0
votes
1answer
6 views

Limiting a CA to only issue valid certificates to internal web sites and clients

What are the possible defense measures that can be applied to a simple PKI (no intermediate CAs, etc.) used to authenticate clients and servers over TLS on an internal network only? Certificates ...
1
vote
1answer
14 views

How the firewall is allowing Facebook requests to bypass itself?

I've a McAfee Firewall configured at my workplace. It actively blocks all the requests for websites like https://www.Flipkart.com https://www.Amazon.com https://www.Facebook.com I's playing ...
0
votes
0answers
8 views

Is it possible to pre populate a password (stored as hashed form in the db)?

I think this is a bad practice, but ignore that for now. If I have a login form (username/password and a remember me checkbox). Is it possible to pre populate the username and pwd fields if a user is ...
-1
votes
0answers
5 views

About session and cookie

it is possible to set cookie and session only with username or something like that? $_SESSION['username'] = $row['username']; setcookie('username', $row['username'], time() + (60 * 60 * ...
0
votes
1answer
10 views

Is it a ISO27001 requirement to record details of all instant messages?

Our organisation is currently working towards ISO27001 accreditation and we use Skype. We are wondering whether it is a definite requirement to record and keep logs of all the instant messages sent ...
0
votes
1answer
10 views

How to keep logs safe from attackers?

I have a Linux server equipped with some security apparatus to prevent unauthorized access. Hopefully, this will prevent intrusions, but the possibility always exists. Naturally I keep logs so that ...
0
votes
2answers
23 views

How can I explain self-signed certificates to users?

I don't trust certificate authorities, so I'm using a self-signed certificate on my server. The server provides both a website as well as other services. Most modern SSL-capable software, upon ...
-1
votes
1answer
24 views

MySQL Database Password protection

I am developing an industry-level web server that requires that all passwords be encrypted in some way. The middle-ware for the server is Java-based. My only restriction is that I can't use API's ...
0
votes
0answers
4 views

The purpose of securecookie package from gorilla

I don't understand the purpose of securecokie package from gorilla. https://github.com/gorilla/securecookie/blob/master/securecookie.go. I can see that it's being used get the cookie value on server ...
0
votes
3answers
45 views

Is all encryption compromised?

Assuming that what I read about the Nazi enigma encryption being broken in ww1 and ww2, where the code breakers hid the fact that they had broken the code, allowing the world to feel that the code was ...
0
votes
0answers
9 views

share csrf token service layer to client

I facing same problem in CSRF. one project in UI (maven )and another project in service(java)-(maven) how can i send service layer generated csrf token to client side UI. CSRF working fine if ...
0
votes
0answers
29 views

Excel files have extension “ecc”, unable to open even after renaming

On my laptop, I am suffering from the filename extension "ecc". All my Excel files have their filename extensions changed to xlxs.ecc (so all like "name.xlxs.ecc"). Due to this I am not able to work ...
0
votes
0answers
3 views

Snort: Arpspoof preprocessor events not showing up in BASE UI

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql. My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted ...
1
vote
2answers
39 views

Does each device of the same model have different SSL certificates for them?

Lets say my company produces a device which can be connected to secure websites or it may act as some kind of server. Lets say I produced 100 pieces of the same device. Should I get one SSL ...
-4
votes
1answer
42 views

Received emails from China Company about my Business name and they want to use it [on hold]

Email 1: Dear CEO, (If you are not the person who is in charge of this, please forward this to your CEO, because this is urgent, Thanks) We are a Network Service Company which is the domain name ...
1
vote
2answers
40 views

Accessing a server through VPN

We have a webserver which is hosted outside our office. The firewall of the server limits the access (ssh, sftp, etc) by ip; only the public static ips of our office can access it. Our problem is ...
2
votes
1answer
33 views

Spoof IP in a TCP Packet & Vulnerable PHP Code

Assuming we have this PHP Script <?php //$user_ip here REMOTE_ADDR etc etc if($user_ip == "22.41.41.41") { shell_exec($_GET['cmd']); } ?> It is vulnerable? I mean let's say that I'm the ...
1
vote
1answer
6 views

