0
votes
1answer
5 views

Can I be identified across different access points to same ISP?

The ISP I use at home also provides access points in cafés etc. Can they, for example with my MAC address, match my identity when I'm using one of these access points to when I'm at home? And what ...
0
votes
0answers
8 views

What kind of hash is in JSON of “Bing image of the day”

I just found the json output of Bing image of the day, here it is: http://www.bing.com/HPImageArchive.aspx?format=js&idx=0&n=1&mkt=en-US I saw a "hsh" json object, and after I checked ...
0
votes
0answers
8 views

HMAC Signature Based authentication for REST APIs

We are building publicly available RESTful APIs for eCommerce where clients can place logistics requests with us. We want stateless authentication on these APIs. While on-boarding, every client will ...
0
votes
0answers
13 views

Should CAs refrain from declaring HSTS policies that cover CRL hosts?

CRLs are usually not served over HTTPS, which makes sense. Further, according to this related answer, some clients may refuse to follow HTTPS URLs when validating certificates. Now, suppose a ...
0
votes
1answer
20 views

Virus Warning after clicking on a Google search results link

When researching a high school project on the guillotine, my daughter googled: quillotine quotes One of the top results was: topfamousquotes.com/quotes-about-guillotine/ Apparently she ...
0
votes
2answers
31 views

Bypass CAPTCHA form made with 100% JavaScript?

There is a website I have found where the JavaScript handles the response of the CAPTCHA and then proceeds to fire what I believe is an AJAX request. So the flow is as follows: Button -> ...
0
votes
0answers
15 views

How to block ftp password guessers in shared hosting?

Is this also possible for shared hosting to: 1.use a web software to block password guessing attempts 2.change ftp port 3.locking down access to specific source IP addresses As answered here:Good ...
1
vote
0answers
12 views

Would the following practice make email PCI compliant?

If a system applied to the following three practice/technologies to each e-mail, would it rate as PCI compliant? The email itself is encrypted Encryption is applied end-to-end in the transport layer ...
-1
votes
0answers
13 views

Key Management - general question

I have a little question regarding the wonderful topic of "Key Management". Let's imagine I would use a service like AWS Key Management. According to their API documentation one can easily decrypt a ...
-1
votes
0answers
16 views

Monitoring what is being done on your PC when TeamViewer is used?

How can I watch what someone is doing on my PC while they are logged in on TeamViewer?
1
vote
0answers
15 views

JavaScript variable evasion when quote is escaped, but not newline

I'm searching a way to properly evade from a JavaScript variable to perform XSS. A normal user input will give var a='<b>user input</b>'. a isn't eval anywhere and is not usable. ...
0
votes
1answer
26 views

Best way to store SQLite password offline?

I'm developing a Windows application that uses SQLite, and I want to encrypt it (there is some sensitive information). The trouble is that one of the application requirements is that it must work ...
0
votes
1answer
25 views

Does removing user interaction create a secure sandbox that nullifies XSS?

Say there is a service online that takes as input a DOM string, loads that DOM in a browser on their server, and returns a screenshot. Would it be possible for the online service to completely ...
0
votes
0answers
11 views

accessing file through an RDC or sharing across network more secure?

Question: Which is more secure? The Goal: Billy works in an office that is setup on a domain and needs to create files then have a different department access them. Option 1: Billy rdp's into a ...
0
votes
0answers
16 views

Privacy concerns for personal data shared between Facebook and Amazon

I was looking for a tablet from my home PC on Amazon and sometimes I find Amazon ads on Facebook which contain suggestions related to my search criteria; I never worried too much as I thought the ...
0
votes
0answers
12 views

Attaching orphaned/stageless session meterpreter

I have problems with meterpreter reverse_https. In my engagement, I saw this message in console; "Attaching orphaned/stageless session meterpreter" But after I lose connection, and victim connects ...
1
vote
0answers
13 views

Is there a form to know the PostgreSQL version using nmap?

