1
vote
2answers
385 views

best place to store backup encryption key [closed]

I have a server on which I keep an encrypted backup of some data. The server updates the backup once a day if the data has been changed and is physically accessible to many people. Further, I would ...
7
votes
1answer
203 views

What's the best duration for storing e-mail? [closed]

We’ve all become so accustomed to using email in our daily personal and working lives that we really don’t give a whole lot of thought to it. It’s the fastest way to communicate with others in the ...
6
votes
2answers
2k views

If encrypted data in a database are accessed by application, does that mean that the application has the decryption key?

I'm using an application linked to a database which holds confidential data (numbers). According to the developer, this data is encrypted. However, i can easily generate a report that will show the ...
5
votes
1answer
129 views

If a service that I registered with FB/Twitter/G+ is hacked, what mischief can be done with the oauth token?

Case in point, TrueCaller. I had logged into TC using a proxy twitter account. I am assuming that as part of the authentication process, an access_token must have been saved by TC. If the hackers ...
1
vote
1answer
1k views

Generate CSR with 2 OU Names

I have to create an application which generates a CSR. While generating a CSR we are required to fill in several details like CN, OU, etc. The problem is that the Certifying Authority to which I have ...
13
votes
1answer
3k views

Cross site scripting and the use of http-only cookies?

I have been a developer and now I am trying to look at XSS from the point of view of a developer. I was thinking of a particular case of reflected XSS . Let us say we have a vulnerable website and if ...
0
votes
3answers
1k views

Ways to keep AES encryption key safe.? [closed]

I am using AES encryption to secure some sensitive data. For that i have to provide a certain key for encrypting and decrypting. It's not safe to keep the key somewhere on the server. So instead of ...
5
votes
2answers
2k views

What's the best way to send and receive lots of login credentials?

I'm currently a web developer for a company with lots of different remote clients. There are lots of usernames and passwords that I need to know so that I can do my job. When I first started, I was ...
20
votes
2answers
1k views

How do I ensure there is sufficient entropy on an embedded system at first boot?

I'm working on an embedded system that will generate an SSL key the first time the system boots. I would like to avoid the problems discovered by Heninger et al. and Lenstra et al. where embedded ...
8
votes
4answers
29k views

Pros/cons of using a private DNS vs. a public DNS

I was wondering why a company should use a private DNS. In comparison with a public DNS, which advantages does a private one have, and which issues can a public DNS create for a company? I'm new at ...
3
votes
2answers
3k views

How to determine if ViewState has MAC enabled when crawling a page?

I was using Burp Suite to do some security testing on a site and I noticed that when it detects ViewState it will automatically tell you whether it has MAC enabled. I'm curious if anyone know of a ...
3
votes
2answers
2k views

If a login/session cookie is stolen,does changing the password void it?

Considering the scenario where a Gmail session/login cookie is hijacked or stolen and it is discovered my means of Gmail last account activity,will changing my password immediately void the cookie or ...
2
votes
1answer
120 views

Tagged website malware

A common occurance I've found when doing forensics on compromised websites is a pattern like this: <span>Clean code here</span> <!--0c0a22--> ... malware code here ... ...
5
votes
1answer
116 views

Is it acceptable to generate salts with a hash of the username?

Salts are supposed to be unique and randomly generated for each user when storing passwords. Is there a reason why we can't generate these salts with a cryptographic hash function using the username ...
3
votes
1answer
4k views

Penetration/Vulnerability testing for REST web services [closed]

Is there any tool to perform penetration/vulnerability testing on REST web services ?
1
vote
2answers
124 views

What is more secure: single long hash, or combination of two shorter?

Fictitious scenario: User accesses a restricted data (available online) identified by random string (supported by captcha to make brute-forcing more difficult). So data is not protected by a ...
-3
votes
1answer
136 views

Mobile Device Security [closed]

Are there any other security threats to a mobile device other then a rogue app? I am trying to secure a set of business phones and tablets and while anti-virus applications are possible, I don't see ...
7
votes
2answers
1k views

How do I forensically determine whether a mobile phone has been infected with a spy suite?

What is the best way of forensically determining that spyware software has been installed on the phones without making any changes to the phone(s)? I have Blackberry and iPhone 4 phones that are ...
4
votes
1answer
4k views

A “new domain registration” spam?

About 6 days ago I purchased a new domain under .org TLD from a local registrar. Few days later, I have received this strange message (which BTW fell to Gmail spam bin), which looks like some kind of ...
2
votes
1answer
2k views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
10
votes
3answers
2k views

Is this code snippet good enough for password hash and salt

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found: $blowfish_salt = ...
3
votes
1answer
49 views

OS reinstallation security contribution

For an average user (doing on-line payments, etc.), would it be useful to periodically conduct a OS re-installation of his computer to improve security? How often would that be and how much extra ...
6
votes
2answers
551 views

What does “Change your password everywhere else” e-mail from compromised service mean?

I've recieved an e-mail from ubuntuforums.org a couple of hours ago: [...] the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum ...
8
votes
4answers
5k views

SHA-512 unix passwords. How secure are those hashes, really?

I came across this very alarming sounding thread which indicates a GPU with about half the compute capacity of the GPU currently powering the monitor I type this on is capable of 11.5k c/s. I'm not ...
3
votes
2answers
2k views

Deduplication of Encrypted Files

Let's assume I have an 18GB database that is backed up nightly by dumping the database and then encrypted using a modern algorithm such as AES-256. This database has a daily update of rate of ...
2
votes
1answer
112 views

Does padding an AES key hurt security (besides lowering the strength of the key)? [closed]

I've been reading about solitare and its weaknesses, and thinking about clever ways of hiding keys. It seems like you could encode an 52-bit AES key in the vertical orientation of cards in a deck (or ...
18
votes
3answers
18k views

Is Signal a secure and secret way to communicate via voice calls?

