0
votes
4answers
134 views

Is secondary password (e.g.: pin) necessary?

I find some cases (especially in online games) that a software or website asks users to enter an additional password, such as 4 or 6 digit pin numbers, in addition to their original password. Most of ...
0
votes
2answers
520 views

Encrypt files on FTP server

I have a practical situation here, my company is a FTP server provider for some clients. The clients are sharing their files on our FTP server and have had no problem with access management and ...
0
votes
1answer
175 views

Is it a security threat to have food or drink next to computers [closed]

I have never worked in big organization and I wonder if any of them considers food or drinks a security threat. More than one movie showed the scenario of an operator who accidentally spills tea on ...
0
votes
4answers
225 views

Security of a Random Password

i. If I choose random password of length say 15 from the alphabet set of size 94 i.e. from the search space of 94^15, is my password protected against all kind of threats? ii. Will there be any need ...
0
votes
2answers
412 views

Given an IP address can you ssh into /tmp without password?

I'm a Software Engineer, but I have no experience in security, so i'm trying to learn by doing (woot Experiential learning!). I know that the permission settings on the tmp folder are very relaxed. ...
0
votes
3answers
375 views

How Safe Are Encrypted Websites Really?

I was at a coffee shop and had to (I mean had to) check something on my bank account and another account. I figured since the two websites I was viewing were encrypted, and because my computer (I'm on ...
0
votes
2answers
114 views

How secure would this method be considered for password storage

Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 ...
0
votes
1answer
220 views

Is my hashing technique secure? [duplicate]

I am not sure if this is the best place to post this type of question. I have come up with function which, I believe, is a very secure method of hashing. (I could be completely wrong). Here's the ...
0
votes
1answer
485 views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
0
votes
4answers
230 views

Is knowing 'a' encrypted with 'b' and 'b' encrypted with 'a' a possible threat?

Excuse me for question name, but I couldn't find any other suitable title. I want to validate client connecting to the server. My algorithm looks like that: Clients sends his login - plaintext ...
0
votes
2answers
101 views

Course of action with this malware [duplicate]

After clicking in a fake "download here" button in a webpage for film downloads, a computer has got infected with what I believe to be an adware. I have located the file, VirusTotal gives this ...
0
votes
2answers
428 views

Transmitting malicious code over audio speakers

In a post that reads like science-fiction, a security researcher claims that malicious code was being passed between computers. A few quotes: ... "badBIOS," as Ruiu dubbed the malware, has the ...
0
votes
3answers
195 views

Devising encryption schemes and protocols

I am wondering how encryption schemes are developed and why certain decisions are made. For example. I have seen a company hash a string with SHA1 and then RSA encrypt it. Why? I've also seen the ...
0
votes
2answers
250 views

How can we trust the tools? [closed]

There is a lot of tools out there to do a lot of things with, like sniffing, scanning, and even backdoors. However, I have a really hard time trusting these tools. When I install them at home and ...
0
votes
3answers
320 views

What does the question mark in nmap output indicate?

In the following nmap output: $ sudo nmap -sS -sV -vv -n -Pn -T5 x.x.x.1-255 -p80,23,21 -oG - | grep 'open' Host: x.x.x.x () Ports: 21/closed/tcp//ftp///, 23/open/tcp//telnet?///, ...
0
votes
3answers
4k views

get vs post which is more secure? [duplicate]

i have heard of programatically difference b/w get and post in web applications,Asking in curiosity which is more secure get method or post method in web applications,i expect answers in terms of ...
0
votes
1answer
8k views

Has the WPS brute-force cracking issue been fixed?

I have heard a rumor that the WPS brute force attack doesn't work on newer devices, and that you now have to try all 10^7 PINs to find the correct one. Is that true?
0
votes
1answer
158 views

Is this a secure method for authenticating clients?

I am working with several other people in writing software which requires authentication before it accesses resources. In order to authenticate, we devised the following strategy. Client sends a ...
0
votes
3answers
657 views

Penetration testing against an ignorant target - Is it legal? [closed]

I know it's a big no-no in terms of etiquette, but is it illegal in Canada to perform penetration testing against a commercial company without authorization? prompted by: ...
0
votes
3answers
192 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
0
votes
2answers
2k views

Tool for generating MD4 collisions

There are a lot of research papers available online that discuss vulnerabilities of MD4 algorithm, but I couldn't find any implementation of these. Uptill now I have used tools like John the Ripper ...
0
votes
1answer
3k views

3 or 4 characters long username from security point of view

I have on my site the ability for the user to choose his/her username that is 4-20 characters long. But some users could have names like "Amy" "Eva", "Ian" etc. Should I stick with 4 letters or go ...
0
votes
2answers
604 views

is it possible to test out remote host by using nmap?

I was trying to test out my friend's computer (with agreement) by using nmap remotely. But the result I got seems kinda awkward to me. It only showed 1900 as tcpwrapper and all other ports were no ...
0
votes
3answers
241 views

What is the most reliable way to transfer emails without specific recipient support?

Many suggestions on transfering emails securely can be found in this answer. But many of them (e.g. PGP) need support from recipient. I want to provide SMTP email server that will route emails of it's ...
0
votes
3answers
3k views

Number of AES-256 operations per second on a maximized Cray XE6

How many FLOPs does one AES-256 operation take in ECB mode? How many AES-256 operations in ECB mode can a maximized Cray XE6 perform per second? Cray states that it can be scaled to over 1 million ...
0
votes
2answers
88 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
0
votes
2answers
128 views

Weird 8-character hash [closed]

I'm investigating an application. In a XML file I came across: <ScrambledPassword>U8P3J2N1</ScrambledPassword> I ran it through a hash identification script which is telling me it's a ...
0
votes
1answer
323 views

How can American Express Serve login be PCI-DSS compliant?