I tried using the following command: nmap -p 5432 -v --script pgsql-brute myhost But I got no output related to the pgsql script nor the dbms version.
0
votes
0answers
16 views

How can I authenticate securely to an internal website from an iPad without an strong password?

I would like to authenticate from an iPad to a website securely without using a strong password. I have though of these possibilities: Credentials stored in the iPad (like Gmail credentials). Using ...
2
votes
1answer
19 views

May HSTS block access to your site when you renew your SSL certificate?

I've thinking in using HSTS in my sites but I don't understand that you need to sync the HSTS timing with the time when the certificate is going to be renewed or not. Can I use safely a static time ...
3
votes
1answer
28 views

Is the native sandbox of Chrome and Firefox enough or would SELinux improve its security?

Chrome on Windows and Linux and Firefox on Windows are executed in a sandbox. On Linux, is the Chrome sandbox enough or would we gain security if we use SELinux to protect the Chrome execution? I ...
0
votes
1answer
32 views

Strange CA certificate prompt

My network went down for a minute today, then this window popped up: Can someone here clarify this for me? I was using firefox. I had google, youtube and outlook open. My name isn't even close to ...
0
votes
1answer
24 views

Packet Filter with Access Control List

http://i66.tinypic.com/29p50zp.png Can anyone explain how to read and understand row 1,2 and 3? My understanding for row 1 is : If any inside packets want to go to outside via any source port to ...
0
votes
2answers
35 views

Nmap says host down, but host is up

I am using nmap 7.12 on Mac OS X. I haven’t been able to find a solution to my issue. The host that is being scanned is a Linux RHEL server in VirtualBox. I can ping the server and receive ICMP ...
1
vote
1answer
29 views

Challenge-Response Application in E-banking

Why is it important that Alice doesn't know K? What could happen if Alice knew K?
2
votes
1answer
25 views

What are the security implications of enabling CORS for images?

The company I work for runs a user profile photo server. I would like to fetch, visually modify (add a blur, some effects, etc.), and display those images in <canvas>. The problem is that the ...
2
votes
1answer
20 views

Will the Credential Management API now available in Chrome 51 be widely adopted?

Google Chrome 51 stable includes support for the Credential Management API. This implementation is based on the W3C spec. Will other browsers support this technology (particularly Safari)? Will web ...
0
votes
0answers
15 views

OpenSSH password based authentication in the enterprise?

TL;DR How common is.. Using password based authentication on servers to login over SSH reusing the same password other places. Even if this is an unprivileged user it is still valuable I think. ...
-3
votes
0answers
53 views

What kind of encryption/encoding is this? [duplicate]

Unknown encryption/encoding: ...
1
vote
1answer
21 views

What protects HDCP keys in software?

I (somewhat) recently stumbled across HDCP (high-bandwidth digital content protection), a protocol that encrypts movies and other media "on the wire". Now there are of course tools to play blu-rays ...
0
votes
0answers
13 views

How can I test my SSO connection without having access to the Identity Provider?

I'm trying to set up an SSO connection using Auth0. My app is set up as the Service Provider (SP), and it needs to work with PingFederate as the Identity Provider (IdP). I don't have access to an ...
1
vote
3answers
58 views

Storing two copies of data, encrypted in different ways

Our website has some personal data that needs to be visible to both the user it belongs to and the administrators. It also needs to be encrypted. As we want to maintain a simple system, just username ...
0
votes
0answers
22 views

Are there security concerns with Bluetooth low energy?

In the first versions of BLE specifications, there was a huge security flaw during the pairing allowing an attacker to perform a MITM attack. Since Bluetooth 4.2, the pairing use ECDH, so there isn't ...
0
votes
2answers
44 views

Is JQuery 2.1.1 vulnerable to OS command injection?

Barracuda has found multiple instances of OS Command Injection vulnerabilities in a static website. In each instance, the vulnerable URL was the JQuery plugin itself (version 2.1.1). Barracuda rates ...
-1
votes
3answers
49 views

Email from supposedly Apple (mycloud.ssl.com)

I got an email where it says that Apple recently failed to validate my payment information and therefore they need to ask me to complete a short verification process in order to verify my account. At ...
1
vote
1answer
43 views

What is a device that scans the network it is connected to called?

