7
votes
2answers
2k views

Why is ECC more vulnerable than RSA in a post-quantum world?

Forgive me if this should be in the crypto sub, but sometimes the answers there are very mathematical and I would rather have an answer which is a bit lighter on the math but still strong on the tech ...
2
votes
4answers
8k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
3
votes
4answers
846 views

If an ATM is stolen, how easy can the personal information of the users be recovered?

ATMs get occasionally stolen. How easy would be for the thiefs to retieve the PINs and other information of the users that have previously used the ATM? Is there a periodic wipe of all ...
2
votes
2answers
6k views

How would one go about becoming a Security Researcher [closed]

Can any Security Researchers/Pentesters/Hackers point me in a direction to learn about becoming a Security Researcher and steps to take?
5
votes
2answers
2k views

Why is NIST removing & not updating TLS guidance? What is the replacement?

The document NIST Special Publication 800-52 Guidelines for the Selection and Use of Transport Layer Security (TLS) Implementations was retired without superseding it with a newer document. In ...
-1
votes
1answer
140 views

What websites do you visit for up to date Malware info? [closed]

I'm expanding my understanding of Malware a lot more, as it's currently 0! I know how it behaves and propagates most times, but I don't have a clue about the latest threats out there, what it ...
2
votes
1answer
81 views

Internet connection for POS of a Third Part

From time to time, our premises and infrastructure is rented temporally for some conventions/meetings. One of these meetings requires an ordinary POS which would require a phone line or internet ...
1
vote
1answer
105 views

Recognizing malicious URL attempts against your website

On serveral websites I've run, I periodically see URLs run against my servers that look like this: /url_result?ctw_=sT,een_j...tdmlydXMtc2NhbS1lb........ Does anyone recognize it? I've tried to ...
-4
votes
1answer
97 views

LUG war games — suggested strategies? [closed]

My LUG on campus once in awhile holds a mock wargames on a VM. I'm trying to figure a way to get root access and make everyone else not be able to have root (king of he hill). I have a few ideas, but ...
5
votes
3answers
4k views

How will IPv6 affect DDoS mitigation techniques?

IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks. What are some examples of risks and mitigations? For example, ...
11
votes
2answers
2k views

What asymetric scheme provides the shortest signature, while being secure?

I've had a look at several signature schemes (DSA, ECDSA for the most common ones), and am wondering about whether there exist a scheme that would have the following properties : Be asymmetric (one ...
1
vote
1answer
3k views

Can I use any ssl certificate to sign and encrypt AS2 message?

I'm absolutely new to this topic of ssl certificates, so please be patient with me. My task is to install an AS2 communication with some business partner. Therefore we need message signing and ...
2
votes
4answers
2k views

Is it safer to design websites and servers with HTML5 rather than flash?

I run a small business, designing and building websites. Currently our websites we build use Adobe Flash. We are thinking about migrating to HTML 5, are there any security advantages in doing such a ...
5
votes
1answer
15k views

How does DHE-RSA-AES256-SHA compare to RC4 as the Cipher for SSL?

I read a lot of issue [1] currently stating that RC4 is broken and is at risk. I just checked my web server (nginx) and it is using the default settings, which is DHE-RSA-AES256-SHA How does this ...
3
votes
1answer
413 views

How can one recover from the Yahoo! XSS attack?

Many Yahoo!/SBC Global email accounts have been hijacked via an infamous XSS attack. The accounts are often used to send spam to random members of the user's personal address book. The spam often ...
8
votes
6answers
2k views

Using linux to combat windows flash drive malware?

I just put an old flash drive which i used with a windows machine into my linux. I noticed many files, mostly exes which were never visible in windows (my windows does not hide hidden files and ...
2
votes
1answer
2k views

How to determine source of e-mail and verify if the source is/could be legitimate?

I got an e-mail (in my spam folder) from usercenter@idcenter.uc.cn which asks me to click a link to validate my login for their website. Obviously, I deleted this e-mail without clicking it's link. ...
3
votes
1answer
1k views

When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?

When displaying a page with content only logged in users should see, I simply check if(isset($_SESSION['hasLoggedIn'])) { //show content } else { echo 'you must log in'; } In this article it ...
3
votes
2answers
121 views

Authorising use of apps from a public store with no back end service

I have a project I'm involved in which needs to distribute a mobile app to a specific audience. Due to regulatory restrictions in the target market, only this audience is allowed to access the data ...
1
vote
2answers
867 views

Spike in TCP port 5904 activity - what for?

There is an 'Internet Weather Report' on the Threat!Traq video blog by AT&T security researchers. In the March 14th broadcast, at around 31 minutes in, they mention an increase of scanning ...
1
vote
1answer
2k views

Brute Forcing Domain Controller

I have a MS-Server2K3 domain controller that also serves as a Exchange server. Due to recent network speed loss and issues I began looking at event logs and noticed an exceptionally large number of ...
2
votes
2answers
543 views

How to guarantee counter synchronisation between client and server for counter in hmac-based one time password implementation?

This is a clone of a question I posted on Stack Exchange. Thought I might catch the eye of some different people who could help here. We are trying to implement a hmac-based one time password ...
-3
votes
2answers
536 views

How do cellphones discover wireless APs? [closed]

I'm trying to find some information on how cellphones discover which wireless networks are in range? Is it via ARP or DHCP discover? Also how often does a cellphone do this polling? I can't find any ...
2
votes
2answers
1k views

Protection against screenshot key loggers [duplicate]

I was thinking of creating an on-screen keyboard to protect against keyloggers. The main problem is that I have found that there is a category of keloggers, called screenshot key loggers, which are ...
7
votes
8answers
1k views

How easy is it to find a password in a huge text file?

