22
votes
5answers
2k views

What prevents a man in the middle from requesting a certificate for your server?

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online). First of all, how can ...
1
vote
2answers
32 views

Guessing the whole PBDKF2 output from 1 half

If I use PBDKF2 with a good enough password and salt to generate a 2n bytes key, does knowing the first or last n bytes make it any easier for a 3rd party to guess the other half of my key than using ...
0
votes
0answers
7 views

Can I change my .onion address name? [migrated]

So I already created a .onion site but I want to change my address to something else, that is more than just symbols. I tried using shallot but that is not working and when I tried to install or find ...
3
votes
3answers
91 views

How do browsers negotiate SSL/TLS connection parameters?

For the purpose of this question, let assume that an SSL/TLS connection has 4 parameters: protocol, symmetric encryption method, asymmetric encryption method, MAC. During the negotiation of SSL ...
4
votes
2answers
151 views

Why is Chrome saying that “TLS_RSA_WITH_AES_128_CBC_SHA (0x2f)” is an obsolete cipher suite?

When I go to this site, Chrome Version 44.0.2403.89 is connecting to the server with TLS_RSA_WITH_AES_128_CBC_SHA (0x2f), and it states that this is an "obsolete cipher suite". For what reason is it ...
0
votes
1answer
31 views

Is there an official standard and/or name for PEM certificate bundles?

This is a question that's not really about security proper. It's about security/crypto nomenclature. It's been bugging me a bit, so here goes: I know two approaches for bundling related ...
-4
votes
0answers
30 views

How does a MS in information security help me in a software developement career [closed]

I am a B.E Information Science graduate. I have 4 years of experience in software development . I am planning to take M.S in INFORMATION,NETWORK AND COMPUTER security. But I am confused how can I a ...
0
votes
2answers
48 views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
83
votes
7answers
8k views

Why is my internal IP address (private) visible from the Internet?

When visiting some websites like "http://www.monip.org/" or "http://ip-api.com/", I get the following result: Your current IP Address - IP: 197.158.x.x - Internal IP: 192.168.x.x I ...
-5
votes
0answers
27 views

How do redhat that the user can log in to x-resrver only once? [closed]

How do redhat that user can log in to x-resrver only once, if user log in in x-server alt+F7, he not log in in x-server alt+f8? thanks
1
vote
1answer
29 views

How to define the rate in rate limiting [closed]

I am working on rate limiting and I want to limit the requests. How should I define the rate of requests? what should I pay attention to?
2
votes
0answers
42 views

Help locate “snot” IPS/IDS testing tool? [closed]

It seems this great tool has been lost to internet backlog somewhere. I cannot locate it anywhere. The description of tools provided is http://www.securityfocus.com/tools/category/112 If someone on ...
1
vote
3answers
71 views

Is my approach good enough for brute force protection

I don't particularly want to implement Captcha on my login form for a website. But I've got a block mechanism already in place. What's the best way to protect from Brute Force attacks? Here's what ...
1
vote
0answers
79 views

How to identify if BIOS is infected? [closed]

How to identify if BIOS is infected with malware? Is there a way to extract content of a BIOS chip?
1
vote
1answer
61 views

Secure Software Architecture

I am designing a software architecture and i need some suggestion and clarification on few issues. This will be a server side RESTfull API for accessing data and multiple mobile/desktop client to ...
4
votes
2answers
67 views

DDoS attack - where are packets dropped?

I'm researching into ddos attacks to get a better understanding. I've read lots from this community however one thing I couldn't get my head around is packet dropping. So lets say I've identified an ...
-1
votes
2answers
170 views

Don't store passwords in database? [on hold]

Where might someone keep them besides a database? By storing passwords elsewhere I mean a non-traditional database. Allow me to explain. A couple of my friends run high security websites. They ...
-2
votes
0answers
106 views

Hacker using my wifi connection to try to log on? [on hold]

My Hotmail account was hacked, not so I couldn't use it, but I didn't know that it was being used. They got banking information and used it! I was overseas. My Hotmail account was opened by various IP ...
-1
votes
2answers
57 views

How to deal with SMS spam? [on hold]

Every few weeks, I get an annoying SMS trying to sell me something, or trying to get me to click something, or otherwise spamming me. I don't think it's a targeted thing- I think my phone number is ...
1
vote
1answer
228 views

Why does SQL not escape/sanitize by default?

