New answers tagged

2

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used, and a long-lasting refresh token periodically requests a new auth token once the previous one has expired. In scenario 1, if the auth token is compromised ...


0

Computerphile vid about steganography Edit- The video covers jpeg steganography where data is meant to be hidden in an image by changing the least significant bit or values in the discrete cosine transform used to compress to jpeg. the idea is to have the image not be perceptibly altered and still contain as much information as possible. From the article you ...


1

Are you defending against an attacker with full access to the device? If so, a credential encrypted with a PIN code (which implies it consists of only 4 or 6 digits) is very easy to decrypt - a maximum of only 10,000 or 1,000,000 tries and you're there. I would recommend verifying the PIN that the user entered against the server for authentication, and ...


2

Androids permission model up to lollipop is flawed in the sense of usability, and they are moving towards context driven permission request model. Let us review the current situation again: You as a normal user are looking for an application and after searching the google play, you finally find it. As happy as you can be you click install, and then there ...


5

With the old telephone systems which were in use 30..40 years ago such crosstalk happened from time to time. I'm not sure about the quality of the phone system in your place, but this is at least something I've experienced myself several times. Of course it could be also related to phone tapping but I doubt that somebody who maliciously taps the phone will ...


0

Assuming it's not a "fake" off state (as other posters point out, a relatively easy thing to do if the phone is under control of the attacker), then: probably not. Most phones that are in an "off" state will turn off the radios (cellular, wifi, and bluetooth) to save power.


1

IF someone asks to borrow my SIM card, am I vulnerable? YES The analogy Your sim card is like your social security number for your cell phone. Lending that to someone is the same as giving them your social. Now they have your information, you identity on the cell network, and can rack up charges by impersonating you. Worse yet they can even intercept your ...


2

Yes, you can clone a SIM card. All you need is a SIM writer, a blank SIM, and roughly 15-30 minutes. (guide for v2 cards) Once that happens, they've effectively become your phone, and can intercept communications and messages, and charge your phone plan. I do not know of any "rogue SIM card attacks," most attackers focus on attacking the SIM cards ...


0

Are you facing this problem while using a wifi connection? If yes, please make sure other devices connected to the same wifi router are working properly. I am experiencing a similar issue in my home. My desktop computer with Fedora 23 is affected, together with all wifi devices sharing the same router. I have read in the avgforums that manually resetting the ...


1

A proxy is better for that. I think if you configure this proxy but skip the SSL cert configuration you should get your answer.


4

You can't, at least not until mobile OS developers stop prioritizing UX over security. For now the best you can do is to make sure the app you're using is from a legitimate and trusted developer, and the credentials it's asking for are related to the function of the app (a photo app asking for Instagram credentials to post on it seems alright, but the same ...


3

The clipboard indeed cannot be considered a safe place, this for several reasons: Malware accessing the clipboard content: in your question you focused on malware installed in your machine, however there could be transient malware (like a malicious Adobe Flash banner on a website you visited for instance...) which will not infect your computer when run, ...


2

When malware is present on the device, indeed, having the pasteboard store this data would be the least of your worries. However, this is still bad practice. You should not store important user data in the clipboard. You shouldn't even be putting it in the pasteboard/clipboard anyway. Why? Because a malicious application could access your clipboard data. ...


0

The token that you are speaking about is not generated in the mobile app. It is generated in the 3rd-party authentication servers and passed to your mobile app. Your mobile app has to pass it back to the servers to validate your apps's authorization. Regarding security of the token, assuming that you are using SSL, you can pass the token in either a query ...


4

It's nothing to worry about, there's no reason to believe that you're compromised from just what you've stated. Addresses are assigned by the chip manufacturer (and, the bluetooth and wifi are likely on the same chip), it's most likely just easier for the manufacturer to increment by 1 for each one. The bluetooth/wifi addresses are also expected to be ...


0

Firstly, go into Chrome -> Settings -> Search Engine and check the search engine. There is a malicious search engine bug that google is yet to fix involving JS execution via the Default Search Engines feature. Then, grab everything from /data/data/com.android.chrome/. The chrome cache is in a directory named cache under this directory. Next, wipe the ...



Top 50 recent answers are included