0
votes
0answers
9 views

Hacking iOS in-app purchase

Is it possible to hack iOS in-app purchase if someone know the product identifier with a jailbroken device ? It seems that someone is getting my app in-app purchase items for free. I accdiently put ...
0
votes
0answers
1 view

How to properly secure a resource server, but allow public clients to have access in a machine-machine style without user interaction

My scenario is this, I have my web API that I want to protect from external people, but I want to allow access for my own applications that could be running in windows forms/android/ios/etc... ...
-4
votes
0answers
27 views

coding or any of this is not my thing [on hold]

I have a lot of open source licenses on a public key, I also have a lot of trusted CAs that should not be there. shell is being used Mozilla Thunderbird. Somehow they have made their way into ...
1
vote
1answer
17 views

Android keystore passwords leaked

We develop Android applications and by mistake following strings were sent within custom Android project folder to several clients: keyAlias keyPassword storePassword The .keystore file itself was ...
0
votes
0answers
14 views

How to intercept My own whatsapp traffic using MITM for demo [on hold]

can anyone tell me how i can do MITM with Chat apps such Whatsapp i want to see my own traffic in my own iPhone , and i want to understand how the protocols is passing the traffic , i try to use ...
-3
votes
0answers
23 views

Find a way to crack a pdf password with a specific format [on hold]

I am looking for a way to crack a pdf I've protected with a password years ago. I remember the format "LLFFFFFFL" (L for letter and F for figure). Is there any specific software where I can plug in ...
1
vote
2answers
53 views

Advantages with PIN code authentication where the digits are placed at random positions?

I noticed that a lot of high-risk websites, such as bank and payment platforms, do not use a passwords for authentication (as usual) but instead use a PIN code where the numbers are placed at random ...
0
votes
1answer
15 views

Do I need to use GPG subkeys for my backups?

I'm reading a lot about the need to separate the master key from additional encrypting or signing keys, like these links: GPG subkey layout. Separate keys for C, S and E? ...
-2
votes
0answers
8 views

One WAN connection causing huge data usage on the other WAN port of the router TL-ER6120 [on hold]

We have a TP Link router TL-ER6120 with two WAN ports. We have two ISP broadband connections (with Static IPs) connected to these two WAN ports. We are noticing that when both connections are up, ...
-9
votes
0answers
36 views

Firewalls are not build to protect [on hold]

The advance firewalls are build to protect DOS & DDOS. But the older firewalls are not protect the Dos, Ddos.
0
votes
1answer
33 views

Random IPs in ARP/RARP table with the same mac address?

I was looking at my router settings and saw a bunch of IPs with the same mac address in the ARP/RARP table. The GEOlocation of them all ranges across my country, any ideas to why they are there? ...
-3
votes
0answers
18 views

information about vpn [on hold]

AGR mein aik VPN server k sath connect hun my real ip is 192.168.8.9 and virtual ip is 44.25.453.213 ab agr at same time koi aur bhi ise vpn server k sath connect hai tw uska virtual ip kya aye ga ?
0
votes
0answers
45 views

Is it possible for an attacker to log keystrokes of a bluetooth or wireless keyboard

Bluetooth and wireless keyboards are sending keystrokes wirelessly. Could this mean that an attacker (or spy) can log the keystrokes by monitoring the wireless or Bluetooth radio waves (or whatever)? ...
2
votes
1answer
43 views

Can you trace someone through picture header information?

I learned that jpg, png, bmp and most image files contain headers and plain text in them. I decided to open a jpg file in Notepad and saw a bunch of information and I was wondering if there was a way ...
3
votes
2answers
104 views

Do hackers still use iterative password cracking techniques?

It's World Password Day! Rejoice, for today is the day that all of our friends will change their passwords from abc123 to 123abc!!! While we're on the topic of passwords, one thing websites do to ...
0
votes
0answers
10 views

Is it ok to use one key pair for my authentication endpoint?

