0
votes
1answer
105 views

Poodle vulnerability and eCommerce

Our client has recently stopped getting new orders placed on their Magento eCommerce site. Could this be related with the Poodle vulnerability, as their server is still on SSLv3. Is there any ...
0
votes
3answers
27 views

Pre-filling username for access to online web application

When sending web application users a reminder email, is it reasonably safe to include a link in the email to take them to the web application sign in form whereby the link has their username as a ...
0
votes
2answers
88 views

Is Certificate-Based Authentication Really Better Than Password Authentication in OpenSSH?

I recently set myself up with a VPS and have been hardening it to the greatest extent of my limited knowledge! I was configuring OpenSSH to use certificate based authentication when something did not ...
0
votes
1answer
71 views

PCI Compliance - Antivirus in host and virtual environment?

We have a couple servers with a host system, and virtual DB and Web instances. Is it possible to be compliant with PCI if you install the Antivirus only on the host system, or does it need to be ...
0
votes
1answer
61 views

Should one worry about using an outdated version of Firefox? [duplicate]

I have access (and the general public) to a computer lab with many workstations. Each workstation is identical in terms of software, hardware and the version of firefox. The version that is installed ...
0
votes
2answers
115 views

Is openVZ patched against all exploits for its current kernel version?

I am looking for a container vitalization software that will allow me to create containers that will house specific software/jobs/tasks which I can start stop at will (and bind to interface aliases). ...
0
votes
1answer
195 views

How come PBEWITHSHA256AND128BITAES-CBC-BC violates the 128bit key limit?

In my Java application (which use StandardPBEStringEncryptor by jasypt), when i use the PBEWITHSHA256AND128BITAES-CBC-BC algorithm instead of something weaker such as PBEWithMD5AndDES, i get an ...
0
votes
2answers
147 views

Trust relationship between domains

I am working in a organisation where it has a structure of parent company and Subsidiary. Both are individual domains without Trust. I work for Subsidiary Requirement is Subsidiary company should ...
0
votes
1answer
137 views

Is there an AES 256 LUKS encryption option in Fedora? [closed]

I have certain information on my drive that I don't want anyone (not even me ;) ) to gain access to. I read recently that Fedora only offers EAS 256 LUKS encryption. This just isn't secure enough ...
0
votes
2answers
358 views

What's the best way to authenticate an user using a websocket?

I'm creating a multiplayer game(based in websockets) which runs directly from the browser and which has multiplayer functionality. Each player needs to have his own account(Username and password). ...
0
votes
1answer
134 views

How many passwords should I have? [closed]

So I am upgrading my personal security. Most passwords that I use are generated by and stored in a password manager. There are a few places where I cannot use a password manager -- here, I plan to ...
0
votes
1answer
100 views

What's the typical approach to caching invalid authentication attempts?

Clients (actually software pieces developed by some random dudes all over the Internet) are authenticating on a web server using "basic" authentication scheme and to do so they are passing the ...
0
votes
1answer
171 views

iptables intercept received packet with proxy and then forward to destination

Lets say I receive internet through my eth1 port and share it via hotspot to other devices (wlan0 port) [internet]----(eth1)[my computer](wlan0 hotspot) | ...
0
votes
2answers
83 views

Storing CardHolder Data using RC2 encryption

I would like to know if storing credit cardholder data using RC2 encryption requires to be compliant with PCI DSS. Currently the 16 digit PAN number and expiry date is stored in the database. The PAN ...
0
votes
1answer
74 views

Which is the best way to secure login password and safeguard user data? (even DBAs couldn't connect data to users)

Lets say that I'm building an website and a app which saves the users' secrets. The user logs in and can save into the app his deepest secrets. I'm worried about two things: - Should I save the ...
0
votes
1answer
97 views

How to Prevent CSRF in Ruby on Rails [closed]

How can I prevent CSRF in Ruby on Rails programming ? Is it possible to avoid overload on the application loading on net ?
0
votes
1answer
43 views

credit card security suggested scenario

I need to know the best scenario for a merchant inserting client's credit cards and expiry dates to process recurring payment for these cards. What I have in mind (and want your expert suggestions ...
0
votes
1answer
47 views

How to change the expiration time for the pkcs certificate?

