2
votes
1answer
18 views

What security implications does DNS prefetching have?

To improve performance, most browsers prefetch DNS records for linked resources in the background so that the browsers already knows where to send the request the instance you click the link. This is ...
2
votes
0answers
20 views

What are the recommended scrypt cost factors for 2016?

I've been trying to look for the answer, but the latest one I found was outdated by three years. So what are the recommended scrypt cost factors for 2016?
16
votes
9answers
1k views

Could keystroke timing improve security on a password?

When I was young, and had just started out in my software-development career 20 years ago, I wrote a little bit of code on my Amiga that took a password, but also recorded (within some threshold), the ...
13
votes
4answers
903 views

I almost searched my password, but didn't press enter. Because of autocomplete, is my password at risk?

Without even thinking about it, I typed my password into the Google search bar, but I didn't press enter. Since autocomplete is on, does that mean my password has been logged or indexed somewhere? ...
22
votes
4answers
4k views

Advantages to killing sessions after 5 minutes?

I'm dealing with a server that isn't mine to configure. Something somewhere between me and this server kills any connection after 5 minutes if no traffic passes between the two machines. (At least, ...
-2
votes
0answers
13 views

Confused in pursuing a field as a recent graduate [on hold]

I am working in a Software Development firm as Java Developer. But, I am not interested in coding in Java right now and I have the option to shift to Networking which I find interesting. So, I am ...
0
votes
0answers
18 views

Why is Fragmentaion done on layer 3 (Network layer) [migrated]

Why is fragmentation done on network layer and why not on other layers ? Fragmentation means splitting the packet into to small pieces and sent from source to destination. The maximum MTU size is ...
2
votes
0answers
13 views

How to enable self signed certificates in Windows 10?

I want to use a Yubikey 4 with Windows 10 Pro for Bitlocker and login with my TPM. Unfortunately, I found out I need to enable self signed certificates and all the guides on the Internet I found were ...
36
votes
5answers
5k views

How do I safely inspect a potentially malicious website?

Sometimes I'm interested in what's behind a malicious website. How do I stay on the safe side if I decide to inspect? I'm searching for methods that are quicker and more simple than running the ...
0
votes
0answers
4 views

Mobile Security and Vulnerability Analysis tool [migrated]

What tools should I use to test the security of my iOS application? What are the open source tools available to make vulnerability assessment of an iOS and android application? Any online tool which ...
31
votes
4answers
2k views

Does FTPS (FTP+S) offer better security than SFTP on the server side?

I had an exchange with some third party sysadmin yesterday regarding the setup of a file transfer interface between our servers. I suggested using SFTP because our application has good support for ...
2
votes
2answers
114 views

Why is 128bit AES considered very strong but 160bit SHA depreciated?

Why is 128bit AES considered very strong but 160bit SHA 'insufficiently secure'? Google/chrome/browsers seems to drop support for SHA1 SSL certificates. I assume it's more simple to calculate SHA than ...
70
votes
3answers
4k views

How to publish scanned documents anonymously?

I was thinking of the following question for a long time and did not find a lot of material* in the web and nothing at all on Security.SE. I think its a very interesting question as it covers ...
0
votes
1answer
18 views

What security policies and practices could one practice to safegaurd against being inebriated?

My passwords for the most part as well as access procedures I could do while inebriated/intoxicated. Be it a simple login/password login to email or VPN and accessing a database. This might sound ...
2
votes
1answer
55 views

How to get around hard coding a PFX password

I've got an application that acts as a SSL server. I've got the pfx file and in code, I've had to hard code the password to use in the following way PKCS12_parse(p12, PFXPassword, &pkey, ...
6
votes
1answer
96 views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
1
vote
3answers
34 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
1
vote
0answers
21 views

Should the RTP feed from a surveillance camera be protected?

I see a lot of camera system and they're either using RSTP over RTP or just RTP. Most of the times they are on straight HTTP for the login, some will be on HTTPS, but unless forced (which I have ...
6
votes
2answers
156 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
3
votes
1answer
26 views

Transport Layer Encryption vs. Application Layer Encryption

Can anyone tell me the key differences between Transport layer encryption and Application layer encryption and outline example use cases where each are most appropriate? The research I have done so ...
0
votes
2answers
987 views

Is there a benefit to having SSL connections on localhost?

I have a mail server with a MySQL database back-end. The mail server and MySQL DB are both installed on the same Windows machine. Is there any benefit to using SSL connections between the two ...
2
votes
2answers
427 views

What is the problem with multiple encryption and how do you know if you have decrypted a cipher?

I have 2 questions that are somewhat related: When you try and guess the key in a program (in a brute force way), how does the program know if it got it right and it had deciphered the message (I'm ...
0
votes
1answer
22 views

Samsung SSD 840/850 EVO with DiskCryptor?

Samsung's 840/850 EVO SSDs have hardware full disk encryption feature, however the stock disk management app (Magician) only mentions BitLocker's support. Encrypted Drive feature provided by ...
4
votes
3answers
69 views

Could Google Chrome's lack of a download confirmation dialog be a security vulnerability?

Suppose the user is playing a game like flappy bird that requires constant tapping in the lower left area of the screen (where the downloaded file needs to be clicked). Then while the user is ...
-3
votes
0answers
75 views

Somehow hackers have used my email box to sign up me here!

I use same login name and password to many sites but this is strange, somebody used my email account to sign me up on stack exchange but also on Paypal but on the first mentioned with login ...
3
votes
1answer
65 views

How secure is my system for a password reset?

