3
votes
2answers
1k views

Is this algorithm for a random string cryptographically secure?

I've pieced together this algorithm (if it can be called that) from various bits of code I've seen online, and I'm wondering how cryptographically secure it is. It's used to generate passwords: ...
5
votes
2answers
765 views

Beginners materials for web security [duplicate]

Possible Duplicate: Resources to learn about security What materials can I study to learn web development security. I'm a web developer, I use ASP.NET, Java, PHP, and JavaScript. I want to ...
8
votes
3answers
3k views

Encryption on mobile phone - myth?

Well, about six months ago I had pleasure to meet Harald Welte and when he talked about m-banking (banking via smartphones) he said that the most people thing it's safe while, in fact, mobile ...
13
votes
3answers
550 views

Does signing out of a website ensure no-one can cookie hack?

If I click the signout link of a website, does this mean it is not possible for someone to hijack my cookie and sign in with it? While I'm logged in, is it possible for someone who has access to my ...
5
votes
2answers
2k views

Storing account numbers and sort codes online

There are a lot of questions on storing credit card information, and of how PCI SSC/PA-DSS regulations apply to such activities and systems. I have read a lot of these, but my question relates to a ...
7
votes
4answers
13k views

Security issues with allowing Dropbox installations on client PC's in our organisation

Does anyone know if there is any good reasons not to allow Dropbox installations on our client PC's? All the PC's have antivirus installed and running. I know it is an additional attack vector to ...
7
votes
3answers
486 views

Which resources can help me learn how to use metasploit?

I tried google search but I can't find good resources to learn how to use the metasploit framework. Where would you suggest a beginner go to learn about using metasploit?
0
votes
1answer
234 views

Where can I practice web-security or network-security? [duplicate]

Possible Duplicate: Servers for penetration testing I'm in a process of learning security of networks and websites. I already practised code reviewing but I want to perform exercise. Is ...
6
votes
4answers
2k views

Are there lists of most common words or ngrams used in passwords and passphrases?

I've been thinking about ways to focus brute forcing dictionary attacks on passwords and passphrases based on the assumption that certain words, combinations of letters, and combinations of words are ...
6
votes
3answers
313 views

Are there password/passphrase guessers/crackers which can utilize facts supplied about the target?

I was just reading a discussion about cracking passwords that said the person running the tool might know things about the target like the birthday of his first girlfriend's dog but the tool won't. ...
6
votes
4answers
5k views

Are the iPhone “connect the dots” passwords secure?

A popular way to login to iPhones and other phones is to use a "connect the dots" password. For those unfamiliar, it looks something like this: Is this kind of passwords secure from brute force ...
17
votes
6answers
3k views

How can I protect my computer from my potentially malicious colleagues?

So, I work in this small company (10 people) where we do stuff in programming, for various platforms. I started recently working there (2 months) right after I graduated. My work is not exactly ...
46
votes
2answers
11k views

Amount of simple operations that is safely out of reach for all humanity?

Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, ...
12
votes
6answers
1k views

Best method of retiring hard drives

What are some typical ways you guys retire hard drives? We have a hard drive that won't mount anymore (makes clicking sounds when it tries to mount). The data on it isn't necessarily sensitive (no ...
5
votes
5answers
2k views

What password cracking software is commonly used?

I am curious to know how secure my passwords are. What password cracking software is commonly used? Preferably open source. EDIT: I am actually looking to crack my passwords used on services I ...
13
votes
2answers
5k views

Paypal Account created using my gmail account

Some time ago, probably about 6 months, somebody hacked my email account and used gmail settings to forward my emails to him/her. I noticed that, removed the forward and changed the password. Now, I ...
-4
votes
2answers
663 views

Web service that converts HTTP GET to POST? [closed]

Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST? For example, I'd like to give someone the URL: ...
2
votes
3answers
2k views

Use a Common Firewall for two Different Subnets

I want to implement a security scheme in a new network configuration. There are two buildings for the client: Office Building 1 (OB1) with address 10.0.0.0 / 255.255.255.0, Gateway 10.0.0.1 ( ...
21
votes
5answers
3k views

How can I choose a strong password that is easy use on a smartphone?

Typing on a smartphone is tedious. Special characters are the hardest; lowercase letters are generally the easiest. But even a long all-letter passphrase like "correct horse battery staple" is ...
4
votes
1answer
1k views

How can I store downloaded video securely to device's sd card?

I want to save videos in my android mobile's SD card securely such no other application or user can use it, outside the application or on any other devices. So for this what can I do? I think about ...
17
votes
5answers
576 views

What should I do when classified information stayed on a unauthorized laptop?

Has anyone ever had to deal with an unauthorized laptop accidentally getting Top Secret level data on it? How did you quarantine the system. Were you required to turn in the entire laptop or were you ...
640
votes
21answers
129k views

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...
6
votes
1answer
484 views

White list or black list sanitation for international input?

There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option. For instance, one can fairly easily craft a white list ...
23
votes
2answers
1k views

What is the attack tree to intercept traffic on Wimax?

My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
4
votes
3answers
164 views

Is there a common name for a software defect that leads to unexpected transfer of secret over the wire?

Suppose in a C++ program I use a memory region for temporarily storing an encryption key and don't overwrite that region afterwards. Then my program wants to send a data packet over the network. Due ...
3
votes
2answers
1k views

How to see whether the pcap contains RTP traffic?

I am analyzing the traffic of a VOIP application. I started up wireshark, and made sure no other application was using internet, and then had a a voice call on the application. Wireshark captured some ...
6
votes
2answers
759 views

Do Flash memory (SSD) architecture impacts encryption techniques?

