1
vote
3answers
659 views

Is applying AES multiple times safer?

The KeePass security help page talks about preventing dictionary attacks To generate the final 256-bit key that is used for the block cipher, KeePass first hashes the user's password using ...
1
vote
3answers
2k views

Are there any web application security standards?

Are there any web application security standards that I can use as a baseline for the security related requirements for a web application, web service, and for applications supported/hosted by third ...
1
vote
6answers
280 views

Does including the username in a password make it less secure?

Many registration forms prevent you from choosing a password that includes your username. Is it a reasonable restriction from security standpoint? I can see that if your username is "foobar" and ...
1
vote
1answer
546 views

How could `iptables -F` lock me out of the server? [closed]

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains. I did not run ...
1
vote
2answers
4k views

How do WPS (Wi-Fi Positioning System) databases have the MAC Addresses of the networks? [closed]

It is known that another way to determine the position is through WPS (Wi-Fi Positioning System). This uses the Wi-Fi networks available in the area, if any, to dermine the position. But according to ...
1
vote
3answers
2k views

How can this web page access the USB? [closed]

A friend bought a "smart" headset (working with voice commands). I had to install a software on Windows to be able to configure this headset. After downloading the software from the page, this page ...
1
vote
3answers
851 views

How to expose a client's real IP address?

As a forum administrator, how can I find a client's real IP address? Are there any third party tools or weakness that expose the real IP address?
1
vote
1answer
229 views
1
vote
2answers
2k views

DDoS — null route everything not approved

Is it possible to create a route on your internet router which routes traffic unknown to null. So you basically dont even let traffic route into your firewall unless its approved? Can this help detour ...
1
vote
2answers
566 views

Can AES-256 encrypted data be changed?

I have a file that supposedly contains AES-256 encrypted data. The file was created using a proprietary program that claims to use AES-256. I have tested decrypting the file with an open source ...
1
vote
4answers
637 views

Custom programming language, and translator that translate it to Java to make more difficult to get source

I want to make my game extremely hard to decompile. So I've come up with the idea of a program which will contain my game's code, coded in a custom language, and which will translate that code into ...
1
vote
1answer
2k views

Man-in-the-middle attack over an encrypted channel

I learned recently about man-in-the-middle attacks and came up with this question. Let's say we have two computers who try to communicate over the network. Each computer has an encryptor and a ...
1
vote
2answers
526 views

How do I ensure that a VPS host will keep my information private?

Basically, I want to use OpenVPN on a VPS to browse confidentially. However, I don't know much about VPS hosters and to me, it seems to be a hard choice because there are so many. However, I think ...
1
vote
4answers
1k views

certificate usage for signing and encryption

I have a question for basic operating with certificates in emails and pdfs. Im familiar with public key cryptography. The scenario: In my scenario I want to send a confidential email to a person A ...
1
vote
5answers
1k views

Good ways to prevent spammers from registering [duplicate]

Possible Duplicate: Is there a true alternative to using CAPTCHA images? Since everyone hates captchas what are good alternatives? I'm looking to prevent the automated creation of accounts ...
1
vote
2answers
183 views

Wifi box produces three SSIDs?

While using a friend's wifi, he said I should use his SSID, let's call it XYZ's Wifi. When I started my Macbook Pro, three SSIDs came up. Two were called XYZ's Wifi and the third was called XYZ's ...
1
vote
3answers
811 views

Web Application - Cookie Expiry

We are using a web application on cloud. I need a small clarification. We are using Perl with Apache. I see a following issue here for the below scenario. I need some inputs of whether this is most ...
1
vote
2answers
264 views

Authentication without saving password

Are there any security problems with following authentication protocol? when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
1
vote
3answers
2k views

SQL — using string concatenation, how can I exploit this procedure?

I have a simple SP create procedure [dbo].[test] @str varchar (100) AS BEGIN select * from [AdventureWorks2012].[HumanResources].[Employee] where JobTitle like '%' + @str +'%' END GO Given this ...
1
vote
2answers
433 views

How to verify correct, secure and test setuid?

I've been looking into setuid vulnerabilities. Particularly, I am looking on OS X (10.5+) but other modern *nix distos apply as well. For example, I found a world writable suid file installed by a ...
1
vote
3answers
367 views

For what do I hash user passwords with PDKDF2 when the user data is stored in the same database?

I'm hashing the passwors of my users with PDKDF2 right now. A user can gain access to his account with his password. When the user is logged in he can edit his personal information and do other stuff ...
1
vote
3answers
5k views

Building a secure server with CentOs [duplicate]

Possible Duplicate: Hardening Linux Server I recently started to manage my own server with a cloud-based server. Recently I got hacked somehow and the server was used for phising. On the ...
1
vote
1answer
369 views

MySQL/CGI: password in C source file unsafe?

Is this line bad practice from a security stance? connect = mysql_real_connect(connection, "host", "user", "password", "database", 0, (const char *)NULL, 0); If so, what solution would you use? ...
1
vote
2answers
2k views

HTTP TRACE vulnerability discovered - what should I do

First, why is HTTP TRACE method allowed on a website Isn't it a bad thing for web server or its users' security? Second, when I run the following PHP script via my browser... <?php $service_port ...
1
vote
2answers
9k views

How to connect sensors such as Snort to AlienVault SIEM?

I want to connect some sensors such as Snort and OSSEC to AlienVault SIEM. How can i do that?! Is it possible to send logs via syslog?
1
vote
3answers
1k views

What is the value of vendor specific security certs vs. general ones?