I have an application (which I'm testing), in which I create some services. These services are accessible via libraries i.e java and python apis. In order to authenticate the api calls, the ...
0
votes
1answer
35 views

Mechanisms to prevent error propagation in wireless networks with respect to the avalanche effect [closed]

I was wondering what mechanisms exists that could be used to prevent error propagation in wireless networks and especially with respect to the avalanche effect. I know ARQ and FEC can be used, but ...
0
votes
1answer
52 views

Enabling wifi or bluetooth before user login in Linux

What would the security implications be of enabling and using wifi and / or bluetooth before a user logs into the system in a Linux box? Thanks for your help!
0
votes
1answer
103 views

How to log all resources my site needs from other sites? [closed]

is there any simple way to log/list all resources my website (wordpress & theme) needs from the outside? Like jquery, fonts and all this stuff. I want to host it on my own server. (doesn't matter ...
0
votes
1answer
42 views

How to restore devices like IP phones to productive use after unexplained activity? [closed]

I'm trying to consider how to properly vet devices that have exhibited unexplained activity for future deployment. Let's just consider my current scenario as an example, but I am interested in this ...
0
votes
1answer
60 views

Indexing encrypted data for efficient searching

I have implemented encryption for certain columns in a database. In some cases it may be necessary to search by these columns, either for exact matches or for substrings. At the moment, there is less ...
0
votes
2answers
117 views

Key Management/storage system

In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour. Each of these hardware devices ...
0
votes
1answer
55 views

Why is it ok that OS X defaults to ignoring owership on external volumes?

I just discovered this fact tonight and I was rather floored by it. Isn't that a gaping security flaw? I realize that an external drive is less secure by virtue of the fact that someone could simply ...
0
votes
1answer
111 views

distinguish between bots and legitimate clients [closed]

If an attack (DoS & DDoS) involves thousands of bots, how can the server distinguish them from legitimate clients?
0
votes
1answer
356 views

Mac OS X : Certificates signed by company trusted CA cannot be verified

I'm trying to setup a keychain on Apache Tomcat that contains a server certificate that was signed by a custom root ca certificate. (not sure if custom is the right word here, but it's a root ...
0
votes
1answer
50 views

Securing connection between redirect from A to B domain

I'm building special extension ( on domain B ) to the present e-commerce hosted on a domain A. The goal is to redirect user from A to B and back. Similar to technique where user leaves e-commerce site ...
0
votes
1answer
29 views

What are valid OpenPGP revocation signature types?

I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL ...
0
votes
1answer
168 views

Security implications for email address and url changes?

recently, we are seeing some From:, To:, Cc: addresses being rewritten from user1@companyA.com to: ...
0
votes
1answer
76 views

Firewall with packet capture and inspection?

Is there such thing as a firewall with packet inspection? Most outbound firewalls simply prompt the user with "program.exe is trying to connect to the internet - allow or deny?". I find it impossible ...
0
votes
1answer
56 views

Bridge mode question [closed]

İ have an outdoor in my shop and distributing my network to customers using mac filtering opition.. one of my neighboor got a weak signal....so, he bought a wirelss repeater to recieve a better ...
0
votes
2answers
154 views

Trust level of whole disk encryption software

For example, if we take this software into account: Symantec Endpoint Encryption Sophos Safeguard Encryption How can we trust suppliers of whole disk encryption software in the lights of the ...
0
votes
1answer
142 views

How to make a decent Certificate Signing Request (CSR)?