I'm working on encryption techniques on SSD's and my question is: does the erase before write architecture of SSD's has anything to do with the encryption technique? What are the problems I might ...
14
votes
4answers
10k views

Is it possible to securely store passwords using reversible encryption?

Everyone says that you need to use a non-reversible hash when you store passwords so that even if your database is leaked, the passwords themselves are still safe. I'm wondering if there is anyway to ...
9
votes
4answers
617 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
14
votes
7answers
4k views

Are jailbroken iPhones an enterprise security risk?

Background My company is currently in the process of rolling out support for the iPhone. As a part of this rollout, they are requiring employees to install an application on their phones that allows ...
21
votes
2answers
4k views

Is “real salt” the same as “initialization vectors”?

In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
39
votes
7answers
3k views

“Real” Salt and “Fake” Salt

During a Q&A period at DEFCON this year, one member of the audience mentioned that we're using "fake salt" when concatenating a random value and a password before hashing. He defined "real salt" ...
7
votes
2answers
5k views

How large blocks does AES-cbc use with a 128 bit key and with a 192-bit key?

I read on wikipedia that the AES with cipher block chaining and a 128-bit key uses blocks of size 128 bit to encrypt the data. However, it also said that with a 192-bit key, there were still 128-bit ...
8
votes
5answers
316 views

How to verify new accounts against a known persons database?

I need to (try to) solve the problem of new account creation for a patient portal for a medical records system (electronic health record). That is, a way to activate a patient online and match her ...
7
votes
3answers
922 views

Server to server encryption: Key rotation over the air. Can it improve security?

In my other question, I explored whether to write my own encryption or use an existing one. I was advised to use TLS or AES or something that is established. This question is about key rotation. It ...
3
votes
2answers
920 views

Security logs on Linux, Solaris and Windows

As the company's security department, our system administrators ask us what they need to log for SIEM (Security Incident and Event Management). We don't have any prepared documents and are seeking ...
8
votes
5answers
2k views

Is finding vulnerabilities in the major browsers easy or not?

If young hackers can detect them, why can't security analysts get and patch them? Also, I dream of finding a vulnerability in a major software, like IE or Chrome. Is it easy? Is it systematic or is ...
10
votes
4answers
2k views

How can an access point spoof me into connecting?

I was reading through the answers of the question "How can I ensure that I connect to the right wireless Access Point?" and was wondering how it is possible for an access point to imitate another wifi ...
7
votes
2answers
3k views

Dictionary Attack on Wifi

I know a few people with pretty weak passwords. What kind of systems exist to prevent dictionary attacks? Would it make sense to restrict the number of connection attempts in a certain timeframe? ...
14
votes
3answers
3k views

Bruteforce attack on my FTP server

I recently setup VSFTPD on my personal server for sharing files over FTP. In the vsftpd.log file, i see hundreds of failed attempts to login with usernames like "adminitrator" , "adminitrator1", ...
8
votes
2answers
3k views

Is doing credit card transaction via 3G secure?

3G, GPRS or other mobile-based connection. Because it seems like it's easier to intercept, than, say, land-based connection or encrypted WiFi. If it matters, the transaction I want to perform is ...
7
votes
2answers
409 views

Geographic equivilent of RFC 3161 (X.509 PKI Time-stamp Protocol)

First time poster here, hope to be around more often. I'm in need of a cryptographically secure 'stamping' system that allows not only time but also location to be attached to data, while still ...
8
votes
1answer
370 views

How many iterations of fuzzing is enough?

Fuzzing is a convenient, relatively low-cost way to detect some kinds of vulnerabilities, particularly in C/C++ code. My question: How much fuzzing is enough? Are there are any standards or best ...
6
votes
2answers
448 views

Outsourcing security evaluation

Does anyone have any experience with outsourcing security code review via freelance sites (like Rent-a-coder, Elance, Guru, Getafreelancer, etc.)? Is this effective? What are the best practices? ...
14
votes
3answers
4k views

Smartphone / GSM Sniffer

This question would be in the category of SmartPhone Sniffers. So we have sniffers that can show the packets that are being sent across a wired or wireless (802.11) network. I am just performing a ...
9
votes
3answers
422 views

How do researchers “gain control of an attacking PC” and not themselves be considered attackers / criminals?

In reference to this Network Computing Report article titled "'Operation Shady Rat' Perpetrated Five Years Of Long-Term Attacks On Government, Enterprises" The Cliff's Notes to the article is thus: ...
8
votes
4answers
1k views

Where do I securely store the key for a system where the source is visible?

I have a customer with an Access database (ugh!) in which credit cards are stored in plaintext (yikes!), so amongst other changes I'm doing in the app, I'm applying some encryption in there. I've ...
3
votes
1answer
463 views

Is there a viable open source antivirus for OS/X? [closed]

I am interested in finding an antivirus program for the Mac, but not one from Symantec, because I don't trust them. I wonder if perhaps there is an open source solution for antivirus for OS/X? Or ...
12
votes
1answer
411 views

What did Blackberry do wrong?

The NIST defines a vulnerability in RIM Blackberry encryption discovered last October. Apparently, Blackberry's flavour of PBKDF2 was weak. They say: The offline backup mechanism in Research In ...
5
votes
2answers
574 views

Security Manager job description

I work in a growing, family owned business. The company has 300 employees and has landed some big clients who require major policy changes in order to give us their continued business. Among those ...

15 30 50 per page