2
votes
0answers
139 views

Scapy capturing Dot11 headers windows

Is it at all possible to capture Dot11 headers under Scapy in Windows? I'm thinking Winpcap, but I'm not sure how I'm supposed to do that. Any clues?
0
votes
2answers
179 views

Determining if company is considered a business associate under HIPAA?

I am trying to clearly understand the HIPAA regulations a court reporting company must adhere to. Let's say the court reporting company does not directly contract with any covered entities but does ...
3
votes
1answer
56 views

Storing original length of encrypted message

Does storing the actual length of the message in metadata make an encrypted message more vulnerable to attack?
5
votes
1answer
2k views

How are ACK storms created and what's a good mitigation strategy for them?

The context is network based load balancers. It would be nice if someone could explain how TCP ACK storms are generated in real life and practical mitigation strategies for them. Edit: Clarification ...
1
vote
2answers
293 views

Why do client certificates not protected against improper server certificate validation

I understand the question of client certs and MITM attacks has been asked several times, but I don't believe this specific scenario has been answered. It was my (seemingly incorrect) assumption, that ...
1
vote
1answer
332 views

how to protect my linux pc from wifi sniffing

I have a wifi shared connection with other flatmates and I'd like to know how can I protect my Debian pc from being sniffed. Should I use a wifi anti sniffer to detect if any wifi card is in ...
3
votes
1answer
1k views

How hard is it to read flash memory off a chip?

What are the parameters in play, and what is a rough estimate of the hardness of the task of reading the contents of flash memory off a microcontroller? Of course, it is assumed that there is no ...
0
votes
2answers
222 views

I need two separate hidden volumes in disk encryption. What are my options? [closed]

C: for system (Windows) D: for my files Makes much more sense to me than packing everything on the same volume, right? Is there a disk encryption utility capable of doing this? I don't know much ...
1
vote
2answers
6k views

Downloading through Tor or not Tor?

If I download a file through TOR, will it be any different than if I download a file through a normal internet browser? I've downloaded stuff through TOR but it's always really slow. I was wondering ...
2
votes
1answer
979 views

Implementation language for crypto

I'm going to implement a small crypto lib/tool. The "do not implement crypto by yourself" rule does not apply here, since this crypto system is new and not implemented yet. ;) So the first step is the ...
2
votes
5answers
335 views

Password Recovery - what if user can't complete 2nd step?

I'm thinking out my password recovery logic for an ecommerce system. Some backround: Passwords are stored using bcrypt, password recovery involves the standard reset link, which then can be used to ...
138
votes
5answers
134k views

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp ...
1
vote
1answer
152 views

Protecting data on an embedded device

I am to release a system-on-chip device that, during its lifetime, will come to store sensitive data. I want to make that data hard to extract or duplicate. Encrypting is good for dealing with MiTM, ...
1
vote
3answers
160 views

What are some good ways to prevent a malicious visitor from maxing out our customer's API maximum allowed service calls?

We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to ...
1
vote
2answers
1k views

best practice for encrypted filesystem inside a file

This is an extension of my question on UNIX. Let's suppose I create a file, map it to /dev/loop0, and create a LUKS partition inside dd if=/dev/zero of=myfile bs=1M count=1000 losetup /dev/loop0 ...
0
votes
1answer
136 views

Securely transmit sensitive data

I am creating a java application which is dependent on a server. On startup the application will transmit sensitive information (passwords and emails) which will be sent to the server and from there ...
0
votes
3answers
494 views

How to safely mirror network traffic for audit reasons?

We have an internet connection that we need to audit: INTERNET ->> ROUTER ->> CLIENTS our idea would be to put a (enough big) HUB before the router (router, that logs in via pppoe to ...
3
votes
2answers
3k views

Why do multiple IP Addresses in my local network point to the same computer?

I'm new to linux and nmap, and I am attempting to do a scan of my local network. Using nmap I find that there are 4 hosts on my network (10.0.2.2, 10.0.2.3, 10.0.2.4, 10.0.2.15). I am using VirtualBox ...
2
votes
2answers
255 views

Website doesn’t always log me out – Privacy concern or am I overreacting?

I’ve been applying to for some jobs and use one certain careers page somewhat regularly. I’ve started to notice that I don’t always get logged out even if I do click “log out” and see a message that ...
14
votes
6answers
2k views

Defamatory post - obtaining evidence tracing perpetrator right to his laptop

A month ago, someone posted an ad with my personal details, including my home address, my phone number and my photo on an ad with very a very defamatory write up. What followed was a week of calls ...
9
votes
2answers
2k views

Is it really secure to store API keys in environment variables?

This site says it is best to keep API keys in environment variable out of the code. And here Storing Credentials Securely You should take great care to ensure your credentials are stored ...
1
vote
2answers
1k views

Is there a way to be 100% sure that your computer is clean of viruses?

If your computer has been hacked or infected, is there a way of cleaning your computer and have 100% sure that it's clean? I heard that you can safely clean your hard-drive with completely wiping ...
2
votes
3answers
573 views

Can authentication in social networks through VPN defeat the purpose of the latter?

If a person uses VPN and authenticates herself to some social network through the VPN, doesn't she lose her anonymity for as long as the VPN session is used ? By losing her anonymity, I mean that her ...
9
votes
1answer
630 views

what is differential privacy?

