All Questions
67,220
questions
0
votes
1
answer
40
views
Storing two hashes of same password?
Typically for user passwords we store their hashes and salt alongside in the database - one per user.
I wonder the security implications of hashing the same password twice and storing locally both.
...
0
votes
1
answer
19
views
Decorating headers after JWT authentication
I'm toying with the idea of terminating JWT after gateway ingress, and looking to see what sort of attack patterns would result.
Prerequisites:
Communication between services would use mTLS to ...
- 101
0
votes
0
answers
22
views
Have an electronic and physical stalker with access to my computer when I am online [duplicate]
I have an ongoing electronic and physical stalking situation. Someone has hacked my computer and is able to at times see my activities such as sending email and shopping. They also took screenshots ...
0
votes
0
answers
15
views
CPE ID - Difference between the NIST specification and CPE ID [closed]
I'm looking at the NIST specification for CPE IDs version 2.3. The document is titled: Common Platform Enumeration: Naming Specification Version 2.3 NIST Interagency Report 7695 in case the link is ...
- 131
0
votes
0
answers
25
views
SPF passes but in Gmail, 'Show Original', top section doesn't show SPF: PASS with IP
When I send an email from my HostGator account to my Gmail account, I see in the header spf=pass...
When I paste the header in this tool -> https://toolbox.googleapps.com/apps/messageheader/
It ...
- 1
0
votes
1
answer
14
views
How to use MFA without relying on a smartphone? [closed]
We have a situation where our company's operators need to authenticate with a 6-character OTP on some websites.
For security reasons, we don't want them to use an app (eg.: Authy) on their personal ...
- 163
0
votes
0
answers
7
views
add linux profile in volatility
I'm trying to add a linux profile to volatility (I am using a kali linux VM) and in theory I should just paste de .zip in the folder:
/usr/local/lib/python2.7/dist-packages/volatility/plugins/overlays/...
- 13
1
vote
0
answers
24
views
Why is PayPal asking for my bank password? [duplicate]
Another posted the exact same question and it was dismissed saying PayPal would never do such a thing.
Well, I was adding a bank acct yesterday to transfer funds and PayPal popped up a username and ...
- 11
0
votes
1
answer
27
views
Can t.me links be malicious?
I clicked inadvertently on this link in a telegram channel - a popoup window says “user doesn’t exist”.
A virustotal scan did not find anything. Do you think this kind of link could be used to execute ...
- 29
0
votes
0
answers
14
views
Why does Firefox use unsecured port 80 to download certs? [duplicate]
When firefox (v111 2023) is opened for the first time it connects to ocsp.digicert.com on port 80 in cleartext. Isn't this a terrible security vulnerability. Can someone help me understand why this ...
- 1,515
0
votes
0
answers
19
views
What is the proper way to manage a company's SSL certificates?
Is there a way/software to manage and sign multiple SSL certificates? We have many intranet web applications that show the certificate error risk in the web browser. I have been googling a lot but SSL ...
- 101
0
votes
0
answers
9
views
I want to join our organisation AD with a recently acquired company's AD for federated access. What are the security risks I should consider?
As per the title. What risks and controls should I consider? Are there any questions i need to ask the external party AD before setting up the 'Trust' between the 2 ADs?
- 641
0
votes
1
answer
25
views
Does saving of ECDHE keypairs to HSM increase security of TLS?
When ephemeral Diffie-Hellman (DHE) is used with TLS, the key-exchange key can/will be discarded after a key-exchange. right?
Is there good reason to use HSM for generating and storing DHE key, when ...
- 283
2
votes
0
answers
7
views
AWS sub-accounts to protect against deletion of versioned data in S3
How can administration teams (or software processes) be granted the ability to alter or remove objects from in AWS S3, while prohibiting the permanent deletion of underlying data versions, so as to ...
- 121
0
votes
0
answers
27
views
Is it possible for my phone to get virus just by viewing a site? [closed]
I know this question is repeated, but I did not find a convincing answer when I searched the internet.
I use this site and this site to download videos. One of my friends said that these sites are not ...
- 1
0
votes
0
answers
9
views
iOS App on Corellium going through Burp shows plaintext
I have an iOS device on Corellium (jailbreaked). I'm on OpenVPN. I have Burp running locally and the iOS device has a proxy that runs through my Burp instance.
