1
vote
3answers
2k views

Which real time cross-platform chat applications exist with end-to-end encryption?

I am looking for an instant messaging / chat application which can be used securely across different platforms, eg Windows, Linux, BSD! Do any exist?
1
vote
1answer
1k views

Securing clients side scripts [duplicate]

Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
1
vote
2answers
204 views

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine?

I am still logged in using a browser X, can CSRF attack work when I use another (default) browser Y on the same machine? Edit Assume the web server has CSRF vulnerability. No hidden token checking ...
1
vote
1answer
121 views

Is the VPN provider's ISP able to spy on traffic?

Traffic between a VPN client and a VPN server is encrypted on the client, and decrypted on the server. As the VPN server passes that traffic through the internet, can the VPN server's ISP see that ...
1
vote
3answers
94 views

Why aren't hardware R/W switches used to defend hard drives?

ISTR back in the early days of (build your own) PCs having an old 486 PC with two hard drives, and hacking the "Turbo" switch on the front panel (remember those?) to be a read-protect switch for ...
1
vote
1answer
63 views

Why does SSLStrip work on some https sites and not others? [duplicate]

I recently tested MITM on my LAN through SSLStrip, but I noticed that on Gmail and Fb doesn't work, while on other sites I can sniff connections easily. What is the difference?
1
vote
2answers
727 views

WhatsApp end-to-end encryption verification [closed]

IS there any way to verify the encryption from remote or so? Like my friend is 1000 miles away from me the physically QR Code scanning is not possible. So is there any way to verify the same?
1
vote
3answers
46 views

MAC address of source in RDP session

In a forensic analysis I analyzed the event logs of the affected machine and saw various RDP sessions from XYZ IP address. However to prove that the source IP was not spoofed is it possible that I ...
1
vote
3answers
97 views

Why shouldn't I use an old password? [duplicate]

Some services like Google or Facebook forbid me to use a password that has already been use for the same account in the past. My question is, if this old password was never compromised (i.e it was ...
1
vote
4answers
102 views

How sensitive are mobile telephone numbers?

A question that came to my mind. How sensitive are they really? I mean basically all you can do with them is stalking you with hiding caller ID find out which provider gave out the number but not ...
1
vote
2answers
84 views

How are private and public keys different?

While reading about DKIM I saw that the sender's private key is used to encrypt a hash, later decrypted by the recipient using the sender's public key. This is exactly the other way compared to ...
1
vote
1answer
51 views

Are there any vulnerability differences between real-time systems and non-real-time systems? [closed]

Are there any fundamental vulnerability peculiarities unique to real-time systems? Are they impervious to some vulnerabilities, due to their speed? Here, real-time system refers to typical usage ...
1
vote
1answer
112 views

Decryping a RAR file with same password

I came across a problem very similar recently and wondered if anyone knew how to solve this. So say for example I have an RAR archive called archiveA.rar and a password to protect it the password is ...
1
vote
1answer
62 views

Was my phpMyAdmin hacked?

On a server of mine I have a current version of phpMyAdmin running. Unfortunately (my bad I knew I hat to delete this folder for security after installation, I simply forgot... dangit) I still had the ...
1
vote
3answers
85 views

Unlock a computer bios?

If you or someone is to add a password to the bios of a computer and make ot so when booting the computer it prompts for the password is there a way to bypass or overide this activity?
1
vote
4answers
89 views

Could we make an impervious server with read-only software and no root access?

A long time ago people talked about the Harvard architecture, which had the program separate from the data. Similarly, if the software of a server was not modifiable (burned in to a crystal or ...
1
vote
3answers
69 views

Are hashing functions designed to be injective where the domain is limited to the codomain?

Using the example of md5, I would like to know if md5(h₀) == md5(h₁) for some distinct md5 hashes h₀, h₁. Are hashing algorithms generally designed to avoid this sort of collision? Do MD5, SHA1, ...
1
vote
2answers
117 views

What is the purpose of SSL Certificate Authority (CA)?

What is the purpose of an SSL Certificate Authority? How would a CA prevent dishonestcompany.com from doing something dishonest? What does the CA signing of the SSL/TLS cert for ...
1
vote
1answer
85 views

If I use my own cloud server as a VPN can my internet traffic be tracked?

If I use some IaaS cloud hosting provider to create my own VPN, and then I connect to that VPN before torrenting something, can I be identified in any way? I assume that when you spin up an instance ...
1
vote
3answers
123 views

Authenticating user in same sub-domain using cookies

We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server. Now we want to extend some application on another server ...
1
vote
1answer
123 views

What does browser do when it queries xxx.example.com and it gets a certificate for yyy.example.com(top level domain is same)?

The question is actually about what level of validations browser does when it gets certificates of some other domains like case 1: Accessing abc.google.com and got def.google.com case 2: Accessing ...
1
vote
2answers
163 views

IMEI.info knows my phone before I put sim

Recently I brought a Moto G3 turbo phone, which I suspect is a factory reset by a seller from other customer, and dispatched to me. I search net for getting in if its factory reset, but non tricks ...
1
vote
1answer
32 views

Diffie Hellman prime attributes

If I generate a Diffie-Hellman prime openssl dhparam 512 -text (deliberately of small size to keep the paste size below small; I know minimum is 2048 and up), what are the different parts of the ...
1
vote
1answer
87 views

Is it possible to prove that a forwarded email has been tampered with prior to being forwarded?

I have requested that an old email exchange between myself and HR be forwarded to me by a previous employer. They complied with the request but I suspect that the body of the exchange which they ...
1
vote
2answers
61 views

Do USB flash drives delete a sector before writing to it?

