26
votes
8answers
3k views
Is it legal to find bugs on a website and report them to the website's owner?
I'm from Canada, and I'd like to know one thing. I know a bug on one website. I'm not sure if it's legal here to search for bugs on a website and NOT use them; instead, tell its company about it.
4
votes
2answers
141 views
Is it possible to create a secure chat web application relying on HTML5 web sockets?
Is it possible to create a secure chat web application using just HTML5 and Javascript?
What possible security holes would there be if the server doesn't store the messages, just relay them using ...
1
vote
2answers
35 views
How to manage company passwords when employing temporary freelancers?
I am from a marketing firm which now has a development team, which i am part of. We have been tasked with finding a few freelancers who can come in and work when either me and the other developer is ...
-2
votes
2answers
83 views
How to minimize your fingerprint, or become invisible on the web? [duplicate]
With all of these news stories about the government reading emails and snooping information from other sources, what are ways to minimize or eliminate an organization's ability to actually track and ...
-4
votes
0answers
28 views
Cryptocat Backend Database [closed]
I was reading about cryptocat and it seems behind it all is an XMPP server. Wouldn't the encrypted messages be stored in the XMPP server's database? Does anyone know if they retain these encrypted ...
1
vote
3answers
82 views
Are different top level domains somehow different security wise?
If so why is the difference?
I've tried to google it but nothing relevant was found.
0
votes
1answer
66 views
Tracing nuisance or malicious cellphone calls
Is it possible for an ordinary citizen to trace source of nuisance calls to cell phone when caller ID has been blocked?
-2
votes
0answers
43 views
How safe is a Random 15 Char Upper-lower-Alpha-numeric unsalted SHA512 password [closed]
Can't seem to find an answer for this or a realistic table that would point me on the right direction. So...
How safe is a Random 15 Char Upper-lower-Alpha-numeric unsalted SHA512 password?
How long ...
-4
votes
2answers
65 views
Security and privacy in email and other communications [closed]
In the light of newly discovered events like the NSA's PRISM program, I'm really concerned about the privacy & security of my personal emails. Chances are governments already have backdoor access ...
-1
votes
0answers
28 views
Python Library for Generating Passwords? [closed]
Some time ago I was reading 2600 and they mentioned a password generator which I believe was written in Python; It would take two words as an input, and generate a password. It was useful in that if ...
-3
votes
1answer
52 views
How to convert some packets in a readable format [closed]
I am looking for a tool for osx, that can convert this raw data in some readable format. Testing my wifi network, I began sniffing my packets, and ran
tcpflow -i en1 -c
I want to get the sniffed ...
0
votes
1answer
31 views
how to make socat ignore client certificate?
I'm trying to set up a listener to check if an application checks the server's certificate (I'm strongly assuming it is not). So I've created a self-signed certificate fake.pem for a listener and am ...
-2
votes
2answers
66 views
Understanding a key establishment protocol
I'm studying a one-pass key establishment protocol.
Let be A client and B the Server.
A sends to B:
E_w(t,b,k)
where t is a timestamp requested for freshness, k is the ephemeral key that will be ...
2
votes
1answer
48 views
What are the advantages/disadvantages of attribute-based access control?
An example attribute would be "employee is currently located in the US" and is trying to access a document that requires the person to be accessing the document in US territory.
-7
votes
0answers
61 views
Want to check deleted browser history? [closed]
I want to check the deleted browser history through command prompt ?
I've checked the command "ipconfig" still not satisfied, i need proper detail of the browser history.
-5
votes
0answers
58 views
i find the admin page but can't use username and password that i found to deface [closed]
hi after find the sql injection bug in a site i use havij to find the tables and then i find admin table and user and pass. but i can't use them in admin page to log in.my real question is that how to ...
6
votes
3answers
289 views
Can cloud based password managing services be trusted?
I'm a big time user of cloud based password managing services like LastPass.
But in the light of recent revelations like various government backdoors in popular sites, programs like prism, etc. I'm ...
