1
vote
1answer
272 views

Is there symmetric encryption like AES or Camelia with keys longer than 256 bits?

I am wondering if is there any (secure!) cipher like AES or Camelia with keys longer than 256 bits (and offering higher security than 256 bits). I have not found anything except ...
1
vote
1answer
2k views

ECC Brainpool Standard Curves and Curve Generation with Bouncy Castle which seed to use?

I want to implement a ECC Key Agreement with a Brainpool curve brainpoolP512r1 or brainpoolP512t1. I'm not clear about whichseed value to use (and how). In this document ...
1
vote
2answers
1k views

Do I have to validate Saml2 InResponseTo?

I'm implementing a SAML2 Service provider that will be running on a public facing web site. The sign in functionality is publicly available, so anyone can get hold of a AuthnRequest from my site. ...
2
votes
3answers
897 views

Suggestion on how to be PCI Compliant

I'm working on a system that takes the customers credit card information before sending it to the processor. It requires me to ask the customer for cc#, CVV, date, one at a time and send that to my ...
1
vote
1answer
249 views

How to check www.abc.com/?page=xyz is vulnerable to RFI or not?

On my friends website when I typed www.abc.com/?page=non existing page, I got page not found error.But when I gave www.abc.com/?page=www.google.com I got blank white page.So is this website ...
6
votes
2answers
973 views

Android side channels: what can one app observe about other apps?

What information can a malicious Android app observe about the behavior of other apps running on the same phone? In more detail, suppose app M is malicious and is running in the background. Suppose ...
1
vote
2answers
146 views

Does a OS manufacturer have permission to access your computer unauthorized? [closed]

Many services such as email and online storage have stated in their Terms of Service that they have the right to view and delete your files at any time. I'm wondering if they same applies to software ...
7
votes
2answers
793 views

Should you use VPN if the website uses HTTPS?

If I visit the website which uses https, is there a point using an VPN? In places like coffee shop where internet is not secure. Because I think https already encrypts data?
1
vote
3answers
1k views

What is this for a Request?

i see the following request-string (see complete example below) with the same request_parameters, but differing values, hitting all our sites/wafs. the scheme is always the same: ...
11
votes
2answers
3k views

How does a weakness in a random number generator lead to a compromise of the entire cryptographic process?

In the news, there are several articles (here, here, and the technical point of view) which have to do with a weakness in a random number generator. The question is somewhat twofold. What symptoms do ...
-3
votes
1answer
5k views

Google Chrome is keylogger? [closed]

Hi i am a little bit worried that Google Chrome is logging my keystroke. One time ago i had situation with chrome that when i clicked some where in input box he was writting key by key(even backspace) ...
5
votes
2answers
1k views

Are there any real life cases, where using final keyword in Java increases system security?

I've came across that question on StackOverflow: http://stackoverflow.com/questions/18755713/how-does-final-play-a-role-in-security The claim is made, that according to Wikipedia: A final class ...
7
votes
3answers
2k views

How important is CAPTCHA on registration pages?

I am working on a site and I would like to add CAPTCHA to the user registration page to prevent user name enumeration. I am working with a front end developer who feels pretty strongly that we should ...
4
votes
1answer
2k views

Hiding backdoors in Open Source code in other languages than C and C++?

I am referring to The Underhanded C Contest and Hiding Backdoors in plain sight. They demonstrate, that you can with some cleverness, write Open Source code, publish the code and hide a backdoor in ...
3
votes
1answer
219 views

How to protect the code of Windows applications against path traversal?

I'm writing a simple HTTP server in Lua and while I can easily find resources on how to secure against Unix directory traversal, I already found some caveats in the Windows version. While I'm already ...
3
votes
1answer
804 views

How does SEH based exploit bypass DEP and ASLR?

