8
votes
5answers
2k views

Save private messages encrypted in database

I'm not sure if this question fits better in StackOverflowSE or CryptoSE but i think this is the right place. In an online community portal I want to save users' private messages encrypted in a ...
3
votes
2answers
235 views

Concerns of data being on the cloud

Would you prefer a private cloud for your data or a public one? Who takes care of financial liability in case of any breach? Do companies still keep the most critical within their data centers, ...
4
votes
2answers
2k views

Keepass client on Android (reliable one)

I need some advice to choose a Keepass client on Android phone which can synchronize using Dropbox. As i keep all my passwords in one place, I would like to keep it safe. Is KeepassDroid client safe ...
7
votes
4answers
3k views

CSRF protection needed for clients that don't accept cookies?

I have recently updated a website from Django 1.0 to 1.3. One of the changes introduced was automatic protection against CSRF attacks. For the most part, this works great, but I have a problem with ...
4
votes
3answers
707 views

PHP/JavaScript with RSA

I have a few columns in the database which should be encrypted. I'm wondering if the way I chose to make this system work is ok, and I'm looking forward to hear some opinions: I chose RSA algorithm ...
3
votes
4answers
454 views

What is the purpose of EICAR?

For as long as can remember, EICAR has been used to test for the presence of Antivirus systems in email, the file system, or other places. Sometimes the AV solution is so far out of date, that its ...
15
votes
7answers
3k views

Convenient cross-platform help on checking secure hashes like SHA-256

It is often helpful to be able to obtain a good cryptographic checksum of a file, e.g. the SHA-256 hash. This can be used to verify file integrity, so long as you have a reliable source for the hash. ...
1
vote
3answers
5k views

Facebook login on HTTP? [duplicate]

Possible Duplicate: Is the Facebook login form using SSL without https in the URL? If you access http://www.facebook.com/, in the top right side there is the login section. You can enter ...
5
votes
3answers
4k views

Bell-LaPadula imlementation example

I'm currently studying the Bell-LaPadula model and i need to do an implementation as an example. I understand how the model works, but I have difficulties implementing it in a programming language ...
18
votes
3answers
2k views

Why aren't applications sandboxed in Windows?

Sandboxing seem to be a way to restrict what an application can do. Today, I don't have much control of what my applications do with my computer. It feels more secure to use JavaScript based web ...
5
votes
2answers
295 views

Do any crypto libraries take advantage of Windows GPU API “Direct Compute”?

Are there any encryption (decryption?) libraries that take advantage of the Windows GPU API?
2
votes
1answer
803 views

Can suPHP lead to security issues due to hijacking people's accounts?

Bear in mind that, although I am pretty good at coding clientside javascript, I am not so great at dealing with serverside PHP. It doesn't help that there is very little information/tutorials/APIs on ...
4
votes
3answers
133 views

Duqu and other reference material for security people

I would like to read more on Duqu and similar exploits when they appear. The problem is that most references from google are for laymen. Isn't there a reference website or... that reports on these ...
3
votes
2answers
1k views

How is WEP/WPA2 key derived?

When I was a kid, WEP had a 40 bit key. Later, they came out with a 128-bit key. But as we all know, WEP was so badly-designed that the RC4 key length didn't really matter much. Ignoring this, my ...
3
votes
3answers
296 views

Where's the security when a payment gateway let website handle Credit Card detail

Has anyone worked with eWay payment gateway before? Basically, there's a service endpoint where you post the customer's detail and credit card details from the web application after the browser sends ...
2
votes
2answers
661 views

How to make a certificate encrypted flash drive?

I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password. The idea is to have a number of encrypted pendrives that can be used on ...
15
votes
4answers
955 views

Is it safe to store and replay user-provided mime types?

If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
17
votes
7answers
9k views

How do I check if a gmail/gtalk SSL certificate is valid?

Pidgin started prompting me to accept/reject new gtalk SSL certificate a few days ago and I am not able at the moment to tunnel the traffic to check if it would continue to happen or if it wouldn't ...
-1
votes
1answer
399 views

How does DNS work?

I'm learning pentesting from books. So far I thought I know about DNS but now I'm completely lost and confused. well, I know what happens when you enter domain name in your browser: Say, I've ...
5
votes
3answers
467 views

Detect spy software on Symbian

I would like to check a Nokia N8 for possible software that might send any kind of data without my consent. Is there a specific tool to achieve this? Are there specific techniques?
12
votes
1answer
1k views

What encryption prevents the tampering of Windows Identity Foundation (WIF) FedAuth cookies?

It occurred to me that the WIF FedAuth cookies contain identity information, that if tampered with, could permit someone to assume the identity of another user. Fortunately, WIF does ...
9
votes
2answers
362 views

Why is there no Domain CA?

I was asked to deliver a signed SSL certificate for an IIS server for a client. I have previously done this for the same client/domain before, so it start to seem like an unnecessary expense to hold ...
4
votes
5answers
198 views

Should there be an anti-virus used on client provided files?

This is based on Stack Exchange podcast # 25. I really don't understand why there would need to be virus checking on uploaded files. It would generally be a bad idea to execute anything which was ...
15
votes
4answers
5k views

How quickly can these password schemes really be beaten?

If you use a quick hashing algorithm like MD5 or SHA-1 to hash passwords and you don't use any salt at all, how quickly could one expect a hacker to find my password out? If I use a truly random salt ...
11
votes
5answers
2k views

Detecting malware-infected USB drives

I'm about to distribute some relatively cheap promotional usb drives to some of my company's clients. I'm fairly confident the company I purchased them from wouldn't intentionally implant malware on ...
12
votes
3answers
40k views

How serious is InstallIQ?