I know that SSDs can't write to a non-empty sector, so must delete it first (and even support TRIM which resets them automatically after deletion). HDDs on the other, write to sectors before reseting ...
1
vote
2answers
66 views

Flaws in my proposed license verification system?

in my firm, most of the software is secured by a couple of different antiquated licensing systems. For example, after setup the user has to start another program that tells him his calculated machine ...
1
vote
2answers
106 views

Credit card data sent as a plain image format [closed]

The full Account number data plus Personally Identifiable Information (PII) for a credit card is captured in a document that is scanned as an image for later processing. This image is then uploaded ...
1
vote
2answers
158 views

HTTP login to iframe HTTPS/ MiTM attack

I would like to know if the credentials can be intercepted/MitM attack if the site is using HTTP to HTTPS login iframe. Here are some login details from my Chrome dev tools (Form Data) So I can see ...
1
vote
2answers
133 views

Why/when would a CA make a generated public key available to the public at large?

I'm confused about this section in my CEH security exam training material: A CA is able to perform a number of roles in addition to the validation process outlined here. Some actions that a CA is ...
1
vote
1answer
82 views

Why is my answer to this security exam prep question incorrect?

I'm studying for a security exam and am confused by one of the chapter review questions in the book I'm using. It reads: When scanning a network via a hardline connection to a wired-switch NIC ...
1
vote
1answer
65 views

When automatic login may be acceptable from the point of view of security?

In my organization some IT people is requesting to install devices with automatic login configured. The reason they defend is that the user will be able to perform only very low risk actions: for ...
1
vote
1answer
254 views

What is advantages of using MTProto for Telegram over using HTTPS?

Why did Telegram decide to make their own protocol? What I think is HTTPS is a kind of perfect encryption solution between server and client.
1
vote
2answers
114 views

Are there any security benefits in deleting the private key of a https webserver after starting it?

Say you have a web server offering pages via HTTPS. After the process begins running, if you were to delete the private key, would this prevent private key recovery in case of server compromise? ...
1
vote
2answers
60 views

Resetting a hijacked router

If you reset a router that's been hijacked to factory defaults with the inbuilt reset button, will that take care of the problem?
1
vote
1answer
226 views

HSM Software Vs HSM Hardware

Can I have a software version of an HSM? I have a client that requires me to connect to its HSM, but I don't have any. Can I get software to do this job? The spec document speaks of MAC key & PIN ...
1
vote
1answer
89 views

How to determine which Browser Certs to reenable on a per-case basis?

Considering that there is no way to actually see which certs that I use in my regularly-visited websites, I've decided to disable all certs and re-enable them on a case by case basis. This is for the ...
1
vote
2answers
90 views

Is a Windows (fresh installation) 7 really this safe against NMAP or am I missing something?

I am playing with NMAP in my small private network performing port scanning. So far I went through scanning the following OSs (Unaltered new installations - Meaning no extra software installed!): ...
1
vote
2answers
143 views

Keepass - password paranoia

How do I know that the Keepass app isn't behind the scenes at some point sending my master password over internet to some secret site whose job it is to collect them and use them for evil means?
1
vote
2answers
94 views

What is the typical computer setup and hosting arrangement of malicious bots?

It's quite well known that if an attacker wanted to, they could spoof their IP address by using a proxy server or some other means. Whilst that's possible, whenever I perform a geo-location lookup ...
1
vote
2answers
92 views

When connecting to a VPN Provider, do other connected users pose a threat?

TL;DR: Can other users connected to a VPN Provider exploit my computer or information? I usually use a VPN service when connecting to the Internet. The provider is a private company whose business ...
1
vote
2answers
59 views

Is it possible to protect the emails and calendar in an Exchange server against own Exchange administrators?

We have our Exchange server in a remote site administered by an external provider. We would like to avoid the possibility of provider employees to access the email and calendar of critical accounts in ...
1
vote
3answers
68 views

How should we store & share documents with restricted access

Up till now we have handled restricting access to documents by having a share on our server that only the 2 accounting people could access and another that only the 2 HR people could access. And ...
1
vote
2answers
570 views

How exactly does Google Account decide my device or location is “familiar”?

In Chrome, I delete all cookies and site data. I close the browser and re-open it. I double check that All Cookies and Site Data is a blank list. I type https://mail.google.com/ into the address ...
1
vote
1answer
435 views

VeraCrypt: Is it possible to change the password after an encrypted container has been created?

I would like to know whether it is possible to change the password after an encrypted container has been created? The password I chose was a bit weak, and I would like to be able to modify it without ...
1
vote
3answers
1k views

The difference between risk assessment and risk analysis [duplicate]

I am a little confused about the difference between the risk assessment and risk analysis. Many people argued to conduct risk assessment during the requirement phase and risk analysis during the ...
1
vote
2answers
91 views

What would typically be considered an acceptable string entropy for passwords?

I have gained interest in creating a way to check password strength (think password strength meters - yes - another one). I've found many ways to award a score on a policy driven approach (one ...
1
vote
2answers
92 views

why would keyloggers be used for stealing money less often than banking malware?

I read Kaspersky statistic and I saw this image : Why would keyloggers be used for stealing money less often than banking malware?
1
vote
4answers
550 views

What is a typical response from webserver for POST request?

My web server is returning a 200 OK after submitting a POST request, but it does not seem to be a good idea according to a security team. It should return a 302 "Object Moved", so that it avoids ...
1
vote
2answers
146 views

Encryption software trustworthy?

If you are downloading and using an encryption software, e. g. Veracrypt or Diskcryptor, how do you know if this software is not a fake one? Backdoored or other security holes? Assuming that such ...
1
vote
1answer
63 views

What is Autocsr and is it secure?

I read an interesting article about something called autocsr for SSL certs. After reading I still could not figure out how it works. Doesn't generation of CSR happen on my box? The CA won't have ...

15 30 50 per page