New answers tagged

0

First of all you have to keep in mind that Windows XP's built-in firewall doesn't have the capability to apply the rules you described. Plus, even if it did, packets would still get dropped by the same machine that's handling the actual FTP connections, so it would still be recommendable to put a separate firewall (or Linux box) in front of it, just for ...


2

Any delay would be a security benefit. One way to look at it is that everything can be cracked, it is just a matter of time. By adding delays, one is increasing the amount of time it takes to break the security. You want the time it takes to crack to be longer than the time the item needs to be secure. In the case of fingerprints, the fingerprint gets ...


1

I think it would be possible to somewhat significantly reduce the search set, but it largely depends on the resolution of the picture and the worn state of the keyboard. With a visibly worn or dirty keyboard (dirt on the edge of keys could serve the same purpose), you would first establish the possible alphabet, with each key weighted at 1.0. Then establish ...


7

Only if the sole purpose of the keyboard is to type one password. Otherwise, you'll find that more frequently used keys such as vowels, WASD, and modifiers will also have oil stains and signs of wear. It becomes especially more difficult if the password is a passphrase containing natural language.


3

The biggest difference is in scale. A keypad on a lock is generally only used to type the password, so the password keys are the only ones being used and worn. "Any given keyboard" is generally used for much more than only typing passwords. There are many other attacks used on keypads: video cameras watch you enter your pin, heat sensing (flir), or even ...


0

Keyboards wise, I'd consider this a minor concern unless I was using the same password for everything. If you're using a different password for everything and changing them reasonably regularly, you're probably fine. Add this to the fact that if you're using the keypad for other things you're going to get a much different wear pattern than just P A S W O R D ...


2

You need to clarify the term "keyboard". If you take a pic of my keyboard I am writing this text. You will surely notice some patterns and missing letters from my typing. But be aware that most of the time such keyboards are not used to enter passwords at all. Typically you rather get a heat map of the frequently used chars for a certain natural language. ...


49

In some cases yes, you can guess the most frequently used keys by the wear marks. That's how I know that apparently I use the L, M, N, A and E keys a lot - the keys are now just black, the letter is faded. But most people don't use the keyboard for just their passwords, and the wear pattern is also influenced by the stroke direction, angle and pressure - ...


18

There are two different scenarios. This would be a valid question if the keyboard is used only for password typing. A numeric keypad on a door, that's something you shouldn’t post on social media. But you can argue this by saying that there are special characters on your keyboard which may be included in your credentials, because normally we don’t use those ...


6

Firstly terminology, SHA-512 is a hashing algorithm not an encryption algorithm, so it makes not sense to talk about "decrypting a SHA-512 hash". As your link states you are trying to find a collision e.g. an input that gives the same value as a known hash. If you have an unknown, large, random input this becomes an exhaustive search such as described first ...


1

This method should have following properties: Probability of false positives can be made as small as desired Server learns only the (approximate) number of items on each person's phone book, but not numbers themselves and cannot brute-force them Client-side brute-force attacks are impossible, as server can enforce policies against them Phones do not learn ...


3

With Isemis mention of "probability of false positives" I thought about Zero-knowledge proof. This answer makes no claims to be secure as it was never reviewed, so others should review and comment it. I am no professional security expert either and I didn't have the time to make sure the low number of possible phone numbers might be a problem. User A and ...


0

Why hash them? Why not encrypt instead, and send them to your own server. That way neither client device has to have access to each other's contacts, and the server does most of the work. This does introduce a single point of failure though, the server. If it was compromised, the attackers could potentially access all numbers. This could be controlled if ...


6

How can we do this in a cryptographically secure way and respecting the users' privacy (i.e. without sharing the numbers in plain-text between them or with a server)? tldr: You can't. Hashing is great for certain uses, but this is probably not one of them. The reason is that an attacker would know that there are only 10 billion possibilities (for ...


5

Let's do some tests! I started with a naive bash implementation, and calculated 10k numbers in 33 seconds: #!/bin/bash phone="2125551212" salt="abcdefghijklmnopqrstuvwxyz" shasalt() { echo "$* $phone $salt" | sha512sum; } for f in {1..10000} do shasalt $(shasalt $(shasalt)) >/dev/null # or write to a file... ((phone++)) done echo ...


17

There are potentially other privacy issues you're not considering yet. By design your app makes it easy to see who is connected to a certain target. So an attacker creates one contact on their phone (the activist/informant/terrorist/victim they are interested in) and then connects to many other users through your app, to create a list of the target's ...


11

Yes, it is (a bit) flawed. The problem is that the space is too small, so even with the multiple rounds and salts, it's relatively easy to bruteforce. Open Whisper Systems had a witty system where they provided an encrypted bloom filter that can be queried locally using blind signatures. They explain the process (as well as providing a good discussion of ...


25

bcrypt would be a somewhat better approach because it is designed to be (programmably) slow. Using a large enough salt and a reasonable complexityFactor, bcrypt(salt + number, complexityFactor) should yield a viable hash and you avoid "rolling your own cryptography", which could possibly turn out to be a difficult sell. To increase security you just crank ...


0

When using CloudFlare (like mentioned in one of your comments. Two things happen. The server and application both are not aware that CloudFlare (a reversed proxy) is used. To fix this you need to tell the used software (WordPress and fail2ban) where to find this original visitors IP. Otherwise I'll be working with the CloudFlare IP's (since that's the new ...


1

I'm guessing you are getting many of the failed logins from other countries outside of the U.S. What I recommend for WordPress is to download an IP Blocker from the plugins and this gives you the ability to block certain countries or all the countries besides the ones you want. In my case I have a website that is only to be viewed in the U.S. so I blocked ...


0

If you have an access to the server then you can install fail2ban. You will need to set up jail for the wordpress /etc/fail2ban/jail.d/wordpress.conf [wordpress] enabled = true filter = wordpress logpath = /var/log/auth.log port = http,https $ service fail2ban restart For more details check here. Make sure that you are not using default username ...


6

Answer: No, a bruteforce attack would most likely fail. http://www.payetteforward.com/my-iphone-is-disabled-connect-to-itunes-fix/ According to this site, and anyone who has ever been a mean big brother, there are only 10 times you can attempt to unlock an iPhone before it is completely locked and needs to be restored. 1-5 failed attempts - The phone will ...



Top 50 recent answers are included