0
votes
1answer
6 views

Adding a “comment” to PGP mail signature files?

I have started signing my mail with PGP, and it attaches the file signature.asc to my messages to verify that I sent them with content, as you'd expect, like this: -----BEGIN PGP SIGNATURE----- ...
0
votes
1answer
30 views

Password stolen on public wifi even though https was used

I saw this video where news reporter is in public place, and some security expert demonstrates to her that even though she logged in at page which was using https that guy got password in his ...
4
votes
2answers
5k views

Fail2Ban does not ban failed root login attempt

I have a small server which only open ports are ssh, http and https. I have fail2ban installed and set up so that after 3 failed attempts someone gets blocked for 10 minutes (thats the dafault I ...
1
vote
1answer
665 views

How secure is automatic authentication in Skype?

How secure is checking the automatic authentication option in Skype client? What if I sign in with Microsoft account instead of Skype id? What if both accounts are merged? Is there any documentation ...
1
vote
3answers
91 views

How can hackers guess passwords (using dictionary attack or brute force) without being locked out?

Nowadays almost every website you want to register in; is asking you to create a complicated password...But why cant we use simple passwords? I am just wondering because in case of multiple wrong ...
1
vote
0answers
6 views

What aspects of a Host OS can be detected from VirtualBox VM?

What aspects of a Host OS can be detected from VirtualBox VM? Processor and display features are all I can think of. What exactly about them? Any other features of the Host that a user with ...
2
votes
1answer
57 views

What is a secure mechanism for wireless communication between Android and Ubuntu?

I have come across a few Android apps that provide various features for communicating with a desktop machine (sending text or typing in one direction or another, controlling the desktop pointer with ...
0
votes
0answers
13 views

Reflected XSS script passing through URL how to make it work and what are the preconditions for it to work?

Trying to learn about security I set up the most simple website on my localhost consisting of one html page that a apache server serves. I first started trying and appending the JS script that would ...
0
votes
0answers
9 views

What could be expected from an AI program for scanning network vulnerabilities?

There are tools like OpenVAS and other such online scanners which help in discovering network or a system vulnerabilities. I need thoughts on the limitations you feel, which are faced while using a ...
1
vote
1answer
30 views

Is there any danger in allowing users to host PDF/RTF/DOC files on my web server?

If I were to allow users to host arbitrary PDF/RTF/DOC files on my server all under the same name, but with different query strings would there be anything to worry about? I've heard of PDF/RTF ...
-7
votes
0answers
43 views

What are the best and most popular authentication algorithms/protocols? [on hold]

Our cryptographic/security company is designing a new generic versatile library that implements all popular algorithms in all areas of cryptography. Now I'm studying a subject of Authentication. What ...
2
votes
2answers
80 views

Does Android encryption really prevent law enforcement access?

Google recently announced that in Android L encryption would be turned on by default: For over three years Android has offered encryption, and keys are not stored off of the device, so they ...
3
votes
3answers
75 views

Is an emailed PIN for 2FA worthwhile?

To log in to our web app, our security team is insisting on 2FA as it is hosted on our internal network. The proposed solution is to have a standard username (email address) and password login, which ...
1
vote
1answer
19 views

Remote Auditing a Secure WiFi Network-Obtaining enough of the Secured-Network credentials to attack without being in range of WiFi

I was wondering if there are any methods I'm unaware of that will allow an attacker to attempt to obtain WiFi access outside the physical range of the WiFi signal. When using net-stumbler or any ...
1
vote
3answers
87 views

What are the differences between dictionary attack and brute force attack?

Can someone explain the major differences between a Brute force attack and a Dictionary attack. Does the term rainbow table has any relation with these?
0
votes
3answers
1k views

Cryptography behind chip based credit cards (smart cards)?

Why are chips safer than magnetic stripes? The answers to the above question explain that the chip based cards can not be cloned as the "secret number" is embedded in the chip and protected by the ...
2
votes
1answer
141 views

What are the security implications of pairwise master key caching in Wireless Networks?

I'm currently investigating WPA2 enterprise security options, and I'm curious about PMK Caching. I've found lots of vendor information about it, and understand that the client does not need to ...
-2
votes
1answer
43 views

A future heartbleed bug? [on hold]

Checking out IBM.com and Google.com: https://www.ssllabs.com/ssltest/analyze.html?d=ibm.com&s=172.230.109.66 Valid from Tue Sep 09 14:00:34 UTC 2014 ...
1
vote
3answers
88 views

Is it ever safe to publish hashed data?

I'm having a friendly debate with someone who thinks that a website can safely make public sensitive data about it's users as long as that data is hashed (don't ask why, it's a long and hypothetical ...
5
votes
1answer
275 views

What is it called when you give hackers a way in?

Is there a name for a system that is designed to be hacked into? (Alternatively, there may be a different name for a system that is designed to look like it is hacked in to, but is actually just ...
0
votes
2answers
23 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
-1
votes
1answer
32 views

Is it possible to hack an Android App or an Android device without being root? [on hold]

Simple question, as the title said. I wondering if in an ideal world where rooting Android devices is not feasible mobile pen testing would be still possible or not. Most of the sensitive folders ...
2
votes
1answer
58 views

How to establish a random OTR remote party as a specific individual?

In reading Glenn Greenwald's 2014 book No place to hide, one thing stood out to me as a bit odd. Greenwald details how Edward Snowden was insistent that Greenwald install PGP in order to communicate ...
0
votes
2answers
27 views

Why the Websense blocks same site when used with http & not when used https? [on hold]

I have been working in a IT firm. I have access to some social sites. When I try to open site Links in mail (that are having http://), the websense prompts me that the access is blocked. However, when ...
2
votes
2answers
74 views

How safe is to secure sensitive content by URL with MD5 hash and no other authorization?

