All Questions

-1
votes
2answers
74 views

Is using TrueCrypt in OSX secure? [duplicate]

What would be a more secure way to encrypt files using TrueCrypt 7.1a. The is an airgapped computer (wifi, bluetooth, speakers and mic removed too). The encrypted files will be on an external drive in ...
-1
votes
1answer
40 views

Regex Protection(Bypassing to XSS or Open Redirect) - Javascript [on hold]

Anyone in the universe can help me finding out the function.What will be done with this regex string /^#~?!(?:\/?[\w\.-])+\/?(?:\?|$)/ When it passed to this javascript statement like this. ...
-1
votes
0answers
27 views

Review of the “Connections Tab” in my browser using secured sites

Can someone help me understand the following information better when looking at a secured site in my browser. For example I'm looking at a site now and it says the following in the connections tab ...
-1
votes
4answers
114 views

I think someone is using my WiFi

I think somebody (maybe one of my neighbors) has access to my WiFi and is using it, because even when I reset my WiFi router it gets very slow, and some of my computers seem to have their WiFi ...
0
votes
1answer
103 views

Wifi Educational Hacking - Aircrack-ng wpa vs wpa-psk

I have a question about the max amount of dictionaries need to crack a wpa2 or wpa2-psk password I am using aircrack-ng on ubuntu Is there any possible way to calculate the maximum amount of ...
-1
votes
1answer
57 views

how to do crud operation using sqlmap? [closed]

I'm new to sqlmap.i need to do insert,update and delete using sqlmap.i in my local-host i have running php project with mysql.i have tried to do using insert using sql-shell command but i got this ...
0
votes
0answers
32 views

Is there a good list of all the parts of the Security Chain? [closed]

I was thinking there must be a concise description, at a high level, of all necessary & sufficient conditions. Like: Strong Crypto, Key Management, Key Cycling, Physical Access, ...
0
votes
1answer
26 views

XOR-Cascade of weak hash secure?

I have following theoretical question: Let H(X) be a hash function which is considered as weak because collissions can be produced (e.g. SHA1, MD5). I wonder if following functions: H2(X) = H(H(X)) ...
0
votes
1answer
45 views

What is this weird robot call about? [closed]

I recently moved and changed my landline number. I have been getting unusual robot calls in the evening, the script goes something like this: "Hello. This call is for [name of person I don't know]. ...
-6
votes
0answers
57 views

How to be a white hat hacker? [closed]

so i have decided to become a white hat hacker but this is challenging because I'm not going to take any certificate i will just do it by self learning only , so i wanna know how to become a white hat ...
-1
votes
2answers
53 views

How can I be as anonymous as possible while on Tor? [duplicate]

I've started browsing the deep web recently and have seen a lot of illegal content. Now while I have no interest in any of the illegal content, I don't want to be caught on one of these sights because ...
1
vote
1answer
95 views

What are the differences between the U2F and UAF FIDO authentication standards?

Google recently announced support for Universal 2nd Factor (U2F) authentication in Chrome and started allowing that authentication mechanism to be used for 2-factor authentication across their various ...
0
votes
1answer
5 views

What are valid OpenPGP revocation signature types?

I'm working on an analysis of the full OpenPGP keyring (ca. 3.8 million keys). I imported all keys to a local instance of hockeypuck (keyserver implemented in go). Hockeypuck uses a PostgreSQL ...
0
votes
0answers
46 views

oclHashcat error messag in Kali Linux

I am in the process of learning oclHashcat syntax. Currently, I am working on breaking a file of md5crypt strings with a dictionary file. The dictionary I am using is rockyou.txt from an installation ...
-4
votes
0answers
38 views

Data protection on DVD's

I would like to encrypt data on a dvd such that one can read but not write the dvd. Ive tried Nero 15 but it requires that I send a public key to the user which I find counter-productive. Any ideas
0
votes
1answer
45 views

How to protect user privacy when sharing photos?