Background: Recently I've seen hits for InstallIQ a "potentially unwanted application" from ESET. From what I can find it seems like this is an installer wrapper that asks people to install other ...
26
votes
4answers
9k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
21
votes
4answers
7k views

Are WPA2 connections with a shared key secure?

This is something that has been bugging me for quite some time: when I have a wifi access point with WPA2 encryption and I give out the key, how secure are the connections? With WEP you could easily ...
20
votes
3answers
3k views

How can I be protected from pictures vulnerabilities?

I've just read this question What is the corrupted image vulnerability? How does it work? (GIFAR, EXIF data with javascript, etc..) I'm asking myself how can I protect myself and my website's users. ...
12
votes
5answers
4k views

Risks with Amazon S3 and costs

I have little security knowledge and looking at image hosting for a startup: Considering S3 doesn't allow you to set a cap on costs, how likely is it that someone could flood S3 with requests for my ...
4
votes
2answers
555 views

Firewall design for big enterprise business

I am wondering if there is any best practice firewalling rules that should be put in effect in most modern networks. For example should the network atleast have the following firewall zones? Client ...
2
votes
7answers
670 views

How can http data be compromised on a secure network?

I understand that it is bad to send passwords in plain text over the wire because somebody can look at it and clearly steal your information, and that the solution is to use HTTPS because the ...
3
votes
3answers
3k views

RSA 4096 with AES 256 Encryption Process Using PyCrypto

I have the following process for encrypting and decrypting data in a python script using the PyCrypto module: Encryption - Server A AES 256 shared key is generated Associated IV is generated Data ...
4
votes
5answers
479 views

Am I required to hash passwords

Is one required to hash passwords by law in the US or elsewhere? If not required by law, are there legal ramifications if unhashed passwords are stolen? If not required in the US, but required in the ...
23
votes
2answers
2k views

Digital Certificate deployment: using two certs for each user?

At a large enterprise environment I have come across a deployment approach for Digital Certificates where each user is issued two (2) key pairs: One for signing documents, emails, etc. that is ...
6
votes
4answers
256 views

What types of background checks of employees are state-of-the-art?

A high security environment requires trust in the integrity of the employees. I am talking about administrators, developers and everyone else who could compromise the security easily. One way to ...
15
votes
2answers
1k views

Why do Chrome extensions need access to 'all my data' and 'browsing activity'?

Often I install simple add-ons for Google Chrome. However, they almost all need what appears to me as excessive access to my data. For instance, I install an extension that allows me to click on any ...
14
votes
3answers
443 views

Android security without updates

I have an android phone which, like many others, has quickly become unsupported and is not receiving any updates. At the same time there are publicly available exploits for privilege-escalation ...
0
votes
1answer
944 views

How do I deploy AD in a hostile location? What are the security implications between Domains, Forests vs RODC's in Active Directory?

Short version What are the risks/ benefits / drawbacks of RODC's vs Child Domains vs Forest Trusts in AD Background I'm working with a company that has various business agreements between many ...
19
votes
6answers
10k views

Is Facebook allowed to sell/give your information away to anyone willing to buy it?

Is Facebook allowed to sell information about their users to other companies? For example selling name, address and IP information on a specific geographic location could be very valuable ...
4
votes
2answers
397 views

Is there a superior approach for threat modeling?

There are at least three different common approaches to creating a threat model: Attacker-centric Software-centric Asset-centric You can take a look at Wikipedia for a quick overview. I wonder if ...
2
votes
1answer
640 views

How do you remove the Security Sphere malware?

My boss' computer has become infected with something called "Security Sphere". When googling for information on how to remove it I get many pages that have been optimized for the term "Security Sphere ...
25
votes
3answers
14k views

Which SSL/TLS ciphers can be considered secure?

The OpenSSL website provides a long list of different ciphers available for SSL and TLS. My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
7
votes
3answers
2k views

Why banking websites always ask me to authenticate my PC even after I'd chosen to “Remember my Computer”?

Why banking websites always ask me to authenticate my PC even after I'd chosen to Remember my PC? This is the case with all banking websites
1
vote
2answers
432 views

Looking for a tutorial on meterpreter extensions

A simple custom DLL source would be sufficient. All of the links I find on google are dead. I don't mind reading some clear source if there's a tut DLL floating about. I tried for meterpreter and ...
11
votes
2answers
478 views

How can I restrict what an application can do with my computer?

Often when I install applications on my computer, I realize that I need to trust the application because it can do what ever it want with my computer, e.g. accessing files, listen to my keyboard, ...
1
vote
2answers
759 views

Are there any strange things with google.com over HTTPS?

So I'm always browsing the web through Privoxy using minimum these rules: vi /etc/privoxy/user.action { +redirect{s@http://@https://@} } .chrome.google.com .code.google.com .docs.google.com ...
1
vote
1answer
240 views

Can we protect domain name by law? [closed]

Some company have domain names worth a million dollar. But sometime they are lost to hackers. So I wonder how can we protect domains by law instead of technology?
8
votes
5answers
2k views

Websites that interactively test browser security (XSS, CSRF, Javascript, etc)

I'm looking for a comprehensive list of browser test sites so that I can visually prove that the browser is patched and configured for safe web browsing. My intent is to know what risks may exist ...
5
votes
2answers
1k views

Have anyone tried to extract the encryption key from a SSD?

After reading this forum thread it does not sound like encrypted SSDs provide much protection at all - specifically encryption only occurs between the controller chipset and the NAND storage. Why is ...

15 30 50 per page