1
vote
1answer
147 views

The need for created timestamp in tokens

In different token, for example SAML, I have encountered I have seen that it includes the timestamp for when it was created. I understand the reason for a expiration timestamp, but before the token is ...
0
votes
3answers
2k views

Is it possible to install spyware in password protected android phone?

I own samsung galaxy y, an android. I suspect my roommate has installed spyware in my phone. Is it possible to install spyware in password protected android phone ?
6
votes
7answers
4k views

Can smartphone spyware work even if there is no data connection?

I am using an Android phone. Is it possible for spyware to transmit data even when I don't have any internet plan/connection? Can it use some other way, say, cellular network etc.? EDIT1: SMS and ...
0
votes
1answer
94 views

Applications security review [closed]

When a company wants to buy a new application, the security aspects must be reviewed (access rights, privileges, logs, data integrity ... etc). Is there a standard for applications security reviews? ...
4
votes
3answers
660 views

What are the security implications of a device like Coin?

Coin is a new device aimed at replacing up to 8 credit cards in your wallet with a single device. It apparently works by scanning the credit card data into a mobile application that syncs with the ...
2
votes
0answers
70 views

Creating New Acc in Mac Mail 1st Connect to Server not SSL is uname & pw tx secure?

It appears that whenever you set up a new mail account on Mac Mail on OS X (or iPhone, iPad etc), that as soon as you enter the server and the mail account user name and password, Mac Apple-Mail tries ...
3
votes
2answers
330 views

Secure storage/retrieval of data in a database

I'm doing some relatively amateur C# development for a small customer support team and working with the SalesForce API in my application. With SalesForce, login using the API requires you attach a ...
3
votes
1answer
12k views

Where to download a list of email accounts hacked from Adobe? [closed]

Adobe announced they had been hacked and millions of user accounts and passwords compromised. These sites allow a search on email address to see if it was compromised: https://lastpass.com/adobe/ ...
4
votes
4answers
413 views

usernames and passwords

I was thinking about usernames and passwords and I was wondering how secure it would be to instead of the server having a list of usernames and accompanying hash of the passwords, just have a list of ...
4
votes
3answers
3k views

How Tor, Privoxy, Vidalia and Polipo are getting together?

I realized that these applications are frequently used together. What is the role of each software in the mission of anonymity and privacy on the web? While I understand Vidalia is a GUI provider, I ...
0
votes
2answers
72 views

How to alert webmaster if he does not put contact address

i found a session cookie that contains user status with two parameters NO for standard users when altering this to YES you become a Premium user and you can download content restricted to premium ...
5
votes
4answers
1k views

Should user's password strength be assessed at client or at server side?

Now most of big website like Google mail, Twitter, Facebook have a feature that assesses password strength (check number of digit, alphabet, special characters, or check the similarity over already ...
5
votes
2answers
773 views

On Hawkes' technique to bypass canaries

I found this reference to bypass canaries: http://sota.gen.nz/hawkes_openbsd.pdf It recommends to brute force the canary byte-for-byte. I don't understand how this works: "Technique is to brute force ...
2
votes
2answers
260 views

Are there “LAN IPs” on the internet?

I have a home-made web application and thought that an easy way to secure it's administration interface would be to simply reject all IPs that arent from 192.168... Is this viable? is it possible for ...
5
votes
5answers
350 views

Would this idea for a password be secure? [duplicate]

I was thinking about password security this morning. Mainly, about the recent adobe hack releasing thousands of passwords. The current problem with existing passwords is that you have three options: ...
2
votes
5answers
1k views

Vulnerability Scanner vs Security Audit

I have a web app, and customers who are concerned about the security of the app. I want to be able to give my potential customers (manufacturing companies with 2k-10k employees) confidence that our ...
0
votes
1answer
213 views

Email hacker, what to do now?

Throughout the past 2 years; I have received email messages (about 6 or 7 cumulative) in which I responded to about 3. Which were personalized messages from a series of 3 email addresses. Nothing ...
0
votes
1answer
401 views

Running browser as different user (in Linux)

On the ArchWiki, it is suggested, as a security measure, to run skype as a different user. My question is: would this make sense for the browser? I use firefox with NoScript and AdBlock, but also need ...
2
votes
1answer
2k views

Is it possible to store an android apk in SIM card and install it from there?

I suspect somebody has installed a spyware in my android smartphone. I have done factory reset, which is supposed to uninstall all apps in SD card and internal memory. I am curious about following. ...
-1
votes
1answer
63 views

Do disassemblers detect standard functions?

Do disassemblers detect the use of C/C++ standard functions and specify them in the output code, adding the #include line to the appropriate header file (such as stdio.h or even windows.h)? If not, ...
1
vote
1answer
4k views

Generating a TRULY random string in PHP [duplicate]

I need to generate thousands (possibly millions) of unique codes for a client. These codes may have a monetary value, so it's vital that they are TRULY random, and that no pattern could be spotted and ...
0
votes
1answer
1k views

How do Java applet exploits work? [closed]

Browsers store web pages in a local cache on the client's machine. How does a hostile Java applet exploit this information to gain more privileges than it is entitled to? My understanding is that a ...
1
vote
2answers
298 views

How to restrict access to unwanted sites?

I use Ubuntu 13.10. I tried to used OpenDNS to restrict some websites. Unfortunately, I couldn't do that. I use AirStream 1200 USB modem to access WiMax internet. OpenDNS setting didn't work for me at ...
5
votes
3answers
3k views

Which is safer, GSM or CDMA?

I have read in the past (no sure where) that unfortunately there exist illegal devices that permit crooks to eavesdrop on GSM mobile phone conversations. I recently also heard that some people had ...
1
vote
0answers
62 views

How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part

1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
1
vote
1answer
947 views

Does a PCI DSS category 2x device require the same physical security as a 1a/b?

