Hot answers tagged

16

Locked domains are domains which require additional hoops be leapt through in order to change ownership. The lock is requested by the owner of the domain and implemented by the registrar of the domain. Historically, transferring ownership of a domain required something like one of the authorized contacts faxing in a signed paper. And, believe it or not, ...


11

You ask for tunneling a protocol (like HTTPS) through plain HTTP. And yes, there is at least httptunnel which does this. From the descrition: HTTPTunnel is a tunneling software that can tunnel network connections through restrictive HTTP proxies over pure HTTP "GET" and "POST" requests. But note that if you work in an environment where use of HTTPS is ...


7

Let me try to sum up what the landscape of end-to-end encrypted messaging protocols for group chat looks like: Protocols like PGP have been around for some time and offer "group messaging" by simply encrypting the content with a randomly generated symmetric key and then encrypting that key asymmetrically with the public keys of each of the recipients. ...


5

If my understanding is correct, anyone in possession of Bob's private key can easily determine the session key and decrypt the message. Only Bob should have access to Bob's Private Key, hence no one else would be able to decrypt the encrypted session key.


5

OpenVPN uses SSL/TLS for it's secure protocol which secures data at the Transport level, while IKEv2/IPSec secures data at the IP level. Both protocols are secure. You can see this answer for comparing the two protocols for VPN use. Android Both protocols are supported by Android. OpenVPN has a mobile app, and there's also OpenVPN Connect (I'm honestly ...


4

I will answer your question in two parts: The communication channel should be encrypted with RSA. How can I do that? RSA is really slow to encrypt whole messages. The usual way this is done is to encrypt the message with a symmetric cipher like AES, then encrypt the symmetric key using the recipient's RSA public key. Having said that, there are a lot ...


4

It would be easy to sniff data using tools like WireShark from someone who can access the data path between your client and the server. This isn't something anyone on the Internet could do per se but if your device uses wireless and there are people nearby they could grab this data if they wanted it. As for finding your UDP service on-line that is easy to ...


4

I sneakily edit a sneaky MITM attacker into your image: The problem with this protocol is that Bob does not authenticate with Alice. That means a man-in-the-middle attacker who can manipulate the data-flow between Alice and Bob can intercept the initial connection attempt from Alice and respond with their own certificate. Alice will then communicate ...


4

DHE key exchange is very slow compared to ECDHE, so you should prefer the ECDHE ciphers. ECDSA is faster than RSA for the same level of security, but of course you need a ECDSA certificate and not a RSA certificate in this case. AES-GCM is faster than ChaCha20-Poly1305 on systems with hardware support for AES but slower on systems without hardware support. ...


3

Learning Basic Networking is very important.These are protocols specific RFC's , to gaing in-depth knowledge about a particular protocol. You can approach by : for example IP RFC 791 First study and learn IP from IP RFC,or various resoures. After Having the knowledge of IP , you can find out what are the different security problems related to IP. For ...


3

No. The facsimile protocols T4 (Modified Huffman) and T30 (ITU-T T.82) are primarily compression algorithms there is no encryption involved. https://en.wikipedia.org/wiki/Fax#Compression Regarding the "Networked" component that primarily refers to newer fax machines which have wireless or Ethernet connectivity so that a group can send documents over the ...


3

Depending on how you see it, there is one, two, three, or many more "handshakes". A first distinction is between "SSL-2.0" and "SSL-3.0 and later". The format of records and handshake messages for SSL-2.0 differs a lot from the records and messages used in subsequent protocol versions. Apart from the format and the implemented algorithms, a notable semantic ...


3

What you have thought through on your own is the standard way of doing encryption for network traffic: Generate a random symmetric key, Encrypt entire "message" using symmetric key (plus IV, nonce, etc), Encrypt symmetric key using target's (in this case, your central server) public key, Destroy the 'plaintext' symmetric key, Ship the encrypted goods to ...


3

Thanks to comments from @Anders (thx!), I'm unsure if the password generator is a shared service or a personal authentication token like digipass or SecureID. Password generator is a shared service In this situation, Alice can only get the signed response H(R,K) by proving to the password generator that she is Alice by presenting her PIN. If Alice knew K, ...