Currently I have heard a lot about differential privacy but I am unable to find out what exactly it is in a non-mathematicians language. Up-till now my understanding is that it add noise to the answer ...
0
votes
1answer
170 views

Unknown Website Linking to my Local Files?

I recently discovered a website that I am in no way affiliated with linking to the files of my local website stored on an external hard drive. This unknown website is actually executing the scripts, ...
1
vote
2answers
6k views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. However,...
9
votes
4answers
14k views

Is it worth it to get paid anti-virus software?

With the rise in cybercrime, I am slightly worried about my computer security. I have been using open sourced anti-virus AVG for years and it has been doing well. Are anti-virus software like Norton ...
1
vote
3answers
497 views

is it possible to write php code in address bar and its gonna work? [closed]

Is it possible if i use in address bar this host.com?<?php unlink("/img/bg.jpg");?> or host.com?<?php rename("/bg.jpg","bg.png");?> if not then is there any way to do that?
1
vote
2answers
522 views

Does server RAM count as storage for PCI Compliance?

We are an eCommerce website. I'm working on our PCI compliance at the moment, and I'm trying, if at all possible, to argue that our organisation falls under SAQ A rather than D. We do not sensitive ...
3
votes
4answers
322 views

How do clients enroll using SRP?

From what I understand, one of the benefits or Secure Remote Password (SRP) is that is does not require reliance on certificate authorities. In a scenario where clients need the ability to register as ...
0
votes
1answer
852 views

Difference between password expiration and account expiration [closed]

If a password expires, the user can't access the account. If the account expires, the user can't access the account... So, what's the difference? Just that in the case of an expired account, I'd need ...
6
votes
2answers
1k views

Are smart watches secure?

My Pebble smartwatch, like many (most?) other smart watches, uses Bluetooth Low Energy (Bluetooth Smart, BLE, BTLE, etc) to communicate with my smart phone. There's some security in the link, ...
2
votes
1answer
1k views

How to Protect JSON Data [closed]

Hi I am using JSON on User Interface side. I want to protect that data. What are the possible ways I can protect my JSON. I have a scenario where I am having JSON Object with data on User Interface ...
1
vote
1answer
507 views

MySQL encryption without knowing key

I am currently struggling with how to correctly implement storage of encrypted fields in a MySQL db, without knowing the encryption key. The result I am trying to achieve is to encrypt certain pieces ...
0
votes
3answers
135 views

Do you need to use the same number of rounds for everyone with bcrypt?

I am going to be hashing user passwords on the client machine, and I would like the hash to be generated in 0.3 seconds. Do I need to find the number of rounds myself and make every user use this ...
0
votes
1answer
310 views

RSA vs ECDSA for VANET Security

I am doing a project on Vehicular Ad-Hoc Network Security (VANET). The proposed scheme uses electronic signature as a means to authenticating the nodes. Most of the research papers I read suggested ...
5
votes
4answers
510 views

Contact person by phone, when their phone might have malware

I have a problem setting where I want to contact a user by phone, and where I need to protect the integrity of the phone call as much as possible. I'm wondering about how to design the interaction in ...
4
votes
4answers
326 views

How do we know if the hard disk we just bought is “clean”?

When we buy a new hard disk drive, what steps can we take to ensure that it is virus-free? For example, there are many vendors selling hard disk drives on Amazon. When we purchase one, how do we know ...
4
votes
3answers
1k views

How is it on some removable media, when enabling/disabling password protection the changes happen immediately?

For example I have a WD Passport external hard drive. After installing WD security I can enable and disable password protection, however the settings basically get applied instantaneously. Does this ...
0
votes
2answers
116 views

Email rejected by the server [closed]

Emails from site such as Gmail and Yahoo are rejected from secureserver.net server and treated as a spam. Can you help me?
0
votes
1answer
256 views

Why not use client certificates for premaster key generation

The question is about a very specific SSL handshake scenario. I understand that some servers may request client certificates in order to authenticate connecting clients. However, as far as I can know, ...
1
vote
1answer
95 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
4
votes
2answers
3k views

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 ...
1
vote
1answer
125 views

Only one entry in No-SQL database needs encrypting

So I have the document format as follows: { id : plaintext, date-created : plaintext, data : binary } The data entry needs encrypting and decrypting. My idea was to have a private key, ...
0
votes
1answer
855 views

WPA/PSK Dictionaries

So i have been reading some articles on WPA/PSK encryption, And one said that the hash is calculated like this: Key = PBKDF2(passphrase, ssid, 4096, 256) Where PBKDF2 is a standardized method ...
9
votes
1answer
7k views

New to security, is php password_hash() good enough?

This is the first time I've had to handle personnel information and I want to make sure I have a good amount of security. I will be storing users' emails and passwords for their accounts on a MySQL ...
0
votes
1answer
54 views

Industry standards for threat names

One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find ...
2
votes
1answer
3k views

Can a webpage read another page's cookies?

I was listening to Pandora as I logged in here, and the next commercial was about InfoSec. That set me wondering as to whether that was a coincidence (probably) or if they knew somehow. To make a long ...
0
votes
1answer
322 views

Cryptic threat names

I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
2
votes
2answers
562 views

Can sessions be handled securely with cookies disabled?

I've been doing some reading here about session ID handling, and have learned that it's generally a bad idea to include a session ID in the HTML source code, and/or on the query string. For example Is ...

15 30 50 per page