Unanswered Questions

19
votes
1answer
638 views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
11
votes
0answers
156 views

DNSSEC signing algorithms

Virtualmin supports a flurry of algorithms for DNSSEC: RSASHA1, RSASHA256, RSAMD5, DSA, DH, HMAC-MD5, NSEC3RSASHA1, NSEC3DSA. If I understand correctly, there's Proof of Concept available for SHA1 ...
11
votes
1answer
650 views

Webapp2 security

I am coding a REST web application that runs on Google App Engine, it authenticates API requests to privileged data using sessions by cookies provided by webapp2_extras.auth and ...
10
votes
1answer
303 views

Skype called someone and connected to them with no action on my part. What do I do?

This happened to me today, September 12, at about 6pm. Any ideas about what happened, what's going on, and what I should do? I was at home alone with my 2 year old -- I was feeding her dinner. All of ...
9
votes
0answers
263 views

CSP Reports: Ignoring Client Malware

I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net... I would ...
7
votes
0answers
66 views

Is Bluetooth's “advertising” mode more secure than “discoverable” mode?

I understand that there are many security issues associated with Bluetooth's "discoverable" mode, and have avoided it where I can. However new features of many systems (e.g. Apple's ...
7
votes
0answers
113 views

Yubikeys & SSH - which option is best for lockdown?

My company has a few dozen servers hosted on a cloud provider. All but one (OpenVPN host) is closed to the internet. We're using OpenVPN AS which uses certs + Google Authenticator for login. We are ...
6
votes
0answers
113 views

Security Risks of BD+

I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
5
votes
1answer
177 views

Is java Client vulnerable by POODLE?

I have a Java based application (running on java 5 or higher) that establishes an SSL connection towards an Apache tomcat 7.0.47 on java 7. From what I understand, to exploit POODLE you need a client ...
5
votes
0answers
112 views

When does iOS check validity of enterprise certificates?

This article should give a little more context (and see my comment on it, same username, for additional info): http://www.engadget.com/2014/10/08/ios-update-will-block-emulators/ iOS developers are ...
5
votes
1answer
173 views

Where are the anonymous/private domain validation SSL certs?

I have yet to find a CA that doesn't require personal information for DV certificates. Is this because all of the major browsers and operating systems have a policy to reject CAs that don't require ...
5
votes
0answers
658 views

Example of how the remaining shellshock bash bug CVE-2014-7169 (taviso bug) could be exploited?

I have a general idea about the Shellshock bash bug (CVE-2014-6271 reported Sep 24, 2014) of what the vulnerability is and how it could be exploited. Here you find examples on how to exploit the ...
5
votes
0answers
69 views

Maximum number of nodes with IPSec?

From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header. Then let's say I have a bunch of nodes where each node wants to ...
5
votes
0answers
103 views

Google Authenticator Error on Reboot

I have set up an SSH server to accept only login using codes generated by Google Authenticator (I have disabled all other forms of authentication on that port). After having rebooted my remote ...
5
votes
0answers
99 views

Does any OpenID identity provider allow site-unique arbitrary email addresses?

Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...

15 30 50 per page