2

Having pentested a number of custom network protocols (all implemented on top of TCP or UDP, sometimes with (D)TLS as well), I recommend against this idea. You will get it wrong, and then you'll have a remote exploit vector. It is much, much safer to use an existing data format (JSON via HTTP is popular these days, though yes, that's a lot of overhead) with ...


2

Assuming it is communicating over a network: Wireshark and/or Tcpdump to capture and analyse data. Hex Editor to define headers, footers and other data structures within the packet streams. A lot of the traffic will most likely not be human readable characters. TCPReplay to replay the traffic, allowing you to modify and re-test. WireEdit, allows you to ...


2

Generally, method 1 is more secure as it is possible to ensure the fingerprint image never leaves the scanner thus cannot be trivially copied via compromised software. Some anti-tampering technology can be employed to make it very expensive to try to extract data from the device. Your concern about how the scanner proves to the computer that the actual ...


2

My gut feeling was that I would rather direct the SNI-less connections to a different server (not the same one serving Bob), and via means that are external from the same server. Something like a Deep Packet Inspection firewall actually looking at the ClientHello versions and the SNI part. I can see two reasons against SNI-hole being parsed in the same ...


2

It is worth noting that numerous services exist online that do this sort of thing. Accellion, LiquidFiles, Dropbox, Box.com, and numerous others can grant you this kind of functionality. Depending on volume and complexity, you might even be able to leverage some marketing-oriented online service like salesforce.com or hubspot. There are a zillion things ...


2

TLD locks were created to prevent the following: > Modification of the domain name, including: > Transferring of the domain name > Deletion of the domain name > Modification of the domain contact details As per "Registrar Lock" status codes. It benefits companies who pay for it as a service (e.g. stop someone from doing ANYTHING to a domain ...


2

Traffic inspection (particularly for Application Filtering). If I am an employer and I keep HTTP proxy logs of the websites you visit (and block some of the undesirables on work-time such as Facebook), I don't want you connecting to a VPN or other SOCKS proxy and bypassing my restrictions or uploading my confidential business information which is why I've ...


2

... never open a socket to "any" protocal,... A socket gets opened by an application to accept data for a specific protocol, because this is just how applications work. No application would accept "any" data because it simply does not know how to handle these data, i.e. it has only implemented a specific communication protocol like HTTP, SMTP etc. The port ...


2

There is no such thing as the most important RFC's. Practically every RFC describing an actually used protocol is relevant, because often you can find security problems in the implementation of rarely used parts of the RFC or when dealing with invalid or inconsistent data. If you want to restrict yourself to analyzing the lower layers then the RFCs for TCP,...


2

Edit: Clarified based on use case First off, no system is perfect. Engineering is the art of making the best tradeoffs. For backend-to-backend APIs (e.g. your server app and 3rd party API service) - API keys are really good. Most issues with API keys comes from developers neglecting how they store them (in code => commit to github public repos etc). API ...


2

This is vulnerable to a MITM. All Eve has to do is sit in the middle and forward traffic from C1 to S1, and from S1 to C1. This entire handshake could occur, and Eve could still be communicating with S1.


1

If it were to change periodically it could be harder for an attacker to know how to exploit a weakness. ... the underlying code ... Of course the client/server would need to be in sync with these changes. As you found out yourself - client and server would need to be in sync. This means that there would need to be some state held on both sides or the ...


1

The list of open TLS 1.3 issues may give you some ideas. For example: Should SNI be encrypted to hide the server name to passive attackers? The issue states that this will complicate the handshake. Why is this the case? Maybe you can research the best way to implement this. Can the server request a proof of work from the client to prevent DoS attacks? ...


1

Short answer: No. By sending a response to the request, you are not challenging the client, making it a different kind of authentication scheme. Longer answer: The method you describe doesn't provide a challenge. There can be credentials provided such as a username/password pair, but it doesn't challenge the client to provide anything beyond what what it ...


1

A transfer lock means that the registry (eg .co, .eu etc) will not transfer the domain, and will not release transfer codes either. Transferring using a code will not work either. To release the lock, you would have to go into the domain admin panel, using the authentication solution that the registrar is using (for example: One time codes) and remove the ...



Only top voted, non community-wiki answers of a minimum length are eligible