All the traffic I am seeing is plaintext ...
0
votes
1
answer
28
views
Size overhead of encryption approximation
Is there some rough analysis or estimation of how much overhead in bytes an encryption using a public key could add to the final object?
- 173
0
votes
1
answer
30
views
Can my local MySQL server be accessed without permission
I have hosted a MySQL database server on a vps to connect to a flask web app on the same vps. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
0
votes
1
answer
29
views
I know hash and salt; how do I use hashcat to decrypt?
hash: 341A451DCF7E552A237D49A63BFBBDF1
salt: 1234
I have a word bank I generated using CeWL that I think I am supposed to use. But when I run
hashcat --force -a 0 -m 0 ...
- 1
0
votes
0
answers
18
views
Impersonation Insight - Microsoft 365 security [migrated]
Using impersonation insight to view domains that are sending phishes, there are several that are being delivered, even though our policy is to quarantine.
One domain that is commonly abused is icloud....
0
votes
2
answers
43
views
Is reading off a OTP code over the phone standard practice?
I just called a number that I thought was my bank's and reached a customer service representative that asked me to verbally read to them a one-time passcode that was texted to my phone.
Is this ...
- 1,323
0
votes
0
answers
31
views
Protecting assets using cryptography [closed]
I'm writing a turn-based multiplayer video game. I want the game "host" to be able to write a file for each player and store them in a single directory, but encrypted so that only the player ...
- 101
1
vote
1
answer
48
views
What security issues are there when accepting skype calls from people I do not know?
Recently I got a friend request from a person I do not even know and of course he was not in my friends list (I mean the people I have accepted in my skype in order to chat or talk live) and he ...
- 255
0
votes
1
answer
46
views
Can virus survive macOS Recovery?
In what scenarios would a MacOS virus/malware/rootkit/etc (I use those terms to englobe all types of undesirable or malicious software or code) resist a format of the hard drive in MacOS recovery?
I ...
- 21
0
votes
2
answers
43
views
Is using weak random numbers for the initialization vector of AES just a theoretical issue?
I'm the maintainer of pypdf, a Python library for reading/manipulating PDF documents. I recently discovered that pypdf used random instead of secrets for ...
Generating the initialization vector (IV) ...
- 3,914
0
votes
1
answer
31
views
Will using a hard drive with the MBR virus cause the main system to be infected?
If I have an old hard drive and assume it has an MBR virus.
If I install it on my computer using a SATA cable as the D drive to store data, will my system drive (C drive) be affected by the MBR virus?
- 21
0
votes
1
answer
25
views
Does url of payment link reveal sensitive info? [closed]
If I share the following url link to a stranger, will it compromise any of my information. does this url encoding undergoing some encryption processes?thanks
0
votes
0
answers
17
views
In OAuth 2.1, can the Access Token and Authorization Code be the same?
OAuth 2 supported a flow called the Implicit Flow where the authorization server on response just provided the access token directly to the browser without requiring a back-channel communication from ...
- 2,579
0
votes
1
answer
41
views
Does CORS Access-Control-Allow-Credentials apply to non-origin/third-party cookies or as well?
I understand if you are cross-communicating with origin A, then if origin A has no Access-Control-Allow-Credentials in the response, you will never be able to reuse Cookies obtained from origin A ...
- 103
-1
votes
0
answers
13
views
0
votes
0
answers
20
views
What information does the Microsoft Intelligent Security Graph use for querying files?
I'm looking into WDAC and the option to use Microsoft's ISG for files that are not explicitly allowed or denied caught my interest. Unfortunately I haven't been able to find any information on what is ...
- 11
0
votes
0
answers
21
views
Analysis of the Qnap Checkmate Ransomware of 2022/2023 [closed]
I have a client that just got their Qnap infected with the checkmate ransomware. My main questions right now is:
It looks like the ransomware was isolated to shared folders and only those files were ...
- 195
0
votes
0
answers
36
views
Website shows nudity ads when entring it from google my business button? What could be the problem [duplicate]
When I try to enter my website from direct link everything is normal, but when I enter it from the website button on my page on google maps, it shows nudity ads once I click on buttons on website.
My ...
0
votes
0
answers
17
views
MDE Attack Surface Reduction rules question
started to investigate audit events from MDE ASR. Get some events regarding the rule Block Office applications from injecting code into other processes.