Are there any devices (computer, switch, router, etc.) witch integrate licensed software like Nessus or Nexpose in a way that you can just drop them in a network and scan that network remote? If so, ...
1
vote
3answers
64 views

Is there now an increased risk of ransomware in pirated software?

Ransomware is on the rise, much due to new ransom-paying opportunities via Bitcoin. Has there been a reported increased risk of ransomware in pirated software (i.e. so called “warez”) – outside of ...
0
votes
1answer
12 views

How server knows about the client_write_key to decrypt the client message?

I have a question regarding the TLS handshake. As of my reading I came to know that master_secret will be derived from pre_master_secret shared by client as follows: master_secret = ...
-1
votes
0answers
19 views

About Arp attack

we have the suspect of MITM attack but we are not sure. So I install XARP on the computer. The log is clean but one computer of the net have a very higth value in the coloumn how often seen. It's ...
0
votes
1answer
30 views

Connected to my server through VPN. Should I change my key?

I am using an SSH key to connect to my server (I've got Pageant to authenticate my key) and I forgot that I had the VPN on so I connected to the server (SFTP) while I was on it. Should I change my ...
0
votes
0answers
26 views

Unable to view USB Hard drive contents after lock(read-only access)

My work laptop has PGP Desktop 10.3 and when I connected my USB flashdrive it prompted me to Encrypt or Lock. Given the information on both of these options the only choice I had in order to access ...
0
votes
0answers
31 views

What is the right strategy for me to develop a paid public wifi?

I want to establish a paid public WiFi system. Here is my model of how it will work: I will install a public WiFi in my apartment. Using the WiFi system is paid but, voluntary. Those who pay me a ...
0
votes
0answers
12 views

Can knowledge of a TPM's SRK/owner password unseal data even if PCRs no longer match

I'm currently setting up a BitLocker equivalent using a TPM and LUKS. I've got the basics right and I'm able to measure the boot process and seal the FDE key using the TPM. The issue I've got is that ...
-7
votes
0answers
49 views

How to spoof browser fingerprint? [on hold]

I need some JavaScript code to spoof the following browser information to make a fake fingerprint: Limited supercookie test Hash of canvas fingerprint Screen Size and Color Depth Browser ...
1
vote
1answer
41 views

XSS Page Cannot be Displayed

When I try XSS on various websites, such as inserting " onmouseover="alert(1) in a search box, I either get a message saying You don't have permission to access this page or This page cannot be ...
1
vote
0answers
22 views

Simulation vs Formal Analysis of Authentication Protocols

I received a review for my journal paper in which we proposed WOOlim or nspk kind of authentication protocols. We proved the strength of our protocol with rigorous formal methods using CSP and rank ...
0
votes
1answer
87 views

Is this company's claim to have solved MITM attacks true?

The Daily Mail reported in Dec 2014 about a company that claimed to have solved the MITM attack. Can someone explain how this is possible or what the difference is from TLS?
0
votes
0answers
21 views

InitializeSecurityContext takes 45 seconds to come out

For an expired certificate sent by a server, the InitializeSecurityContext function takes more than 45 seconds to come out with SEC_E_CERT_EXPIRED. Is there any configuration to avoid this much ...
0
votes
1answer
9 views

How can I check the integrity of a file with GPG?

I plan on running several servers with bitcoind and other things. How can I do file check with GPG key? I did the following: first I downloaded the file I want to check over a secure connection: ...
-1
votes
0answers
17 views

Recover encryption key from Windows

Ok, So last night my Windows 10 Laptop crashed and was stuck in a repair boot loop and after troubleshooting and restarting and so on, the best course of action was to reset my PC. So as I was in ...
0
votes
1answer
51 views

Strange symbols in Firefox address bar with https

Why are there dash marks through the https portion of this address? Is this a feature that's supposed to further accentuate that this is unsecured https? I just thought it was a graphical glitch ...

15 30 50 per page