0
votes
1answer
478 views

how to verify file signature by client PGP

Currently working on verifying and signing a file via GNUPG, given that I've already signed a file, given the clients the .sig and public key, is there a way for a client to verify the file without ...
0
votes
3answers
120 views

Cryptosytem Question [closed]

A file is encrypted and placed on a secure FTP server. An MD5 hash is taken of the file and also placed on the FTP server. A userlogs in to the server and downloads both files, however, the hash fails ...
0
votes
1answer
92 views

Is sharing the Membership Provider with other devs a security risk?

I hope this is a good place for this, but I am looking to be safe while sharing my ASP MVC project. If a page was designed with a membership provider is is possible to share this project with out ...
0
votes
1answer
179 views

list of PKCS7 certificate file extensions

RSA (the company) devises and publishes the public key cryptography standards. In those standards PKCS #7 is a standard which defines how to encrypt and sign messages using PKI. PKCS#7 defines a ...
0
votes
1answer
754 views

TLS sequence number

Watching at TLS 1.2 traffic using Wireshark, I figured out that in the Application Data record, the 64-bit sequence number in some connessions is sent and in others not. Does it depend on the Cipher ...
1
vote
1answer
550 views

DOCSIS modem only authenticated by MAC?

Is a DOCSIS modem only authenticated by the CMTS by a MAC address or are there any other AAA techniques? In that case, how do I prevent other customers from spoofing my modem's MAC address? Cable ...
-3
votes
1answer
147 views

Need to prove someone sent an email, not me [closed]

Received: by 10.182.241.38 with HTTP; Sat, 15 Mar 2014 14:09:36 -0700 (PDT) In-Reply-To: <294B46790F860A4B9790B42606DFA3E4E4E5AE@MAHEXMB02.thrivehosted.local> References: <...
-2
votes
2answers
471 views

VPN Vs Hotspot Shield [closed]

A VPN is a Virtual Network that is used to hide IP address of the attacker. A Hotspot Shield is also used to change IP address which hides the origin IP. What is the difference between VPN and ...
0
votes
2answers
528 views

Secure Way of Encrypting Your Bash Shell Script [duplicate]

How can I encrypt my bash shell script on Linux server The shell script contain credentials of other servers for remote access. The problem is I do not want others with same level of access to view ...
1
vote
2answers
2k views

What security does an ISP provide for its customers?

I've heard that ISPs provide some kind of protection; using NAT and firewalls, to prevent hackers from using tools such as nmap to attack customers from over the Internet. What other technologies are ...
1
vote
1answer
458 views

Heartbleed detection [duplicate]

It is fairly easy to detect the heartbleed exploit if it all happens over cleartext, which it seems most things are doing for the time being. However, I believe that there are some heartbleed ...
3
votes
3answers
834 views

Encrypting passwords?

I am planning on creating a text file to store my passwords, so I only need to remember 1 password (at the moment, I have about 20 long/complex passwords in my mind, and am worried that I might forget ...
3
votes
1answer
219 views

Getting an employer to secure their website immediately

I'm employed as a consultant at a big tech consultancy. I recently noticed a major flaw in their website, they send my login credentials in plain text over HTTP. I verified this by doing a outbound ...
0
votes
2answers
796 views

Is Google Drive security compromised?

Today when I visited drive.google.com, I was auto-directed to http://drive.googe.com/router.php After clicking on "Exit Now" on that page I was redirected to http://globalreward-zone.sweepclam.eu/...
0
votes
1answer
223 views

Protect from Facebook like clickjack

In the past month I've seen a better grade growth in sites that have clickjacking scripts that make you like the webpage or the Facebook site's Page when you click anywhere on the page. I have even ...
9
votes
1answer
1k views

Who proposed adding heartbeat to SSL? And who proposed it's form?

So we now know who wrote the bad code (Robin Seggelmann). And we have an idea of why it is needed: Why does TLS need an explicit heartbeat protocol? We can also understand why the client supplies ...
2
votes
1answer
263 views

/WEB-INF/web.xml showing MySQL credentials?