I am using my custom Parse Server with Heroku which I am pretty sure (99%) that it is decently secure using things like oAuth2 and 1 way hashed passwords. The problem is I am trying to implement my ...
-1
votes
0answers
30 views

Is there a list of currently active botnets?

I am a researcher, I want a list of currently active botnets names, I prepared a list but unfortunately, C&Cs of most of them are now down and they have gone offline. (For example fast-flux and ...
0
votes
0answers
20 views

Response Header Exploit in Set-Cookie?

I'm looking at our internal testing servers and noticed this in the response headers in Burpsuite when sending data to an API we have (Apache/PHP) Set-Cookie: raw=0 The site/page delivers a XML ...
29
votes
3answers
5k views

How does IP address spoofing on the Internet work? Who can do it?

Someone recently told me that the NSA could impersonate pretty much anyone they want by using IP address spoofing on the Internet. But how would that work and to what extend is it true anyway? Could ...
1
vote
1answer
163 views

Yubikey with KeePass using challenge-response vs OATH-HOTP

i got my YubiKey 4 today and first tried it to use KeePass with OATH-HOTP (OtpKeyProv plugin). My Configuration was 3 OTPs with look-ahead count = 0. It was not working that good because sometimes the ...
1
vote
1answer
28 views

Looking for Defensive security training or content

We all know there is a lot of "offensive security" classes and content but what about "Defensive Security" how to look for bugs and leaks in your perimeter.
2
votes
1answer
58 views

Spoofing an NTP server to allow bruteforce on any smartphone

We all know that smartphones (i'll take iPhone as an example) rely on SNTP/NTP servers to update a device's time and date. So, by creating an SNTP server that mimics Apple's server, we can actually ...
0
votes
2answers
42 views

Converting an intranet site to internet

We currently have a web application with client sensitive data that is only accessible by the intranet. The management wants to open this to the internet because there will be a need to have other ...
14
votes
4answers
17k views

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

My friend ordered clothes from a clothing site and was asked to send a picture of her credit card. Is it standard practice to ask a customer to send a photo of their credit card to confirm their ...
0
votes
0answers
30 views

MAC-spoofing / unsolicited incoming ARP reply detected - what to do?

I am behind a Linksys router. I have my computer connected to the router via cable. I have a WPA2 security set up. I am on Win 7. I have just been notified by Symantec antivirus with the following: ...
0
votes
3answers
61 views

Does a WAN to LAN Route Conversion Through a Router Adds Security?

Use of a Router is the first solution for adding a security layer to any LAN with N machines, connected to the internet (through its firewall settings). My question is does the WAN to LAN conversion ...
138
votes
8answers
16k views

What should you do if you catch ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and ...
1
vote
0answers
44 views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
0
votes
1answer
51 views

Is `/dev/urandom` secure to generate a salt on a Virtual Machine?

I've read the new password_hash() function from PHP uses /dev/urandom to generate a secure salt, however this assumes some noise from device drivers. Is possible that /dev/urandom is not so random ...
3
votes
1answer
404 views

Is the OpenSSH server using a fallback, hard-coded DH parameter for 2048bits?

I'm toying around with OpenSSH configs and poking at the Diffie-Hellman parameters. I'm using GDSSecurity's tool to check DH settings and this page to view other SSH settings. For funsies, I removed ...
17
votes
2answers
2k views

How do I remove my website from the malware database?

I have a website which is basically a service platform. As far as I know there is no malware in my website (at least not found according to these free scanners). However, Check Point malware database ...
4
votes
2answers
377 views

Question about ISO 27001:2013 scope definition

My company would like to be ISO 27001 certified, so we have started a preliminary study and are now working on a draft ISMS scope in accordance with the standard (context of the company, interested ...
0
votes
0answers
34 views

PHP null byte exploit through cookie

I have a challenge(centos) where I found a null byte based path traversal vulnerability in the 'user' cookie on a simple PHP/5.1.6 on Apache/2.2.3 based web app. I'm able to include the /etc/passwd ...
0
votes
0answers
4 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
-1
votes
0answers
11 views

How can I be sure that gochange.co is a secured service?

I heard about gochange.co somewhere but i'm not sure they won't mess with my bank account. How can I trust this service? is it any good?
0
votes
1answer
30 views

How do connection relays strengthen anonymity?

We've all heard of the concept of some geek bouncing their internet connection over a number of servers to hide their trail when doing something secretive. I'm curious about why this is done. I know ...
0
votes
0answers
23 views

Security issue with CSRF token

My website has CSRF vulnerabilities. I have tried to mitigate the risk. Whenever users try to perform CSRF attack, they will be redirected to login page for re-authentication. On top of that, I ...
2
votes
2answers
172 views

Are there any security concerns for CGI scripts written in pure bash?

I'm working on a project that would use bash and FastCGI to create a pseudo-CMS. Are there any kind of security concerns to watch out for within FastCGI itself over a well written bash script (for ...
7
votes
1answer
60 views

How can meta data be used to identify users through chained VPNs?

Online privacy is a big issue for many people nowadays. Using VPNs is the usual suggestion as a means to stay anonymous. More often than not, somebody comes up with the point "just chain multiple VPNs ...
3
votes
2answers
76 views

Setting up SFTP at Production Server is a Risk?

There is a requirement to setup a SFTP server. This will be used by some of user b2b agents to upload files. Such kind of setup is always doubtfully risky in production environment where user can ...

15 30 50 per page