0
votes
0answers
7 views

Staying logged in as a user for remote access (such as Team Viewer) Pros & Cons

This company we newly help have no remote access policy for say, but they allow the users to use Team Viewer. I have noticed some user leave their PC logged in all night and weekends and just shut ...
0
votes
1answer
8 views

Secure Flag and HSTS in HTTPS Only site

If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
-1
votes
2answers
12 views

What is the weakness of aircracking wifi attacks?

I did not come to anything after searching Google for some time. What's preventing someone from just doing an aircrack wifi atack and do any kind of attack once logged on the victims network?
0
votes
0answers
8 views

OSSEC is making AWS EC2 instance w/ Centos 7 become unresponsive

If I start OSSEC, my Centos 7 AWS instance becomes unresponsive after a short while (under 30 mins usually). httpd and ssh do not respond ever until I go into the AWS console to reboot it. I've ...
0
votes
0answers
10 views

How to generate “CRL numbers” for X.509 CRL

(Context: I'm working a process to publish a CRL periodically -- eg once every day.) With standard X.509 certificates, "serial numbers" are required to be positive integers, but they do not need to ...
0
votes
0answers
6 views

Requirements Placed on a User of a FIPS 140-2 Validated System

Per customer requirements, I am working with a FIPS 140-2 validated network switch that is actually running in FIPS mode. This guarantees that any cryptographic operations the device performs will be ...
0
votes
0answers
15 views

Using UUIDs for non-guessable URLs

How safe is using UUIDs as URL identifier for non-guessable IDs? Specifically UUIDs generated by Python's uuid4() function, using base64 encoding. E.g. ...
1
vote
2answers
20 views

In the context of SSL Labs where is the “trust store”?

When I'm testing a site with https://www.ssllabs.com/ssltest/ I'm getting this: Could you explain: Why are there two paths? Were do they come from, where are they configured? What is this "trust ...
3
votes
3answers
435 views

Why no self-hosted email? (Snowden, Lavabit, Hushmail, NSA)

Why would anyone like Edward Snowden rely on 3rd party services like Lavabit or Hushmail to host his email? I mean it's very easy to set up a self-hosted email server. What you need: Rent VPS (even ...
1
vote
1answer
21 views

Does any VPN protocol authenticate the server?

When you connect to a server using SSL/TLS the client authenticates the server using the certificate that the server provides. If certificates mismatch an error page is shown instead. So you know you ...
0
votes
2answers
34 views

Could a compromised root CA impersonate any SSL certificate?

My question is about MITM attacks against https and how those would appear to the end user. Suppose a trusted root CA were compromised / coerced into producing fraudulent SSL certificates. What would ...
2
votes
1answer
31 views

Reset links in password expiration emails

Our organization is rolling out yearly password expiration to our 40,000+ users this fall and we have been socializing this change for some time now. However being such a large organization, our users ...
2
votes
1answer
35 views

Tools to demonstrate NO storage of cardholder data

Our organization has been asked to comply with PCI DSS. As part of IT Department, we need to demonstrate that none of our IT infrastructure stores any carhdolder data nor sensitive authetication ...
3
votes
1answer
28 views

Reading magnetic stripe on a credit/debit card with an EMV chip

Is there any way of knowing is a credit/debit card has an EMV Chip, by reading the magnetic stripe. This way I could deny the payment via magnetic stripe and ask to the customer to insert the card via ...
-1
votes
0answers
31 views

How to reset an HSM server without password? [on hold]

I purchased an HSM online but I do not know the password. Is there a way to reset a HSM server?
1
vote
1answer
32 views

Security server log review

We have a Kiwi Syslog server for Centralized logging purposes. Currently, our focuse is only on monitoring, reviewing and reporting User Account/Password Violations. We already used the necessary ...
0
votes
1answer
40 views

How can I put snort in front of nginx server

I want to prevent attacks to my nginx server. How can I proxy the requests through snort to nginx server. NFQueue's are a solution.I am able to pass packets to snort using the following rules sudo ...
1
vote
2answers
45 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
4
votes
1answer
38 views

How can I see which sites have set the HSTS flag in my browser?

My question is about Firefox and Chrome. Is there a possibility to see which sites have set the HSTS flag in my browser?
-1
votes
1answer
68 views

SSL and Fake Domain

I am reading information related to SSL handshake on the Internet. It seems like in the last step the domain name is compared to the domain in the certificate. How exactly is this protecting against ...
-1
votes
0answers
34 views

how to fix XSS Reflected in java [migrated]

I got fortify report which shows XSS Reflected defect from the below 2nd line. String name = request.getParameter("name"); response.getWriter().write("Name: " + name); Recommendation ...
-5
votes
1answer
56 views

Make really personalised wordlist file

i want to make a really customised wordfile with: 4 letters first + 2 numbers example: divo11 or yeve11 And not like this: p0oiw1 or u4hf3e This wordfile is really important. How can I do it?
2
votes
0answers
92 views

Bypassing Hotel Wifi authentication using VPN [on hold]

I'm currently in a hotel with pay per day WiFi, I have have logged into it a couple of times on my phone. I just turned on my VPN before logging in to the WiFi and it seems to have bypassed the hotel ...
2
votes
1answer
86 views

Facebook hacker [on hold]

My Facebook account was hacked. Searching through security and settings info, Facebook showed that someone was logged into my account from another state and showed some kind of id number. The number ...
0
votes
0answers
21 views

Improve iptables configuration [on hold]

First, I am not able to ping with ipv6 (ping6) to my server even being able to ping with ipv4 (ping). What should I modify to be able to ping to and from my server with ipv6? Second, what should I ...
0
votes
1answer
24 views

How to verify SSL cerficate If restored session after session broken?

