New answers tagged

2

There are tools to make builds deterministic. However it is not as simple as picking the correct language and compiler. You also have to eliminate all sources of non-determinism from the build. This mostly consists of time stamps and check sums. See https://reproducible-builds.org/docs/deterministic-build-systems/ for a more complete list of non-determinism. ...


1

As already stated, this is that way by design. Probably MSDN article could (or should) be more explicit about that. The way you extracted the "signed" data is wrong. The XMLDSig documentation is clear about it. You may want to read section 8.1 of this link https://www.w3.org/TR/xmldsig-core/ Just as a user should only sign what he or she "sees," persons ...


1

XML Signature are prone too many attacks. That is due to the way XML as a file format is defined and how it is implemented by (parsing) frameworks. https://www.owasp.org/images/5/5a/07A_Breaking_XML_Signature_and_Encryption_-_Juraj_Somorovsky.pdf https://lists.w3.org/Archives/Public/public-xmlsec/2009Nov/att-0019/Camera-Ready.pdf


1

To me, this seems not really as a error of the protocol but as wrongly used. You get a part of the XML using Doc.SelectSingleNode("/message/msgenvelope") but you never checked that "/message/msgenvelope" is actually the signed part of the XML! You have to treat the XML more like a file system with different files and not like one entity. Think like this: ...


3

An IP number is very comparable to a phone number. By default this is a public information available in any public directory and is necessary to establish a communication. However there are tons of way to exploit even public information in illegal ways. So the real determinant here is not the fact that you are collecting the local IP and MAC address, but ...



Top 50 recent answers are included