2
votes
4answers
120 views

How do you build a secure web application that is also COPPA compliant?

If you are building a web application to be used by US schools, you will probably have to worry about COPPA compliance. Children's Online Privacy Protection or COPPA is new to me, probably because ...
0
votes
2answers
2k views

DrayTek Vigor 2920 HTTPS allowed

In my office we have a DrayTek Vigor 2920 router, with CSM setup to only allow certain keywords (keyword objects) to certain IP groups. This all works fine, however we've discovered that all HTTPS ...
1
vote
3answers
341 views

Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?

Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP. Should banks offer integration with services like OpenID, WS-Fed, or ...
1
vote
2answers
5k views

Anyone out there using Umbrella from OpenDNS? What exactly is it?

I'm still looking for a centrally-managed AV/malware management system and I've been testing out both Panda and Webroot (due to their 'cloud-based' structure that doesn't require a server for me to ...
7
votes
4answers
2k views

Is it possible for a third party to sniff data off the line to an ISP and determine what the user is doing?

Can somebody hack the line between my router and service provider and monitor what I'm doing online and what sites I'm visiting?
2
votes
1answer
244 views

Does Verizon Wireless LTE network have intrusion prevention capabilities?

Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM. EDIT for clarity: I ...
1
vote
1answer
2k views

Windows System event log warnings for smtpsvc

I get a lot of the following type messages: Message delivery to the remote domain 'particular domain or IP address' failed for the following reason: The remote server did not respond to a connection ...
2
votes
2answers
778 views

Breaking out of attribute in double quotes

I have a piece of code that allows for [url]someurl[/url] BB-Code and replaces it with <a href="someurl">someurl</a> It takes two precautions to prevent XSS. It replaces ...
2
votes
1answer
90 views

Privacy laws' right-to-amend (and right-to-delete) requests and archived data/backups

Under HIPAA and some privacy laws (in US, EU and other countries), the user has the right to amend (under some laws even delete) his/her data. What is the right way to handle a request to amend/delete ...
2
votes
1answer
167 views

How do automated systems store their keys securely?

As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
333
votes
13answers
66k views

Are passwords stored in memory safe?

I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory. I think the OS does its job and forbids processes from accessing each other's ...
1
vote
2answers
142 views

Bad transactions in an e-commerce system?

I read an article signifyd-raises-2m-from-andreessen-horowitz-to-help-online-businesses-use-data-to-prevent-payments-fraud which talks about a service that pulls together data to screen the ...
4
votes
5answers
2k views

Are image uploads also vulnerable to sql injection?

I have some good knowledge how sql injections work. I see that the Googling inurl upload.php will tell one about the upload paths in a website. My Question is that if a person finds a path by which he ...
-1
votes
1answer
207 views

Idea feedback wanted - easy and secure web notes manager (javascript) [closed]

I have an idea for a web app that I'd like to discuss. I like it a lot but chances are that I missed some evident security hole. Or, maybe it just sucks. The idea is a web-based secure text notes ...
1
vote
1answer
365 views

What does key, key pair and signature mean here?

I was reading How are possible uses for X.509 (SSL) certificates denoted? on IT SE. It begins with: X.509 certificates can be used for servers, clients, email, code signing and more ...
6
votes
4answers
4k views

How should I react to finding GMail outbox e-mails that I didn't send?

This morning I found 17 e-mails in my GMail outbox that I didn't send. The e-mails were sent to seemingly random people from my GMail contacts and contained the link to a suspicious php file on ...
1
vote
1answer
578 views

Pseudo-Unique PICC Identifier in Passports/ID Cards

I'm currently researching fingerprint abilities of german ID cards. These cards are compliant to ISO 14443 (the same standard as for passports). I found a part that caught my attention and I have a ...
3
votes
2answers
299 views

Suspicious phone browser activity

On a droid Razr M, I used chrome to log in to Gmail instead of the app. It asked to log in as me on a toast at the bottom of the browser, taking my credentials from somewhere on the phone I assume. ...
1
vote
1answer
230 views

Any recipient can modify an order confirmation mail, right? Does this ever matter ?

I have boldly stated that there is no way to 'write protect' an e-mail, but want to be sure of my ground. Surely if Joe Bloggs receives an e-mail from me (or my e-commerce site or a web application ...
6
votes
1answer
414 views

secure credit card transactions on the internet

I have read about how hopelessly insecure credit cards are, and was wondering if there is, in the uk, a provider of either: One time use credit cards. Text me on transaction cards. Pre paid cards: ...
8
votes
2answers
2k views

Will disabling the Java add-on in IE protect you from Java exploits?

Concerning the recent Java vulnerability (Should I be disabling Java?), the most common advise seems to be to disable Java plug-ins in the browser. However, Heise Security suggests that, when it ...
3
votes
3answers
1k views

unknown MAC address in the LAN, DD-WRT router

I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
1
vote
1answer
814 views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
5
votes
1answer
233 views

Is this a security flaw in Firefox 18.0?

I had a couple of .mht files which opened in IE, a browser I never use. I renamed their extension to .HTML to run it in Firefox. When I opened the file in Firefox, Firefox created new tabs endlessly. ...
4
votes
2answers
217 views

How can an “alternate” or duplicate HTTPS certificate be used in an attack?

