22
votes
10answers
4k views

Best password strength checker

In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or ...
12
votes
5answers
780 views

Should passwords be truly random?

When generating a password, should it be "truly random" or should I make it a little less random by enforcing some rules? If a password is generated at random, it could come out all-lowercase letters ...
1
vote
2answers
1k views

What are some secure methods of sending email from your server?

This question title might seem a little vague, and I apologize for that. Let me just begin by stating I'm an engineering psychologist—not an IT security or computer guru by trade. As luck would have ...
25
votes
4answers
15k views

What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?

I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services? I don't understand email protocols in details, but as far as I know email traffic is ...
18
votes
4answers
614 views

Malware - are removal tools acceptable or is bare metal re-install the only safe option?

I see a number of companies offering "malware removal" services. I see some software that claims to be able to remove malware from an infected machine. Is using a removal software tool to 'clean' an ...
34
votes
8answers
2k views

Who is responsible for the strength of user's passwords?

Who is responsible for a user's password's strength? Is it us (developers, architects, etc.) or the user? As a web developer, I've frequently wondered whether I should enforce the minimal password ...
0
votes
1answer
3k views

Is OpenVPN secure in this way?

I'm familiar with OpenVPN because my home router has a builtin OpenVPN server. I would like to use OpenVPN all the time, but how do I deal with situations where I don't own the routers? ex.: in a ...
19
votes
3answers
4k views

Google hacking - why “numrange” is so dangerous?

I'm reading Google Hacking for Penetration Testers and in book it's said several times operator "numrange" is especially powerful and dangerous. However, they don't give example of using this ...
5
votes
3answers
741 views

Open source web application penetration testing community

I do web development for a living but my real passion is security. I have worked with countless open source web application/framework and I have found vulnerabilities in most of them. The main cause ...
4
votes
4answers
1k views

Do these ports mean anything?

I'm diving to the world of penetration testing and I decided to port scan my server. My website is completely managed by a friend of mine but he lacks any knowledge of security. PORT STATE ...
11
votes
2answers
5k views

Can an attacker sniff Mac addresses on a wifi?

If an attacker turns on wifi but doesn't have the security key to connect to an access point in range, can he still sniff packets that travel between the access point and clients connected to the ...
13
votes
7answers
1k views

How to browse the Internet safely?

What is the best way to browse the Internet safely? By safely I mean: anonymously having encrypted communication Extra bonus for: being able to do it with little or no performance impact cheaply ...
8
votes
5answers
6k views

How would one fully protect himself against man in the middle-attacks? [closed]

Imagine I have a computer where all the trafic is being sent through the MitM. How would it be possible to have a secure connection through this setup? In this case it would be OK to design a new ...
3
votes
5answers
534 views

What should one do when he/she wants to protect him/her home--computer--?

As you know, deleting a file by pressing shift-delete or by using the Trash doesn't mean that the file is unrecoverable. It's data persists on your computer. In day to day life, adversaries use ...
8
votes
7answers
1k views

Is this set-up PCI-Compliant?

Question: Is there a way to store credit card information on a shared hosting server AND be PCI compliant? Here is the setup: 1) SSL is being implemented for the whole checkout process and for the ...
4
votes
1answer
608 views

SSL, SSH, OPENVPN, etc which one?

To start with I am not a security professional, in fact I am on the other end of the spectrum. In the opinion of people on this site what would you choose for secure internet browsing. I will be ...
87
votes
8answers
15k views

What would one need to do in order to hijack a satellite?

I realise this borders on sci-fi, but there's been some interesting demonstrations regarding security of various satellites. What would be required to hack a satellite (in general terms, any hack ...
6
votes
4answers
671 views

Secure Web Password Fields + http to https redirect

I'm a software developer but I'm marking my niche in secure development. It turns out that while using WebScarab, I discovered that a popular user group site doesn't appear to properly take care of ...
8
votes
6answers
2k views

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ...
3
votes
1answer
249 views

Could Stock Exchange be shut down by HFT attack vector?

First of all, stock, not stack exchange. I just read this post on Krypt3ia. In short, it says that HFT attack vector in combination with DDoS is possible new nemesis for stock exchange IT systems. ...
4
votes
3answers
460 views

Preventing users from tampering with replay data [duplicate]

Possible Duplicate: Protect application from being modified This probably belongs here as much as it does belong in gamedev.stackexchange.com, but I suppose I might find better technical ...
4
votes
4answers
1k views

Can the loopback interface be hijacked?

Inspired by this question I came up with this weird idea of making what that user actually wants to prevent. So, bear with me for a little bit: Let's assume that for some reason we could make the ...
16
votes
2answers
4k views

Google Chrome Browser - Privacy Concerns

After i saw many people using Chrome i wanted to inform myself on this browser and everything concerning it as i am a Firefox user since it existed. However i am always afraid of Google being a "data ...
7
votes
2answers
236 views

What to add to a repeating security checklist?

I work in a smallish company (100-200 computers and a handful of servers) and I am trying to come up with a checklist of things to check at a regular basis, such as weekly, monthly, etc. We use ...
10
votes
7answers
3k views

What security implications are there for allowing outbound SSH traffic?

