Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

The history of the IT security domain. For user's history managed by software such as browsers, use the [tag:logging] tag instead.

0
votes
0answers
10 views

Where are historical data for the CIS Alert Level?

The CIS Alert Level is a representation of the current state of cyber(in)security, globally. There used to be a history of the levels, with an explanation for the changes (especially the rises). I ...
0
votes
1answer
70 views

Why was pseudo-authentication using OAuth more successful than actual authentication using OpenID?

A few years ago, OpenID was nearly everywhere, with support from what are currently the major OAuth providers -- Google, Facebook, and even Yahoo all provided OpenID authentication. Since then though,...
5
votes
1answer
440 views

What was state of the art knowledge on security of speculative evaluation when it was introduced to Intel CPUs?

Many sources claim that almost all Intel x86 CPUs back to Pentium Pro are vulnerable to the Meltdown attack. Pentium Pro was introduced to the market in 1995. What was the state of the art knowledge ...
0
votes
1answer
266 views

i have a school laptop can the school see my history if i use a vpn? [duplicate]

i have a vpn, can the school still see what i search? and when in turn it on i can go on sites that been blocked. i haven tried inappropriate sites but game sites work and social media sites which the ...
4
votes
1answer
186 views

Why don't browsers trust the US Treasury?

(inspired by How do you tell a website they have expired security certificates? ) Why don't major browsers trust the US Treasury PKI certificate authority by default? I know that the government isn'...
1
vote
1answer
70 views

Has the paradox 4.5 database file encryption ever been broken?

As the encryption of the paradox 4.5 database files is from around the late eighties or early nineties, I would have thought it would have been broken by now, but I've only seen tools to brute force (...
1
vote
1answer
94 views

Is there an example of a 'first' human error security breach?

I'm writing something on the biggest threats to cyber security (of either a nation state, company or individual) in the world today, and I've unsurprisingly settled on human error as the biggest. For ...
0
votes
0answers
85 views

Leaking of local time in TLS via nonce composed of timestamp

I was reading up on nonce-based cipher block chaining (CBC), and the author noted how in the history of TLS, the nonce was not encrypted before becoming a initialization vector (IV), leading to a ...
3
votes
2answers
78 views

Did any VT100 derivatives rely on client-side security?

VT100 terminals are "dumb terminals" - they just display data from the server, and send key strokes, with no local processing. In this setup, there can be server-side application flaws, and the ...
12
votes
2answers
244 views

Who was in the first set of CAs

I am currently digging into the history of SSL/TLS. I found that netscape introduced SSL around 1994/1995. They obviously decided to go with a X.509 PKI to mitigate MitM attacks. I, however, could not ...
65
votes
2answers
8k views

Why has the NSA had a hand in deciding on encryption standards?

The NSA has had a large hand in the design of at least two significant encryption standards: the Digital Encryption Standard, and its successor, the Advanced Encryption Standard. Because of their ...
1
vote
2answers
109 views

Do modern cryptographers / cryptoanalytics need the knowledge of historical cryptography

It makes a lot of sense for people to know the history of their profession from various points of view and I suppose especially in cryptography because people can still use old ciphers and no one ...
8
votes
2answers
1k views

When did development on various TLS versions begin? [closed]

What I'm looking for I'm looking for an approximation of the date that the development on each TLS or SSL version started (so the development start date). So I do not want to know the date when the ...
0
votes
1answer
1k views

Origins of the “man-in-the-middle” analysis

Who first formulated communication security in terms of the "man in the middle" attacks? The earliest source I have so far is: Larsen, Gerald H. “Software: A Qualitative Assessment, or The Man in ...
6
votes
1answer
306 views

When Shellshock was introduced, how bad was it **then**?

The shellshock bug, and the underlying feature allowing Function Import from the Environment (I'm calling it FIE), have been in bash since at least 1993, before the rise of CGI. At that time, the ...
3
votes
2answers
279 views

Why is the *-property in BPL security model named “star”?

I am just looking for the meaning of "star" in this property
0
votes
0answers
104 views

Old Tool: S.A.T.A.N. (a.k.a. S.A.N.T.A.)

Years ago computer security analysts Dan Farmer and Wietse Venema wrote the security program S.A.T.A.N.. Does anyone know what happened to it (or if it just went out of style) and what people ...
0
votes
3answers
484 views

What is the technical rationale behind intermediary email servers?

EFF's Survelliance Self-Defense (SSD) project has an illustration of how email over SMTP goes through intermediate mail exchange servers: AFAIK each intermediate servers is expected to add its own ...
0
votes
1answer
206 views

Which is considered the first Cyber Security incident? [closed]

No matter we are talking about Information Security, or cyber security or IT security... I always hear first about "the moth" being the first security threat. But I don't believe it is when talking ...
74
votes
5answers
11k views

What was so dangerous about PGP that its creator was charged in court for it?

I was reading up on the history of the PGP encryption software when I realised its creator was under criminal charges for munitions export without a license for releasing the source code of PGP. ...
0
votes
2answers
105 views

Company Laptop and iTunes/iPhone

With their permission, I am selling a company laptop that I used, but I had been using iTunes and syncing my iPhone on that PC. Is it possible for a forensic tech to retrieve any of the browsing ...
7
votes
3answers
3k views

Where did common “minimum password length” guidelines originate?

Not long ago, the common wisdom was that passwords should be at least 8 characters long. These days, the most common minimum is 12. Where did these common values originate? Interestingly, 8 is ...
15
votes
4answers
6k views

What was SSL 1.0?

What was SSL 1.0? SSL 2.0 and 3.0 are well-known and well-documented. But what did the SSL 1.0 protocol look like? Wikipedia says there was a SSL 1.0 but doesn't say anything about how it worked. ...
10
votes
1answer
12k views

Password length limits in history of operating systems and popular web sites

I heard that many years ago for example passwords on linux systems were limited to 8 characters. Or rather, you could type in more than 8 characters, but only the first 8 characters mattered. ...
3
votes
1answer
3k views

Notable XSS attacks in 2011 [closed]

I am wondering what notable events in XSS attacks we saw in 2011. What big events hit the infosec community in regards of XSS? I am thinking of specific events like for example the Samy worm in 2007 ...
7
votes
2answers
613 views

NSA crypto Suite B - historical

I'm looking for information on what NSA suggested for use in commercial systems in past times. 90's and early 2000's. I'm mainly interested in PKI and symmetric cyphers for SSL and file/disk ...