First, since there is no SQL stackexchange I am not sure where the best place to ask this question is (I debated between here and programmers.stackexchange). If this is the wrong place, please move ...
-1
votes
0answers
24 views

domain typosquatting detection services [closed]

I would like to subscribe to a service that monitors domain name registrations to detect and alert us when someone registers a typosquatting domain for our company. For example, if our domain were ...
1
vote
0answers
43 views

Is there anything to worry about — worth putting security on a simple test site?

So I want to make a site, this site won't have users (so no one but me will be able to post to the site) or anything it will just echo out items from Mysql like title and text-body I was wondering if ...
3
votes
0answers
37 views

Forcing new password with zero-knowledge proof authentications

Let's say a ZKP (e.g. SRP6a) is used, for password verification. Let's say I need to force a user to change their password (so I have the salt and the verifier for the current password). For this, ...
6
votes
5answers
308 views

Does setting a default DROP policy actually improve security?

It seems that the status quo at the moment is to configure firewalls to drop any packets that aren't destined for specifically-opened ports. Many defensive port scanners (such as ShieldsUP!) seem to ...
2
votes
2answers
49 views

Authenticated encryption (Symmetric encryption) for .NET applications [on hold]

Is there an implementation of Authenticated encryption for .NET applications? The AES API from .NET does not include mode such as GCM. In the documentation, I can only see insecure modes (ECB, CBC, ...
0
votes
1answer
106 views

How dangerous is checking email on open Wi-Fi network

How risky is it to check my email on my smartphone on an open Wi-Fi network (i.e. Starbucks or Old Navy)? Is this only risky if someone is snooping? Do they have to be there, or can they leave a ...
0
votes
0answers
14 views

How secure is a ODBC connection from MySQL(5.6) to MS Access

I have created a connection from a MySQL server (unpopulated) to Access using their ODBC driver but don't know anything about how secure this connection may or may not be. I do not have openSSL set up ...
-1
votes
2answers
48 views

How should I report a security vulnerability? [duplicate]

I've found an SQL injection vulnerability in a website and I want to go reporting it. I do have contact email, but I'm afraid that they'll sue me because I found a way to hack into their site. (No, I ...
0
votes
1answer
56 views

Using the index of characters in a security question [duplicate]

I'm seeing many sites offering one or two "security questions" that have to be answered by choosing characters at specific indexes, in addition to username + password. For example: "What is your ...
2
votes
2answers
112 views

If password is super long, your wpa / wpa2-psk is safe?

sorry im kinda clueless with this stuff... I heard if you set your wifi password to more than 10 or so digits (and make it complicated), then your wpa / wpa2 psk would be safe. Is that true? If not, ...
-2
votes
0answers
57 views

Why Social Security Numbers are still used for human authentication in USA? [closed]

Imagine that your bank requires that your login to consist of 9 digits and that your password must coincide with the last 4 digits of your login. Moreover, you must disclose your full 9-digit login to ...
0
votes
0answers
22 views

Can PHP sockets and HTTP requests be logged? [migrated]

I would like to be able to log outgoing HTTP requests from PHP scripts with the time and PHP script location and line. It occurs to me that since you apparently can open sockets in PHP, you would also ...
0
votes
0answers
11 views

Secure Distribution of Admin-Defined Credentials to End-Users [duplicate]

Situation: I need to safely send database credentials created by the admin to users in a secure fashion. Currently, creds have been sent to users via plain text email (which is a huge security ...
0
votes
0answers
49 views

Why is Rabin encryption equivalent to factoring? [migrated]

