Unanswered Questions

17
votes
1answer
448 views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
10
votes
1answer
594 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
7
votes
2answers
423 views

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? ...
7
votes
0answers
111 views

DNSSEC signing algorithms

Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5, NSEC3RSASHA1, NSEC3DSA. If I understand correctly, there's Proof of Concept available for SHA1 ...
6
votes
1answer
137 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
6
votes
0answers
229 views

CSP Reports: Ignoring Client Malware

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net... I would ...
5
votes
1answer
297 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
5
votes
0answers
90 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
5
votes
0answers
629 views

krb5 and pam_mount

I successfully installed and configured krb5 on a Red Hat 6.4 server, now I can authenticate against an active directory with kerberos. pam_mount is installed and configured, but it only mounts a ...
4
votes
1answer
34 views

OAuth - Why exchange the authcode for a token

In OAuth, when the user authorizes the client the client gets a authorization code, the client then exchanges this for a token that is used to access the resource. Why do we need to do this extra ...
4
votes
1answer
86 views

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + ...
4
votes
0answers
78 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
4
votes
0answers
91 views

Does any OpenID identity provider allow site-unique arbitrary email addresses?

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...
4
votes
0answers
137 views

Bootstrapping an EC2 Spot Instance

I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended). For this specific use case, I'm happy to lock down ...
4
votes
0answers
518 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...

15 30 50 per page