Hot answers tagged

16

Locked domains are domains which require additional hoops be leapt through in order to change ownership. The lock is requested by the owner of the domain and implemented by the registrar of the domain. Historically, transferring ownership of a domain required something like one of the authorized contacts faxing in a signed paper. And, believe it or not, ...


11

You ask for tunneling a protocol (like HTTPS) through plain HTTP. And yes, there is at least httptunnel which does this. From the descrition: HTTPTunnel is a tunneling software that can tunnel network connections through restrictive HTTP proxies over pure HTTP "GET" and "POST" requests. But note that if you work in an environment where use of HTTPS is ...


8

Secure Communication The communication protocol must be secure. If the communication channel is insecure then the authentication is insecure. TLS/SSL is one way to secure the communication protocol. If you don't use TLS/SSL you would need to build a framework to build a secure communication protocol over an insecure link. If done properly ...


5

If my understanding is correct, anyone in possession of Bob's private key can easily determine the session key and decrypt the message. Only Bob should have access to Bob's Private Key, hence no one else would be able to decrypt the encrypted session key.


5

OpenVPN uses SSL/TLS for it's secure protocol which secures data at the Transport level, while IKEv2/IPSec secures data at the IP level. Both protocols are secure. You can see this answer for comparing the two protocols for VPN use. Android Both protocols are supported by Android. OpenVPN has a mobile app, and there's also OpenVPN Connect (I'm honestly ...


4

I will answer your question in two parts: The communication channel should be encrypted with RSA. How can I do that? RSA is really slow to encrypt whole messages. The usual way this is done is to encrypt the message with a symmetric cipher like AES, then encrypt the symmetric key using the recipient's RSA public key. Having said that, there are a lot ...


4

It would be easy to sniff data using tools like WireShark from someone who can access the data path between your client and the server. This isn't something anyone on the Internet could do per se but if your device uses wireless and there are people nearby they could grab this data if they wanted it. As for finding your UDP service on-line that is easy to ...


3

Learning Basic Networking is very important.These are protocols specific RFC's , to gaing in-depth knowledge about a particular protocol. You can approach by : for example IP RFC 791 First study and learn IP from IP RFC,or various resoures. After Having the knowledge of IP , you can find out what are the different security problems related to IP. For ...


3

No. The facsimile protocols T4 (Modified Huffman) and T30 (ITU-T T.82) are primarily compression algorithms there is no encryption involved. https://en.wikipedia.org/wiki/Fax#Compression Regarding the "Networked" component that primarily refers to newer fax machines which have wireless or Ethernet connectivity so that a group can send documents over the ...


3

Depending on how you see it, there is one, two, three, or many more "handshakes". A first distinction is between "SSL-2.0" and "SSL-3.0 and later". The format of records and handshake messages for SSL-2.0 differs a lot from the records and messages used in subsequent protocol versions. Apart from the format and the implemented algorithms, a notable semantic ...


3

What you have thought through on your own is the standard way of doing encryption for network traffic: Generate a random symmetric key, Encrypt entire "message" using symmetric key (plus IV, nonce, etc), Encrypt symmetric key using target's (in this case, your central server) public key, Destroy the 'plaintext' symmetric key, Ship the encrypted goods to ...


3

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID. Password generator is a shared service In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, ...


2

These are simply Subdomains created by the website owner. ww3 is often used to share load (ww1,ww2,ww3) on their servers. In you example it seems intel created www-ssl subdomain to separate normal http traffic and https traffic on subdomain level. If you want more information why somebody is doing this, just ask google or the website owner


2

My gut feeling was that I would rather direct the SNI-less connections to a different server (not the same one serving Bob), and via means that are external from the same server. Something like a Deep Packet Inspection firewall actually looking at the ClientHello versions and the SNI part. I can see two reasons against SNI-hole being parsed in the same ...


2

A formal proof might only be made against a formal specification. In other words: you cannot mathematically prove that a software matches a behavior if you are not able first to mathematically define this behavior. I have serious doubts that a general concept such as "anonymity" or "privacy" may be formally specified, and therefore that they can be formally ...


