Tag Info

New answers tagged

0

There is one risk that hasn't been mentioned here yet: when you're having both Tor Browser and a different browser open, you may accidentally confuse them and either enter identifying information in Tor Browser or perform activities which you wanted not to have tracked back to you in the other browser. There is no great technical risk, but you'll have to ...


1

Yes, an app can access either camera without requesting the user's permission (except in China as you found out). All apps have unrestricted access to view the camera feed of either the front-facing or rear-facing camera and take pictures/videos. However, access to the Camera Roll to save such media does require the user's consent. Most apps on the App ...


-3

Thanks gents, Apparently this is related to heartbleed. I had an email received from TRA as follows: Telecommunications Regulatory Authority Republic of Lebanon e-Security Alert: Beware of Heartbleed Bug A serious vulnerability named the Heartbleed bug was announced Monday night (04/07/2014) in OpenSSL* (version 1.01 and OpenSSL beta 1.0.2.). The ...


2

This looks like a bug. Actually, regardless of whether there was interception or not, this is bug: when you spy on someone, you certainly don't want to make that person aware of the spying. But in this case, I'd rather incline towards a more mundane buffering issue. In phone networks, especially mobile networks, audio data is split into individual packets ...


-2

Ubuntu is the most secure operating system in the world, check out this link http://www.technology91.com/ubuntu-12-04-lts-tops-gchq-security-report-over-windows-and-mac/


2

One censorship method that hasn't been mentioned yet is TCP Reset packet injection, which terminates undesired connections via forged TCP RST packets. The Great Firewall of China has been known to do this for years (source: http://www.icir.org/vern/papers/reset-injection.ndss09.pdf). Often this is used in conjunction with DPI, such as to do protocol ...


5

Some research on this topic: Empirical Analysis of Internet Filtering in China (2003) For some 1,043 of sites tested, we confirmed that DNS servers in China report a web server other than the official web sever actually designated via each site's authoritative name servers. We call this phenomenon "DNS redirection," though others sometimes refer to the ...


0

In addition to Bob's answer, there is another security disadvantage when making use of GET requests with sensitive parameters. The URL, which includes the sensitive information, is sent to third-party web servers hosting resources referenced by the resulting HTML page. Example: First request: GET /someCode/pages/somePage.jsf?pin=MzAwMDY3MDI2OQ HTTP/1.0 ...


4

It's a question of resources actually. If a country were willing to devote a enormous amount of time, money, and expertise to the problem, I believe it would be possible to effectively block a few select sites. The reasoning is that all the circumvention methods themselves need to be broadly publicized among the target audience to be successful. A ...


32

You have covered the main ones. In short: it's very hard, if not impossible, to effectively block a site you want. You can make it hard by using the techniques you've mentioned: blocking IPs, redirecting DNS, blocking HTTP requests to certain sites / containing certain keywords. These methods are thwartable by proxies (in the case of deep packet ...


11

"Efficiency" depends on your goals. An important point to be made is that all blocking techniques can be circumvented, at a price. For instance, an individual can use a satellite phone to get connectivity which cannot be blocked by his country, save by direct physical intervention of armed forces. But using such systems is quite expensive. Countries which ...


1

I made a 16384-bit master signing key with 4096-bit subkeys using a modified version of GnuPG about a week ago. Then I imported it into a trial version of Symantec Encryption Desktop (formerly PGP Desktop). The key (and all of its subkeys): will not encrypt, sign, or decrypt anything. cannot change password. cannot modify preferences (like encryption, ...


1

Your "master key" has value only insofar as its public part can be used to verify that which was signed with it; and this includes other people. For instance, your "master key" is your ultimate resource to revoke sub-keys. So if you mind about interoperability, then you cannot make the master key as big as you would wish, even if your GnuPG binary has been ...


1

A "master signing key" (ie your identity) should be safe enough for a lifetime, because ideally you don't ever want to change it, right ? Yes, that's the idea. I am considering using 4k keys for encryption and documents signing, and a 8k+ key as "master key". That means I will use my master key only to sign my owns keys, and other ppls keys. Also ...


-2

Although the data you send is decrypted it is not possible for the IT staff to actually view the data you have sent, the only thing that is looked at is the web address.


2

The answer is yes, he can see what you're doing on the internet when he is connected to your WiFi network. The encryption protocol used is pretty much irrelevant. Whilst WPA2 will generate a unique session key for each client association, if the attacker captures this he can still decrypt your traffic. Even if the attacker doesn't capture it, he can forge ...


-2

Short answer: WEP? Yes. WPA? Maybe. WPA2? No. WEP is broken and you shouldn't be using it for a multitude of reasons so we'll skip that. Some WPA networks can be exploited by attackers who do not know the password. http://www.aircrack-ng.org/doku.php?id=tkiptun-ng WPA2 is what you should be using. In this scheme each client connected to the access point ...


