0
votes
0answers
6 views

RSA Encryption parameter not work

I try to encrypt with RSA algorithm with the parameter p=2353 q=3167 e=13 d=1145605 and the encryption field even on small number. the parameter hold all the condition. why it field, what wrong with ...
0
votes
0answers
3 views

what are security precautions to ask clients who send a USB or CD?

We're launching a tender for a big project, and some of the businesses who want to make an offer are asking if they can send some brochures together with a USB stick or CD-Rom. Since we're trying to ...
1
vote
0answers
6 views

Security Vulnerabilities and Risks for an Information only website

My website is an information only website and all the information on it is available to all those who visit the website. There is no sensitive data. And we do not store any user submitted data nor ...
0
votes
0answers
4 views

Microsoft Edge Cache Data

On CCleaner in Windows 10, there are options for Microsoft Edge, which I do not use for browsing the web. Deselecting the option to clean for MS Edge significantly speeds up the process, but I am ...
0
votes
0answers
5 views

Hashing sensitive data in request

We have set the https connection, between the client and server. The problem is that security guys, showed us it is possible to intercept the data using rogue invalid certificate (user must accept it ...
1
vote
1answer
15 views

What's the impact of a simple certificate serial number?

As a result of following internet guides slightly too closely, my company's internal PKI now has an intermediate certificate with the serial number "10 00". Comparing to other certificates, where the ...
0
votes
0answers
10 views

What are simple things I can do to protect my digital identity?

I have taken a big interest in securing my digital info and feel like I have addressed many typical problems. For example: I've gone to full disk encryption on my android phone and linux laptop. My ...
2
votes
0answers
21 views

Can Restarting An Infected Computer Make It Worse?

I seem to remember that rebooting a potentially infected Windows PC before removing the malware may allow it to take advantage of early boot up states that may be vulnerable if the security measures ...
0
votes
0answers
24 views

Reverse TCP Shell not working on separate network

I made a Reverse TCP Shell in Metasploit. Set the LHOST for my Local IP: 10.0.0.27 Then set the port for 4444. Then I run it on my network and it works. I transfer the file to another network. Run it, ...
1
vote
2answers
35 views

Does revealing two factor codes reduce security?

If I were to publicly display the 6 digit code from my google authenticator, would my account security be diminished beyond it's valid life time? What if it were the code and the time it was ...
0
votes
0answers
9 views

OpenSSL Generate ECDH Public Key

I am trying to use the OpenSSL command line to generate a ECDH public key that meets the following specifications: Use a Base64 encoded X.509 SubjectPublicKeyInfo structure containing a ECDH ...
0
votes
1answer
11 views

Bypass bcrypt max input

I was reading this question regarding bcrypt max password length. Is there a preferred method or way to allow user passwords to be unlimited length? Or at least much higher? Is there an alternative ...
0
votes
1answer
22 views

Is stolen client side certificate a valid concern for SSL communication? How to build an automatic revocation system?

In the context of server to server communication, we do TLS/SSL with client certificate authentication. So the communication looks like the following: service_a on Host_A (as the SSL client) --> ...
-4
votes
1answer
23 views

How to change user agent string on Tor to see mobile sites?

I asked this question but got logged out and can't get back in but need to ask additional Q... How can I see mobile version websites on PC/Mac while using a privacy secure browser such as Tor I tried ...
0
votes
0answers
9 views

Security Concerns of importing SharePoint Root Authority to Trusted Root Certification Authorities store

We are experiencing slowness because of SharePoint's STS certificate CRL checking. This is a known issue and there is a Microsoft Workaround for it: https://support.microsoft.com/en-us/kb/2625048 The ...
0
votes
3answers
53 views

How does one verify that a Python script is a pure math function?

I have a Python project that dynamically loads Python scripts from a set of specified directories and executes an expected function off of them (the framework expects a function name that takes a ...
2
votes
2answers
55 views

How to get help from an ISP to take down a phishing campaign?

My company is suffering from a phishing campaign. Over the last two months we have tried to issue a take down to the ISPs (publicdomainregistry.com and confluence-networks.com) – both of them seem to ...
1
vote
0answers
27 views

Does Windows “System Volume Information” folder pose a security risk in servers?