0
votes
0answers
38 views
What is the safest way to keep TorBrowser up to date? [closed]
I just installed TorBrowser (complete n00b) and I'm not sure what the best way to keep it up to date it. It has the usual Firefox update screen:
But I'm not sure if that was also adapted to bring ...
-2
votes
1answer
33 views
Rsync without ssh access [closed]
There is a host of computers and one of them needs to Rsync a specific folder from each of the other computers.
The way its done right now is that this central computer has ssh access to all those ...
-1
votes
2answers
66 views
My Computer hacked?
I have Window 7 and believe it has been hacked. On two occasions, as I was reloading my operating system, I got a message that my computer had been counterfeited. I get the impression that my computer ...
-5
votes
1answer
42 views
History of Buffer Overflow attacks and it's countermeasures? [closed]
I want to know the chronology of BoF attacks and it's countermeasures.
We know it's started about 1972, here's a hypothetical of it:
Buffer Overflow Simple (attack)
ASLR (Contermeasure)
ret2reg ...
0
votes
2answers
45 views
How does Wuala store symmetric key?
As far as I understand Wuala (so called secure cloud storage) is not using the original (user provided) password to encrypt data so what role does original password play in their system?
I think they ...
2
votes
2answers
73 views
Is any company or group working on secure hardware architectures? [closed]
My impression is that mature Unix-like operating systems are less vulnerable to trojans that might be present, mainly because of well-debugged kernel code, including correct use of hardware memory ...
-5
votes
0answers
42 views
I need to know my keystore password [closed]
I lost my keystore password for my key .. I could find the way to copy the content of they key store into another keystore with a new password via this link now I really need to know the password of ...
0
votes
2answers
53 views
Generating session CSRF token based on SSL session ID
Following situation:
Application is only accessible via HTTPS/SPDY
nginx is sending the SSL session ID to the upstream server
Upon session start I'd like to use the first 128 characters of that ...
3
votes
2answers
55 views
Does Windows keep an Active Directory user token while locked?
The Firewire DMA hack Inception allows for the password checking subroutines on a local Windows box to be overwritten, allowing any password to be entered for a locked computer. My question is about ...
0
votes
0answers
18 views
Emacs and EasyPG not performing public key encryption
I have a file which I edit and encrypt following this guide : http://emacs.wordpress.com/2008/07/18/keeping-your-secrets-secret/
I'm a noob as far as security goes and thought that the point of ...
-2
votes
0answers
28 views
Enabling TCP md5 signature option in centOS? [closed]
I'm trying to enable md5 checksum/signature for tcp packets in centOS (the main use case to stop tcp RST attacks, etc). It seems like I may be able to do this for individual ports using netcat or via ...
1
vote
1answer
98 views
Files to monitor in linux
All,
I have been googling around for different guides on what files to monitor that people would edit for malicious intent. In my readings so far, i have found the common files people edit.
so far i ...
51
votes
5answers
3k views
Somebody bumped into me, next day my storage unit was burglarized
While I was walking in the street, somebody carrying a laptop bag bumped into me, and the next day I found out that my storage unit was burglarized and some important items were stolen.
My storage ...
2
votes
1answer
66 views
Checklist for securing smtp
What are some things, one should know when setting up an SMTP server, which supports ESMTP protocol. I have disabled relaying, and only enabled TLS authenticated transfers.
when I telnet to my server, ...
1
vote
1answer
72 views
Totally different IP addresses assigned when using the same router
For some time I have observed a strange behaviour when connecting to the internet through my WLAN. Depending on the computer I use on my network, the ISP assigns me totally different external IP ...
-1
votes
3answers
232 views
How likely/possible is it that the NSA have broken common encryption techniques such as SSL/TLS?
Jumping on the NSA/Prism questions bandwagon - There's been a lot more attention drawn to facilities such as Room 641A which indicate that the NSA has been, amongst other things, applying mass ...
4
votes
4answers
409 views
Can a VPN avoid the Prism Surveillance Programme?