2

Having pentested a number of custom network protocols (all implemented on top of TCP or UDP, sometimes with (D)TLS as well), I recommend against this idea. You will get it wrong, and then you'll have a remote exploit vector. It is much, much safer to use an existing data format (JSON via HTTP is popular these days, though yes, that's a lot of overhead) with ...


2

Assuming it is communicating over a network: Wireshark and/or Tcpdump to capture and analyse data. Hex Editor to define headers, footers and other data structures within the packet streams. A lot of the traffic will most likely not be human readable characters. TCPReplay to replay the traffic, allowing you to modify and re-test. WireEdit, allows you to ...


2

It's not exactly what you requested but at least these two are worth a look in my opinion. There's a general and abstract notation for describing security protocols, which is being used to describe quite complicated stuff such as Kerberos. The Needham-Schröder protocol can also be expressed this way. Again, not really what you were looking for, but made ...


2

It is worth noting that numerous services exist online that do this sort of thing. Accellion, LiquidFiles, Dropbox, Box.com, and numerous others can grant you this kind of functionality. Depending on volume and complexity, you might even be able to leverage some marketing-oriented online service like salesforce.com or hubspot. There are a zillion things ...


2

TLD locks were created to prevent the following: > Modification of the domain name, including: > Transferring of the domain name > Deletion of the domain name > Modification of the domain contact details As per "Registrar Lock" status codes. It benefits companies who pay for it as a service (e.g. stop someone from doing ANYTHING to a domain ...


2

Traffic inspection (particularly for Application Filtering). If I am an employer and I keep HTTP proxy logs of the websites you visit (and block some of the undesirables on work-time such as Facebook), I don't want you connecting to a VPN or other SOCKS proxy and bypassing my restrictions or uploading my confidential business information which is why I've ...


2

... never open a socket to "any" protocal,... A socket gets opened by an application to accept data for a specific protocol, because this is just how applications work. No application would accept "any" data because it simply does not know how to handle these data, i.e. it has only implemented a specific communication protocol like HTTP, SMTP etc. The ...


2

There is no such thing as the most important RFC's. Practically every RFC describing an actually used protocol is relevant, because often you can find security problems in the implementation of rarely used parts of the RFC or when dealing with invalid or inconsistent data. If you want to restrict yourself to analyzing the lower layers then the RFCs for ...


2

Edit: Clarified based on use case First off, no system is perfect. Engineering is the art of making the best tradeoffs. For backend-to-backend APIs (e.g. your server app and 3rd party API service) - API keys are really good. Most issues with API keys comes from developers neglecting how they store them (in code => commit to github public repos etc). API ...


2

This is vulnerable to a MITM. All Eve has to do is sit in the middle and forward traffic from C1 to S1, and from S1 to C1. This entire handshake could occur, and Eve could still be communicating with S1.


1

A transfer lock means that the registry (eg .co, .eu etc) will not transfer the domain, and will not release transfer codes either. Transferring using a code will not work either. To release the lock, you would have to go into the domain admin panel, using the authentication solution that the registrar is using (for example: One time codes) and remove the ...


1

Both sides (client and server) can encrypt everything by a shared secret. The handshake would start by a salt and then everything would be encrypted by a stream cipher. Possible sniffer would see only the random mess being send between server and client, no handshake, no packet headers, no readable/open data. So, the only way how to determine the protocol ...


1

So here's a quick sketch of what I would do here. Assign each user a pin on registration. Make sure it's secret. https://codereview.stackexchange.com/questions/61338/generate-random-numbers-without-repetitions Should give you a good way to do this with no repeats. Be sure to pick a sufficiently large number of digits! Have a page with boxes for the ...


1

I've written this type of chat service before. When a user joins the server the public key for the client should be sent. Then whenever a private message is started the server can distribute the public keys to the respective clients who are communicating. You have to remember that using RSA to encrypt entire chat messages will be slow. Which is why ...



Only top voted, non community-wiki answers of a minimum length are eligible