11
votes
2answers
1k views

What is the purpose of a Pepper?

I've been trying to find out exactly what a pepper is. The only things I could accurately determine are that a Pepper: Is theoretically unique from site to site and hard-coded in the site's source ...
1
vote
3answers
13k views

Is it possible to find who posted comment on my blogspot anonymously?

Problem Behind question : I own an blogspot site and people used to come and comment on my posts. In recent days I can see a spammer who comments anonymously on my every blog-posts. The comments were ...
3
votes
2answers
706 views

How many bytes should an authorization token have? [duplicate]

Assuming I generate random bytes with a secure PRNG, how many bytes do I need to make authorization tokens secure? Specifically, when users log in to a website, a token will be generated and stored ...
-3
votes
1answer
321 views

Different AES 256 algorithms produce different results?

I've tried 3 AES 256-bit CBC encryption programs, and I seem to be getting different results for each one with the same 32-character password, which consists of all @ signs. They are: Polaris SSL ...
3
votes
2answers
433 views

Requirements for qualified certificates in DIRECTIVE 1999/93/EC

DIRECTIVE 1999/93/EC at ANNEX I Requirements for qualified certificates states that one requirement for qualified certificates is (a) an indication that the certificate is issued as a qualified ...
4
votes
1answer
124 views

What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2

From Technical Spec http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC a Root Certification Authority from which a certification path can be established down to ...
13
votes
8answers
898 views

Trust Issues Relative to Open Source

Two separate discussions have very recently opened my eyes to an issue I had not considered – how to confirm the Open Source binary one uses is based on the published source code. There is a large ...
5
votes
1answer
518 views

Safe to drop email verification when using Facebook login

If a user registers an account on my Website with Facebook authentication, can I safely skip the "verification email" that is usually sent to users who sign up without Facebook (that is, from a ...
2
votes
3answers
524 views

Safe parental control app for Android?

A lot of parents when they get smart phones (Android) for their children ask me whether I can install some kind of parental control app on the device (Even though I'm barely out of high school myself ...
1
vote
3answers
321 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
-1
votes
1answer
87 views

firewall settings for VPN

In my firewall settings there are options for "Allow VPN connections via PPTP" and "Allow VPN connections via L2tp-IPsec". All of my internet traffic goes through a VPN. Should I have these settings ...
6
votes
3answers
864 views

How do poor-quality initialization vectors affect the security of CBC mode?

(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.) From what I have read (looking specifically at AES in Cipher Block Chaining ...
0
votes
1answer
2k views

Using Volatility Framework with Linux memory dumps

I am using Volatility Framework 2.2 to anlayze a Linux memory dump. This memory dump was taken from an Ubuntu 12.04 LTS x86_64 machine with the kernel version 3.5.0-23 I have the profile for it and ...
18
votes
1answer
1k views

Does a maximum length of password mean non-hashed storage?

When a system requires a password between say 6 and 20 characters in length, does it mean the password is stored without using a hashing function, and that the mysql-field (or similar) is 20 ...
18
votes
3answers
4k views

Why doesn't Linux randomize the address of the executable code segment?

I've recently been learning about how ASLR (address space randomization) works on Linux. At least on Fedora and Red Hat Enterprise Linux, there are two kinds of executable programs: Position ...
4
votes
2answers
216 views

To What Extent does an Attacker Have Access to the Browser History through the CSS Pseudoclass :visited Styles?

I have read this article on how a scripted web page is able to obtain the visited history of a user browsing the page. However, I can't find any clear information in the article describing the extent ...
1
vote
1answer
338 views

Is it possible to execute xss under these conditions?

Is it possible to execute xss under the following conditions? The following blocked characters and words are replaced with _. characters: > , : , ; , " , ' , # , ~ , \ , % , ( , ) , [ , ] , { , } ...
3
votes
1answer
291 views

How effective is Caja at preventing XSS?

