114
votes
11answers
14k views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the ...
371
votes
20answers
57k views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
XKCD 936: Password Strength
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones ...
168
votes
4answers
41k views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
66
votes
16answers
15k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
121
votes
7answers
8k views
How to store salt?
Nowadays, if we expect to store user password securely, we need at least do the following thing
$pwd=hash(hash($password) + salt)
then store $pwd in your system instead of the real password. I have ...
34
votes
4answers
11k views
Password Hashing add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
53
votes
12answers
3k views
Does an established ssl connection mean a line is really secure
From the view of somebody offering a webapplication. When somebody connects with SSL (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
172
votes
3answers
45k views
How does SSL work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
35
votes
6answers
11k views
How secure are virtual machines really? False sense of security?
I was reading this CompTIA Security+ SYO-201 book, and the author Prowse claims that
Whichever VM you select, the VM cannot cross the software boundaries set in
place. For example, a virus might ...
38
votes
11answers
4k views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
18
votes
10answers
2k views
Resources to learn about security
I am currently just finishing a undergrad computer science degree, but I know very little about computer security.
What are some good resources (aside from this site) to learn the fundamentals of ...
19
votes
11answers
2k views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
147
votes
3answers
32k views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEASTs successor, what is possible protection is available for an individual and / or system owner in order to protect themselves and their users against this new attack on ...
42
votes
8answers
6k views
Hardening Linux Server
We have already had questions on here about Hardening Apache, Hardening PHP and Securing SSH.
To continue this trend I am interested in what steps people take to harden Linux servers. As in what ...
24
votes
2answers
3k views
Amount of simple operations that is safely out of reach for all humanity?
Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, ...
130
votes
9answers
8k views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
17
votes
6answers
3k views
How can I reliably erase all information on a hard drive?
As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also.
Methods for flash drives ...
43
votes
2answers
5k views
What are rainbow tables and how are they used?
Where can I find one? Is there a pot of gold at the end?
How do I protect against them?
From the Area51 proposal
This question was IT Security Question of the Week.
Read the Sep 09, 2011 blog ...
26
votes
4answers
5k views
What are the career paths in the computer security field?
What sorts of jobs are there, in which organizations, with what sorts of day-to-day responsibilities?
What areas are good for folks coming out of school, vs what are good 2nd careers for experienced ...
196
votes
9answers
20k views
Is my developer's home-brew password security right or wrong, and why?
Our developer, let's call him 'Dave', insists on using a home-brew script for hashing passwords. See Dave's proposal below.
We have already researched and adopted an industry standard protocol using ...
49
votes
8answers
5k views
Can anyone provide references for implementing web application self password reset mechanisms properly?
We are implementing self password reset on a web application, and I know how I want to do it (email time limited password reset URL to users pre-registered email address).
My problem is that I ...
43
votes
6answers
3k views
Can anybody explain XSS to an idiot?
That idiot being me, of course.
I work programming Enterprise Java applications and do very little web development in 2002. I'm interested in security and like to read articles about it. However, I ...
69
votes
12answers
15k views
Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a ...
18
votes
5answers
2k views
Professional certifications for IT Security
Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist.
Information Security
CEH ...
20
votes
4answers
1k views
How is “something you have” typically defined for “two-factor” authentication?
A wide range of products claim to offer "two-factor authentication" (c.v. Two-factor authentication - Wikipedia). Most are deployed as "something you have" to be used in addition to a normal password ...
26
votes
4answers
2k views
Are there DRM techniques to effectively prevent pirating?
A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective?
The question for IT Security is: Can DRM be made effective, and are there any examples?
...
198
votes
16answers
19k views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
58
votes
12answers
10k views
Apache Server Hardening
What are some best practices, recommendations, required reading for securing an Apache Server?
20
votes
1answer
2k views
Are there more modern password hashing methods than bcrypt and scrypt?
This question made me start thinking about password hashing again. I currently use bcrypt (specifically py-bcrypt). I've heard a lot about PBKDF2, and scrypt.
What I'm wondering is if there are any ...
