0
votes
2answers
22 views

Does Non Repudiation offer proof of receipt ?

I understand that non repudiation intends to provide a mechanism that reliably proves that the sender of a message cannot deny sending the message. But does it also provide similar mechanisms to ...
2
votes
2answers
54 views

How secure is this method to remember security questions?

So I found an interesting method of remembering those pesky security questions. Basically, the guy takes a hash of the question (IE what is your mother's maiden name?) and then appends his own ...
0
votes
1answer
24 views

Problem with OpenSSL rejecting CA possibly due to 12 digit Serial No

I work as a tester at a VoIP software company. We've been running into a problem with using TLS to communicate with certain phones. The phones are from different manufacturers but both exhibit the ...
1
vote
2answers
53 views

Does WPA2 Enterprise protect against evasdropping from within the network?

At home, I have a simple ISP supplied router where I have set up a WPA2-PSK wireless network for our laptops and other devices. While I played around with Wireshark, I noticed that I could use my ...
1
vote
1answer
55 views

Which one to ask first in multi-factor authentication?

Let's say I have a system which use something you know, like a password, and something you have, like a code sent to a cell phone, to authenticate. Is there a preferred order to ask for the password ...
1
vote
1answer
39 views

Getting null byte injection attacks to work with PHP 5.2.17

I'm trying to understand how null byte injection attacks in PHP code used to work before it was patched in PHP 5.3.4. I have this sample HTML page that is a somewhat modified version of what's shown ...
1
vote
2answers
30 views

How to Secure Exchange 2010 cookie?

We have received the below finding from an IT audit. Missing Secure Attribute in Encrypted Session(SSL) Cookie: It is best business practice that any cookies that sent over (Set-cookie) an ...
0
votes
0answers
32 views

How to use Truecrypt AES keys to decrypt a Truecrypt volume

I am performing a forensics experiment. I have access to a '.mem' memory dump and I am successful in extracting 2 AES keys from the dump. Now I wish to use these AES keys to decrypt a volume encrypted ...
1
vote
1answer
52 views

Shared Key vs Pre-Shared Key

Does Shared key and Pre-shared key mean different thing ? Currently reading Text , Security+ Guide to Network Security Fundamentals.
9
votes
4answers
1k views

Why should I sign data that's already encrypted?

My question is about the difference between signing and encrypting. Why would you still sign something if you are already going to PKI encrypt it? Doesn't the PKI encryption inherently provide ...
4
votes
1answer
99 views

How safe can connecting to VPN really be?

I would like to make this story as short as possible since my question is not that long, I have worked with journalists previously in war zone where we investigated the involvement of EU IT companies ...
2
votes
2answers
70 views

Does a VPN hide what URLs I visit?

It's clear that someone listening on a network could still find out what website I visit over HTTPS (as discussed here) but what about when surfing in a VPN? What exactly can the underlying network ...
-2
votes
0answers
25 views

Others solutions to enumerate vhost for an IP instead of bing

I was using bing to enumerate every vhost entry for a given IP: ip:AA.BB.CC.DD But recent tests do not work, bing seems ti have switched off the funcionnality. What are the (reliable) ways to have ...
0
votes
0answers
16 views

Tool that can only find directory listing vulnerability

Is there are command line tool or online site that checks only the web server directory listing. In nikto there is no specific switch to find out this vulnerability. There are multiple online sites ...
-2
votes
0answers
13 views

.pfx certificate on iphone app on .cer form [on hold]

I am developing an iPhone app, i need to connect to a web service using a certificate, I have a .pfx certificate that I changed into a .cer because the ios system wont work with a pfx on the app ...
3
votes
4answers
176 views

Can firewalls get affected by the traffic they process

Does such attack exist? Forgive my wild imagination but is it possible for a hacker to pretend/try to communicate with a service on the server and when the firewall examines the traffic it get's ...
-1
votes
1answer
21 views

DOM XSS issue in code [on hold]

Is this DOM vulnerable to XSS attacks? var theForm = document.forms['aspnetForm']; if (!theForm) { theForm = document.aspnetForm; } function __doPostBack(eventTarget, eventArgument) { if ...
-3
votes
0answers
15 views

PKCS11 Module problem with hp [on hold]

I am having a weird problem. We have a Java PKCS11 signing application which is used by thousands of users without problem. But, for our HP users, after few signings it doesn't initialise and java ...
20
votes
4answers
2k views

What is the point in having arbitrary username requirements?

I've looked around on Security.SE, but couldn't find much related to the following problem: I recently signed up for Chase Quick Pay as my method of being paid by a part-time job. I've heard of ...
0
votes
0answers
36 views

CA Flag in SSL certificate

I have an web portal running as a POC purpose, and then i have a mobile apps to access this web portal. Since it's a POC, I just generate a self-signed SSL cert and load it inside the Web and my ...
1
vote
1answer
35 views

Early ChangeCipherSpec Attack

For the early ChangeCipherSpec attack, the attack would affect client with all version of OpenSSL and server with OpenSSL version 1.0.1 and above. My question: If two mail servers are communicating ...
3
votes
2answers
173 views

Why do the banks all use weaker TLS suites?

I've been checking out various TLS certificates lately and noticed that most of the banks seem to have the following two issues: 1) They do not offer perfect forward secrecy 2) They are still using ...
16
votes
8answers
2k views

Can a HTTPS site be malicious or not safe to visit

I know that your computer can get infected by just visiting a website. I also know that HTTPS websites are secure. To my understanding secure here refers to "immune to MITM attacks" but since such ...
2
votes
0answers
75 views

How can I protect my “try it with one click” service?