I have a Windows 10 WAMP server running, and Windows by default has a hidden folder in every partition called "System Volume Information". I can't access it because Windows denies it, but I noticed ...
0
votes
1answer
22 views

Can location apps locate a lost phone if someone switches out the SIM card?

I lost my T-mobile Galaxy S7 somewhere between the front seat of my car in the parking lot at the grocery store and the first few aisles inside the store. (None of us remember exactly if I actually ...
1
vote
1answer
15 views

Is traffic not encrypted given ERR_CERT_COMMON_NAME_INVALID?

If I am shown ERR_CERT_COMMON_NAME_INVALID, and I can see that the domains do not match (cert for *.example.com but I am visiting https://foobar.com), do I understand correctly that someone packet ...
2
votes
1answer
105 views

Why would a site demand passwords to consist of digits only?

My bank's internet banking site enforces a pretty weird policy: it does not allow you to set a password that has anything but digits in it. The only reason I can imagine is that they are using not an ...
2
votes
2answers
116 views

Information collected by Windows 10 at maximum privacy configuration [duplicate]

I am thinking about installing Windows 10 on a machine. However I am concerned about the information Windows 10 collects. I have searched a bit but haven't been able to find what information Windows ...
2
votes
1answer
37 views

How to protect API from from malicious usage

We are developing a community portal service using Java-Spring and Angular UI. We are also going to have an Android app soon. Our back-end exposes many services via REST API. There are couple of ...
0
votes
0answers
23 views

Netcat seems to close the connection from the attack box?

I am trying a practice box, and am running into trouble stabilising a connection. I have an RFI vulnerability that allows me to run commands on an Apache server, but does not lead to an interactive ...
21
votes
4answers
2k views

What can a company do against insiders going rogue and negatively affecting essential infrastructure?

In 2013, a Citibank employee had a bad performance review that ticked him off. The results were devastating: Specifically, at approximately 6:03 p.m. that evening, Brown knowingly transmitted a ...
0
votes
0answers
11 views

How dangerous the fact that selinux is permissive/lacking on android? what should one be wary of? [on hold]

So there is this ROM who due to some constrains has its SELINUX set on permissive most of the time. The phone has its root disabled. Now I'm not really sure what are the consequences of such a state ...
0
votes
0answers
22 views

DMZ with Reverse Proxy for both Web and Email servers

I have both a web server and email server, instead of placing these two "public" servers in the DMZ, instead In the DMZ I was going to place a Reverse Proxy. for the Web Server: Firewall accepts port ...
0
votes
0answers
26 views

Data dump - realse, as insurance

Just trying to figure out the best way, to set up a data dump mechanism as a safety insurance. A timed data dump which could be only deactivated by me, and released in case of my absence (harm). And ...
2
votes
0answers
28 views

OAuth - initial log in to get API key

I've been reasearching how major web systems implement OAuth in their RESTful API. Here is how Paypal describes theirs: Basically the question comes down to the "note" part of the picture. Say ...
0
votes
0answers
17 views

Is comparing the thumbprint of a SSL certificate secure enough?

I was wondering if comparing the X509Certificate2.Thumbprint of two certificates count as a save way to identify if a certificate is correct or not. Of course this would only work for specific ...
0
votes
1answer
26 views

Does stretching a hash increase a denial-of-service (DoS) risk and does brute-force protection mitigates that?

Disclaimer: I noticed several questions on this site but none really answer this two questions directly. Therefor I do not consider this duplicate. Personally I really like the article called Some ...
0
votes
1answer
37 views

Where do magic constants for signature algorithms come from?

For example, I've seen 3031300d060960864801650304020105000420 as an identifier for RSA/SHA256, 3020300c06082a864886f70d020505000410 for RSA/MD5. Where do these values come from? I ran into one of ...
-4
votes
1answer
41 views

What are the best all-in-one security tools for linux? [on hold]

What are the best all-in-one security tools for linux? Please list them by open-source and commercial, and functionality. Thanks.
2
votes
1answer
53 views

Does SFTP cost more to implement than FTP?

