Tag Info

Hot answers tagged

44

Tor uses a routing method called Onion routing. Much like an onion, each message (the core of the onion) is covered with layers of encryption. image attribution Your message is encrypted several times before it leaves your device. Node A can only decrypt (peel) the layer A, under which it would see the address of the next node. After the packet reaches the ...


39

Here are my thoughts on this: Somebody could hide something--a flashdrive with malicious content, for example--in an unlocked drawer. An employee could find that flashdrive and plug it in to his computer, putting the computer at risk of compromise. Also, it's easier to modify the locks of unlocked drawers than it is to modify the locks of locked drawers. ...


19

The HTTPS protocol is equivalent to using HTTP over an SSL or TLS connection (over TCP). Thus, first a TCP connection (on port 443) is opened to the server. This is usually enough to reveal the server's host name (i.e. www.mysite.com in your case) to the attacker. The IP address is directly observed, and: you usually did an unencrypted DNS query before, ...


16

The worst thing you can do is tearing them apart. It's time consuming and attacker just needs extra time and patience to put pieces together. The same rule applies for shredding - if after shredding are left too large pieces, again, attacker just needs time and patience. There are several shredding techincs (from wikipedia) Strip-cut shredders, ...


15

It depends on whether you are talking about the concepts, the terminology, or the acronym. Concepts of confidentiality, integrity and availability of information have been used by war generals for quite some time; for instance, one can see Julius Caesar operating along these lines during the Gallic Wars and he was certainly not the first to grasp the ...


13

SSL serves three purposes (I'll use a snail-mail analogy to illustrate): Keep the communication secret: prevent the mailman from reading your letters. Verify that the communication is unaltered: prevent the mailman from altering your letters. Verify the identity of the sender: prevent someone else from sending you letters under a false name. Note that ...


13

As @Paŭlo Ebermann and @Jeff Ferland have told you, the GET request is encrypted under SSL and so is safe. However, don't forget that many web servers log GET requests and parameters, and any credentials or other sensitive information you send via GET could be written to a log somewhere. For that reason, you should use POST (which will also be encrypted ...


13

Why even store it in a MySQL database when you can be using Authorize.Net's Customer Information Manager API and taking PCI compliance and security issues right out of your hands completely and letting them do all of the heaving lifting for you? CIM let's you create customer payment profiles by storing the customer's credit card information on their end and ...


12

This is far-fetched, but non-obvious information leaks: 1. We must keep empty drawers locked If someone knows that there is a regular meeting discussing secret project X every Tuesday and Friday; and noticed that the drawers are always empty and unlocked on Tuesday and Friday, but locked otherwise, then it's pretty clear indication that the content of ...


11

On any Wi-Fi network - encrypted or not, given today's Wi-Fi encryption protocols - any sufficiently skilled and equipped user of the network (and especially the network administrator) could easily access any data you transmit or receive via cleartext protocols. This includes usernames and passwords as well as web pages, documents, and other data sent or ...


11

The key regulation you must follow is the Payment Card Industry Data Security Standard (PCI DSS) and of specific interest here is section 3.4 - Protect Stored Cardholder Data Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of the following approaches: One-way hashes based on ...


11

TOR uses the principle of onion routing. Let us say there are 3 TOR nodes A,B and C involved (selected randomly by client) and the message is m. We assume the corresponding public keys of these nodes to be Pa,Pb and Pc. The message is repeatedly encrypted by the client starting with the public key of the exit node (Pc) followed by Pb and in the end Pa ...


10

To a large extent, yes. See RFC 4880, section 5.1: for each recipient, there is a "Public-Key Encrypted Session Key Packet" which contains the recipient key ID. This key ID is a 32-bit value which is used as index in key servers; there are key ID collisions, so this is not an absolute, totally accurate indication of the recipient, but it still gives a lot of ...


10

In security, attacks are generally divided into two categories: Opportunist attacks and targeted attacks. The former are generally low-effort and low intelligence (ie, no specific information or recon on the target), the latter have to be assumed to be motivated, well-equipped, and intelligent. The broader issue behind this question is: Does obscurity do ...


10

None that I know of. And I believe this is because.. I don't think the solution (implied by the question) is a good solution/proposal. Not only because hashing function may have collisions (even if it has a very low probability, the impact would be major, so why should we add such a risk ?) but also because you have another problem prior to hashing: unless ...


