Tag Info

Hot answers tagged

25

You don't need DNS names to be detectable. The entire IPv4 can be scanned in less than a day. And it has been done. And it is still going on. Therefore you must assume, that your IP address has been discovered. You can download all the certificates for all the IPv4's port 443 from Rapid7's Sonar project. -> Make this a nice demo. Download the ...


19

This might make very casual surfers move on, but anyone running any sort of scan on your server will discover the OS, web server version and running software. For example the nmap http-enum NSE script should detect that Outlook Web Access is running should anyone care to run it against your server. Yes, by all means replace the home page with something ...


10

Jack sits back, Reflects his thoughts for the moment, Scratches his head wondering if you mean the magic bytes that would be used by file(1), the signature of the internal fs, the UUID of the device... and how to phrase it to be understood by Diane. Jack - "What do you mean. What's that?" Diane thinks Jack has absolutely no idea and proceeds with ...


9

Pronounceable words are more-or-less sequences of syllables. What constitutes a syllable depends on the language, including the language variant (British, Scottish, American, Indian... versions of English are not rigorously identical). So we will make some approximations. Let's suppose that we want two-letter syllables, always a consonant followed by a ...


7

I agree with you that security by obscurity should never be the primary defense, but I also agree that you should never make it easy for an attacker to detect the services you are running. An attacker would probably first try to figure out the version of your web server by banner grabbing. So you should make sure that IIS is not giving away such information ...


4

Restricting yourself to only passwords that are pronounceable does decrease the entropy, which reduces strength. So in theory, the password will be weaker But password strength is a complicated beast. In particular, if choosing pronounceable passwords means you can remember a longer one than usual, then your entropy goes up and your password becomes ...


4

Hard question to answer exactly. I'm going to refer to Theodore T'so's pwgen (v2.07) implementation exclusively here (pwgen -A0) These pronounceable passwords use "phonemes" as "symbols", rather than single characters, in (the English language biased) pwgen a phoneme can be 1 or 2 characters. There are 40 defined (in pw_phonemes.c), 25 are a single ...


3

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you ...


3

DNS management is the modern way to do this for the non-technical. Managed DNS services keep track of valid and non-valid entries in an effort to protect the non-technical in this way. Yes, you lose the granular control of whitelisting only those sites that a particular user goes to, but the admin overhead in case the user wants to change their behaviour is ...


3

The problem with a outbound filtering solution of the nature suggested is that modern web applications and software contact a bewildering array of servers on the Internet and it would be very difficult for a non-technical user (or indeed anyone) to make informed decisions about this (To get a good illustration of the problem try running glasswire or Little ...


3

Is it possible for breaching google chrome and take my credit card information? Yes. As long as Chrome can use your number for auto completion, it has to be possible for Chrome to access it. If one program on your computer can do this, another program or a least humans can do it too. it's not stored with any type of encryption Even with ...


3

Security is necessary in order to counteract "risks" to a system. You need to determine what those risks are and if "loss" in that area is acceptable. Presumably, this train set up is not public, but in a locked building where people need a key to enter, or if allowed in, are monitored by other people watching. Yes, it is possible for someone to come in ...


2

In general, any computer that has the capability to go online needs to be secured. This includes not only "laptops" and other things people consider to be computers, but thermostats, sprinkler controls, and any other programmable device. The problem may or may not be what the attacker can do to you, but also what the attacker can use your computer to do to ...


2

A common phishing website looks extremely similar to the website it is trying to impersonate, but is still a different website. One could develop a tool which examines any websites the user visits and alerts them when they look exactly identical to one of the websites is set $S$. Unfortunately there is a problem with this: A phishing website only needs to ...


2

It is improbable that a basic laser pointer will "burn out the CMOS" -- the power conveyed by a laser pointer, even though concentrated on a small surface, is small when compared to that would be achieved by pointing the camera towards the Sun, and I expect the camera to resist such occasional pointing. Unless, of course, you have decided not to stop at ...


2

At least your server wouldn't show up in a simple evil crawler that looks just for these welcome pages. Or if you mask yourself as an Apache, following automatic attacks would hopefully fail. So for a dedicated attack on your server, this makes it maybe just a tiny bit harder. But for automatic attacks this can make the difference.


1

This works similarly to any symmetric key one-time password (OTP) technology. Point 1 - This is not meant to replace your password but instead be a second factor of authentication. Without possession of the Yubikey you are unable to generate the code necessary to authenticate to a system. Point 2 - Well, it generates one time passwords so it is more ...


1

1) Yes, it is possible to breach Google Chrome. Even with the encryption, there would be somewhere password or private key. 2) It is not secure as not using autofill, however, you do not type in the autofill your CVV code, which is needed for a successful operation with the card. You can find more about CVV here: https://www.cvvnumber.com/


1

My answer is would be a toned down version of this: "They are suggesting we use an unencrypted shared key authentication scheme designed for another use case. Their recommendation is bizarre and useless. There are no web browsers that are able to generate the required keyed hash for each TCP segment."


1

From my limited point of view, an attacker would not be able to immediately gain access to the database. The data source in your snippet refers to a database server on 10.#.#.#. The 10.0.0.0/8 network is reserved for private networks according to RFC 1918. If you are an external attacker without direct access to the private Network the database server is ...


1

Just because you were not able to connect directly, this still poses a few problems (will speak on them in a second). Anything and all should always be reported for a few reasons, it is informational, it illustrates that time was taken to analyze information during an engagement. Now there are a few reasons I can think of, for this happening (permissions)" ...


1

Using MD5 for consistency checking is a clear violation of CWE-327: Use of a Broken or Risky Cryptographic Algorithm. Any protection that RFC-2387 provided, is voided by the use of an outdated, and insecure algorithm. Rapid7 is making the internet less secure with this recommendation. This BS "vulnerability" is more pointless noise that drowns out real ...


1

One-factor authentication is no more or less secure than existing methods in itself because the password itself is not the main weakness; The flavor of the moment in security circles is man-in-the-middle. Adding two factor authentication, in use by Google products like Gmail, Outlook online, or RSA tokens was another layer of security, but here's an example ...


1

I commend their effort to make the internet a safer and easier place to navigate. The centralization risk is no different than with any other password manager in that if the password vault is compromised, it's all compromised. In this case, the physical device acting as the vault, and the handshake being mostly automated.



Only top voted, non community-wiki answers of a minimum length are eligible