I don't understand the proof of equivalence I've read everywhere (e.g., in Rabin's paper or on Wikipedia). Here's my objection: let's say you have a Rabin decryption oracle that takes n and c and ...
1
vote
2answers
38 views

how should I protect url parameter in JPQL query for reset password flow

I am implementing a web app with reset password flow. Here is what I've done to try to make it secure. Put in the email address in forgotten password form. Regardless of whether the customer exists, ...
1
vote
0answers
57 views

Is it possible to exploit an image field in which I can upload any file? [closed]

I'm pentesting this web application developed in ASP.NET. I've found that I can upload any file as profile photo. When I later visit the profile page the site tries to display it like this: <img ...
1
vote
1answer
152 views

Is the 'SUIDGuard' patch safe to implement?

Can someone who really knows what they're looking at advise whether the patch published here by Stefan Esser is in fact safe to install? While I'm very concerned that Apple haven't published an ...
-2
votes
1answer
49 views

Freedom method for anonymity

In a book I am reading, a system called Freedom is mentioned as a means to protect user privacy. Though at some point it mentions that it uses multiple proxies, so even if a node behaves maliciously ...
3
votes
2answers
67 views

Internet Explorer - Advanced Properties for Trusted Root Certificates

If you go to IE -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities. Now Click on some CA certificates and click on Advanced You can add properties to the ...
0
votes
2answers
61 views

Content on a usb flash drive available for a limited time [closed]

I need to distribute some content on a USB flash drive. This content should be available for a limited time only. I am looking for some approach to achieve above. So far I do not have information ...
-8
votes
0answers
38 views

Antivirus signature generating algorithm [closed]

I just want to know what technique or algorithm used by the most antiviruses to generate signatures of malware? e.g MD5. And how they generate their signature for a malware? Is it a whole file ...
-3
votes
0answers
79 views

Ph.D in Netwok Security? [closed]

I'm already Cisco Network Support Engineer and cleared CCNA Exam . I wanna to start my PhD in network security. What kind of programming skills(Java,c++, Erlang) are required to gain before join PhD ...
1
vote
1answer
32 views

what is more secure, to have PPPoE on the modem or on the firewall

We are trying to understand what a more secure installation is: a) A modem connected to the internet with PPPoE doing a NAT to the firewall than doing a second NAT for all the devices b) A modem ...
10
votes
1answer
1k views

Git server security

I want to install a Git server for my company. I'm able to get a Windows virtual machine. Now I've been asked to assess its security aspects. I'm lost on how to achieve this goal. As it is a Windows ...
1
vote
1answer
50 views

The use of SHA-1 in a cyber forensic

Let's say a hard disk (A) is retrieved from a system to make a clone of it on hard disk (B) and use this clone for a forensic investigation. Is SHA-1 secure enough to make sure that no other ...
4
votes
1answer
44 views

Attacks on keys generated with low entropy

If i were to give someone a two 4096 bits keys, and say one was generated in a Linux OS with very very low entropy available, and one was generated in a Linux OS with more than enough entropy. Would ...
-1
votes
1answer
61 views

What are any risks associated with being associated with potentially subversive software? [on hold]

I have been doing a little research regarding software security. One of the ideas I came across is searching for or downloading some software such as Tor or TAILS will amend you to a government list. ...
2
votes
0answers
32 views

Risks when connecting Public WLAN networks [closed]

I want to refer with my question directly to a question posted on the forum before. wifi topic I am running teamviewer on my android which is not rooted and i am not using a firewall on it. I guess ...
5
votes
2answers
154 views

Is it safe to give my PayPal email and Home Address to a stranger? [on hold]

I am selling some fairly expensive furniture on CraigsList. A few hours after posting, I received an offer. They said to send them my PayPal email and the address so that movers could come pick it ...
2
votes
1answer
47 views

Tools for finding stored XSS vulnerabilities, given DB write access?

I'm aware that there are various tools for testing for XSS vulnerabilities. However, all the ones that I'm aware of (Vega, possibly BeEF, etc.) operate purely client-side. When testing for stored XSS ...

15 30 50 per page