I found the file /WEB-INF/web.xml on a domain I'm associated with. The XML file contains: <database> <jndi-name>jdbc/mysql</jndi-name> <driver> <type>...
0
votes
1answer
226 views

Alternative to ICANN? [closed]

What are major DNS services offered that aren't state-controlled. Better yet, why can't we take Bitcoin's model and create a truly decentralized system with P2P DNS? I see potential reasons behind ...
1
vote
0answers
66 views

Ability to decrypt intercepted encrypted SSL traffic when having private key [duplicate]

I was reading some blog posts about the Heartbleed vulnerability (who's not nowadays) and was thinking about the following. Situation A If I would use a regular SSL/TLS connection the handshake will ...
2
votes
1answer
240 views

Heartbleed: hackers have already used the vulnerability? [duplicate]

Read about the vulnerability and decided to check out the site. Receiving a response from the php code was surprised. Look at the screenshot. Perl-script: http://pastebin.com/rL0XkewP Hackers ...
4
votes
9answers
1k views

I only use windows for games. Do I need anti virus protection?

I use Linux, and even though I'm not pretending my system is virus-free, it's generally accepted that even an aggressive firewall is not a requirement. I want to install Windows 7 on a machine which ...
4
votes
1answer
620 views

Is DNSSEC immune to stripping signatures?

In my opinion, it should be possible to forge DNS reply so it doesn't include DS/RRSIG/... parts for any request, thus bypassing DNSSEC validation of resolved domain. Is DNSSEC system immune to this ...
1
vote
2answers
398 views

Is a C plugin safe if I read it through an echoing parser before?

I wanted to use sharable plugins for an application. However, the plugins were extremely time critical, so I wanted to distribute them as C libraries. Now, these are not guaranteed to be safe (the ...
62
votes
3answers
7k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
1
vote
1answer
137 views

Perplexities about TLS handshake

I analyzed the TLS (1.2) handshake and I didn't manage to understand the message after the Change Chipher Spec Here it is: It is called "Encrypted Handshake Message" by Wireshark and it is sent ...
1
vote
0answers
909 views

How to calculate FAR and FRR in pattern recognition? [closed]

I am working on a vein pattern recognition project based on SURF algorithm and euclidean distance. I have completed my program to find the maximum and minimum distance between vein features and find a ...
4
votes
2answers
349 views

Heartbleed and heap management - Why user data and passwords are kept in memory?

If I understand correctly the hearbleed vulnerability, only the heap of the OpenSSL process can be retrieved by an attacker (or part of depending on the memory allocation type that is used). Then, how ...
9
votes
1answer
932 views

Password Managers: encrypted database vs hashing strategy

I'm considering moving to a password-management strategy based on supergenpass or something similar. This is an alternative to other password managers where instead of having a database of passwords ...
0
votes
3answers
172 views

When given a SSL-Private-Key, how would one generate a valid SSL-Cert from this? [duplicate]

in the hybris of leaked ssl-private-key everybody cries for new certs and new keys. my question: how would one generate a new and valid ssl-cert with the private key from my website? our certs are ...
0
votes
1answer
94 views

Will the recently found OpenSSL vulnerability Heartbleed affect my public site for which I obtained an SSL certificate from a CA? [duplicate]

I had generated the CSR with OpenSSL. Do I need to regenerate a new CSR with no vulnerability due to OpenSSL in order to obtain a new certificate from a CA?
1
vote
0answers
260 views

Gladman's file encryption library = AES in counter mode with HMAC-SHA1 authentication?

I would like to use Gladman's algorithm to create AES encrypted data in JavaScript. I use the Crypto-JS library, but its performance is horrible. PBKDF2 is terribly slow, so I switched to another ...
2
votes
1answer
124 views

After restoring from a (valid) full disk backup can malware still persit?

In the comments to this question it is mentioned that even after a backup recovery malware still can persist. Do I understand that correctly? How is this possible? If Acronis True Image is used to ...
6
votes
1answer
930 views

How secure is OpenSSH on FreeBSD?

In a discussion about the recent OpenSSL information disclosure vulnerability, the subject of OpenSSH being vulnerable came up. While OpenSSH is not vulnerable due to the problem lying in the TLS ...
0
votes
1answer
318 views

Can a VM be used as a home computer?