I am trying to further understand the scope of my environment. I have a group of category 2x devices that are used to manage a category 1b device through a category 2a device. I understand my group ...
12
votes
3answers
9k views

Free/Libre software to handle TCG OPAL 2.0-compliant Self-Encrypting Drives (SEDs)?

I'm in search of a free/libre software that is able to handle OPAL (2.0)-compliant SEDs (i.e. manage the setting of Pre-Boot Authentification (PBA) environment, encryption keys...). It could be a ...
6
votes
5answers
5k views

Nmap reporting almost every port as open

I have noticed during some assesments when doing a TCP port scan, Nmap will report almost every port as open for a machine. Using for example nmap -sS -PN -T4 target -p0-65535, over 20,000 ports will ...
3
votes
2answers
1k views

GPG good signature but Warning: untrusted signature

I'm having an issue with some of my clients being unable to open email attachments when I sign the messages. The error they get is something like (free translation): Error: cannot open. The ...
0
votes
1answer
173 views

Data categorization: tools?

For the purpose of setting in place the appropriate means of securing data, and to secure this process, I'm asking me the questions: What are the tools to associate to a document a categorization ...
3
votes
2answers
367 views

A new virus with unknown function

We have detected a new virus that was sent to us by mail. The email contained a zip file which contains an executable with the same name. As a first step, we uploaded the file to virustotal, to be ...
3
votes
1answer
998 views

What key to use in HMAC

I need to use HMAC on a certain message to guarantee integrity, but I cannot figure out what are the requirements for the key to be given as input to the hashing algorithm. In particular I have to ...
1
vote
0answers
61 views

Any Suggestion Exchanging shared key between process via port in untrusted machine (infected my malware)?

I am trying to get shared key between Firefox extension and a java program running in same machine. I am communicating both application via socket. My assumption is that malware is running in ...
3
votes
1answer
1k views

Key Management: storing encrypted key in database and decrypted key in session variable

Edit: Rephrased title to hopefully get some interest on what I would have thought was a common issue ? I am developing a website using php/mySQL to store non-commercial data and it will be clearly ...
-1
votes
2answers
80 views

encrypted emails and keyservers

I read that encrypted emails are secure, cause only who has your public key can decrypt it. I also read that it's a common thing to upload your public key on a keyserver. But if my encrypted email ...
2
votes
2answers
10k views

What details does my iPhone reveal about the user (if any) when I connect to a wifi network?

I accidentally used my work's wifi to look at porn using my iPhone. I refreshed a tab I had open from a session when I wasn't at work. Now I'm worried my firm will find out. The network is ...
6
votes
2answers
527 views

Trustworthy Android recovery image that allows rooting?

I have an unlocked but not rooted Android device (Nexus 7 2013 WiFi "flo", legitimately unlocked using fastboot oem unlock from an x86 computer). Neither adb root nor adb shell followed by su let me ...
1
vote
0answers
334 views

Throttling DropBox behind a firewall

Our office network bandwidth gets choked when an employee copies a large file into her DropBox, since it gets downloaded on several machines (of other employees). LAN Sync is an option, but needs to ...
10
votes
1answer
13k views

Are there any known vulnerabilities in PPTP VPNs when configured properly?

PPTP is the only VPN protocol supported by some devices (for example, the Asus RT-AC66U WiFi router). If PPTP is configured to only use the most secure options, does its use present any security ...
0
votes
1answer
358 views

Is it possible to scan a remote host in another network if I know a port that is opened?

First of all, this question is not the same as is it possible to test out remote host by using nmap?, because on that question, the questioner is asking for something impossible due to NAT's nature. ...
0
votes
1answer
99 views

Transmission of messages

I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
16
votes
5answers
7k views

Why can SSL certificates not be free of charge?

I am a newbie in this field. I am confused with why SSL certificates cannot be free of charge. In my understanding the certificate is just a text file consisting of cryptic numbers installed on a ...
2
votes
1answer
469 views

What is setuid based script root spoofing?

I'm reading this and I'm little confused. What exactly is this setuid based script root spoofing?
11
votes
2answers
826 views

Why are we still using HTTP? [duplicate]

I've been reading a lot of online articles and blogs about advantages of using HTTPS (HTTP over SSL/TLS) and the performance issues involved in deploying a website over HTTPS. What I understood is ...
-1
votes
3answers
412 views

help me about salting passwords

Eve has just discovered and decrypted the file that associates each userid with its 32-bit random salt value, and she has also discovered and decrypted the password file, which contains the ...
4
votes
2answers
234 views

Guidance for “image based” password reset challenge

Thycotic has a Password Reset Server that allows the user to select from several images. What general guidance is there for an image-based password reset challenge question? Examples may include ...
1
vote
1answer
343 views

List of social engineering hacks and defenses [closed]

Sorry if this question is absolutely stupid or irrelevant, but I can't help but ask. I am just curious about different approaches hackers take in social engineering attacks, and clever examples of ...
0
votes
1answer
826 views

Am I correctly preventing XSS in PHP? [duplicate]

While building my website I put together a security class which includes two functions, one takes input and returns it as a string passed through htmlentities function of PHP. The other strips out ...
0
votes
2answers
73 views

Secure the Datacenter, untrust the LAN?

In a scenario where you have a Wireless network provisioned as untrusted behind a firewall, using VPNs to reach the trusted Datacenter. Does anyone have an reason why this should/not be expanded to ...
1
vote
4answers
4k views

Block all Nmap scan methods on Windows [closed]

How can I prevent someone from scanning my Windows box using Nmap? I used Comodo as my firewall but someone still can scan my box using Nmap and get some info like open services and OS detection.

15 30 50 per page