0

With basic means (i.e. software to write to the memory card) I am rather doubtful that it is possible to trustedly delete all sensitive data. Inside of such a SDXC there is a complex microcontroller. Those microcontroller is not known to you and its software/hardware is proprietary. The memory size shown by the SDXC must not reflect the complete data the ...


10

This topic has already been covered here and there. To sum up: If you simply overwrite the complete disk (as a block) with data (random, null bytes... it does not matter), then there may be parts of surviving data, which could potentially be recovered by extracting the chip and reading from it directly. You cannot know what data has survived without taking ...


1

The best alternative will be quantum locking of communications in peer to peer sessions but it is still developing, extremely expensive, has distance limitations for now


1

You asked quite a lot of different questions here. I'll try answering each. Spoofing/sniffing: The cure is encryption. More specifically Public Key Infrastructure. Then B can't modify (or even decrypt) data that it's relaying. The only question here is how you want to implement the key exchange (so that it can't be attacked). Open ports: An open port is ...


0

The following article explains some ways that NSA could undermine the security of SSL: http://blog.cryptographyengineering.com/2013/12/how-does-nsa-break-ssl.html To summarize, here are some of the methods the NSA may be using to break internet encryption: Compromising RSA keys, either by remote software exploit or subpoenas and gag orders. Suborning ...


2

There is nothing in the "Snowden revelations" which even hints at any special NSA ability at breaking RSA. Even taking all that Snowden says as gospel, NSA is still at the same point as everybody else, meaning that breaking 1024-bit RSA is "theoretically feasible" but subject to the building of a very special machine whose design has been roughly sketched, ...


-1

I think there is no alternative for RSA as its the most used algo for all public key crypto mechanisms, I read somewhere that NSA pay RSA in order to keep the algo weakest, actually using an RSA key with less than 1024 bits is vulnerable to brute force attacks, security experts recommend 2048 bits as key length, but NSA still have the possibility to spy ...


0

using Bank account number alone will not let you directly reach any thing , but on some banks it is used as username for online banking , or it will be asked by customer service person as layer of authentication, or it can be used for social engineering and be part of information gathering


2

The BBC has a two minute video of talking heads discussing the technology but it doesn't show how it works. The iSIS technology is a 'special material' that can be added to the existing aRMour technology that electroplates a 25 micron coating on coin blanks. The mint's PDF submission to the International Association of Currency Affairs explained that there ...


1

You want to use dynamic data masking. There are different products in that space. Have a look at Oracle VPD (Virtual Private Database), Informatica DDM, or Axiomatics Data Access Filter which all provide means to define policies as to what you can see / cannot see. These tools are meant to protect data, which seems to be along the lines of what you want to ...


1

Software that "phones home" usually contains a unique identifier. The most common examples are iPhone apps that are ad-supported, as they transmit your advertising identifier every time they display an ad. But any software that requires you to pay for an online service will identify you every time you use it. Office365 is one such example. I don't think ...


1

When you make a request with your browser, the server can request to know capabilities in order to know what to serve you plugins, fonts, etc. For other general purpose client-server applications like FTP, SCP, the protocols generally don't provide a mechanism to transfer this information. If you do not have a malicious client that is sending files in the ...


2

No, I wouldn't worry too much about other applications, especially not the ones you've mentioned above. First of all they don't send out as much information as your browser does. Depending on the protocol or application there might be a a couple of things like a header describing the used program or version, but usually there are no plugins or extensions ...


53

The Royal Mint indicated that the technology is patented, and having relatively few patents under its name it seems likely that they are tagging their coinage with embedded luminescent particles. Abstract: Formation of an authentication element by deposition of a metal layer with embedded particles on a metal substrate, wherein the embedded particles ...


1

I was reading about the anonymizeation problem just the other day. As it happens, the first edition of what I was reading is on line, at https://www.cl.cam.ac.uk/~rja14/Papers/ This is from Ross Anderson at Cambridge, who is well-known in the community. You want one of the Security Engineering chapters, starting at SE-01.pdf, but the're other stuff there ...


71

They are using a system called ISIS which also has some more details available here. It appears to be a form of micro-tagging embedded within the currency itself (based on the comment the same technology has been used in fuels and perfumes). Basically, a specially manufactured particle is constructed and then mixed as an additive with the coin. This ...


2

Well, obviously we don't know - security by obscurity is a perfectly good idea so long as it is only one part of a security in depth approach. But my understanding is that it is chemical - ISIS is a plating system that uses a material that you can cheaply and accurately detect, so your vending machine can taste the coins and figure out if they are good or ...



Top 50 recent answers are included