I have a web site that lets users upload a profile picture that is then visible to other users of the site. What steps should the site take to protect user privacy? For example, some Jpeg files may ...
1
vote
1answer
85 views

Email clients and POODLE vulnerabilities

I use a commercial email service that provides IMAP over SSL on port 993 and SMTP over SSL on port 465. I currently connect to their servers with Thunderbird and the Apple's iOS8 email client. Could ...
1
vote
2answers
36 views

Shared Database and PCI Compliance

Say we have a cloud based web application which is SaaS. This application is to be made PCI compliant as a service provider, as client card data passes through the application. This application uses a ...
0
votes
1answer
34 views

Shall I set “RSAAuthentication yes” in sshd_config if I use only ECDSA key?

In a context of proprietary client boxes and servers, I want to limit authentication to ECDSA keys. Historically, "RSAAuthentication yes" was used to enable authentication with RSA and maybe DSA keys. ...
3
votes
1answer
64 views

Encryption and HMAC with the same password

I need to send authenticated ciphered messages by using a single password. Reusing the same (derived) key for the block cipher and the HMAC is not a good practice, I know. My initial idea is to ...
1
vote
1answer
27 views

Code deployment in PCI CDE

The PCI DSS v3 standard states the following: Network Segmentation To be considered out of scope for PCI DSS, a system component must be properly isolated (segmented) from the CDE, such that ...
0
votes
1answer
85 views

Is (WEP) shared key authentication secure?

I've been reading up on wireless authentication and shared key authentication sounds completely bonkers. I know WEP is very insecure and breaking it with aircrack-ng takes 5-15 minutes but this sounds ...
2
votes
2answers
59 views

Old floppy disk protection

can somebody explain in detail how old floppy disks copy protection works? Someone told me that it was based on an error on a trace of the floppy that was read only during the copy (and never when the ...
3
votes
1answer
94 views

Protecting a document that you sell

I have written a short guidebook that I have been selling hardcopy. There is now interest in a digital version. How do I protect this guidebook so only the people who purchase it have access to it? I ...
1
vote
2answers
26 views

DMZ-Hosting for VOIP services…To Use or Not To Use?

I have VOIP service from PhonePower... They give their users an MTA device to connect to their network, however their instructions are that the user must turn on DMZ-Hosting for this device, to allow ...
17
votes
0answers
2k views

What can the school do with my MAC address? [duplicate]

At my school they are requesting my MAC address so that I can use the schools Wi-Fi. Now I understand that the school can see what sites I am going to while I'm at school. But can the school see what ...
2
votes
1answer
24 views

SSL Mixed Scripting Vulnerabilities and XOR Attacks

Given that RC4 is a stream cipher (I'm pretty sure the details of its inner workings don't matter for the sake of this argument) and the existence of Mixed Scripting / Mixed Display (web applications ...
4
votes
3answers
935 views

Unknown URL shows my website

I run a website at https://fastslots.co. I just discovered that I am getting requests from the URL https://canadaehtees.com/ that I have no affiliation with. When I load canadaehtees.com in my browser ...
1
vote
1answer
95 views

Is google.com/webhp malicious?

Lately, I've noticed the addition of "/webhp" in the url of Google searches along with some additional variables, "sourceid", "rlz", and a few others. Together, they make a URL in the form of ...
1
vote
5answers
79 views

Identity Theft: should I shred documents with only name and address details?

I routinely shred documents with any personal information on them to protect myself and others against identity theft. I have no doubts that shredding any documents with ID numbers, account details ...
-2
votes
1answer
53 views

Good log file review tools [closed]

I am wondering, what tools are good for log file review? I am interested in a tool that is cheap or free, easy to use, covers all relevant log files, is useful for forensics (e.g. what did a hacker ...
3
votes
2answers
27 views

Why browsers implement stricter policy for local files

I have a problem viewing HTML/JS/CSS files generated on disk. Specifically, several calls in javascript are blocked by Google Chrome. I googled and found an answer here: ...
3
votes
1answer
74 views

How to best to secure data over HTTPS

My aim is to have an (iOS) app in which the user would login, then on sucsessful login, gain access to additional information over an encrypted webservice (undecided). From research, I understanding ...
2
votes
3answers
671 views

Is it possible to force a browser to use http in an ssl enabled (https) website?