For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How ...
1
vote
1answer
67 views

Mystery IP address Hijack

I'm working on a customer's new website. To get things up and running quickly, we're maintaining his domain name service and hosting the website on another server. Customer bought the URL name years ...
1
vote
1answer
35 views

Can a salt maintain pseudo-randomness after being modified?

TL;DR: How much can a function (such as the one below) modify an initially random string before that string becomes useless as a salt for password hashing? Is there a general rule? # Function ...
2
votes
1answer
33 views

Is it possible to build completely verifiable hardware?

Reproducible builds like they are used for Bitcoin, Tor or the Debian package repository aim at making sure that the binaries you install exactly equate the source code that they are supposed to be ...
3
votes
1answer
30 views

Secure online server -> Airgap transport?

I'm facing the issue to develop a system which archives some data, which was available via a web-server some time before (to selected users). Now the question arises on how to securely transport the ...
1
vote
2answers
86 views

Is it feasible/possible to have encrypted data that looks unencrypted/innocuous?

i.e., could I send "Let's rob the store at 9 tonight" so that it is impossible to see what I'm saying, but it doesn't look like gibberish and obviously encrypted?
0
votes
1answer
36 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
0
votes
1answer
34 views

Identify encryption algorithm for .enc files

I need to identify the encryption algorithm used to encrypt some files. I have the key, but I can't decrypt it using OpenSSL, because I don't know what algorithm was used to encrypt it. Is there any ...
2
votes
1answer
16 views

How safe is it to use shared SPF record domains?

I'm wondering the following, what if shared SPF records like below are used? "v=spf1 include:_spf.google.com ~all" "v=spf1 include:spf.mandrillapp.com ~all" "v=spf1 include:servers.mcsv.net ~all" ...
0
votes
1answer
39 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
3
votes
2answers
181 views

Should I be concerned at the lack for transparency by Microsoft which quietly added 17 root certs?

This week it was noticed that Microsoft apparently very quietly pushed out 17 new trusted root certificates (Infoworld Article). The lack of public announcement seems a bit strange. Is anyone aware ...
1
vote
1answer
27 views

What's RSA and ECC's role in TLS 1.2? [duplicate]

I'm trying to figure out what is RSA and ECC used for in TLS 1.2 cipher suites. Let's take TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 for example, communication between server and client would look ...
-6
votes
2answers
62 views

Is it possible that the person I write to will see the email before I write to him?

Is it possible that the person I write to will see the email's content before I reply to him? If I got an email and I answering that email, is there any feature that can cause my reply to be seen by ...
1
vote
1answer
28 views

EC private key, RSA certificate. Is this realisable?

I was wondering if is it possible to generate EC private key: openssl ecparam -name sect571r1 -out ecparam.pem openssl ecparam -in ecparam.pem -genkey -noout -out eckey.pem then generate ...
2
votes
0answers
36 views

How to indicate that content in an iframe is untrusted

As part of a website I am developing, untrusted content is displayed in a sandboxed iframe. The content is loaded using the srcdoc attribute, but the iframe is sandboxed using sandbox="allow-scripts", ...
5
votes
5answers
557 views

How much is the entropy of a randomly generated password reduced if I regenerate until I get a password I like? [duplicate]

In many of the answers and comments on the well-known XKCD #936: Short complex password, or long dictionary passphrase? question, the importance was stressed of generating the password randomly, and ...
1
vote
1answer
48 views

Is there a Service to setup a Honey Pot URL to collect user IP + other data? [on hold]

Being the paranoid user I am. I always think I have an infected computer with trojans or malware or prying eyes to my work computer. I was wondering is there a service that lets you create a honey pot ...
1
vote
0answers
33 views

Machine compromised [on hold]

Recently, one of our GUI based jump box (ec2-instance) used for deployment to other ec2-machines got compromised, and was used for DDOS attack to other sites. Amazon reported abuse for the same. On ...
1
vote
1answer
29 views

Handling CSRF tokens on pages longer than the PHP session limit

I have a page that is open (i.e. requires no login) and allows users to give quick feedback. This page is available on a single shared PC or tablet. The form itself has a CSRF token on it. Problem is ...
-5
votes
0answers
59 views

what algorithm is this? [on hold]

can you tell me what algorithm is used here , i have several examples but i can not find out what algorithm is used? 076a720f-67e6-4dd9-b9f2-38464e10d6ac = 35246 ...
1
vote
1answer
49 views

Extract public information from p12 without having the password

I know this question was already asked here but unfortunately there are no satisfactory answers. Please correct me if I'm wrong, but if I have a p12 file the following two situations are possible: ...
2
votes
1answer
56 views

is x509 certificate signed by ca valid?

I've got certificate 'sample cert' which is valid to '2015-12-31' but it was signed by root CA certificate. But when it was signing CA cert was valid to 2015-06-30'. So my question is, is today ...
1
vote
1answer
32 views

DMZ and Mail servers

I've seen a few DMZ related questions here in the past, but wanted to ask one directly related to email. I've done some research on this, but wanted to ask the forums opinion. I know it's best ...
2
votes
1answer
84 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, ...
-1
votes
1answer
33 views

Tor website HPKP (key pinning) failure

I'm currently facing a key pinning error when trying to access the torproject.org website with Firefox. Is anyone facing the same problem? Does anyone know if they changed their certificate? If not, ...

15 30 50 per page