I have a service with "try it now" experience that currently offers a "one click" effort. This service has a pool of N resources (lets say 50). Each new resource takes about 1 hour to generate. ...
0
votes
0answers
39 views

How to convert SSL Certificate for mobile app?

I am in the current process of renewing my SSL cert for my website. I also have a mobile app for my site. I want to use the same cert from my website in my mobile app. How can I do this? Thanks - I ...
6
votes
1answer
445 views

What is “c/s” in context of hash cracking?

I was reading hashcat's About page, and the stats are listed in terms of c/s....is that "Cracks per seconds"....the 'c' part seems wrong, I'm just guessing. What is 'c'?
0
votes
1answer
58 views

Is running a TOR node from device in home network secure?

I want to run a TOR node using a small ARM device mini server. I already have a good firewall set but feel a bit uncomfortable when giving away my IP address to the open web by opening a port. If I ...
9
votes
4answers
872 views

Can ISP block HTTPS selectively? [duplicate]

Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?
0
votes
0answers
26 views

TOR security if ISP blocks TLS channel?

If ISP blocks TLS channel while a user is using TOR, can he read the TOR traffic, since TOR uses TLS encryption ?
1
vote
2answers
53 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
-1
votes
1answer
126 views

Does microwaving a CD erase it?

I just read the question: Does microwaving a hard drive erase it? and now I am curious too... does microwaving a CD (or for that matter, DVD, or blu-ray) erase it? My initial thought is that some ...
1
vote
1answer
95 views

Does microwaving a hard drive erase it?

Kind of a silly question, but I'm genuinely curious: (in part because I recently saw several questions that refer to "nuking" a hard drive...) what would a microwave DO to an HDD? Would it erase data ...
0
votes
0answers
27 views

IDS/IPS for Ubuntu Server [on hold]

I have Ubuntu Server VPS. I tried CSF firewall but it couldn't block even a simple port scanning command (nmap myserver_IP). I tried psad and I got tons of email from Google DNS servers which it was ...
0
votes
1answer
52 views

Good way to make a secure token for logged out users

I work for a firm that has a marketplace on the web. We want to make a link with a token that stops an ad on the marketplace without the user being logged in. Someone suggested that we make a token ...
0
votes
0answers
18 views

SSL Mismatched Address Certificate Error on IIS 7 [migrated]

We have a local application server (trisha0002), and on this server we have an application (FlexibleBenefits). When we install SSL for this application, it gives Mismatched Address. What can be the ...
6
votes
1answer
181 views

How could a system be zero-knowledge?

I'm actually interested about zero-knowledge storage system. Those system where the storage provider claims he can't have any access to the data stored. As far I know, the data are encrypted using a ...
0
votes
2answers
101 views

SQL injection filter evasion

During manual SQL injection testing I came upon this. Is there any way to bypass these filters that supposedly prevent a UNION based attack? <?php error_reporting(0); include('db.inc.php'); ...
0
votes
0answers
19 views

Fuzz Testing Framework [on hold]

I need to create a Fuzz Testing Framework for network protocols, which will use generation based approch for test case generation and modeling. Framework also support easy integration of well known ...
2
votes
3answers
140 views

What's the difference between mitm attack and sniffing?

What's the difference between MITM attack and sniffing? Also could anyone name a few other attacks similar to those?
0
votes
0answers
41 views

Authenticating Session-less system [on hold]

While trying to understand the authentication in distributed system, I came up with a situation where their is a front web based application, where the access is given through authentication done by ...
0
votes
1answer
29 views

Forward Secrecy not supported with referenced browsers?

I am running a scan against one of our servers from the Qualys SSL tester site and it says that my server "does not support forward secrecy with the referenced browsers". What exactly does that mean? ...
-5
votes
2answers
30 views

how do vpns secure the encyption key? [on hold]

VPNs are accessed by the user with credentials so that the information is encrypted. There are credentials that you download to allow this. Since you don't physically, in person get the credentials ...
3
votes
0answers
139 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
0
votes
0answers
13 views

Transaction without 3DS in some online websites is Fraud prone? [duplicate]

I use my credit card for online transactions MasterCard which uses SecureCode for preventing online frauds even though hackers knows our credit card details. I have come across many sites which is ...
1
vote
2answers
66 views

Should every post request include csrf token?

What is the vulnerability level if the anti-csrf token is not sent with every post request? (If the vulnerability levels were high, medium and low). I understand for critical functions like login etc ...
1
vote
2answers
44 views

Relying on openssl's certificate authority list or provide my own

My apologies if this is too subjective, but I am looking for advice on best practices. We maintain a small program written in Python that runs on our customers' servers and communicates back with our ...
4
votes
2answers
81 views

Human or Bot: Behind the Scene Checks vs CAPTCHA

I'm working on a web app at the moment where we’re trying to remove any user friction and excess steps from our user creation page. To avoid computer bots completely spamming our app we need to have a ...
4
votes
3answers
84 views

Wordpress Brute Force Attacker knows real admin Username -

I've noticed a brute force attempt on several different Wordpress installs that know the right admin user name for those respective sites... It seems very strange that the hacker would be able to ...
2
votes
5answers
488 views

Is hashing the hash considered an extra level of security [duplicate]

As in md5(md5(md5(x)))... I can remember coming across that in some piece of code. If the attacker can somehow reverse md5(md5(md5(x))) into md5(md5(x)) then he certainly can reverse md5(md5(x)) into ...
14
votes
6answers
892 views

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In ...

15 30 50 per page