Let me preface my question by saying that I understand that experience is generally more valuable than certifications when it comes to the IT profession. Having said that, are vendor specific ...
1
vote
2answers
657 views

AVG Website Scan, Chance of 'Potential Threat'?

In a recent question I asked about investigating websites for viruses. The answers were very helpful, I ended up using the AVG website scanner. First I used it on our website and found it was clean, ...
1
vote
3answers
3k views

How does a DOS attack work when attacking a single server with a single client?

How is it possible to make a DOS attack from a single computer? Let us assume two computers, one acting as server and the other as client. Both has 100/100 mbit bandwitdh. How can then the client ...
1
vote
3answers
206 views

Information Security standards in corporations

I'm developing a web based application. I want to create it so that it could be adopted by teams within corporations and large organisations that have tight IS standards. The initial organisations ...
1
vote
2answers
289 views

References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA [closed]

There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD. I'd like to know if there are any other references to this issue. This would help ...
1
vote
5answers
201 views

How to replace a constant identifier, for a resource on a network, with a variable one?

I guess the example can make it easier. Assume each Client on a network has an identifier(some alphanumeric sequence) which identifies it uniquely on the network. Each time the Client corresponds ...
1
vote
2answers
264 views

Password system, possible solutions

I am trying to solve a problem with a password system. I need to figure out the probability of the password being guessed. If I have an 8-character alphanumeric password. it cannot be all #'s, ...
1
vote
2answers
416 views

How to store the access token / password reset token in the database?

I have an access code that is sent to users so that they can access the site in one-click. From terms of access it's very similar to the password reset url, so I assume the same assumptions apply. ...
1
vote
2answers
171 views

Advantages with PIN code authentication where the digits are placed at random positions?

I noticed that a lot of high-risk websites, such as bank and payment platforms, do not use a passwords for authentication (as usual) but instead use a PIN code where the numbers are placed at random ...
1
vote
2answers
143 views

Why won't Firefox accept my certificate?

I've been trying to get stunnel to work with my signed certificate (with a CA that I've trusted in Firefox). The error is: 127.0.0.1:5559 uses an invalid security certificate. The certificate is ...
1
vote
2answers
93 views

How would one recall a worm? [closed]

Hypothetically, say I wrote a worm, call it W1, just for fun/to see if I could, and it had silently infected a large number of computers attached to the internet. Say it didn't do anything but just ...
1
vote
3answers
105 views

Can a rogue DNS server see my passwords?

Recently I've been testing a couple DNS servers to see which one performs the fastest because I need a really fast connection. On to my point, if I were to use a malicious DNS, could they see my ...
1
vote
2answers
145 views

Password may not be similiar to last 5 passwords [duplicate]

SAP NetWeaver has a password policy to prevent your new password beeing similiar to the last 5 passwords. Are the passwords stored in plaintext to verify this? Or is something like a soundex value ...
1
vote
1answer
83 views

Server providing two different SSL certificates

When I check on browser for a site example.com, I see that site has a valid certificate, not expired, with validity till end of 2016. At the same time, When I scan for the same domain on the port 443 ...
1
vote
2answers
127 views

What is the real advantage of using a “more secure” algorithm like bcrypt for password hashing?

I read this article about password hashing using bcrypt as the recommended method. The advice is similar to what they're saying on hacker news about not using something like SHA2+salt. There are other ...
1
vote
3answers
267 views

Possibly illegal material discovered through hacking - theoretical discussion [closed]

Lets say for instance... X has hacked Y. X does not know Y but thought Y looked and sounded suspicious over social media. X infiltrated their emails and discovered content that local authorities ...
1
vote
1answer
30 views

Is it a good idea to use an OpenPGP key that has no password?

I'm tarballing and compressing backup files of my system configuration, and other important stuff. The process of tarballing, compressing and encrypting happens every time rsnapshot changes something ...
1
vote
1answer
154 views

How does letsencrypt's ACME work?

I found the technical paper on ACME's inner workings, but I still feel a bit confused about the ways Let's encrypt's Domain Validation works. From what I already know, verification can be performed ...
1
vote
1answer
97 views

Any ways to exploit PHP through an echo'd parameter?

I was wondering, lets say we have a page like this. <?php if(isset($_GET['example'])){ echo $_GET['example']; } Would there be any way to exploit this page into doing something such as executing ...
1
vote
2answers
139 views

Password Reset URL forwarding

If a previously registered user clicks on the password reset button during login, I want to send them an email with a reset password link. I have three queries: How to add an expiry date to the ...
1
vote
1answer
182 views

Does using ASP.NET prevent XSS [duplicate]

I was reading about XSS, and I know that ASP.NET doesn't allow saving HTML to database. So my question is Does using ASP.NET make my web application secure regarding XSS completely, without ...
1
vote
2answers
875 views

can web application disable browser's password manager's remember feature for that application?

Is there anything a website code do to prevent any browser from remembering your password? I am aware that from browser's options, users can change setting to ask to remember password or not. But can ...
1
vote
1answer
276 views

I have a virus in my USB drive. I haven't inserted it on my PC yet. How should I proceed?

I plugged the USB drive on a public computer at my university and all the files became .exe Is there a way to clean it without risking that it will copy the virus as soon as I insert the thing?
1
vote
1answer
77 views

Ssl multiple domains on same cert

I Came accross cloud flares which "provides SSL certificates utilize the Subject Alternative Names (SAN) extension to support multiple domains on the same SSL certificate" Why would one want this, ...
1
vote
3answers
241 views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...

15 30 50 per page