2answers
94 views

Is it reasonable to make mandatory inside an organization (in the internal network) that all traffic were encrypted?

Is it reasonable to make mandatory that all traffic were encrypted inside an organization (in the internal network)? Usually, in the LAN of an organization some protocols are plain text, for example, ...
1
vote
1answer
135 views

Encrypting password string in C++

I have a client server based application where user is presented with login screen in the client. It then passes the credentials to the server which does the authentication. Client-server ...
1
vote
2answers
82 views

Why does nmap remotely show when I have port 6969 open, but not others?

Specifically, I was running a node.js application on port 6969 which I thought was strictly local. I discovered this was not the case when I ran nmap <myip> from a different computer and found ...
1
vote
1answer
131 views

How does letsencrypt's ACME work?

I found the technical paper on ACME's inner workings, but I still feel a bit confused about the ways Let's encrypt's Domain Validation works. From what I already know, verification can be performed ...
1
vote
3answers
128 views

Best way to keep private PGP keys?

What is the most secure way to store my private PGP keys?
1
vote
2answers
157 views

Can bad guys record phone conversations without the carrier's knowledge?

I know that, in most of the world, phone conversations are transmitted as digital data (whether frames in circuit switched protocols or packets). I know that several companies offer products which ...
1
vote
2answers
67 views

Is a SHA-256 signature required on a CSR in order to generate a certificate with SHA-256 signature?

I've heard conflicting statements about this from certificate authorities and security groups and would like to confirm: Is a SHA-256 signature required on a CSR in order to generate a signed ...
1
vote
2answers
220 views

Is this some sort of scam or do I have stalker?

Sender: msmith11@mail.com Emails are from IP address:74.208.4.200 Emails are weekly. all text, no links, no images. Some Depict sexual fantasies in high detail directed to a female - which I am. ...
1
vote
3answers
446 views

Prevent or detect key copy

This question can be classified as somewhat two interrelated questions - or two goals. Main aim is basically to authenticate client to server, but remain secure even if someone steals the key from ...
1
vote
2answers
141 views

Does using NATO's phonetic alphabet increase password strength?

Given an alphanumeric password intended to be strong yet easy to remember, we change each alphabetic character by its NATO alphabet counterpart (e.g. 'cat' becomes 'charliealphatango'). I understand ...
1
vote
1answer
275 views

Sent images on company WiFi network by accident [duplicate]

I know this was stupid, so I don't need to be told that...here goes: I was at work and thought I was on 4G network on my Android phone but after sending a number of nude pics via a social media app ...
1
vote
2answers
135 views

Is my password visible on an SSL/TLS connection across unprotected wireless?

If I am using an insecure wireless network that has no security protocol at all and trying to connect to my encrypted online banking website, can an attacker who is sniffing the wireless network sees ...
1
vote
2answers
301 views

Should I invest my time in making my site HTTPS-only?

I'm building a Django website that does not need to have registration/authentication. The only sensitive part is a form with a reCaptcha v2. Of course I'm embedding the CSRF token, which then I read ...
1
vote
2answers
126 views

How to deal with SMS spam? [closed]

Every few weeks, I get an annoying SMS trying to sell me something, or trying to get me to click something, or otherwise spamming me. I don't think it's a targeted thing- I think my phone number is ...
1
vote
2answers
119 views

Could I ever be legally required to decrpyt user information? [closed]

Suppose I host some web app which stores information about its users. In the interest of confidentiality, that information is stored in an encrypted format. Under what circumstances could a legal ...
1
vote
3answers
2k views

Tracing an email's MAC address

Can someone trace the MAC address of an email to the point of origin if the email address has been deleted? I received an email from an unknown sender regarding an issue at my work, and when I tried ...
1
vote
4answers
177 views

how can this prove a clickjacking vulnerability?

How does just putting a site link in an iframe (and when opens in iframe) indicate that the site is vulnerable to a click jacking attack? I have also read that if the site is a forum base, then the ...
1
vote
1answer
115 views

Which kind of SSL certificate is the big one?

Okay, so I just recently visited a couple of https (secure) websites and noticed that there was a difference with the way they were shown in Chrome. As you can see, the top one has some extra ...
1
vote
3answers
581 views

Is it possible to crack ransomware encryption if I have the original file?

Is it possible to crack ransomware encryption if I have 2 versions of a file: before and after the encryption? Are there any tools for such a thing?
1
vote
4answers
385 views

is it easier to eavesdrop on ethernet connection rather than wifi?

I heard someone say that ethernet connection is vulerable if someone can connect to your LAN, and that the traffic isn't encrypted in the way it might be if you're using WPA wifi encryption. Is this ...
1
vote
1answer
221 views

Storing encrypted information in database vs partition encryption

Trying to search for answers like Database encryption or filesystem encryption? but did not found what I need. My database contains confidential information. What is better? To store encrypted ...
1
vote
1answer
310 views

Should I trust zxcvbn with my password?

I want to measure current and future password entropy with the zxcvbn formula. Is there any way to test and detect if the input on this website is truly confidential? EDIT: 1. I found an ...
1
vote
2answers
337 views

Encryption / Decryption algorithm generic across JRE (Sun/IBM)

Is there any encryption algorithm that is generic across all platforms? Is RSA generic across SUN/IBM JRE? Another question: will base64Encoder / base64Decoder sun.misc.BASE64Decode / ...
1
vote
2answers
300 views

Code Vulnerability in Shell script

I was given an assignment for my Computer Security class. We we were given a piece of code to analyze and determine the vulnerabilities that it might have. #!/bin/sh # shell script to create a copy ...
1
vote
2answers
516 views

Malicious self-executing code can only exist in EXIF data in JPEG images?