I am new to structured exception handling based exploits. Why don't we put our return address directly in SE handler to jump to our shellcode? (with no safe SEH) Can anybody explain the reason of ...
0
votes
1answer
163 views

Timing analysis attack and cryptosystem

Why is a “Timing Analysis Attack” a problem for a cryptosystem? I've been trying to learn security, and have a question about timing analysis attack.
1
vote
1answer
99 views

DNS Redelegation - Security Risk?

I am a web developer and I use Adobe Business Catalyst. To use some of their services it is recommended you redelegate the domain. In other words change the nameservers to Business Catalyst. I have ...
1
vote
2answers
859 views

MAC spoofing preventing connection

I'm attempting MAC spoofing on a network I own. I'm connecting to a NETGEAR WNDR4300 wireless router from an Ubuntu Linux machine. The network uses WPA2-PSK [AES] security. Connecting to the network ...
2
votes
1answer
4k views

What is a stub?

Would someone please explain in depth what a stub is? I understand it as a file created by a crypter to keep a program encrypted and undetectable by anti-virus software. It is attached to the ...
10
votes
1answer
1k views

Why are some DLLs not randomized? What makes it hard to deploy full ASLR for all DLLs?

One of the challenges with deploying ASLR for everything is that, at least on Windows, some DLLs (libraries) are not compiled in a way that's compatible with ASLR. (They're not compiled as ...
4
votes
2answers
139 views

Is there a pre-existing taxonomy of attackers?

When building a security policy (and implementing it) you must know who you are defending against. I would like to use proper terms, if they're already defined. I'm imagining a list such as: Passive ...
4
votes
2answers
244 views

How can you I detect low frequency brute forcing over multiple connections?

While I realize that servers can easily detect brute forcing strategies via a single I.P, it seems that servers would be vulnerable to a distributed attack from a botnet, with each computer attempting ...
29
votes
2answers
27k views

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?
16
votes
5answers
3k views

Is it possible to inject values in a drop down list?

Say a ASP.NET page, or any html page for that matter, has a drop down list with a bunch of prices. On posting the page, the code looks at the selection of the drop down list for a computation. Is it ...
1
vote
1answer
547 views

How could `iptables -F` lock me out of the server? [closed]

I was just configuring IPtables and whilst doing so, had the default chain policies set to ACCEPT, but when happy with the generated rules I changed that to DROP for all chains. I did not run ...
1
vote
1answer
717 views

OpenSSL DH modp size

If OpenSSL is configured to use a DH for key exchange, e.g. TLS_DHE_RSA_WITH_AES_128_CBC_SHA, where does it take the size for modp (or even modp itself) from? The following is a screenshot from ...
15
votes
11answers
3k views

Should I know my users passwords so I can check they can logon? [duplicate]

I have an issue with support for a system and I don't know what approach to take. It boils down to the question: Should I know my users passwords so that I can check with certainty that a ...
3
votes
1answer
10k views

What effect has MaxAuthTries=1?

I configure a new server right now and ask myself what is the internally effect if I set MaxAuthTries=1 in sshd_config. The server only accept key authentication an no root logins. Has this setting ...
13
votes
4answers
4k views

How can I make sure password hashing is secure on computers while not being prohibitively slow on mobile devices?

I'm new to cryptography and its implementations. I'm designing an Android app where an user enters a password to retrieve some encrypted data. After some research on possible solutions I ended up with ...
4
votes
1answer
99 views

Securing an IMAP service

I need to secure an IMAP service running on dovecot. Which wrapping layers of security can I enhance security with? I am using most of the built-in dovecot-specific security features, like ...
-4
votes
2answers
250 views

What kind of Wi-Fi security protocol does not use encryption?

