Tag Info

New answers tagged

1

These are the golden rule of computer security: "It is impossible to hide anything from a competent user with system administrator privilege" and "any competent user with physical access to the device can always elevate himself to system administrator". You cannot hide any information from someone with physical control of the machine. If the secret you are ...


0

I assume you are the only root/administrator on the machine. You can use one of those two options: Do not allow other users on that machine at all Let the process run as a special user and use a communication mechanism that is only accessible (read + write) to that user (named pipe, unix domain socket, etc.) Any of those two options will make it ...


0

Basically, security is usually bear by the key, not the algorithm. So you're on a fool's errand here. As stated by the Kerckhoff's principle: "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.", or as Shannon reformulated it : "the enemy knows the system". So you can't really have a cryptosystem that do ...


1

Yes. The server is sending back data of its choice to be processed by the client. If there is a flaw or an exploit, it can be taken advantage of by the malicious server. Even if this is legitimate software. The fact that its well maintained, battle tested, etc does not mean its guaranteed to be free of vulnerabilities. There may be new bugs introduced with ...


0

In his first sentence, he is saying that protocols on higher layers can be left unchanged. This is false, period. Higher layers need to indicate in some way that SSL/TLS should be used; in the Web this is done with the HTTPS: URL scheme, with the secure flag on HTTP cookies and with an HSTS (HTTP Strict Transport Security) policy.


2

Http Https +------------------+ +------------------+ |7 http methods | | http methods | <---same No change needed +------------------+ +------------------+ |6 data:ex)"$1000" | | data:ex)"kf4d3s1"| <---data encrypted +------------------+ +------------------+ |5 Sock: | | Sock: | ...


1

High level protocols may not be secure when used, unchanged, with SSL. There is a possibility of side channel attacks. As others have explained well, SSL allows you to wrap an unencrypted stream in an encrypted one. In theory, no information about the data being transmitted should be leaked. In practice, there's one piece of data that always leaks - the ...


1

After establishing a secure connection, a web browser will still ask the same type of question such as GET /som/page.html HTTP/1.1 host: www.example.com and the web server will still respond the same way 200 OK Content-Type text/html ... The only difference is that underneath this conversation we do not have a straight TCP connection but instead ...


3

TCP provides to applications a stream interface. There are a few exceptions where the details leak through, but generally a TCP socket is opened, and then each side sends a series of bytes to the other. Those bytes will be delivered intact and in order, up until the point where the remote end closes the connection (which you will be informed of). ...


1

This is just like moving vehicles on the road. Like road is the fixed medium and on it many types of vehicles can run and so if you make new vehicle for it to run on road the vehicle must have tyres that could run on that road. Similarly if you consider Ethernet as one medium it could carry various networking protocols like IPv4 or IPv6. So the point over ...


0

Higher-layer protocols don't bother with the details of lower layers. They just assume that the lower layers have been implemented in some fashion, and proceed from there. If we go by the TCP/IP model, there are four of these layers: OSI defines a Physical layer, which handles connecting two machines together; TCP/IP doesn't, but it's useful to think about ...


10

While OSI is just a model, and in reality the layers can be blurred or nonexistent, the concept of layering protocols is specifically to allow a change in a particular layer to leave the layers above and below it alone. As an example: Physical - does a basic packet care whether it is travelling over copper, fibre or wireless? It could travel over all ...


69

You should think of OSI layers as packaging. Let's say I want to ship a glass to you. I chose an original package for advertisement purposes, showing how nice is my product and what you can buy to add to your "glass" experience. That's the high layer of my protocol. Then I put this package in a box filled with soft thingies because I don't want it to be ...


1

There is nothing wrong with SMS. Let's reverse engineer, and redesign the whole network as if to protect communication between two people. 1) Let's make it a point-to-point communication network where there's a salt known only to the sender and receiver and the phone numbers are encrypted. This prevents spoofing and/or spam. 2) the gateway itself only has ...



Top 50 recent answers are included