I have an web endpoint that checks user passwords, then issues signed JWT tokens to the client if password matches what we have in the database. The JWT is signed with a RSA private key using RS512. ...
0
votes
0answers
11 views

Data integrity and authentication of an Arduino using JSON Web Tokens and HMACs

I have a school project involving an Arduino-based sensor that needs to send sensor readings to a server via HTTP. The sensor readings do not need to be encrypted (it's okay that people know what they ...
-6
votes
0answers
25 views

needing help with a lot of things including GitHub Jason format code pulse someone has hacked my system and all sorts of stuff [on hold]

I know nothing about any of this but I know a lot of stuff is going on they have access to Everything I Do please help but it greatly be appreciated any information at all thank you so much
2
votes
2answers
28 views

Should HSTS header be sent on an error response?

We need to configure our loadbalancer to send the HSTS header and we are debating whether or not to send the header on HTTP 4xx/5xx responses. Our main concern is application layer DDos attacks. We ...
0
votes
0answers
14 views

DVWA hydra brute not matching

I am trying to brute force DVWA on low security. I disabled the first authentification as well. However when I ran my hydra script it doesn't match it with correct password. Here is my query hydra -l ...
0
votes
1answer
46 views

Is a password-protected excel file considered secure versus encrypted file or email

I understand that encryption is the highest form of security for document/data storage. While a password-protected document is more secure than one without password protection, if the document is ...
3
votes
5answers
480 views

How secure is changing or adding a single character in your passphrase?

I'd wager quite a many people are required to periodically change their passwords for certain applications or even at the office. I'd also wager that a large percentage of these people "change" their ...
0
votes
1answer
16 views

Can a 3rd party validate the origin of an HTTPS session?

I'm wondering if HTTPS can be used as proof that a server reported an answer. If I understand correctly, the initial handshake is for HTTPS is the only time that the public/private key of the server ...
0
votes
2answers
111 views

How can you be sure that there is a virus on your computer?

Am I being paranoid? I'm seeing signs of a virus everywhere on my computers but I have no way of being sure. I've tried scanning with Windows Defender multiple times but haven't found anything. My ...
0
votes
1answer
35 views

Getting user to login, then checking if someone is logged in already

I'm horrible at security so I was curious if you guys had any ideas. I recently wrote an application in Python that I will be selling to select people. The information on the application is private ...
2
votes
4answers
525 views

Can malware bridge external storage HW power-off switches?

Right now I have a backup setup which involves a 3.5" external USB-HDD with a seperate power-supply (as is usual for such drives). This HDD is internally a standard SATA HDD with USB+Power wrappers. ...
17
votes
7answers
2k views

Find matching phone numbers without actually knowing them

We have a mobile app that, given two users, needs to let them see what common contacts they have based on their phone numbers. How can we do this in a cryptographically secure way and respecting the ...
1
vote
0answers
29 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
-1
votes
0answers
20 views

I would like information regarding possible security violation [duplicate]

How to figure out if someone has been using TeamViewer 8 to access my computer remotely?
1
vote
1answer
29 views

Using TOTP instead of passwords for IoT device authentication

I am trying to come up with a way to authenticate an IoT device to a server. Since the device is "un-monitored", I cannot expect a user to enter a password on the device whenever the device starts or ...
1
vote
2answers
55 views

Asp.net web forms is not generating a new session id if a user logs out and logs back in

Asp.net web forms is not generating a new session id if a user logs out and logs back in. Is this a major security risk? We're using SSL.
-1
votes
1answer
38 views

Running an app in docker on Windows

If I run an app in a docker container using Kitematic, does that help protect my system from that app? I mean: does it prevent any problems if the app tries to damage the Operating System?
0
votes
2answers
68 views

Obfuscate Identity for Password Reset Information

I am just wondering your opinions on why it would/would not be a good idea to mask or obfuscate email address data in a password reset web submission once the user has entered their username informing ...
0
votes
1answer
66 views

How does a DNS provider provide SSL?

I use CloudFlare as my DNS provider for my domain, and I learned that they provide SSL. I was confused as to how a DNS provider can provide SSL because my communications between the client and my ...
2
votes
0answers
23 views

How can I ensure that phone app traffic is using HTTPS? [duplicate]

When I access a website, I know just by looking at the URL whether it's HTTPS or HTTP. If I'm using an app on my phone, I cannot see this. So if say the app wants me to enter a password in to create ...
0
votes
2answers
69 views

How do data breaches of account login information end up in plaintext?