Our old computer is getting replaced, and I want to secure the new computer right from the get go. So I figured if I install something like VirtualBox first thing, I could then create one very ...
-1
votes
1answer
110 views

Heart Bleeding Bus [duplicate]

This may be a unwise question, but I'll ask anyhow. I have been analysis relatively a bit about the Heart Bleed vulnerability, and I'm curious as to whether it only affects web applications or could ...
0
votes
1answer
88 views

Cryptographic Hash function [closed]

How can I implement a cryptographic hash function using the block cipher? I was wondering whether I can use AES in cipher block chaining mode to achieve this.
1
vote
1answer
265 views

I login to Stackoverflow (vulnerable) with Google (not vulnerable). Do I need to change my password? [duplicate]

According to this heartbleed mass test, Stack Overflow is vulnerable whereas google is not. I use my Google ID to logon to Stack Overflow (and some other sites). Do I need to change my password? In ...
0
votes
1answer
333 views

are there serious weaknesses in this free password management system?

I want to protect my passwords for free and store them on a machine that might get stolen but have the passwords very securely backed-up in the cloud, again for free, and minimize the total lifetime ...
4
votes
1answer
509 views

API to change passwords?

After I learned last week that the login data of some of my accounts was leaked, I had to change my passwords for more than 30 sites. That was tedious! As luck would have it, some days later we ...
2
votes
1answer
162 views

Ethicality of websites that test other sites for Heartbleed [closed]

I realize that this may be more of an opinion type question, but I see a lot of questions on ethics in this forum so I hope mine fits in. I was reading a BBC article about Heartbleed, and in the ...
2
votes
1answer
168 views

Which information does a whois lookup reveal about the registrant of the domain?

A friend of mine recently got her Gmail account "hacked" because of a weak password (the same as her login..). While sanitizing her account, I removed the forwarding of her emails to one email ...
3
votes
1answer
146 views

Password security on lost or stolen smartphone

I have a number of apps on my smartphone that store the passwords - facebook, mail, etc. So say the phone is lost or stolen and the finder decides he wants my passwords - what can he do to get them, ...
-2
votes
3answers
71 views

Does HTTPS retrieval, among its other effects, sign a document? [duplicate]

Does HTTPS retrieval, among its other effects, sign a document? I'm asking in hopes of understanding in more specific details what TLS accomplishes. I will try to elaborate my question, as follows. ...
0
votes
1answer
53 views

problem upgrading openssl on ubuntu servers [closed]

I'm running Ubuntu x86_64, and want to upgrade to OpenSSL 1.0.1.f. wget <openssl latest> tar -xzvf openssl.tar.gz cd <openssl dir> ./configure --prefix=/usr make In the console output, ...
3
votes
1answer
2k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
-2
votes
1answer
2k views

What causes an Operating System to become Corrupted? [closed]

What Causes an Operating Systems ISO image to become Corrupted? I found an ISO image of windows 7 off the internet and now when I use windows 7, its extremely slow. What causes this? I cannot boot up ...
1
vote
0answers
40 views

What part of the browser is typically attacked? [closed]

Pretty sure that browsers are compromised most often through their plugins, at least, that's what I keep reading. So, then, does that mean the browser itself has vulnerabilities, and the plugins are ...
4
votes
1answer
273 views

Is there an actual use for OpenPGP authentication keys?

The OpenPGP specification (RFC 4880) describes, page 34, the different capabilities that an OpenPGP key may have; including: 0x20 - This key may be used for authentication. In GnuPG, one of the ...
26
votes
3answers
2k views

How can an attacker use a leaked private key?

I admit that while I'm a programmer, my crypto/security knowledge is fairly basic. I understand that the potential of leaking private SSL keys is cited as one of the most serious effects of the ...
10
votes
1answer
3k views

Check logs for Heartbleed exploit use?

According to articles such as the following, it's apparently possible to check logs for heartbeat requests matching the payloads described in the Heartbleed exploit. Is this something that any server ...

15 30 50 per page