Now, I executed the following query in AH:
...
- 1
0
votes
1
answer
34
views
Practicalities, implementation, and weaknesses of simple symmetric encryption for plain text files
For about 20 years, I've been using gnupg to encrypt a plain-text file containing my passwords. (The actual per-site passwords are generated using a hash function.) It's worked OK for me, but gnupg is ...
2
votes
1
answer
51
views
Why does Hydra SMB attack not work while Metasploit does?
I'm learning about password attacks, and doing TryHackMe labs.
User: penny
Pass: leo1234
When using Hydra to find the password for the SMB user, I get no valid results:
I know the valid password is ...
- 23
0
votes
0
answers
10
views
Disaster recovery solution advice [closed]
What are the flaws in the DR system I am planning to implement:
Data -> File Server -> Sync to Synology NAS (Local Back up) -> Synology NAS (in off-site location)
Is this a cost-effective and ...
- 1
0
votes
1
answer
69
views
How does Google's "on-device encryption" work?
I use Google to store some of my passwords and I noticed a "On-Device encryption" option in Google Chrome settings, that I had disabled. From what I understood, by allowing this, the ...
- 105
0
votes
0
answers
14
views
How do Android data recovery tools work without root? [migrated]
Sometimes I come across tools like DroidKit which promise to recover your data from Android phone without root. I do not understand, how they obtain raw binary access to internal storage over USB only....
- 154
0
votes
1
answer
52
views
How does anti-cheat prevent mocking itself?
As far as I understand, usually the game anti-cheat runs in another process from the game client. This makes it obvious to try to simulate anti-cheat, for example, to replace it with your program, ...
- 3
0
votes
0
answers
7
views
Which inbound/outbound rules are necessary for stable IPv6 connectivity in Windows 10/11? [migrated]
I'm experiencing an issue with Windows 10 where IPv6 connectivity becomes unstable over time. Initially, IPv6 works as expected, but after a while, it stops working. Upon investigation, I've ...
- 101
0
votes
1
answer
51
views
Port 53 on my home router opened, why?
I couldn't find anything online so I'm here to ask experts. I've nmapped my public ip and I noticed all ports are closed but the 53. In the router's options upnp is disabled and the NAT rules are ...
- 1
0
votes
0
answers
25
views
What are the challenges when doing forensics on cloud storage services?
My class question:
"What are the key challenges for cloud forensics on cloud storage such
as Dropbox?"
With what I've been told and what I generally understand, the question is basically ...
- 101
0
votes
0
answers
28
views
Windows Defender picks up Kali Linux's ISO. Is this normal or a real threat? [migrated]
I ran a full PC scan by windows defender and this thing comes up and isn't going even after pressing start actions. Please help me out.
- 1
0
votes
1
answer
61
views
Full disk encryption with LUKS?
I encrypted my Ubuntu Desktop 20.04.3 with LVM/LUKS during the installation process. If I turn off the computer, is the brute force the only attack available for getting the password and accessing the ...
0
votes
2
answers
52
views
How to reuse PIN codes in the most secure way?
I've made a list of the services/devices that require a PIN code. Shockingly, it's over 10, which I find impossible to remember, so I need a strategy to reuse the codes.
What could be a strategy for ...
0
votes
0
answers
6
views
Why isn't my wireguard working properly? [migrated]
I have an AWS debian ec2 that I want to use as a vpn server, I installed wireguard and created the following server config
[Interface]
Address = 10.8.0.1/24
ListenPort = 51820
PrivateKey = <...
- 1
0
votes
1
answer
21
views
Does webauthn support mutual authentication? [duplicate]
Does webauthn provide any authentication of the server end?
Or asked differently, is there any defense against a man-in-the-middle attack that pretends to be site X, performs what looks like a ...
- 103
0
votes
1
answer
53
views
How long would it take to crack hashed password stored in plain sight?
I want to store a password hash in plain sight. If I am using a dictionary to crack an Argon2 hashed password that I am storing in plain sight, how long would it take (assuming my password is ...
0
votes
1
answer
32
views
PHP code review: is it open to object code injection through unserialize [closed]
I'm trying to figure out if the code below is open to object injection:
<?php
// loggin level
define('CRIT', 5);
define('ERROR', 4);
// secret is defined somewhere in the script ...
- 1