0
votes
5answers
1k views

What if I develop my own hash algorithm to create strong passwords from easy ones?

I came up with this idea but I cant figure out if it's good or bad, maybe you can help. My goal is: I want to create extremely strong passwords for my main accounts (gmail, skype and so on). I want to ...
0
votes
2answers
279 views

Is this hash function safe?

Below is the hash function implementation of the roguewave library. It returns a 32 bit hash. The core operation is A = B ^ ((C << 5) | (C >> 27)). Is this hash safe to use as a password check ...
0
votes
2answers
483 views

What current algorithms are considered (un)secure? [closed]

With the new release of Windows 10, Microsoft has given .NET, Javascript and C++ developers a whole new bunch of options for cryptographic algorithms. Where as the old .NET code only allowed AES and ...
0
votes
3answers
356 views

Sending database name in request headers

I am doing a project with an architecture of single server and multiple database. Every client request will contain a header containing database name that this request should connect. Is this a good ...
0
votes
2answers
186 views

Why should one bother encrypting the harddisk in linux if one can easily recover the root password?

If you have physical access to a machine, it's pretty straightforward to recover the root password thereby skipping the whole point of having an encrypted drive. Am I missing something here? EDIT: ...
0
votes
6answers
300 views

Why does everyone require certain password characters now? [closed]

I understand that passwords with varying cases (upper and lower) as well as numbers and special characters are much "stronger" and harder to crack than those that are short and all lowercase or ...
0
votes
4answers
179 views

Control over IT security

In pharmacy the safety of drugs is under fairly tight control by national authorities, e.g. FDA in US. The risks of patients taking drugs are thus very effectively minimized, though understandably ...
0
votes
2answers
439 views

Can a man engaged in phishing be prosecuted if I know his IP?

My familiar received some emails from a man she meets at dating site. The man sent her his photos by email. In them he made some attempts that looked like phishing so I decided to lookup more ...
0
votes
3answers
721 views

How strong is a simple XOR encryption with random IV?

I'd like to implement some kind of simple (yet as strong as possible) encryption for my client-server application network traffic. Data to be encrypted can be both textual, and binary. Now I'm ...
0
votes
3answers
6k views

Password protected zip opened in notepad

I have two password protected zip(COmpression method: normal) file with the same content(aaa.txt(blank notepad)) and I opened the zips and this came up. First one's password is: abcd PK Rd¦D ...
0
votes
2answers
539 views

Tools to extract code comments from sites? [closed]

I often come across sites that have way to many comments included in their source code, sometimes these comments offer valuable insight into whats happening in the code, the logic of functions, unused ...
0
votes
3answers
189 views

Why does an overload of requests give one root access all of a sudden?

There's this saying that using a DDOS-attack, people first attack a server using millions of concurrent requests and by doing that they miraculously gain access to the server. How does this work? Why ...
0
votes
2answers
141 views

Hiding (Obfuscating) Java script [closed]

So i heard that obfuscating java script is useless and waste of time because anyone with a little of skill can decode your code. So i want to test that. This code will display a alert box saying hey ...
0
votes
2answers
11k views

Why don't mobile operators blacklist stolen phones using their IMEI?

I've just read this piece of news that Android and Windows phones will get a 'killswitch', rendering them useless to potential thieves. However, since all devices have a unique identification number ...
0
votes
3answers
818 views

Protecting data through an XOR operation with sufficiently long keys

Suppose two parties S and D would like to protect a communication channel. Therefore, S and D exchange two sufficiently long key sequences SB und DB of random bits over a secure channel [e.g not over ...
0
votes
3answers
3k views

Dropbox vulnerability details [closed]

Dropbox (the online cloud storage provider) was recently in the news for some security and privacy vulnerabilities. What was the problem, and what has been done to resolve it?
0
votes
3answers
84 views

How many backups should I keep?

Recently my backup disk almost got full because of all the backups we keep: 30 days of daily backups for every database (mongodb). So, the more databases we have, the more space we need for backups. ...
0
votes
3answers
285 views

What can I do to rely less on certificate authorities?

I never trusted and liked CA's and in fact I removed a lot of them from my devices. But now after this question I'm wondering if I should generate my own certificates for the sites I care (e.g, like ...
0
votes
2answers
431 views

Storing multiple hashes to prevent collisions, security risk?

This is all just for curiosity's sake, so discussion on which hashing algorithm is harder/better/faster/stronger is irrelevant. But my question/thought is this.. With regards to password storage, and ...
0
votes
3answers
186 views

How secure would this method be considered for password storage

Ok I am currently storing the passwords in most secure way I could think of. With use of Encryption and Hash. The passwords are first generated by user as plain-text with minimum length of 6 ...
0
votes
2answers
793 views

Is Google Drive security compromised?

Today when I visited drive.google.com, I was auto-directed to http://drive.googe.com/router.php After clicking on "Exit Now" on that page I was redirected to ...
0
votes
3answers
621 views

Is all RSA encryption now considered insecure? (Notably SSH and SSL)

Some of the leaks which emerged during/after Snowden concerned the fact that the NSA was paying the organization behind RSA a lot of money in order for them to systematically weaken the encryption by ...
0
votes
5answers
1k views

How a DOS TCP packet different from normal Packet?

a normal tcp packet shown in figure How a TCP packet that causes dos attack different from normal Tcp Packet?
0
votes
4answers
3k views

Brute forcing ssh keys

My problem is a common one: I deleted my SSH key, and forgot to set rm to point to a .trash file. I have the public key, and I need to get in this server. I am not doing this on anyone else's server. ...
0
votes
3answers
150 views

Why is UDP port scanning slower than TCP port scanning?