Say that my password is PASSWORD1 I have a 10MB jumbled text file. I hide my password in two parts in the text, between > and < so I can find it myself. Then I put the 2 parts together and add the ...
4
votes
2answers
238 views

Incident Reporting or Notification Policy domain?

I'm writing a company policy on how employees should handle reports of information security related events and notifications that come from vendors, customers, and from people within our organization. ...
5
votes
5answers
1k views

Does using ssl matter if I am connected using a VPN? [duplicate]

Say I have an internal server that I am using for source control. If I only access that server through a VPN connection, do I still need to have SSL setup on the source control server to ensure that ...
1
vote
1answer
475 views

is pkcs#7 suitable for signing and encrypting zip files?

I'm looking to protect zip files that I will be regularly sending to a 3rd party. I need to ensure strong confidentiality and non-repudation. I would like signing/encryption to be based on ...
2
votes
1answer
2k views

how to specify pkcs#7 requirements for a third party you are exchanging data with?

I am looking to use PKCS#7 to sign and encrypt data (offline batch data files) that are exchanged with a 3rd party. I need to write an interface specification for the 3rd party so that they can ...
0
votes
3answers
579 views

nmap.online inconsistent results

I recently used nmap online to test my firewall security on the WAN port. I purposely did some port forwarding but received inconsistent results. I opened ports 6881 to 6889 on the firewall and did 2 ...
12
votes
3answers
22k views

Is it possible to execute a php script in an image file? [duplicate]

I have an image upload php website. Users can upload images to my website. A user claims he can hack my website using an uploaded image. I opened all the images that he uploaded to my server with ...
2
votes
1answer
619 views

UUID and Open_id in cookie 'good' enough?

I am using Tomcat 7, jsp to build a small website. I am new to security and it is a school project so using Spring Security is not an option. I am attempting to store UUID and Open_id in the clients ...
2
votes
1answer
154 views

Best practices for setting up client connections to a server with app credentials

The question title is... ugly to say the least. Here's an overview of what I've got: I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back. ...
6
votes
2answers
99 views

What information should I provide to a website or organization when notifying them that their domain may be sending out spam?

Over the past few days, I've received several spam emails coming from the addresses of a school district. I don't know much about email message headers, but since they contain numerous references like ...
2
votes
1answer
1k views

How does Binding Images with Malicious Patches happen?

Well I don't know if this technique is still used, but about 5-7 years ago it was a popular way to deliver a malicious patch (Sub-7 , bifrost etc ..) to a victim. There used to be a program that ...
0
votes
1answer
232 views

Setting up two way SSL

I am trying to setup two way SSL to communicate with partner web service. I understand I have to provide server certificate on client side. However, questions are: Is self signed certificate okay? ...
6
votes
1answer
1k views

Reducing password length with hash function

Suppose I would like to use a very long string as a password. As an example we can just say this string is 100 characters in length. However, suppose the application for which I would like to use ...
4
votes
3answers
596 views

What type of PCI Compliance do I need if I don't hold any card data

I am working with a company that is "PCI Compliant" and in order for them to give me any of their data (customer name, email) they ask that I be "PCI Compliant" even though this data is not credit ...
25
votes
3answers
3k views

Migrating GPG master keys as subkeys to new master key

Currently I have 3 private GPG pairs which are all master keys. I want to convert these keys into subkeys for a new key pair (and keep that in the vault). I have read the following thread ...
2
votes
3answers
542 views

Is there an anti-proxy detection available?

Sites like Wikipedia and Google (among others) don't let you sign up through a proxy or TOR (at least with Google, you have to provide SMS verification if you sign up through proxy.) Somehow they ...
26
votes
6answers
15k views

How do I safely inspect a suspicious email attachment?

I received a pretty blatantly spammy email to my Gmail account. I'm not really sure how it made it through the spam filters, since it has all of the telltale signs. The FROM field is spoofed as ...
161
votes
12answers
41k views

How is an ATM secure?

I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since ...
4
votes
3answers
2k views

JInitiator is obsolete and I should reject it on grounds of security, right?

I'm getting a lot of flack and resistance from developers for not allowing a large (200+ users) roll-out of Oracle's JInitiator (http://www.oracle.com/technetwork/testcontent/jinit-084453.html) as ...
6
votes
4answers
7k views

Why do APIs use API Keys instead of Usernames?

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
14
votes
5answers
1k views

Is a VM only as secure as its host?

Question If one installs a VM with "high security" on a host machine with "low security", will the VM be only as secure as the machine it's installed on, or will the high-security aspects from the VM ...
6
votes
2answers
6k views

How can I prevent people from duplicating my barcodes [duplicate]

I would like to manage my inventory using a barcode system, but I am afraid that people will be able to scan or copy my barcode and make duplicates. I would like to offer a discount card that has a ...
7
votes
5answers
676 views

Is it safer to compile open source code vs simply running the binary?

I understand that with OpenSource software, my milage may vary based on the trust of the author and the distribution platform they use (Codeplex, Git, or private server). Oftentimes a FOSS website ...
2
votes
2answers
673 views

7zip AES encrypted archive, padding oracle attack

I created an encrypted but forgot the password. When I attempted a pattern based brute force it said it had over a 100 trillion passwords to check. And to my knowledge that could take a few years. ...
5
votes
1answer
402 views

Is it safe to abandon a free webmail account that has been in use for a significant amount of time?

I have a free webmail account that I have been using for around ten years now. Over the past two years I have almost phased out using this address. I have concerns around accounts that I may have ...
-2
votes
2answers
870 views

Evaluating candidates for Hacker/Pen Test Positions [closed]

If I need to employ Penetration Testers, what are the procedures to follow and how to examine candidates to know their skills and qualifications. Also, I need to know what are the ...

15 30 50 per page