Inspired by an old question from PulpSpy, I'm trying to think of whether this is a significant weakness in the Certificate Authority system. Here are the attack methods that I think would work - ...
0
votes
1answer
487 views

Need advice on automated virtual pentesting lab configurations

I request you to read the problem before suggesting any duplicate or down-voting, I am well aware of hundreds of questions about somewhat similar problem but this one is just to attract some good ...
3
votes
2answers
670 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
7
votes
1answer
1k views

Brute force login attempt from spoofed IP's

I see that many of my WordPress installs are being hit with 1000+ failed login attempts using non-existing 'admin' account name. The requests come from different IP's every time, and I see IP's such ...
7
votes
1answer
2k views

What are the benefits and drawbacks of the HTML5 Keygen element?

As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
4
votes
6answers
928 views

Bot detecting by considering request inter-arrival time

If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time? When a user request for a page (page request), browser request for several ...
10
votes
1answer
5k views

Android Device Encryption

I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
4
votes
1answer
2k views

How traceable is ATM and point-of-sale credit card use back to you in practice?

A friend said ATM use is traceable easily, while point-of-sale credit card use isn't - this statement goes against my common sense. I searched for the the topic and this is what I have found: ...
1
vote
0answers
260 views

How can Nokia decrypt HTTPS data? [duplicate]

Possible Duplicate: Can real end-to-end SSL encryption be made? Regarding this piece of news, I wonder how can Nokia so easily decrypt HTTPS data? As I understand the data is encrypted by ...
5
votes
3answers
6k views

Java vulnerability: What about OpenJDK + IcedTea?

These days there is a lot of recommendations about disabling java-plugin due to a serious vulnerability. I know this topic has already been covered on this site here and here. In the reports about ...
3
votes
3answers
9k views

Browser security - Firefox + NoScript is better than Google Chrome?

I saw that NoScript + Firefox combination blocks all "dynamic content" (especially those spammy ads). I really like that. It reduces the chances of being exploited. But, chrome only asks me to allow ...
2
votes
1answer
417 views

How effective is a URL scanner?

How do I test if a Link is REALLY malicious or not ? I use VirusTotal, but I suspect that it is not useful at all. To see why, please read further. I wanted to find out which side the stomach is on. ...
11
votes
5answers
1k views

Where can I find statistics on security breaches?

I am putting together a security presentation, and I would like statistics on the occurrence of and damages from security breaches. Does anyone know of a reliable, recently-updated source?
1
vote
2answers
2k views

UNION SQL Injection

I'm trying to demo SQL Injection with a UNION query but I'm not getting results. This is the C# code and the database is SQL Server 2008 R2: string cString = "server=.\\sqlexpress; ...
23
votes
3answers
2k views

Should I be disabling Java?

First it was Apple, now it's the US government... U.S. urges users to disable Java; Apple disables some remotely New malware exploiting Java 7 in Windows and Unix systems How serious is this ...
1
vote
1answer
822 views

Cuckoo Sandbox python errors after task submission

I'm New to Cuckoo Sandbox. Why am I getting this error? I don't understand. If there is something wrong, can anyone please explain how to setup Cuckoo Sandbox? My setup works very well before I ...
1
vote
8answers
7k views

How should I select which antivirus software to install on my new laptop?

I'm in a bit of a dilemma here. I have bought a new laptop with no antivirus installed. I'm wondering how to choose an appropriate antivirus software to install.
2
votes
1answer
187 views

Passing generated keys to another process

I am doing a project in which one process generates a key using a distributed algorithm. I need to pass this key to the calling process or procedure. Generally speaking, one can do this in the ...
1
vote
1answer
130 views

Ciphertext for email vs Ciphertext for database

Let's say Bob wants to send a message to Alice. This communication requires to achieve confidentiality, integrity, proof of origin, non-repudiation. Therefore we can use this cipher-text: ciphertext ...
8
votes
6answers
33k views

Playing with Referrer Header

There are 2 sites: http://www.site1.com http://www.site2.com http://www.site1.com contains link to http://www.site2.com as <a href="http://www.site2.com/">link<a/> When user clicks ...
3
votes
1answer
4k views

Tutorials, Exercises and Environemnts for Penetration Testing Mobile Environments

I'm looking for a list of exercises or distributions to practice penetration testing on mobile environments. There are plenty of existing things like the environments found at pentesterlab.com and ...
1
vote
2answers
202 views

How can I catch an Instant Messenger Identity Thief?

Here is the scheme. The identity thief logs in as my American friend in the instant messaging program QQ. (Did he steal her password or use some other exploit? I don't know.) The thief contact's ...
11
votes
2answers
12k views

Encrypting local HTTP traffic using a self-signed certificate

For the past couple of hours I've been trying to create a self-signed certificate which I'd like to use to encrypt HTTP traffic between computers and a server on my home network (because I'm paranoid ...
10
votes
4answers
37k views

Can an employer access Whatsapp messages if you are using their servers?

Does anyone know if an employer can access whatsapp messages if you are using their servers? Whatsapp apparently say the messages are encrypted, but I'm not sure about this.
2
votes
1answer
557 views

How disable Java in Chrome 23?

Well in case someone doesn't know yet... there is a new Java zero day. I'm trying to disable it on Chrome but I can't find any option. Google searches says that the option for deactivate it is on ...
3
votes
3answers
2k views

How do a VPNs route SSL traffic and do they compromise security?

If my understanding of how VPNs operate is correct, all traffic between me and the Internet at-large is routed through the VPN's servers. So an attacker would only be able to see encrypted traffic ...

15 30 50 per page