I recently found Caja which looks like an effective way of preventing XSS. From their site: The Caja Compiler is a tool for making third party HTML, CSS and JavaScript safe to embed in your ...
12
votes
2answers
733 views

USB to Firewire converter is a security issue?

So: https://en.wikipedia.org/wiki/IEEE_1394#Security_issues FireWire has security issues. But what happens if there isn't any FireWire ports on the given machine, and ex.: the Operating system ...
2
votes
3answers
438 views

Can risk mitigation controls bring down the impact?

While doing a Risk Assessment, I found that in some old RA documents, after controls have been placed, the Impact in the forcasted value was changed that did not make sense to me. To me the impact ...
1
vote
0answers
56 views

elapsed time from the time of opening of a container [closed]

Does anybody know of any packaging which measures elapsed time from the time of opening? I have conducted a great deal of research and have found packaging which monitors exposure to temprature and ...
7
votes
2answers
2k views

ATA security erase on SSD

Is it possible to recovery data from SSD, that was secure erased (https://ata.wiki.kernel.org/index.php/ATA_Secure_Erase), by IT or professional data recovery company? Does this type of erasing ...
1
vote
0answers
502 views

Does ZRTP provide useful protection, given that the SAS is not verified?

Firstly, some important backstory. I'm producing a corporate version of an IM/VOIP/Screensharing client using the Open Source Jitsi. We are going to be using a central server and have already ...
4
votes
4answers
2k views

Does using Google DNS make extensions like AdBlock Plus useless?

As many of you probably do, I am not using my ISP DNS because of very low performance, and I am using Google's primary and secondary DNS (8.8.8.8 and 8.8.4.4) which are good speed-wise but, knowing ...
0
votes
2answers
140 views

Are there any obvious flaws in this anonymous-receiver communication method using Twitter?

There might be flaws in the following method for anonymous signal reception that I'm not seeing: Alice doesn't know who Bob is. Bob wants to Alice to notify Bob of a particular outcome without ...
1
vote
1answer
341 views

How does IIS persist identity credentials? Does it create any security issues?

We want to implement a feature similar to IIS in how it remembers user configured usernames and passwords. As I understand it, when you configure IIS to use a set of credentials for an app pool ...
3
votes
4answers
1k views

Are kiosk-style, full screen apps possible on iOS, Android, or Windows phone?

A popular car insurance company in the US has an app that displays "digital car insurance" papers. In the commercials, these apps are opened, and the user gives the unlocked phone to police officers. ...
12
votes
4answers
3k views

What was SSL 1.0?

What was SSL 1.0? SSL 2.0 and 3.0 are well-known and well-documented. But what did the SSL 1.0 protocol look like? Wikipedia says there was a SSL 1.0 but doesn't say anything about how it worked. ...
1
vote
1answer
396 views

How to check my application passes multiple virus scanners

I have an application I am trying to bring to market and I want to ensure that nothing in it is picked up by a virus scanner (since that would reflect badly on me). Since I only have a single scanner ...
4
votes
1answer
2k views

How do I know if a font is malicious?

There are cases of fonts being used for exploiting vulnerabilities {for ex: ThreatPost, SecureList and F-Secure}. My question is if you ever get hands on such a font, how do you know that it is ...
-1
votes
1answer
5k views

Incorrect file permissions for LAMP [closed]

I have installed Apache 2.4.6 on my server and have the following virtual host config: <VirtualHost *:80> ServerAdmin webmaster@localhost ServerName foobar1.com DocumentRoot ...
15
votes
6answers
4k views

Do salts have to be random, or just unique and unknown?

First of all, my motive is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database. After discussion in comments and in ...
1
vote
2answers
922 views

VPN and Firefox proxy

What happens if I use VPN and then configure my firefox browser to use SOCKS proxy? Am I then behind both or just proxy?
3
votes
1answer
1k views

Why is OAuth 2.0 being used for mobile devices, and not OpenID?