31
votes
6answers
6k views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
31
votes
41answers
3k views
What is your way to create good passwords that can actually be remembered?
What are the methodologies which can be used to generate "human" good quality password?
They have to ensure a good strength and also easy to remember for a human being.
31
votes
2answers
3k views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
16
votes
9answers
579 views
Does hashing a file from an unsigned website give a false sense of security?
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
68
votes
13answers
6k views
What “hacking” competitions/challenges exist?
I have always enjoyed trying to gain access to things I'm not really supposed to play around with. I found Hack This Site a long time ago and I learned a lot from it. The issue I have with HTS is that ...
24
votes
3answers
5k views
Is it enough to only wipe a flash drive once?
According to the documentation for the "diskscrb" command for wiping conventional hard drives: http://www.forensics-intl.com/diskscrb.html
"Conforms to and exceeds the Government Standard set ...
22
votes
4answers
1k views
Why shouldn't we roll our own?
Why shouldn't we create our own security schemes?
I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.
With that in mind, I'm ...
15
votes
1answer
837 views
What cookie attacks are possible between computers in related DNS domains (*.example.com)?
Here, several servers in the same DNS domain emit cookies under a variety of settings (scope, HTTPS, Secure) and another host emits a cookie with the same value.
Example
Suppose a user has the ...
20
votes
5answers
1k views
Open Source vs Closed Source Systems
My understanding is that open source systems are commonly believed to be more secure than closed source systems.
Reasons for taking either approach, or combination of them, include: cultural norms, ...
31
votes
3answers
3k views
Are all SSL Certificates equal?
After running a few tests from Qualsys' SSL Labs tool, I saw that there were quite significant rating differences between a GoDaddy and VeriSign certificate that I have tested against.
Are all SSL ...
11
votes
5answers
874 views
Different strategies for online anonymity and their +/-s?
I saw this question about anonymous web browser, but I wanted to go a little bit more in depth. I prefer answers that take into account how a connection would be traced back, time it would take to ...
11
votes
6answers
1k views
Anonymous web browser. Is it real?
Do anonymous browsers work? What principles do they use? Can I use them to test access to my web site? Can I detect if a visitor is using one? What is the different between traditional and anonymous ...
24
votes
6answers
878 views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
15
votes
6answers
3k views
What is the difference between a penetration test and a vulnerability assessment?
What is the difference between a penetration test and a vulnerability assessment?
Why would you choose one over the other?
What deliverables would you expect to receive and how would you rate the ...
17
votes
3answers
3k views
Why should one not use the same asymmetric key for encryption as they do for signing?
In an answer to a question about RSA and PGP, PulpSpy noted this:
It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for ...
10
votes
3answers
960 views
How can I be protected from pictures vulnerabilities?
I've just read this question What is the corrupted image vulnerability? How does it work?
(GIFAR, EXIF data with javascript, etc..)
I'm asking myself how can I protect myself and my website's users.
...
8
votes
4answers
2k views
Options when defending against SSLstrip?
I'm wondering, does anyone have any suggestions to defend against SSLstrip particularly?
3
votes
4answers
438 views
Is it safe to serve any user uploaded file under only white-listed MIME content types?
Let's say I develop an application that,
Allows any user to upload a file of only white listed mime content type and extensions (word and pdf).
Serves those files with the allowed extension and ...
7
votes
3answers
967 views
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
We allow users to upload a number of files, all of which we either send over to scribd (doc, xls, ppts, etc) or display as a video ourselves (flv, mov, mp4, etc in flowplayer).
To avoid users ...
12
votes
4answers
360 views
Is it safe to store and replay user-provided mime types?
If a user uploads a file but modifies the request by setting the mime-type to something arbitrary, like "superdangerous/blackhatstuff", is it safe for me to send the same mime type back to a different ...
47
votes
18answers
3k views
What security resources should a white-hat *developer* follow these days?
What sites, twitter accounts, FOSS software should a white-hat code 'hacker' follow these days?
Do Include:
Late breaking information on new security issues (RSS, Twitter, etc)
A website that ...