I need to sniff HTTP packet over the WiFi network. What kind of WiFi security protocol does not use encryption? I mean if I capture the WiFi packets, no effort required to decrypt wireless packets and ...
1
vote
1answer
303 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
2
votes
2answers
2k views

Running arp command on public wifi network

I accidentally ran this arp -a on a public wifi network(because it is in my terminal history). I killed the process almost immediately. I want to know if this would raise an alert for the network ...
7
votes
3answers
692 views

What can a web application developer do to protect user information from powerful adversaries like the NSA or China

Some well funded intelligence services with potentially untrustworthy employees intercept and store encrypted data for years, in hopes of cracking it with future technology. What can I do to make this ...
3
votes
1answer
6k views

How To Track Down Who Initiated A Remote File Transfer Via TeamViewer If I Have Log File

Walked into my office an hour into a Remote File Transfer initiated by an unknown user. I disabled it right away and looked through the files they transferred, which include a blank check with my ...
8
votes
1answer
492 views

Are there any reasons why browsers should block mixed passive content by default?

Most browsers block "active" content that's being loaded over HTTP on HTTPS pages. This includes stuff like javascript which can be modified with an MITM and compromise the security of the entire ...
2
votes
1answer
402 views

Using only private non-government resources, how can something be sent such that the NSA will see it? [closed]

Supposing you want the NSA to see something, what does one have to do to guarantee it. This means in their normal data collection it will be swept up, not in a targeted probe of an individual or with ...
5
votes
1answer
5k views

What block ciphers and algorithms are now safe? [closed]

I work for a large non-US based international organisation. Regarding the recent leaks about the NSA breaking most encryption on the internet, we now know the US and UK governments are actively ...
6
votes
6answers
14k views

How can I generate custom brute-force dictionaries?

I have found during testing that companies often use variations of their names for critical passwords (for example Microsoft's password might be M1cr0s0f+ or m1cros0ft etc etc). So if I gave it the ...
2
votes
1answer
4k views

How does Activesync security policy affect the usage of the iOS fingerprint scanner?

An Activesync IT administrator has the ability to choose if the phone should require a password, and also how complex it should be. Since the fingerprint scanner appears to replace the traditional ...
2
votes
2answers
653 views

How to get URL behind REST-style

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only ...
9
votes
3answers
2k views

iPhone 5S security: Given someone's fingerprint can I use a 3D printer to create a fake finger with a real fingerprint on it?

With such a big deal being made about the iPhone 5S's fingerprint reader (and formerly the Thinkpads' fingerprint readers) I really wonder how secure it is to use fingerprints in lieu of passwords. ...
1
vote
1answer
364 views

Disadvantages of a single administrator checking all file permissions

What would be the security disadvantages of a single administrator checking every file permission in a network of computers? Obviously this is a theoretical question. I'm thinking that the fact that ...
2
votes
1answer
72 views

How does CVE-2013-4287 make Rubygems any more vulnerable?

I've recently heard about CVE-2013-4287, which can cause denial of service due to CPU consumption. But earlier this year, I attended Hacking with Gems which showed all kinds of weird and wonderful ...
7
votes
2answers
675 views

Is it possible to reliably derive a key from a biometric fingerprint?

Many products (e.g. notebooks, security doors and now smartphones) support some form of fingerprint authentication. That seems simple enough: A trusted system compares a stored representation of a ...
1
vote
2answers
3k views

Privacy of Gmail for business?

Considering the recent litigation in which Google apparently claimed that all the emails, all the data in them, are Google's property and can do with the data whatever they want, I get frequent ...
7
votes
2answers
894 views

Is there any Linux distro or kernel patch that wipes a process memory space after the process exits?

An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, ...
1
vote
2answers
698 views

Why two key DES algorithm provides only 80 bits security

In the wiki link, it is mentioned that due to "chosen-plaintext" or "known-cipher" attacks, two key DES provides only 80 bits of security. My question is how these attacks work and how did NSIT came ...
6
votes
1answer
368 views

Any not totally insecure browser vulnerable to BEAST?

People still worry about BEAST quite a lot when configuring web servers to the point of preferring RC4 over AES-CBC. But most browsers mitigate BEAST even while using TLS 1.0. Is there a browser ...

15 30 50 per page