I'd like to know how to make a decent Certificate Signing Request (CSR) to secure my website and e-mail with a wildcard SSL certificate. With recent exploits as POODLE on SSLv3 and such, I'd like to ...
0
votes
1answer
127 views

Is a Cloud-Connected Door Lock More Secure Than a Traditional Lock and Key?

Now that app based door lock replacements are getting more popular in the market, I'm wondering what the security risks are and why or why not this is more secure than an old fashioned lock with a ...
0
votes
1answer
473 views

getting an error in aireplay-ng in kali linux

When I was testing penetration testing on my router using kali linux, I followed all the steps from this link. In the step where you have to enter the router's bssid and client's bssid in aireplay-ng ...
0
votes
1answer
166 views

Rooted android cached password

Assume you could exploit a vulnerability on an old Android 2.2, the questions are: 1- Is there anyway you could see stored passwords on that operating system, specially Facebook password. 2- Can you ...
0
votes
1answer
131 views

Why is not safe to use the same public key in RSA?

In the RSA context, why is not safe to use the same n (public key)for different people?
0
votes
1answer
69 views

Where does Snort log the messages when using a pcap file?

When you're using Snort for real-time monitoring the messages are logged to /var/log/snort/alerts. However, when you load a pcap file, where do you see if any packet triggered a rule? Because they ...
0
votes
1answer
392 views

Wifi Educational Hacking - Aircrack-ng wpa vs wpa-psk

I have a question about the max amount of dictionaries need to crack a wpa2 or wpa2-psk password I am using aircrack-ng on ubuntu Is there any possible way to calculate the maximum amount of ...
0
votes
2answers
760 views

Is it dangerous to use hamachi

In the Minecraft community people are firing up hamachi with Minecraft servers, but over all is a public hamachi dangerous for the host and all the users using it?
0
votes
1answer
85 views

Understanding Digital Signature

I have just learned Digital Signature and am trying to ensure that I have got my understanding of Digital Signature on the correct track. Assume Alice wants to send a message (M) to Bob where the ...
0
votes
1answer
80 views

IP Address when access website on Remote Computer

Can you please advise me on this, All the web sites visited on remote computer, can that be traced? I have a office computer say COMP1 and Home Computer COMP2. If i access any websites on COMP2 ...
0
votes
1answer
146 views

Making 2 yubikeys generate the same password

Is their a way you can make two yubikeys generate the exact same password at the exact same time? (identical copy) I am wanting to purchase two of them so I am able to store a backup yubikey in a ...
0
votes
1answer
140 views

How will Gmail be able to detect SPAM and display ads when emails are encrypted end-to-end?

Context Google is making end-to-end encryption easier to use. SPAM How will they be able to perform SPAM detection when the email is transmitted and stored encryptedly? I suppose that if the SPAM ...
0
votes
1answer
172 views

Malicious JavaScript — Troj/JSRedir — Gumblar

I have a client with a website receiving AV warnings from Microsoft Security Essentials. A further investigation revealed that the site is blacklisted by Yandex.com, due to a report that the site ...
0
votes
1answer
329 views

Decoding tunnel bytes in EAP-TLS or EAP-TTLS using Wireshark

I have a few pcaps of traffic for EAP-TTLS conversation, carried by RADIUS. I also have some being carried by EAPoL, but I think the answer to that case might be even less straightforward (though ...
0
votes
1answer
140 views

How does the Dell Sonic wall Authentication works?

My College Router has Dell Sonicwall authentication. We will be automatically redirected to the login page. If the username and password is correct a new popup opens showing that user 'x' has logged ...
0
votes
1answer
86 views

How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up?

And if it is possible, how do you prevent other people from claiming they are you and lost their phone? Amazon only directs you to a page which does not exist. http://aws.amazon.com/iam/faqs/ If ...
0
votes
1answer
63 views

Securing access tokens?

Preface: I have no experience with securing applications whatsoever. I'm building a web app that uses Google Plus authentication to sign users in. My initial thought is to save the access token that ...

15 30 50 per page