I was doing a security research on storing the session id in local storage instead of storing it in cookies. I understand that it is not possible to tag the values in local storage as HttpOnly and so ...
5
votes
2answers
118 views

How to evaluate the damage after being hacked [duplicate]

It's well known what measures one should take to prevent hackers from hacking their PC. But are there any steps that allows a user to evaluate the damage done by a hacker? Say that I know for sure ...
0
votes
2answers
77 views

How would you set up a ‘cold’ netbook for master-key signing, large Bitcoin transactions, etc? [closed]

I've just ordered a cheap-o netbook on Amazon, with the intention of installing a Linux distro, and turning it into a permanently-offline high-security machine for sensitive tasks. However, I'm no ...
0
votes
1answer
81 views

How to disable SSLv3 on a Windows 8 phone?

I have a Nokia Lumia phone that runs Windows 8. However, simple test on the browser tells me I'm vulnerable for POODLE attacks. I use the phone for internet and email access a lot and I need it to be ...
0
votes
1answer
69 views

sslv3 is still showing in openssl result even after disabling from sslprotocol [closed]

We are trying to disable sslv3 for poodle vulnerability.so i disabled in ssl.conf SSLProtocol -ALL +TLSv1 -SSLv2 -SSLv3 and tried to connect using tlsv1 using openssl command. openssl s_client ...
0
votes
1answer
25 views

Do we require to eliminate share drive access to PCI users?

Do we really require to eliminate the share drive access to the PCI users. We have a file server outside PCI VLAN. But PCI users have access to it. We dont have any DLP solutions. Does the PCI ...
0
votes
1answer
36 views

What are the major threats involved in storing the session identifiers in local storage instead of cookies?

I want to know the major security threats involved in storing the session variables in client side local storage, instead of storing it in the cookies. Can somebody give me a brief description?
3
votes
1answer
68 views

Is it a good idea to do double AES encryption with 2 different keys, when one is held by the user and one stored on the server?

I'm building a web app. The app needs to keep certain data within the database very secure. Please assume for the moment that I don't have a HSM or Key-Management facility and can't afford to ...
1
vote
0answers
40 views

SSL Asymmetric encryption newbie [duplicate]

I am relatively new to the world of cryptography and was wanting to develop a webpage which allows credit card payments. Thus, I looked into the digicert ssl service, hoping that it could do what I ...
1
vote
0answers
44 views

Build only OpenSSL crypto?

I was wondering if it's at all possible to compile only the crypto functionality of OpenSSL that I want? In particular, is it possible to compile just SHA1, AES, and DH parts of OpenSSL? I followed ...
1
vote
2answers
108 views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...
0
votes
1answer
84 views

How to ensure a second hand computer is safe to use [duplicate]

I'm planning to buy a second hand computer (2012 Mac mini, which is no longer available in stores). Because I'm not sure if there is any malware in the computer so I will perform hard format several ...
0
votes
5answers
78 views

SSH server: What's more secure, pub key auth or Google Authenticator time-based auth?

I'm curious which would be more secure, pub key authentication or 2-factor auth via Google Authenticator. Apparently I can't use both. If I have pub key authentication, the Google Auth PAM module ...
0
votes
0answers
35 views

Preventing “existing accounts” data leak during account creation [duplicate]

It is common practice for web apps to prevent mining of existing user accounts for logins (with "username and/or password does not exist" rather than "user does not exist"), and for password resets ...
-2
votes
0answers
36 views

Hydra Too many connection to target? [closed]

This is what i get when i type in cygwin... $ hydra -l rivaljet@gmail.com -p (not saying it) -s 465 say ip Hydra v8.0 (c) 2014 by van Hauser/THC & David Maciejak - Please do not use in military ...
1
vote
1answer
46 views

PHP would this be risky (using hackable data for includes)

mysql_select_db($db.'_'.$table); include("/home/site/includes/".$type."/functions.php"); Would this be a bad idea if $table and $type are values passed via ajax from a JS script? And this.. ...
1
vote
1answer
36 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...

15 30 50 per page