Signal (former RedPhone) provides end-to-end encryption for your calls, securing your conversations so that nobody can listen in. But really, how is the probability that a voice conversation is ...
8
votes
3answers
2k views

Can I use the same keyboard on both my infected and non-infected computers?

I have a computer which is virus infected. Can I use the same keyboard on both it and a "safe/clean" computer without fear? Keyboards these days seem to come with built in software and thus must ...
1
vote
1answer
621 views

BitMessage : Key authentication?

Does BitMessage provide key authentication? If so, then how? How would one can be sure that the public key belongs to the right person?
4
votes
2answers
4k views

Rounds of MD5 and SHA512 Hashing Algorithms

What is the exact number of rounds employed by the MD5 and SHA512 hashing algorithms? According to various sources, the SHA512 hashing algorithm employs a total of 80 rounds ...
5
votes
2answers
208 views

What is the meaning of the term “simple string” for the SALT string in Unix crypt using SHA-256 and SHA-512?

In Unix crypt using SHA-256 and SHA-512 the author, Ulrich Drepper, introduces the SALT string as the following (highlight by me): For the SHA-based methods the SALT string can be a simple string ...
3
votes
2answers
354 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
1
vote
1answer
663 views

Is decryption using Java+JSF safer than using JavaScript?

First off, this is in addition to using SSL! I am building a web application that receives encrypted data from a server. The data is to be decrypted client-side. I've read enough posts here to see ...
6
votes
5answers
977 views

Is it a good idea to use an input by the user as SALT?

I have read many Q&As here on IT Security about password hashing and salting. I am building a simple registration form for our community website which will be used by our members to create their ...
3
votes
3answers
435 views

How to know if mail is for tracking our IP

Consider if I have got a mail from a colleague on my GMail, and it has got some images or attachments in it. Gmail asks for "Show Images" option to explore images. My query is that how can we get to ...
2
votes
3answers
3k views

Is an outbound firewall connection 'safer' than an inbound

We're trying to determine if pushing data through a firewall is more safe than pulling it. The data will be from SSIS to SSIS through the firewall. An advisor here has suggested that pushing the data ...
-1
votes
2answers
9k views

Want to authenticate oracle login using encrypted password…how to?

We are connecting to Oracle using korn shell scripts, which use sqlplus to connect to Oracle. The Oracle database is on the same Solaris box. Currently, we are storing the Oracle user id and ...
6
votes
2answers
359 views

Can a web application administrator access the database of that application?

We have a web application linked to a database. The database is secured but contains unmasked confidential numbers. Can a normal administrator who can access the application, access those numbers in ...
5
votes
1answer
1k views

Retrieving client certificate using Tcpdump results in zero length certificate

I am trying to proxy a mobile app (with Fiddler), which sends a client certificate to the server it connects to. I would think that capturing traffic with Tcpdump, retrieving the client certificate ...
-3
votes
1answer
3k views

How do I unencrypt emails from a pst file without a digital certificate? [closed]

I saved a pst file on a CD. It contains a lot of email that was sent to me using a digital signature. I am now in a lawsuit and need to print out those emails but no longer have access to my digital ...
-5
votes
3answers
551 views

PHP web application security [closed]

I am building a PHP web application, that needs enhanced security, due to the fact that it contains very sensitive information (in a database). I think that I want to use self-signed SSL ...
-1
votes
1answer
115 views

Network Security Design Resources [closed]

I am looking for respected resources that state guidelines on how to design my network from scratch in a secure way, including different positioning scenarios for different network/security appliances ...
3
votes
2answers
834 views

Should I customize my Root CA's thumbprint/fingerprint? (SHA1 or MD5)

My goal is to make a certificate's thumbprint "easier" to verify, and not reduce security in doing so. Given that the RSA-based Bitcoin technology has a concept called a "Vanity address" where the ...
1
vote
1answer
97 views

Nessus Report Total 0?

This may seem like a slightly esoteric question but, I am wondering if it possible to achieve a result summary in Nessus where the Total is 0 for a windows server? Things that have no risk factors ...
4
votes
1answer
6k views

Is using RC4-MD5/RC4-SHA as SSL ciphers enough for most purpose?

In the AWS ELB, I have uploaded a cert and only selected "RC4-MD5" + "RC4-SHA" as the ciphers and scored A in the ssltest [1] If I using the default ELB setting, I can only score a C Since I am not ...
0
votes
1answer
1k views

In-office Flask app on port 80 - is it safe? [closed]

The title says it all; I'm just serving data to coworkers as a courtesy via a series of single-page apps that I basically consolidated under Flask, serving Jinja templates. Presently, I have Apache ...
12
votes
4answers
2k views

Sending HTTP 403 as. 200 - “Silent Identification of Admin”

A researcher recently reported an issue in a site about using script on a 3rd party site to discover if a user is an admin. Here's the scenario: Main site is target.example Attacker site is ...
11
votes
1answer
319 views

WAF Process Creation for Integration of IT and Business

A client has asked me to help them out with their WAF processes. Currently they have a few critical web applications being protected by a couple of WAFs. I have managed to get the WAFs tuned and ready ...
5
votes
4answers
2k views

“Forgot my password page” best practice

On a "forgot my password" page, is appropriate when user doesn't have an account to display the message "this account doesn't exist"? Or in the interest of security, should I display a success message ...
1
vote
1answer
402 views

Generate Keytool Object from CSR

I have to develop an application which uses another application for generating a CSR. After generating the CSR I have to provide this CSR along with a SHA256 hash of the public key to a CA. The ...

15 30 50 per page