This is causing me major concern and i can understand it is for a lot of users as well. I have nothing to hide but it's the moral aspect of snooping which has ticked me off.
Can a VPN avoid the ...
1
vote
2answers
63 views
Open exploits database, with structured data (CMS name, version, etc.)
For a web security app I'm working on, I want to list all the exploits that a certain Wordpress version have. (and hopefully the same for other CMSs)
I found some (open) exploits databases that list ...
3
votes
1answer
35 views
Obtaining an S/MIME certificate without disclosing my private key to the TTP
I would like to obtain a trusted S/MIME certificate, but all the certificate authorities I have asked so far generate the keypair on their server, sign the certificate and send me both the private key ...
1
vote
1answer
60 views
What are the security implications of using TOTP for single factor authentication?
(Note: I am not actually planning to do this. This question is strictly theoretical.)
TOTP is commonly used as the second factor in Two Factor Authentication. It is an open standard with available ...
2
votes
1answer
191 views
What are the implications of including binary blobs in the Linux kernel?
According to this there are compelling reasons for caution when installing obfuscated binaries. Knowing this, how can running binary blobs as a part of the Linux kernel be acceptable from a security ...
2
votes
2answers
64 views
Login system using authenticated encryption without storing user password
I'm not a security expert, so I might be asking a silly question, but let me describe what I am thinking about.
First, I know that a lot of web sites store hashed/encrypted passwords which could be ...
-3
votes
0answers
55 views
How to tell if your internet is being filtered? [closed]
In his recent interview, Edward Snowden states that Hong Kong's internet isn't being firewalled more than "any other western nation." I take that to mean that the United States government filters our ...
-1
votes
2answers
127 views
How to use VirtualMerchant without PCI-DSS?
I want to use Elavon VirtualMerchant to make credit card payments on my website.
I don't want to do PCI DSS certifications other than SAQ A, so don't want to process or store card data on my site. I ...
0
votes
1answer
63 views
SSL vs TLS, which is less vulnerable to DOS attacks?
When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks.
However, all I seem to find ...
5
votes
2answers
124 views
Encrypting an empty database field versus leaving it empty
In a system where personal information stored in a database is encrypted, but one of the fields only contains data in a minority of cases, would it make more sense to leave the field empty, rather ...
1
vote
1answer
98 views
Site Hacked - Where to go from here? [closed]
Our magento based e-commerce site was hacked over the weekend, the hackers managed to gain access to the magento files and embed some scrambled code into the get.php file in the root directory.
I ...
-6
votes
1answer
49 views
How to determine decrypt type? [closed]
That my excryptyion: $apr1$Xd.M80Hx$CMwMdjv79eiE4PfFjuI8R.
How should I determine the current encryption?
Thanks you people.
-1
votes
0answers
18 views
Digital signatures. Ways of implementation [closed]
I have been given an assignment with the following title: "Digital signatures. Ways of implementation", I am also supposed to create a small application illustrating the concept.
While I've been ...
0
votes
0answers
13 views
Cisco 871: IPsec Remote VPN [migrated]
After having followed several tutorials and none of them worked for me, someone might help me here.
I have a Cisco 871 router, version 12.4(4)T7.
Currently, I have it configured as a PPTP VPN ...
2
votes
1answer
54 views
Is it safe to derive an IV partially from the secret data if it is hashed before use?
To help ensure uniqueness of IV's used in a CFB AES-256 cipher, software I know of gathers bits from various sources including the plaintext being enciphered, and runs that through an SHA-256 hash. ...
-3
votes
1answer
63 views
Feasibility of brute-force on online password [closed]
I am familiar with how offline brute-force attacks work. But for online accounts, assuming no social engineering, how feasible is it to brute-force attack a password? For example, is this dependent ...
-2
votes
0answers
42 views
HTTP Parameters Pollution attack [closed]
I have a search form in my site that is submitted with POST method. I recently realize that it is vulnerable against HPP (Http Parameters Pollution). Somebody told me that fact. But I am not sure if ...
