New answers tagged

0

There are multiple layers of encryption available on iOS devices which I feel are best explained before saying what can and can't be accessed. Whole Disk Encryption For iOS 3 Apple introduced whole disk encryption where the entire hard-drive is encrypted when the device is locked. However the key for this encryption are held within the device so whole disk ...


3

PCI DSS v3 section 6.5 calls out the need to protect sensitive data even if it is in memory, to help thwart memory scraping attacks. So if you expect to need PCI compliance, yes, you should protect sensitive data even if it's in memory. I don't know what technology you are using, but even non-persistent data can stick around for a while. For example, ...


0

Any such system worth its salt (sic) will have a time based MAC (or at least an option to add one) for exactly this reason. I can't comment specifically on Apple's service, but I know it's something which, for example, Azure offers for token based access to its cloud storage system... I even wrote a similar mechanism for protecting RTSP streaming commands ...


1

Some ideas: For web apps, use SAML SSO. They will need to login to one web app, then other logins will be seamless. There's also OpenID and OAuth which do similar things. For mobile apps, you could have the user just login once when they install the app, and have a long-lived session token. You could use client certificates. A pretty decent solution, ...


0

Absolutely. There are countless ways to compromise a VPN. VPNs were not designed for multiple mutually untrusted people to share the same system. This applies to all direct IP to IP technologies, including OpenVPN, IPSEC, GRE, MPLS, IPIP, and more. Using a variety of methods (lsrr, netbios probing, dns cache poisoning, etc), attackers can find your real IP ...


1

A CSPRNG is expected to return every possible value of the image space with a probability indistinguishable from a random distribution. Leaving certain results out would make a bad design. Think of dice. If you roll 1-1-1, you would not think that this is not random enough and sort it out - You just generated that entropy with certainty that it is real. ...


2

The attack simply does not work on iphones. Main reason being iOS performs key wipe on the RAM, so it is not possible to retrieve any key via cold boot attack. You may find this link useful. Note also that this attack was based quite some time ago on Android 4.0 http://www.slideshare.net/DaiYang/main-29642969



Top 50 recent answers are included