Let's say we got an infected JPEG image that just by viewing it can automatically execute the malicious code stored inside it. It can do this either by taking advantage of the image viewer's security ...
1
vote
3answers
126 views

Securing a secondary login page for inputting a multi-factor auth token

I would like to implement the following use case: User lands on the login page User submits login credentials Credentials are validated and they are redirected to another page for inputting the ...
1
vote
3answers
122 views

External JS Security

I'm kinda new to security development. I've work mostly with backend processing stuff. I've been assign on how to secure external javascript that we import from facebook, twitter and google. One ...
1
vote
2answers
382 views

Hidden Malware on a windows OS able to startup [closed]

How do hackers hide there malware on windows, to startup and be impossible to find then delete. The results I found that a hacker can use to hide his malware: (found here) Windows: Setting hidden ...
1
vote
2answers
382 views

How to wipe potentially infected SSD?

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the ...
1
vote
1answer
612 views

Can public certificates be password-protected?

I've only seen private key files (.pfx, .pkcs12) being password protected. Someone told me public cert files (.cer) can also be password-protected. Is that true? Is it also true to say any certificate ...
1
vote
1answer
190 views

How can I prevent keys loaded into ssh-agent from being sent to a particular (insecure) server?

A particular server I need to interact with has an ancient or crippled sshd installed, and only supports SHA1 algorithms for key exchange. From information in the Snowden documents, I am leery that ...
1
vote
2answers
59 views

Transferring passwords to outside counsel

As part of a new eDiscovery effort, we send large amounts of data on encrypted hardware to third parties (outside counsel) that are not very technically proficient (so no key exchange via PGP ...
1
vote
3answers
189 views

Encrypt data going through an encrypted connection

If data are passing through a SSL-encrypted connection, is it required to re-encrypt these data? In other words, is it mandatory/useful/worth it to AES/RSA (for example) encrypt data that will be ...
1
vote
2answers
281 views

guidelines for password managers

I use Lastpass and I'm testing out other password managers in order to set policy for organizational use. Depending on settings, I've found that these programs can automatically send your password ...
1
vote
1answer
343 views

Phone got pick pocketed and I got a huge bill

I'm really sorry if this is posted in the wrong section. I did spend some time trying to get it right but I am not sure if this is... I have been exposed to thieves who have stolen my phone and then ...
1
vote
3answers
443 views

Can an attacker spoof an IP address to access my .htaccess protected file?

Let's say I lock down my site through .htaccess and say DENY FROM ALL ALLOW FROM myip how involved is it for a hacker to to simply spoof their IP address to match whatever mine is and gain access? ...
1
vote
1answer
226 views

Is dot character safe against sql injection?

I'm modifying the search module of prestashop in order to be able to search strings containing dots : . Prestashop uses its own sanitize functions against mysql injection vulnerability (yeah...) and ...
1
vote
3answers
214 views

Why do credit cards have chips, if I can purchase online without the chip being read?

Credit cards (and debit cards) are used in three different ways: In person + pin. The seller requires me to insert my card with the chip and input the PIN number to complete the transaction. In ...
1
vote
2answers
238 views

Encrypted retrievable password

I have a password conundrum. I need to store an encrypted password in a DB table but in such a manner that would allow me to retrieve the password as plain text afterwards. Please note that this is a ...
1
vote
2answers
138 views

Storing AES password for verification

I was wondering if such practice would be safe: I have a table that stores encrypted notes Every note has a data field and a password field When a password is entered, i want to select all notes, ...
1
vote
2answers
226 views

Stream/block cipher add a simple hash to guarantee integrity

The question is simple: Adding a hash to a message and then encrypt it using a stream cipher / block cipher. Why can't this guarantee integrity of the message upon decryption?
1
vote
2answers
426 views

Is it possible to restrict email accounts within one computer?

can emails(e.g gmail)can be configured to open-up only in my laptop ,my operating system is windows 8 and is it possible to restrict my gmail account to be opened up only in my computer?Usually we ...
1
vote
2answers
317 views

Send fake response(?packets) to a program [closed]

So my idea was.. There is a program that require login to be able to use(the program should work offline aswell not requiring any online data), so i want to make that program to be able to run offline ...
1
vote
1answer
72 views

Multi hash security [duplicate]

Is md5(sha1(pass)) more secure than md5(pass)? For example in case of sqli when attacker cant get our hashing schema, brute force or dictionary attack would be much less efficient. Am i right or is it ...
1
vote
1answer
614 views

portscan using nmap fails to return open dhcp-port

I've just stumbled upon something pretty weird, at least for me at this moment. When i've finished setting up my openBSD 5.5 server, along with the isc-dhcp43-server port. I tried to see if i could ...
1
vote
3answers
2k views

What is same site scripting and what are some exploit scenarios?

I know it is an issue with how DNS is configured , but is it really dangerous if the attacker couldn't access your network?
1
vote
2answers
284 views

When MBR pirates grin as an indication of absolute pleasure!

Someone, have no idea who, really worked my computer, and placed some rootkit, all-knowing, all-smashing malware something and I simply cannot keep Windows OS clean in a multiboot configuration with ...
1
vote
2answers
204 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
1
vote
1answer
118 views

How to execute an XSS attack against a site that uses client side protection?

Say I have a site that allows me to save my name to the database, and that name is then displayed to other users. I have determined that if I save the following as my name: Abe ...

15 30 50 per page