10

On a theoretical point of view, an HTTPS site with a warning on the certificate is no better, but no worse either, than a plain HTTP site. As long as you only browse, reading data but not sending anything, and not especially trusting what you read, then you can ignore the warning. However, it is quite rare that a reading-only site goes to the trouble of ...


10

There are three meanings for "safety" here: safe against eavesdroppers (confidentiality); safe against malicious alterations and/or theft (integrity & availability); safe against accidental alteration and/or loss (integrity & availability, also). Amazon S3 is a service which strives at providing safety types 2 and 3, but not 1. However, their ...


9

Keeping information in RAM can enhance security, if done right and if the requirements allow it. I'm going to show two security architectures where keeping the data in RAM provides a security benefit. These are fairly specific scenarios; most of the time keeping data in RAM doesn't help. Protection against file dump attacks Consider a web application that ...


9

To answer my own question: It seems that some systems are, or rather were indeed insecure, leaking environment information to other processes. A similar issue to the present one is raised on github by user 'mitchblank' for the 'mosh' application (mobile shell). The author writes: Background: in the process image argv[] and envp[] are stored in the same ...


9

They will get a CA that is in the CA root zone for all browsers to issue them valid certificates. This CA will probably be a UK based company. Spying will be completely transparent to the users. Browsers will show no warnings. This will work for a few days, until it is detected by the public at which point browser vendors will revoke the root certificate of ...


8

Rather than "bypass" encryption, they can spoof the identity of the server, so as to perform a MITM attack (effectively). Encryption itself is only one part of the configuration when setting up an SSL/TLS connection: this ensures the confidentiality of the communication between the client and the server. Before that, the client needs to verify the identity ...


8

You should assume that the URL is not protected, i.e., that a passive eavesdropper may be able to learn what URL you are visiting. I realize this contradicts what some other folks are claiming, so I'd better explain. It is true that everything after the domain name is sent encrypted. For instance, if the url is https://www.example.com/foo/bar.html, then ...


8

In a perfect world, you are right: there should be no point in keeping data encrypted in RAM. The OS should keep strong separation between processes, clear RAM when it is reallocated to another process, and, if the attack model allows for an attacker stealing the device afterwards and doing some harddisk analysis, encrypt the swap (or use no swap at all, ...


8

Burning is a cheap and effective way to get rid of this data. Included are some links to some burning standards: US Army Data Destuction (Check out Section V) http://www.apd.army.mil/pdffiles/r380_5.pdf (Search for "burn") http://kdla.ky.gov/records/Documents/Destruction%20Guidelines.PDF One of the biggest issues with burning is that you end up with ...


8

Simply put - any unencrypted message which is sent can be seen by an attacker who has access to the communications channel. This can be more of a problem with a wireless network, as it is broadcast as opposed to a wired network, which would require an attacker to gain access to a point on the route. The solutions to this are: to encrypt the message to ...


7

The short answer is that when you put your data on the cloud the provider has the technical capability to do what they want with it. They could sell it, trade it, share it, etc. What is keeping them from doing just that is a) the terms of service or contract agreed (read it to make sure they don't have rights to your data as some claim rights over anything ...


7

This may sound very non-technical, but the simple way to do this is: Start as per @ThomasPornin's answer - use strong encryption on your data for confidentiality, and use a very long passphrase (sufficent to rule out brute forcing in any reasonable timeframe) store the encrypted data in various locations for availability (personally I wouldn't want to ...


7

Going to have another go at this one, to try and address the many excellent comments... A cheque is an instruction to a bank to take money from Alice's account and give it to Bob. In order to act on it, the bank need to know Alice's account details; they must be written on the cheque in some form when it arrives for clearing. A pre-printed cheque in ...


7

After reading your question several times, I think I understand what you mean. You're talking about an Administrator in the sense of Joomla! or WordPress administrator. Where an admin is a concept created by the application itself, and that admin has no access to the actual server. In applications (Joomla!, WordPress, ModX, Concrete5, DotNetNuke, etc.), the ...


7

I like the point that SSL provides: Point to point confidentiality - the ssl provider on the server side and your browser are sharing an encrypted session that is not easily breakable by a man in the middle - this gives you both privacy, and integrity between the points. Assurance of the server's identity - when the server side certificate provides proper ...



Only top voted, non community-wiki answers of a minimum length are eligible