My school currently blocks outbound SSH traffic. Users inside the network cannot use Port 22, and attempting to make an SSH connection over another port is also blocked. (I'm assuming the firewall ...
1
vote
3answers
971 views

How is it possible that anonymous members still post on Twitter but aren't busted? [duplicate]

Possible Duplicate: Why is it difficult to catch "Anonymous" or "Lulzsec" (groups)? I think that something that Anonymous & other hacking groups do, is illegal and ...
10
votes
3answers
339 views

What are common/official methods of reporting spam/phishing/nasty-grams to organizations?

A user of mine just received a phishing email claiming to be the IRS. What methods of reporting are available, and what should be included?
8
votes
3answers
549 views

How is “anonymous” getting ahold of all these plain-text passwords

In the last several months there have been several publicized data breaches and public website defacements done by several different hacking groups (which the media loves to group under a single ...
2
votes
3answers
4k views

SSL verification of host name of https server

I recently found that a library I am using (specifically Apache HTTPClient) when is configured to verify the hostname of the remote server against the certificate's CN it just seems to be doing a ...
19
votes
6answers
17k views

At what point does “hacking” become illegal? (US)

Hypothetical situation: before I hire a web development company I want to test their ability to design secure web apps by viewing their previous client's websites. Issue: this situation raises a big ...
21
votes
12answers
3k views

Why do we even use passwords / passphrases next to biometrics?

In the last couple of days there were a lot of talking about passwords and passphrases, not only here, but on several blogs and forums I follow (especially after XKCD #936 saw the light of this ...
1
vote
2answers
856 views

Which encryption algorithms will be used to replace RSA when quantum computers become common? [duplicate]

Possible Duplicate: Are the encryptions "broken" with great computing power? I just wondered which algorithms will be used once quantum computers become common. Are there already ...
6
votes
3answers
218 views

Detecting OAuth malicious Implementation

I am wondering how can an end-user detect a maliciously implemented OAuth whether 2-legged or 3-legged. Particularly I am interested in those cases where the consumer requester is maliciously ...
4
votes
2answers
608 views

Is this an example of XSS attack?

A scripter sees on certain web pages it's technically possible to include markup like HTML and CSS/JS. It's technically possible to submit a javascript or iframe and have it display to the visitor ...
4
votes
8answers
935 views

How can I be sure that an intranet app is absolutely not accessible from the internet?

I am developing an intranet application using Apache/MySQL. The server hosting it does not have a public IP address itself, but can access the internet through a router. There is not any sensitive ...
6
votes
3answers
2k views

SSD (Flash Memory) security when data is encrypted in place

I'm surveying current techniques on flash memory security. I've learned that the non-in-place update of flash memories prevent us from adapting the same encryption techniques that we used on hard ...
1
vote
5answers
534 views

How do a firewall's rules for individual programs work?

I kind of know that how a firewall's rules for IP/port work, but I have no idea how a firewall deals with individual programs. In other words, how does the firewall know a program wants to access the ...
9
votes
4answers
545 views

Are there state-of-the-art techniques or theory specifically for attacking passphrases over passwords?

With passphrases becoming more and more common based on length being more important than complexity, I'm assuming there must be some work going on involving techniques aimed specifically at cracking / ...
234
votes
13answers
25k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
17
votes
3answers
3k views

Should I have a maximum password length?

I'm creating a webapp, and part of my authentication method is password length. Should I put one in place? (say, 50 characters?) Or should I just put a minimum length (Currently at 6). Are there ...
60
votes
21answers
13k views

How can I avoid my password being harvested by key loggers from internet cafes?

During traveling, especially in poor countries, sometimes you are going to need to use the internet at an internet cafe and you really can't be sure whether anyone has installed anything to listen to ...
14
votes
2answers
1k views

Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?

As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
28
votes
3answers
9k views

What useful things can I do with the html5 “keygen” element?

There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
10
votes
2answers
1k views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
11
votes
1answer
758 views

Any risk in using the same salt for several hashes on a user?

Right now I'm storing a salt and password_hash on the users table (pretty standard stuff). The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt ...
15
votes
5answers
886 views

Safe way to authenticate (multi-factor authentication?) while being monitored?

(I'm trying for a bit more precise answer, particularly with regard to multi-factor authentication, than I received for "Safe way to use a computer that has spyware/keylogger installed?" on SU.) ...
11
votes
2answers
1k views

Password auditing

Most password policies require the password to be at least 8 characters long and contain symbols from at least 3 classes (lower case letters, upper case letters, numbers, other). Problem is, that a ...
8
votes
2answers
239 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
14
votes
2answers
3k views

Tamper-proof BIOS password & settings storage with Trusted Platform Module?

In the olden days, one could trivially bypass BIOS passwords on most PCs by removing the BIOS battery and clearing the CMOS. My question is: On modern PCs equipped with a Trusted Platform Module ...
4
votes
3answers
2k views

Is there a compelling reason to ssh tunnel RDP connections?

We don't run any Microsoft products natively in our office, but there are a few folks who use a linux RDP client to access an application on remote virtual desktops with a service provider. Would it ...

15 30 50 per page