For example, see this story. Am I missing something here? Are the login details actually still encrypted? I don't understand how it is possible for a data breach of what I assume is encrypted ...
1
vote
1answer
35 views

How can I list all self-signed certificates in my stores on a Windows client?

I'm on a mission to list the self-signed certificates ('issued by' and 'issued to' match) on my machine via an automated method. PowerShell is available for use. Preferably the results would be ...
19
votes
2answers
3k views

Why I am getting Facebook login pop up for every site?

My Chrome browser keeps prompting me for Facebook authentication, even though I have never logged on to Facebook from my PC. I am using Chrome browser from my company where they have a strong proxy ...
0
votes
0answers
7 views

How to configure Tor browser without Vidalia on Mac OS X? [migrated]

I have a problem with finding a configuration file for my downloaded Tor browser bundle (the default installation from project webpage). I want to adjust some advanced settings for my Tor browser, and ...
3
votes
1answer
41 views

How can AES-CBC be used for LUKS encryption, when the ciphertext is not static?

In CBC mode of operation, ciphertext from previous block is used as IV in next block. How then can AES-CBC be used for disk encryption (LUKS), when the data on the disk (ie the ciphertext) keeps ...
2
votes
1answer
37 views

How to detect, inspect and delete a super cookie of a specific website?

Definition of supercookie from the paper I am reading: "Supercookies settle in parts of the system that are harder to erase, and include the usage of Flash Local Shared Objects and IE Local ...
3
votes
0answers
37 views

Is there a place where I can upload my honeypot logs to?

Maybe a weird question but I've had a public facing HTTP/SSH honeypot for a little bit over a year now and was wondering if there was any place that I can upload my logs to? There are a bunch of ...
6
votes
2answers
69 views

Is it possible to disable all PHP functions not used in my application?

I want to secure my PHP installation. I can disable some functions, like system(), exec() etc using disable_functions in php.ini. But I can forget to disable some dangerous functions. Is it possible ...
3
votes
1answer
41 views

Can canvas fingerprinting be prevented?

How can canvas fingerprinting be prevented in web browsers? The site Panopticlick said I had a hash of WebGL fingerprint of 5 bits of entropy. I installed CanvasBlocker addon and tested again and it ...
2
votes
2answers
27 views

Is QUIC (Quick UDP Internet Connections) safe to allow through firewall?

Our firewall currently blocks QUIC (UDP 443) traffic which seems to be enabled by default in Google Chrome. Is it safe to allow QUIC or should I wait until it is implemented in all the major browsers? ...
0
votes
1answer
26 views

How to check if any host trying to connect back to the my executable(application)?

Last month i have downloaded some hacking tools!!! After that i'm having a strong feeling that some host trying to connect back to the application(don't know whether i'm been monitored or not). Is ...
3
votes
2answers
52 views

For high entropy credentials, is SHA256 hashing good enough?

Let's say I've got a database of high-entropy credentials (e.g. 256-bit random values) used as API keys by clients. I'd like to hash them in my database so that a database compromise doesn't allow an ...
2
votes
2answers
120 views

Suspicious Network Activity - is my system compromised?

When using Firefox to open a blank page, I have a weird network connection that shows under Network Activity in Resource Monitor (Windows 7). The address is: insiders-guide.pacedev.com. A ...
1
vote
1answer
20 views

How could you detect and defend against this type of (local) man-in-the-middle attack?

Consider this type of non-standard man-in-the-middle attack, which is fundamentally the same nature of attack without the poisoning phase being required: Someone cuts the internet line at your ...
-2
votes
1answer
22 views

Is it fundamentally possible to prove a current industry standard end-to-end system of secure data storage and transfer?

I know we can design an ultra simple system that is proven to perform one thing with perfect security. We've done that. That's called a proven system, and it has been done with micro-kernels. (An ...

15 30 50 per page