Today I went to log into my American Express Serve account at https://secure.serve.com/ and accidentally discovered what appears to be a huge hole in their login process. Here are the steps involved: ...
0
votes
3answers
115 views

Please critique my encryption scheme for a very small microcontroller [closed]

I am new here and not an cryptography expert; but I have been using encryption library for a while. My company is working on a small hardware device. It is powered by a microcontroller so memory is an ...
0
votes
2answers
325 views

Will gmail close my well intentioned botnet account? [closed]

I'm part of a company that has at least 1000 PC's distributed in different buildings over a radius of 25 miles. I've been asked to make a program to survey technical information on each PC. Since ...
0
votes
1answer
129 views

Is there any security benefit in stripping only `<script>` tags that contain code?

On a client's corporate network something is stripping all <script> elements that contain code, i.e. things like <script type="text/javascript">do_something();</script> will simply ...
0
votes
3answers
106 views

Security concerns of downloading websites contents

I recently started using Firefox for Android and saw I can download pages as PDF and near every image or video for any site and I'm using that quite a lot so what is the risk of downloading such ...
0
votes
1answer
249 views

How can the private key be obtained in PKI without alerting a third party? [closed]

For example, I sent a message to Ardi and encrypted it with Ardi's public key. Ardi must decrypt the message with his private key. How can Ardi's private key be obtained in PKI without anyone else ...
0
votes
2answers
323 views

Will an ISP give out network/traffic info upon request?

Nothing big, just a fear of embarrassment. I use my mom's (she pays for it) internet service to connect online and stuff. The thing is, I am nervous that she may possibly ask the ISP for some traffic ...
0
votes
4answers
266 views

Software for web hacking? [closed]

I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks ...
0
votes
3answers
196 views

Encryption and Layers understanding

If I'm right the SSL encryption take place in the application layer, but we can also have encryption in the Internet Layer. Why are we using both, and why sites that doesn't have SSL are considered ...
0
votes
2answers
93 views

Precise measurement of password complexity

I am thinking on a system, which measures the complexity of a password not based on its entropy or compressibility, but with a simply sophisticated method. The measurement of the ...
0
votes
3answers
643 views

Can a smart card with PKI certificate be used to protect a document?

I want to use a smart card (or USB cryptotoken) with a PKI certificate for manual authorisation. Is this possible? I want to put a file (e.g. a word file or even a simple text file) into a smart ...
0
votes
1answer
203 views

Figure out how internet access is being monitored [closed]

I suspect that someone is monitoring my internet connection. Said person has revealed information about sites I visit and online conversations (Facebook) even when I am not using his/her network. ...
0
votes
3answers
2k views

very secure router and advice to prevent intrusion

I suspect that my home router was been hacked (with firmware upgrade), so that I would like to build and buy a new router enough secure. Something that can prevent not authorized firmware upgrade. I ...
0
votes
2answers
487 views

Can AES-256 encrypted data be changed?

I have a file that supposedly contains AES-256 encrypted data. The file was created using a proprietary program that claims to use AES-256. I have tested decrypting the file with an open source ...
0
votes
2answers
9k views

Can you track someone using a proxy? [duplicate]

This is past experience, and is not the case anymore since I am a programmer now and have nothing to do with security anymore. However in the past I had a person constantly trying to make comments of ...
0
votes
3answers
2k views

Is there a combination of Windows permissions that allow execution of a .NET executable but not reading nor copying its content?

I suppose that if a file is executable by anyone, in other words, if a user has enough permissions to execute an executable in Windows, it will be possible to read the contents of the executable and ...
0
votes
1answer
1k views

Man-in-the-middle attack over an encrypted channel

I learned recently about man-in-the-middle attacks and came up with this question. Let's say we have two computers who try to communicate over the network. Each computer has an encryptor and a ...
0
votes
3answers
908 views

Password and username used to connect to database in source code [duplicate]

In PHP scripts that communicate with the database I have the username and password to the database in plain text i.e. mysqli_connect('localhost:3306', 'root', 'PASSWORD!'). From OWASP Do not ...
0
votes
2answers
222 views

Filehosting - Malicious or not? [closed]

I see a lot of file hosting services like rapidshare, mediafire etc. But, I wonder if some of them are malicious or not. Rapidshare seems okay, but there are many (obscure) sites like the ones below ...
0
votes
3answers
1k views

How to hide local network traffic on my computer?

I want to hide any traffic an application makes on the local network, make it look like the network is completely quiet to the system and other monitoring software. Is this doable? How would I ...
0
votes
2answers
166 views

Does excluding username letters from passwords increase security?

Recently I was asked to change a password, along with a password policy which reqires you to use a digit, a special character and a letter, but forbids any letter from you log in name to be used for ...
0
votes
3answers
222 views

Make the public key unrecoverable given the private key

OpenSSL seems to bundle the private key together with the public key when it produces .pem files. Is there a way to prevent this from happening; i.e. prevent OpenSSL from creating a .pem private key ...
0
votes
3answers
251 views

Using a VM to access internet when malware blocks internet access?

My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know ...

15 30 50 per page