9
votes
5answers
12k views

How is Facebook locating me when I use a VPN?

I am using a private VPN network for my internet connection. But it seems that if I go to http://m.facebook.com and try to check in, Facebook sees my location properly. My IP address seems to be from ...
7
votes
5answers
3k views

How unlikely is it that a Google Doc link is guessed?

Most (if not all) of us know that a Google Doc link looks something like this: https://docs.google.com/document/d/13P3p5bA3lslqEJT1BGeTL1L5ZrQq_fSov_56jT9vf0I/edit There are becoming several tools ...
2
votes
4answers
2k views

SSH: reusing public keys and known-man-in-the-middle

Usually, people recommend to use a single private-public key pair everywhere (if we're not talking about a possibility of compromising the private key): Best Practice: “One per-user ssh key” or ...
7
votes
3answers
5k views

Is it necessary to setup a firewall in both PC and router?

If I have the router firewall enabled, is it really necessary to setup iptables in my system? Isn't it a little redundant? For example I add a rule in the router where the PC can't use the port ...
11
votes
4answers
13k views

How secure is the new Mega-site encryption?

The new Mega site, sucessor of Megaupload, claims that all information is encrypted with a symetric key that only the user has access. The general terms are listed here: All files stored on MEGA ...
0
votes
3answers
250 views

Maintain sensitive key between requests

EDIT: Reworked question. Previous version too poorly asked. On my website users write sensitive messages that must be kept secret. The entire user area is over SSL, so the communication between user ...
0
votes
2answers
2k views

Msf and exploitdb on Backtrack 5

Metasploit (msf) doesn't see exploits from exploitdb. I've just updated directory on my Backtrack cd /pentest/exploits/exploitdb svn update How can I load them now into msf? When i use a script ...
4
votes
1answer
603 views

How dangerous is a virus introduced to a malicious website in chrome?

I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing. If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started ...
54
votes
2answers
126k views

Difference between .pfx and .cert certificates

What is the difference between .pfx and .cert certificate files? Do we distribute .pfx or .cert for client authentication?
3
votes
2answers
382 views

Is a random keyfile more secure than a derived key?

I'm devising an encryption layer for some proprietary cloud storage API. Basically this should act as a transparent adapter that encrypts whole binary blobs (files) on upload and decrypts them on ...
2
votes
0answers
766 views

SSL Certificate Authentication Issue 403.7 [closed]

I have been trying to configure SSL for authentication and was unable to resolve this error 403.7 on IIS 7.5 windows 2008r2 vps server. I would like to give access to few computers where client ...
0
votes
1answer
252 views

Tracking information on HTTPS connection

My organization uses cyberoam firewall. They are monitoring all activities including my search text in Google, Wikipedia etc. So recently i changed to HTTPS versions and now using HTTPS connections of ...
5
votes
5answers
941 views

When hashing passwords, is it okay to store the algorithm used right there in the database?

Since hashing password has become a hot topic recently, it is only natural to expect things to change and assume that some time down the road you might want to replace/tweak the algorithm used in your ...
0
votes
1answer
1k views

Is TLS secure when full eavesdropping on the network occurs? [duplicate]

Possible Duplicate: How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it? Alice connects to Bob's site via a TLS secured connection ...
4
votes
2answers
4k views

How is it possible that a virus can infect the system if the browser is started with non-admin rights

If I open my web browser (for example firefox) in Windows 7 with activated UAC as normal user (non admin) a virus - which uses a security leak in my browser - will only gets privileges of the normal ...
1
vote
1answer
688 views

Is suspicious network activity likely to be caused by a rootkit?