I can't seem to find an answer for this. Any suggestions?
0
votes
3answers
197 views

Best practice of Secret Question/Answer

I'm building a web application and I'm actually writing a code that allows users to choose their secret question and answer used to identify them if they forget their passwords. I'm a little bit ...
0
votes
1answer
243 views

Please help me understand this PHP hack [duplicate]

We have found this on a hacked PHP webserver. It was in a single file. This file was included from somewhere else with @require. That's what we know: This site is running PHP 5.3 The site had ...
0
votes
3answers
108 views

Why are websites obviously run for nefarious reasons not taken offline asap?

Although the question has a much broader scope an example case is my posted question: Should I worry if I have tried to ssh into a 'fake' dyndns.org site? (with ssh keys) In summary the ...
0
votes
4answers
191 views

Corporate PKI - is it an enterprise standard?

I've heard from one person that companies often issue own certificate for their internal usage. It's not signed by any public CA. And he says that it's an enterprise standard. I couldn't find any ...
0
votes
2answers
477 views

Are passwords in Mozilla products stored insecurely?

I have just downloaded a Polish program Passtool Password Reader (written by Rafał Jelitto), unpacked it from .rar archive and run it. I have hit the bottom-left button (Pokaż wszystko) and this small ...
0
votes
2answers
187 views

Is my hashing function good enough

Is there an obvious flaw with this hashing function (written in PHP)? function hash($password) { sleep(1); // Make hashing slow $hash = ""; $iterations = strlen($password); for ( $i = 0; $i ...
0
votes
4answers
259 views

How safe is it to use older/unknown Encryption methods for plaintext?

When mailing or chatting with people, it had crossed my mind, what if, for simple communication, someone would use an older encryption method (i.e., ENIGMA), to encrypt their message? Would because ...
0
votes
4answers
976 views

How can i protect myself from tor vulnerability on windows

Recently I came across an article regarding Tor. According to article there is speculation that the uncovered malware was used by a law enforcement agency to harvest the IP addresses of users ...
0
votes
3answers
749 views

Is using a numbers station to transmit a one-time-pad as key actually insecure?

We all know the two most important problems related to a “one-time-pad”: The one-time-pad needs to be truly random (which I think is logic, as pseudo random generators are quick but predictable). ...
0
votes
2answers
975 views

Keeping the password secret over regular http

I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
0
votes
4answers
2k views

A faster method than Blind SQL Injection?

Blind SQL Injection is based on TRUE/FALSE tests. Here is an example: is first letter A? --> NO is first letter B? --> YES is second letter A? --> NO ... is last letter X? --> YES It's ...
0
votes
2answers
123 views

RSA: Do private keys have to be private?

I was thinking about using RSA, but in reverse. Where everyone has the private key, and only the server has the public key, so that all the clients can decrypt a message from the server, and the only ...
0
votes
2answers
171 views

Firewall tiered architecture and firewall brands in today's context

In the past, we were often taught that we should have at least two layers of firewalls and it was best to use different brands so that at least it would make it more difficult for hackers to ...
0
votes
2answers
455 views

Why would Gmail ask for the last password I remember? [closed]

Yesterday I tried to recover the password for a Gmail account that I have created few months ago and during the process it asked me for the last password I remember. Why would it ask for that? I'm ...
0
votes
3answers
4k views

Is JavaScript malware as dangerous as native viruses? [closed]

Can JavaScript malware be as dangerous and damaging as more traditional viruses that are programmed mostly in native APIs?
0
votes
3answers
6k views

Can you write OS-related virus using high level languages like Python

It is a well known fact that OS-related viruses are commonly written in low level languages like C or C++ which require direct access to the kernel of the CPU , I am just wondering if its possible ...
0
votes
1answer
867 views

Is this password hashing + salt method the most secure way possible? [duplicate]

I am just wondering what all the security experts think of my method for password hashing. I want to come up with a method I can use for all my future web development projects. First I create a ...
0
votes
2answers
235 views

Is my domain registrar storing my password in cleartext? [closed]

I called my domain registrar (unnamed here but not difficult to find out and a major provider) about a year ago to have them change some DNS settings. While on the phone, the customer service rep had ...
0
votes
1answer
2k views

Why aren't sophisticated Malware written with .NET [closed]

I've been trying to research malware techniques lately, as malware analysis intrigues me. I've got a pretty heavy background in .NET, and based on my 7+ years in .NET, I feel that I could write a ...
0
votes
3answers
292 views

Make the public key unrecoverable given the private key

OpenSSL seems to bundle the private key together with the public key when it produces .pem files. Is there a way to prevent this from happening; i.e. prevent OpenSSL from creating a .pem private key ...
0
votes
4answers
1k views

Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?

I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
0
votes
1answer
397 views

How does a Web Security Gateway analyse SSL Encrypted Traffic?

Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
0
votes
3answers
788 views

SQL injection explanation

I just found in logs that someone try to exectue this SQL injection ...
0
votes
2answers
120 views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
0
votes
4answers
230 views

VM Kali Linux - nmap why is so slow? [closed]

I was scanning an IP using this command: nmap -sT -p- -Pn <Ip_Address>, but is very slow scanning. To reach 100%, the command line said 3 hours remaining. Why is it so slow?

15 30 50 per page