Suppose we have website that use MD5 hash in URL like this: http://somewebsite.com/XXX/ where XXX is MD5 hash. Content of this website may have sensitive information like transaction details with ...
3
votes
3answers
2k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...
-5
votes
0answers
22 views

iPhone & windows pc malware removal and reverse tracking of perpetrators location, ip, et al [on hold]

There are various examples of malware available for sale nowadays, spybubbble being one of the best. cheaper alternatives eventually leave traces (clicks, hissing noises, crossed lines etc.) a key ...
1
vote
2answers
46 views

Will the cookies crumble when it comes to proxy servers?

One important use of proxy servers as I understand reading Wikipedia is to keep you anonymous from other servers by acting as a middle-man. If that is indeed the case, consider the following ...
1
vote
1answer
126 views

Do any tracking networks or ad networks not use JavaScript and only track based on IP address? If yes, how can they be prevented?

Are there any websites that collectively track one computer based on its IP address alone? Browser extensions such as Ad block plus, Do Not Track Plus and Ghostery modify the client side script but is ...
1
vote
2answers
236 views

How do hackers deploy keyloggers?

I know the use of keyloggers. What I wish to know is how a hacker can install the keylogger onto the victim's system? If it can be done by XSS then to where this keylogger is actually installed (I ...
1
vote
1answer
26 views

Connecting to Oracle Database from VBScript - Hiding Credentials

At work our first level support uses a ticket management system that allows us to add extra functionality via VBScripts that the application invokes. First level support also receives quite a few ...
0
votes
2answers
33 views

Does Nmap requires a closed TCP port to do OS fingerprinting?

I was checking the security of a server by running Nmap. Last time it gives me the following results, indicating that OS could not be fingerprinted: PORT STATE SERVICE VERSION 21/tcp ...
2
votes
2answers
84 views

How common is port-knocking? [on hold]

Today I read about port-knocking for the first time. It has been a pretty known concept for more than ten years, but I don't know anybody who uses it for their servers. How common is the usage of ...
0
votes
1answer
19 views

What happens if my signing subkeys are compromised?

Let's say my subkeys are compromised, but my master keypair is safe and secure, so I revoke the old subkeys and issue new ones. With encryption keys, the results are pretty clear: I can still decrypt ...
2
votes
0answers
148 views

Some http requests are not send encrypted by vpn! Why?

I subscribed to a VPN service recently, and installed wireshark to take a look at the traffic sent from my computer. Practically all of it goes through UDP protocol, encrypted. But there are two HTTP ...
7
votes
1answer
355 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
10
votes
1answer
593 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
0
votes
3answers
49 views

Phone location detection

If someone posts something on the internet using their phone's data connection, is it possible to track their location? For example, somehow link their IP address and figure out their location. Or ...
22
votes
9answers
3k views

Why is it a security problem not to update one's browser?

I was hoping that someone could explain if it in general is a security problem not to update your browser. Firefox constantly prompts me to update my browser, but how dangerous is it to not update? ...
0
votes
1answer
25 views

Tracking urls in network using python [on hold]

I have requirement to track all the urls passing through network inside my organization, is this possible to track using python ??
0
votes
0answers
4 views

Location Parse Help Please [migrated]

I succeeded has to get back the position of the user and I also managed to get back the position of all the restaurants ( GeoPoint un data cloud Parse) my question is now to know how to compare the ...
-2
votes
1answer
75 views

Spyware for feature phones

There are a lot of spywares for android and ios smartphones. Are there spywares for feature phones ? I am using this samsung phone, which is basic. I am wondering if somebody who has access to this ...
3
votes
2answers
28 views

Why is the *-property in BPL security model named “star”?

I am just looking for the meaning of "star" in this property
0
votes
1answer
41 views

SFTP between guest virtual machine and its host

The System I am using Windows 7 host with Cygwin and a virtual machine running Linux. The actual running guest is an Arch Linux ISO. The Objective I want to share files between the Cygwin host and ...
0
votes
2answers
76 views

Can we hide a constant hashed key used for AES encryption of a password?

Are there any methods in java to hide a constant hashed key which is embedded in a class? FYI, the key is used to AES encrypt a password used to authenticate a Web Service which would only take a ...
2
votes
2answers
84 views
+50

DPA compliant way to receive uploaded data on server, and remotely access it as a volume whilst keeping it encrypted

I need to set up a server on which users upload tarballs containing Personally Identifiable Information. I must be compliant with the Data Protection Act, so this is so far what I understand I must ...
0
votes
1answer
29 views

Replacing subkeys.

Here's a specific scenario that I have. I want to have subkeys on my laptop and store the master key safely. So I went ahead and created new keys: gpg --gen-key gpg (GnuPG/MacGPG2) 2.0.20; ...
0
votes
0answers
20 views

Security considerations for RESTlike HTTP API of an embedded system

I'm designing a HTTP service for an embedded device and wondering if the following security concept is good enough: SSL(Up to Version 3) is enabled by default, TLS is not by limitations of the ...
0
votes
0answers
20 views

Privacy implications of big data for the average user [on hold]

First of all, it's not related to What are the implications of NSA surveillance on the average internet user? My Master's degree project is about intelligence gathering from big data analysis. As my ...
0
votes
0answers
9 views

what is the default cache control mechanism of http? [on hold]

I have heard about the cache control header parameter in http. I know that it can be edited with the way we wanted like no-cache,public,etc. But if we don't specifically provide anything, then what is ...

15 30 50 per page