Unanswered Questions

20
votes
1answer
723 views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
11
votes
2answers
611 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
10
votes
2answers
298 views

CSP Reports: Ignoring Client Malware

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on. I ...
8
votes
0answers
142 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
6
votes
3answers
265 views

Decentralised password recovery

Are there good/established techniques for password/key recovery in situations without a centralised service? (Anything goes, but I'd prefer solutions that distribute the recovery information across ...
6
votes
0answers
103 views

Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header. Then let's say I have a bunch of nodes where each node wants to ...
6
votes
0answers
120 views

Does any OpenID identity provider allow site-unique arbitrary email addresses?

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...
6
votes
0answers
164 views

Bootstrapping an EC2 Spot Instance

I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended). For this specific use case, I'm happy to lock down ...
6
votes
0answers
582 views

MPPE-Send and Receive key derivation from MS-CHAPv2

I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
6
votes
0answers
203 views

Use token for Windows Server 2008 AD RMS

I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
5
votes
0answers
27 views

Authentication Agent Protocols for SSH

Is the protocol described at https://tools.ietf.org/html/draft-ietf-secsh-agent-02 actually implemented by any ssh agent? pageant implements a different protocol as does OpenSSH's ssh-agent.
5
votes
2answers
139 views

CTF competitions/challenges that are Windows based?

I've been messing about in CTF's for a while and I also do pen-testing professionally, what i've noticed is a distinct lack of CTF competitions using windows environments. This is in stark contrast ...
5
votes
1answer
163 views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
5
votes
0answers
95 views

Connection Android - Baseband Processor - SIM Card

I currently examine the hidden components of a smartphone, inspired by the research of Weinmann All your baseband belong to us and Karsten Nohl Rooting Sim Cards. According to Weinmann, the ...
5
votes
0answers
104 views

Why doesn't the 802.11 standard implement TLS for wireless handshakes between clients and routers?

Why aren't wireless handshakes sent using TLS? It seems like it would be relatively simple to implement, perhaps having the vendor insert the private key into the routers. That way WPA/WPA2/WEP ...

15 30 50 per page