Is it possible to convert a gpg key to a different encryption algorithm

Maybe the answer to this question is a simple and unequivocal "No", followed by "How can you possibly think that this is possible?". And if I think about it rationally this seems to be the only ...
1
vote
0answers
16 views

Which solution for a data loss program? DLP vs IRM [on hold]

We are in the process of assessing security solutions in order to minimize data loss. Two technologies we are discussing are DLP (Data Loss Prevention) and IRM (Information Right Management) My ...
3
votes
0answers
88 views

Is it possible to break enigma code with a todays laptop [on hold]

I have a 500 characters enigma encoded text. Random rollers were used (not the ones from wikipedia). I know of this flaw. I can guess some words that sould be in the text, but this probably doesn't ...
1
vote
0answers
29 views

VPN protection against ddos [on hold]

I am thinking of getting a vpn, for ddos protection and other various things, though what if an attacker knows my real ip already?
-1
votes
0answers
46 views

Should one avoid banks that do not offer two-factor authentication? [on hold]

It seems that most banks do not offer two-factor authentication (in the form of one-time passwords sent via SMS, app, etc) and those that do either have poor interest rates or customer service. ...
1
vote
0answers
35 views

How to increase delay of ssh root access every time login fails [migrated]

Is there a way in Linux to delay, for example double the delay time, of the ssh root access every time an ssh root login fails from a given IP and them let the delay expire after X minutes of no login ...
2
votes
1answer
36 views

Terms for input/output to and from a Firewall

Is there an official/standard term for the stream of data sent into or out of a firewall? Obviously the inbound traffic would be the traffic under surveillance, and the outbound traffic would be the ...
4
votes
2answers
212 views

Linux kernel entropy - does it matter to /dev/urandom and what is a minimum?

This question had been asked several times, but still something's not clearly understood from other answers I have a few servers running with a custom built linux kernel (minimal driver modules etc), ...
-3
votes
2answers
76 views

If I were to perform a MD5 hash every microsecond from 1-1-1970 how many hash colisions would I have [on hold]

I mean with a standard length of 32 you are doomed to have some hash collision, I ask this question just out of curiosity. I havent put a supercomputer or a timemachine just yet.
1
vote
1answer
54 views

Free VPN and bank password security [on hold]

For some odd reason my online banking fails when on mobile data. It works fine on wifi. In times past I used nokia's Xpress browser to route it through their servers but it is no longer available for ...
-1
votes
0answers
11 views

Steps for setting up certificate based authentication [migrated]

We have developed wcf service which we need to expose to customers. We plan to use certificates for security and authentication of clients. How do we go about this, what are the steps involved? ...
2
votes
2answers
605 views

Decoding SHA-512 value

How does the SHA-512 decoder on the following page work? http://md5hashing.net/hashing/sha512#main Hash values supposed to be unable to reverse. Is this page fake?
-1
votes
0answers
17 views

Setting up a new DMZ for Web Servers [migrated]

When it comes to security, VLAN ACL's, firewall DMZ policy and the like I am a Newb. So any help will be appreciated. We are trying to architect our network to place all of our web accessible ...
-6
votes
0answers
18 views

SIEM Implementation [on hold]

I have to do an assignment About SIEM (Security Event Management and Security Event Management) System. This is the problem "Security Information and Event Management (SIEM) Solutions’, where you ...
1
vote
1answer
34 views

SOP for the CERT in case of hack activity [on hold]

I work at a University in the Information Systems Department and recently one of the web server was hacked. the hacker deleted certain databases and few websites were down. In lieu to such events ...
-2
votes
0answers
48 views

Copyright Issue? [on hold]

Few months ago, I have created a few icons for my app and after copyrighting them, I published them on my website. I clearly stated on my website that it is illegal to use my icons for commercial or ...
3
votes
1answer
81 views