Netstat has been one of my favorite tools to check out possible malicious connections, but then I heard about the dangers of rootkits and their high complexity, allowing them to be able to bypass ...
15
votes
4answers
2k views

Attract Brute Force SSH Attacks

I posted a question on Server Fault, but got downvoted and had the question closed. One of the comments suggested looking over here, so here goes: For my senior project, I'm working on an ...
3
votes
3answers
626 views

How hard it would be to infect a system with malware through a portable web browser

If I use a portable web browser on a USB device like Google Chrome Portable how hard it would be to get infected by a malware/virus in the system to which the USB device is connected? Google Chrome ...
1
vote
1answer
118 views

Guidelines on out-of-band server management via integrated Lights-out services (iLO, iDRAC etc.)

Several CVEs (CVE-2012-3271, CVE-2011-4158, and earlier) point out vulnerabilities in remote server administration firmware; what are the guidelines on hardening this extremely useful component of ...
4
votes
4answers
8k views

how safe is a home NAS with ssh access?

I'm thinking about acquiring a NAS from Synology (or QNap), these are pretty cool NAS and do much more than just storing files. Some extras include: ssh, ftp, telnet, mail servers photo gallery ...
26
votes
5answers
11k views

Comparsion Between AppArmor and Selinux

I was reviewing several different comparison of AppArmor and Selinux which include Why I Like AppArmor More Than SELinux SELinux and AppArmor: An Introductory Comparison From these articles I ...
-1
votes
1answer
132 views

GnuPG implementations are not cross-compatible? [closed]

Let's say I made my private key using Enigmail. Then I imported it into a Windows program called GPG4USB. When I want to decrypt a message it asks for my encryption password but it doesn't accept the ...
44
votes
5answers
51k views

Is 7-Zip's AES encryption just as secure as TrueCrypt's version?

The main difference being TrueCrypt creates containers and 7-Zip encrypts the file itself, so file sizes can be guessed. Now let's just talk about the strength and breakability of the encryption. ...
1
vote
2answers
348 views

Linux kernel 3.2 syscalls

Just trying to get the assembler instructions for <__execve> of the code below because i want to build the shell spawn opcode list: #include <stdio.h> int main() { char *happy[2]; ...
0
votes
2answers
2k views

Can my ISP know my passwords

If I am using some proxy service, proxy service provider can know my passwords to my online accounts. In which case my ISP can filter my requests and get my passwords to my online accounts? And how ...
3
votes
1answer
244 views

Is this acceptable login security?

I was logging into a VM on a computer at work. The VM was Linux Debian 2.30.2. I discovered that I could input my password, followed by garbage, and it would be accepted. How is this considered ...
23
votes
1answer
6k views

What are darknets, and how can they be used to provide security and anonymity in network communication?

One of the major problems with the internet is that it's difficult to stay anonymous while retaining the ability to communicate with a large number of people. While encryption can be done effectively ...
7
votes
3answers
730 views

Is it a good idea to have a “master” password?

Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
-5
votes
4answers
323 views

Law & Ethics - I'm not be breaking the law its the computer [closed]

So it would be illegal to run a metasploit attack against a computer you don't have permission to do so against, right? But what if I configure a web server to nmap scan, then metasploit attack ...
2
votes
1answer
2k views

Why is windows considered insecure? [duplicate]

Possible Duplicate: Linux or Windows- the security issue I often see people complaining that Windows is "highly insecure" while linux is MUCH more secure. What exactly are the ...
10
votes
5answers
3k views

Swap file may contain sensitive data

Is it possible that the swap file will contain chunks of data by a file you have accessed, and could this be detected during a forensics analysis? How could you prevent this situation ? Is using ...
0
votes
3answers
617 views

Backup TrueCrypt hidden volume [closed]

I have a usb stick witch is encrypted using truecrypt. How can I back it up? The only method that comes into my mind is making a image of the usb drive and then restore it. But 16 GB I think it will ...
0
votes
3answers
278 views

Using a VM to access internet when malware blocks internet access?

My computer was recently infected by some malware which had blocked internet access. I had a virtualization software with an OS in it. Surprisingly, I could access the internet from the VM. I know ...
0
votes
3answers
962 views

Privacy in torrents?