This is a two part question. How does the implementation of SFTP differ over FTP? (Account Creation, Setup of connection) Is it more expensive (in terms of time/cost) to do so? In this scenario I ...
0
votes
0answers
22 views

I currently have a downed laptop. I want to install Tails on my Android flash card so I can use it as a boot card on the laptop [on hold]

Does anyone know how to install Tails on an sd card from an Android tablet? Thanks
-1
votes
1answer
35 views

Options to do regarding a hacked twitch stream with a known twitter, used email and (maybe fake) name

In short, a friend of mine under DzyDzyDino's stream. I contacted him and together we were able to obtain a bit of information. First, though, the overall situation. I managed to contact him via ...
1
vote
1answer
38 views

Security implications of using an algorithm to lengthen and salt passwords before using them?

I have created a JavaScript bookmarklet which, among other things, base64 encodes my plain-text passwords combined with information from the site's domain name. The idea is that base64 output is ...
0
votes
0answers
13 views

PGP key transision: Strong RSA subkey under weak DSA masterkey?

I have a DSA/ElGamal 1024/2048 PGP key and want to migrate to a stronger set. I see two options but I'm unsure which is smarter. a) Keep DSA 1024 Masterkey, generate 4096 RSA subkey b) Ditch the ...
0
votes
1answer
14 views

ISO27001: Scoping Definition for Data Hosted on Cloud

I'm trying to define a scoping definition, as required by ISO27001, for a company that offers advice to customers based on health-related data. The strength of this company is its advice that offers ...
7
votes
1answer
70 views

How could Firefox password manager talk to Chrome password manager?

I recently installed Firefox and realised that it was able to successfully import all passwords that were stored in Chrome. I had been using a sync passphrase in Chrome and I expect it to store the ...
0
votes
0answers
41 views

Surveillance cameras go offline every 30 minutes or so

I'm setting up a 4 camera security system with an Anran Digital Video Recorder (Model NVR6008T), and keep having the cameras go offline approximately every 25-30 minutes. They stay offline for ...
0
votes
1answer
48 views

What are all these connection attempts in my firewall log?

I've read many similar answers, but they all dealt with machines that were running publicly accessible services. In my case, I have a (newly installed and fully patched) Ubuntu machine that is used as ...
0
votes
0answers
7 views

Is there any guideline to configure Mutual Certificates Security(MCS) using WSIT-Security for Glassfish-Metro WS?

I am building a WebService using Java with Metro WS-Stack and looking for a guideline to learn the concept and configure the practical usage of it on NetbeansIDE. Any leads on this?
0
votes
0answers
27 views

How Do Botnets Leverage LAMP stacks and Web Servers? [on hold]

I understand MySQL databases, PHP, HTML forms, etc. And I also understand that basic botnets rely on client bots that communicate with a central command-and-control server. However, if someone were ...
0
votes
0answers
15 views

Netfilter SNAT DNAT interaction

In this example [root@real-server]# iptables -t nat -A PREROUTING -d 205.254.211.17 -j DNAT --to-destination 192.168.100.17 [root@real-server]# iptables -t nat -A POSTROUTING -s 192.168.100.17 -j ...
0
votes
0answers
28 views

credit card skimming and protection information [on hold]

please i would like to know if a skimmer could possibly add 0's, write info using card reader and withdraw from POS or ATM. All info related to this would be appreciated
1
vote
1answer
26 views

Deep attestation of VM's

Hypervisors like Xen have virtual TPM (vTPM) support. In cloud environments, are there any implementations where such vTPM's are being used during remote attestation in addition to the host TPM based ...
0
votes
0answers
34 views

Problem with configuring PEAP to only accept users with client certificate. (freeradius)

I'm currently trying to configure PEAP. I had no problems configuring it without the use of client certificates. But I want to only accept people who have a valid cert. However, the clients can ...
2
votes
0answers
17 views

What is the benefit of OAuth “one-time code flow (hybrid authentication)”?

With reference to the omniauth-google-oauth2 gem which describes what it calls "One-time Code Flow (Hybrid Authentication)" as such: This hybrid authentication flow has significant functional and ...
1
vote
1answer
27 views

Bitlocker encrypted drive access from other machines

Can drives encrypted with Bitlocker be moved to different machines and accessed as long as the password is known? For example, via an external drive enclosure? Or is the encryption tied to the ...

15 30 50 per page