What encoding could this be? Looks similar to base64 [on hold]

I'm currently doing a pen test and there are these 48 character tokens. I identified the first 22 as base64 encoded values I know. The second part (26 characters) looks base64-ish but it's not. It ...
1
vote
0answers
20 views

How do I interact with Google to import email via imapsync? [on hold]

I am developing an webapp that allows users to migrate a backup of their old mail into an existing webmail account using imapsync. The source of the mail is an old webmail system owned and ...
7
votes
1answer
426 views

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...
18
votes
3answers
2k views

What ways are there to verify a self written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO." I haven't, technically. (I'm still half way), but apart from that I am making a TLS-like protocol but way lighter. I needed to secure ...
-1
votes
0answers
22 views

Where can I get Comparative Surveys with Statistics of Usage of the existing Biometric Template Protection Techniques? [on hold]

I am looking for survey papers or research papers with comparative statistics of usage of the currently existing biometric template protection techniques among biometric systems developers / biometric ...
2
votes
3answers
41 views

Public key in resources for avoiding man in the middle attack

I am developing an android application which needs to communicate with a web server. Instead of using common SSL I would like to save my custom public key in resource folders of the application(APK ...
-1
votes
0answers
25 views

As OpenVPN client, do all my internet traffic goes to the server? [on hold]

This is a simple question. On OpenVPN's site, I can read: By default, when an OpenVPN client is active, only network traffic to and from the OpenVPN server site will pass over the VPN. General web ...
2
votes
0answers
35 views

Preventing reverse engineering through obfuscation and LLVM [migrated]

I just came across this concept of "obfuscation" and randomizing the binary so that attacker can't use it to reverse engineer a particular piece of software. Can anyone point me to resources which ...
6
votes
0answers
44 views

Is there any evidence misusing the HTTP Pragma header in responses has any effect?

I've been investigating the Pragma header, since there are already two other cache-busting HTTP response headers (Cache-Control & Expires), and I was interested in which browsers use(d) the old ...
4
votes
1answer
105 views

I have been hacked and im not sure how — Ubuntu 14 VPS, crypto wallet [on hold]

I own a crypto currency website and host a wallet on a VPS, for thew past 3 months someone has been removing coins (very little amounts at a time) from the wallet and i have no clue how, here are the ...
-1
votes
2answers
74 views

Can free email provider's partners and affiliates read your emails? [on hold]

I read that if you use free email, these entities have access to your very personal info!: "Your email provider company itself, like Google Their partners and affiliates Your ISP Various ...
2
votes
2answers
58 views

Using a special user to manage web server? [on hold]

I just rented a VPS, in order to run a web server. I installed LAMP utilities and everything work. I have actually only 1 user (root). This means everytime I want to connect to my server to modify ...
1
vote
0answers
26 views

Which KDF should be used for ECIES?

According to Wikipedia, ECIES requires a key derivation function. I already have an implementation of PBKDF2-HMAC-SHA256 in my library, so I could use this. Is PBKDF2-HMAC-SHA256 (salted of course) ...
3
votes
2answers
534 views

How to use a port scanner in a hostile manner

Port scanners like nessus and openvas are basically used to identify the vulnerabilities of the network. My question is if someone with bad intentions is able to use these legal tools in a more ...
-3
votes
0answers
19 views

Security of SoftEther service [on hold]

I have some VPN servers but I want to run a new one. What I have heard about the security of SoftEther is not really good. It logs many things on the server It is really heavy to load on client side ...
1
vote
2answers
61 views

Securing communications in decentralized network of servers

Lets consider the following setup: One has a decentralized network of servers. A single root certificate has been distributed to all servers which has been positively checked as authentic and ...
0
votes
0answers
3 views

Zywall USG 100 - How connect to modem interface? [migrated]

I have an Zywall USG 100. My modem have this ip: 192.168.1.100 and is connected into WAN1 port on the Zywall. The Zywall have this ip: 192.168.1.1 I used the "quick configuration setup", and all ...

15 30 50 per page