Tag Info

Hot answers tagged

8

Pronounceable words are more-or-less sequences of syllables. What constitutes a syllable depends on the language, including the language variant (British, Scottish, American, Indian... versions of English are not rigorously identical). So we will make some approximations. Let's suppose that we want two-letter syllables, always a consonant followed by a ...


5

To answer your first question: As far as I know, there is no way to circumvent this. It's a security feature. To answer your second question: Yes, non-default trusted root certs are definitely potentially problematic. They are often abused. They are sometimes used for workplace or traffic monitoring (which is potentially OK if adequately disclosed, ...


4

Hard question to answer exactly. I'm going to refer to Theodore T'so's pwgen (v2.07) implementation exclusively here (pwgen -A0) These pronounceable passwords use "phonemes" as "symbols", rather than single characters, in (the English language biased) pwgen a phoneme can be 1 or 2 characters. There are 40 defined (in pw_phonemes.c), 25 are a single ...


4

Restricting yourself to only passwords that are pronounceable does decrease the entropy, which reduces strength. So in theory, the password will be weaker But password strength is a complicated beast. In particular, if choosing pronounceable passwords means you can remember a longer one than usual, then your entropy goes up and your password becomes ...


3

You can't secure FTP. Remove it and replace with a secure alternative like SFTP if you need file transfer. The way in which you've asked the question implies that you don't have a valid need for it, that it's probably just on by default. Depending on what you're running, 'rpm -e pure-ftpd' or 'dpkg -r pure-ftpd' might do for you.


3

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


2

It is not a bad idea, but the key point here is not just having a separate e-mail but to enforce compartimentalisation of access. Here's a scenario: you have your regular e-mail on @gmail you have your "secure" e-mail on @hotmail (oh well..) you check both e-mail from the same web browser that browser is not up to date, or you stumble upon a 0-day ...


1

From my limited point of view, an attacker would not be able to immediately gain access to the database. The data source in your snippet refers to a database server on 10.#.#.#. The 10.0.0.0/8 network is reserved for private networks according to RFC 1918. If you are an external attacker without direct access to the private Network the database server is ...


1

Just because you were not able to connect directly, this still poses a few problems (will speak on them in a second). Anything and all should always be reported for a few reasons, it is informational, it illustrates that time was taken to analyze information during an engagement. Now there are a few reasons I can think of, for this happening (permissions)" ...


1

One-factor authentication is no more or less secure than existing methods in itself because the password itself is not the main weakness; The flavor of the moment in security circles is man-in-the-middle. Adding two factor authentication, in use by Google products like Gmail, Outlook online, or RSA tokens was another layer of security, but here's an example ...


1

This works similarly to any symmetric key one-time password (OTP) technology. Point 1 - This is not meant to replace your password but instead be a second factor of authentication. Without possession of the Yubikey you are unable to generate the code necessary to authenticate to a system. Point 2 - Well, it generates one time passwords so it is more ...


1

ASP.NET uses something called request validation to prevent stored (and possibly reflected?) XSS attacks. Request validation basically looks for malicious content when requests are submitted. If it finds any it will block the request. By default request validation is enabled, but users can disable it. It should be noted that request validation will not ...


1

I wouldn't do it. Injection attacks have been in the wild for long time, and everyone (in this field) know about them. As I see you are focusing on web applications, my suggestion is to take one of the vulnerabilities in the end positions of the OWASP's ranking, and then research about it.


1

I think the idea is that you have a completely separate email only for this. As with access to this email account you could get access to all of your passwords, you would want to limit the exposure of this email to LastPass only.


1

There are a few different kind of labs available. There are ones you can construct yourself in VM's such as Vulnhub and they have a lot of links to good resources there. Another site i can recommend with good resources is Pentesterlab, i tend to steer clear of the online sites such as hackme so can't give much as to online but hope these help.


1

FTP is a very old protocol and not recommended anymore today because credentials are transmitted in plaintext which can be read by sniffing the network traffic. If you don't need it you should uninstall it or you can block this port with a firewall. On Linux you could use iptables to block all traffic to this port as follows: iptables -A INPUT -p tcp ...



Only top voted, non community-wiki answers of a minimum length are eligible