It seems that if you download a file via torrent, each downloader can see other downloaders IP addresses. I also noticed that my (windows) pc's name was sometimes displayed briefly. How does one keep ...
2
votes
1answer
2k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
-3
votes
1answer
2k views

is there better email, file, disk encryption than PGP? [closed]

Currently, I am using Symantec's PGP desktop whole disk encryption for my Mac. After hearing that FileVault was insecure and supposedly easily crackaable. However, PGP has been around for a long ...
3
votes
3answers
670 views

Java 7u11 - Safer to switch to 6?

Java update 7u11 has made some news lately for a couple reasons. Firstly, it was an out-of-band patch to resolve vulnerabilities being exploited in the wild. Then it came back up because it is now ...
1
vote
1answer
852 views

Protecting peers communicating with WebRTC

For reference: WebRTC Homepage I've been really interested in these new RTC technologies that are coming out, specifically the fact that use the PeerConnection API to establish a connection between ...
1
vote
2answers
1k views

How to generate a highly unpredictable random bytes

void vncRandomBytes(unsigned char *bytes) { int i; unsigned int seed = (unsigned int) time(0) + getpid() + rand(); srand(seed); for (i = 0; i < CHALLENGESIZE; i++) { bytes[i] = (unsigned ...
4
votes
2answers
1k views

ASLR and how a program can actually call its functions

I'm studying protection techniques and I've got a doubt about how ASLR works for a program in a Windows environment. As far as I know ASLR works by randomizing part of the imagebase address when ...
6
votes
1answer
10k views

What is the significance of the version field in a TLS 1.1+ ClientHello message?

I am trying to add TLS 1.1 and 1.2 support to a packet capture product which already has TLS 1.0 support. I have used Wireshark to capture traffic between my browser and an openssl server to generate ...
6
votes
2answers
2k views

Is the use of DSA keys a security risk?

According to the answers on this question the differences between RSA and DSA would seem to be trivial. However, according to this page DSA compromises your security if anyone is sniffing your ...
-1
votes
1answer
410 views

how to secure my login user id and passwords specially for facebook [closed]

i think they hack me with facebook cookies. i dont get what exactly is going on with me. every time i get the login notification from another ip location.i want to secure my cookies and i wanted to ...
1
vote
2answers
1k views

HTTP Response Splitting

Is this apart of a HTTP Response Splitting attack ? Here below is some code that gets put into a web browser after clearing the url while on the website javascript: var xhr = new XMLHttpRequest(); ...
0
votes
1answer
386 views

Generating Web Application Security Profile

Currently i have deployed ModSecurity as a reverse proxy for providing application layer security. Now i want to write application specific rules for all the web application i am protecting i.e. ...
-3
votes
3answers
2k views

What's the use of making users use digits, uppercase-lowercase combination password if the passwords are hashed?

Some websites, even the StackOverflow asks for atleast 1 digit, 1 uppercase character in the password. Does this really matter when the developer uses a password-hash algorithm to store the passwords ...
2
votes
2answers
923 views

How does Chat monitor work,if we use encrypted service like gtalk

i have heard that there are software like this http://formessengers.com/mdetect.htm that monitor Chats and can see the chat logs,but how do these kind of software work if we are using services like ...
5
votes
3answers
6k views

How easily could be truecrypt and EFS cracked in this scenario

I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for ...
3
votes
4answers
107 views

What is the technique to determine if a user is “reading” a page called? (similar to “infinite scroll”)

When I read an article at Salon.com I notice that the "overflow content" (where I need to scroll down) is loaded on demand. I can't imagine this being a useful bandwidth savings technique, so the ...
5
votes
3answers
236 views

Defense in depth vs low complexity - Balancing point?

I've asked a few questions relating to schemes for various security-related functions, and posited schemes to accomplish those goals. In the responses, I see a conflict between two fundamental ...

15 30 50 per page