Microsoft Azure Mobile services exclusively uses OAuth 2.0 for authentication, and many other providers mention the use of OAuth 2.0 specifically when referring to mobile devices. Question What ...
1
vote
3answers
139 views

How does Windows know which part of memory is “intended to hold data only”?

I'm learning about DEP implementations, now I'm trying to figure out how does the OS know which part of memory is intended to hold data only?
1
vote
3answers
940 views

Text changing virus

Can malware change words that I have typed and then saved in the computer'? If so, how likely is this?
-2
votes
2answers
1k views

Why don't we have any popular decentralized chat systems, social networks etc.? [closed]

Let's say two computers have the same decentralized chat program. Each user has to have an ip address and port number to send the message to another person. Each message is encrypted using, let's say, ...
2
votes
1answer
93 views

Web App Protection and Sign On

I have a client that wants to protect access to a web app in case the employee leaves because the app gives access to clients, sales, etc. He wants to "hide" the login credentials to this app and ...
2
votes
0answers
262 views

If my users use Google OAuth for authentication, can I allow 3rd party apps to read data on my site?

Suppose I run a book club, and each of the members sign into my website using an OAuth token from Google, Twitter, Live, or LinkedIn. When the book club becomes popular, we discover that 3rd party ...
3
votes
2answers
845 views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
-1
votes
1answer
2k views

Is Opera spying on its users when traffic conpression is enabled?

Correct me if I misunderstand the following quoted paragraphs, but basically to compress something it must be decrypted first. This seems to be the claim of the article but I don't see this as true. ...
2
votes
2answers
683 views

Are Yubi Keys secure “out of the box” when purchased for use with Yubi Cloud?

The YubiKey personalization tool allows someone to configure a YubiKey for HOTP, challenge response, and a variety of other authentication formats. YubiKey offers a number of personalization tools ...
7
votes
2answers
2k views

Possible to use a YubiKey in HSM mode to secure a Windows CA infrastructure?

I'm looking for a low-cost Hardware Security module, and discovered that YubiKey has a HSM mode. I'm not entirely clear if this HSM mode is what I'm thinking, but I'd like to use it as the offline ...
5
votes
2answers
1k views

Why does Google SSL cert change so frequently?

For the last few months I have been using the Firefox addon Certificate Patrol to watch for changes to sites' SSL certs - so as to know if I am being MTIMed, against which SSL otherwise provides no ...
3
votes
5answers
421 views

Are hash functions “strongest link”?

It seems to me that if you were to use multiple hash functions, the "strongest link" would hold up the others. For example: HelloWorld --- md5 --> 68e109f0f40ca72a15e05cc22786f8e6 --- sha256 ...
4
votes
2answers
4k views

Storing the MAC Address of a computer in Active Directory

I’m considering enabling WoL (Wake on LAN) on the workstations on my network. In order to boot a workstation using WoL I require its MAC address. I could store the MAC address in a database, however ...
1
vote
2answers
250 views

Queues for Mobile Web Application Security Architecture?

Dear Security Mavens (of which I am not), Your thoughts & suggestions regarding an application architecture for a mobile web application (e.g., HTML5 with Sencha Touch) are invited & ...
1
vote
1answer
427 views

Selinux: How to log/monitor all accesses to a file?

Does SELinux support monitoring accesses to an object type? I would like to log all instances where sensitive files are accessed.
3
votes
2answers
697 views

Is HTTPS still secured with a known server certificate (private key)?

I see that some product are shipped with a default server certificate. I guess that a lot of these installed products still use the default server certificate in a real environment. If your server ...
5
votes
4answers
1k views

How should a webmaster manage all her passwords and keys?

I have several private keys that I use to ssh into AWS, dreamhost, github, etc. I have passphrases for all of these private keys that are too complex to remember. I have mysql passwords that my ...

15 30 50 per page