Questions tagged [protocols]

A description and set of rules for the ordered exchange of structured information designed with the goal of protecting the security of the system.

Filter by
Sorted by
Tagged with
-1
votes
1answer
82 views

How to restrict my PC to browsing only for security reasons? [closed]

I have a PC that i only use for browsing the web. I do not have any problem with disabling any other services/protocols that does not affect web browsing. I want to disable these unnecessary services (...
2
votes
1answer
241 views

What's the fastest protocol to target for password attacks

In a Windows domain environment, there are numerous protocols (SMB, LDAP, Webpages, RDP, FTP, etc.) that query against the same Windows based AD. Many of these protocols have their own overhead that ...
1
vote
2answers
2k views

Why is SQL considered to be a session layer “protocol”? [closed]

Within the OSI-Model, why is SQL considered to be a session layer "protocol"? Isn't SQL a language and not a protocol at all?
1
vote
2answers
147 views

Is there any way to protect a client-side game from a hacked client?

Here's a toy example of a game: the player is presented with N slot machines. They can click on each slot machine once, and when they do so, the slot machine rolls a random outcome (based on a ...
15
votes
1answer
329 views

Why is caller ID spoofing so simple, and catching offenders so hard?

There is plenty of software which allows a user to input a recipient's information, and a fake-originator's information, and the software will complete the caller ID spoof. I'm trying to understand ...
4
votes
1answer
368 views

Secret Santa - implementation that does not require a participant to trust the server

In the Christmas spirit I read Cryptographic Secret Santa from MathOverflow, and then followed the link to another page titled Cryptographic Secret Santa. On this latter page the author explains an ...
2
votes
1answer
375 views

Is it safe to store secrets in LDAP?

Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP. Is it safe to store secret or sensitive information as an ...
3
votes
0answers
103 views

Is there a secure, anonymous peer to peer matching solution?

I am newbie so please pardon my naivete. I was wondering if there is any cryptographic procedure that allows for peer to peer matching. Perhaps to illustrate my question I will use an example. Say I ...
9
votes
2answers
4k views

Is it already the right time to say goodbye to TLS1.1 support on web servers? [closed]

Reading different articles, mentioning this one, for the sake of this question on old TLS topic. Quoting part of the article: 30 June 2018 is the deadline for disabling SSL/early TLS and ...
3
votes
1answer
577 views

Penetration Testing & TCP/IP Interview Question [closed]

I recently read that as a penetration tester you should be able to explain the TCP/IP protocol in depth, however these writers never say how in depth is good? Rewriting the protocols by hand type of ...
2
votes
2answers
120 views

TLS Extentions: Omitting TLS Handshake Messages

I've been reading though various RFCs and couldn't find a definite answer to my question: can a negotiated TLS extension skip some of the TLS Handshake messages and still be compliant with the TLS ...
-1
votes
1answer
42 views

How to connect to external address as other outgoing port number without proxy [closed]

Is it possible to (mask / define) outgoing port locally on network without using a proxy? default (outgoing protocol) [address] [port] set to (outgoing protocol) [address] [selected port] There ...
1
vote
1answer
134 views

File transfer secure from a network security perspective

Let's assume a simple network with a (Windows) server and a (Windows) workstation. Turns out the question of how to securely transfer files between the two isn't obvious considering: I define secure ...
4
votes
1answer
248 views

How can I see whether the e-mails I exchanged with someone have been encrypted?

In my understanding (please correct if applicable), The e-mails sent through a secure server are encrypted in the route between me as client and the mail server, whether this is a local or remote ...
2
votes
0answers
215 views

How do adversary models and security types relate [closed]

Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement for ciphers. It got me thinking about this paper I recently read, where a formal model of the Honest-...
5
votes
1answer
429 views

Minimum set of TLS features for an embedded device

I am reviewing the security of an embedded system, specifically how it uses the TLS or DTLS protocol to communicate securely. The system implements as few features of the protocol as it can get away ...
2
votes
0answers
99 views

Why don't cell towers authenticate with cell phones? [duplicate]

Stingrays exploit a significant security vulnerability of cell phones: phones attempt to identify themselves to, and even worse, continue to use fake towers. Why not have towers authenticate ...
0
votes
1answer
45 views

Process of finding device hostnames on LAN

Is there a reliable way to retrieve hostnames from LAN devices without having to install extra software or performing nmap-style OS fingerprinting? I'm ideally looking for either a protocol that has ...
0
votes
2answers
781 views

What should I know to prevent relay attack on NFC?

I am doing thesis on "NFC relay attack" in my BSc last year. I have studied 10-15 papers and learned the basics of NFC and relay attack. Still I am no where near to understand how relay attack is ...
4
votes
1answer
2k views

What to do if you still have SMBv1 running on your network?

I was looking into the network traffic at our company while preforming a security audit and I found that we still have a server running SMBv1 on the network. The server is a Windows 2003 Domain ...
1
vote
3answers
196 views

Securing a rest API with one client

I am about to develop a REST API that will only have one "user" and I am curious about how I should implement security to make it as secure as possible(hopefully implementing some protocol that I am ...
2
votes
0answers
187 views

Implementation of existing smart lock methods

Smart lock? Apple, Android, Google, and now Microsoft have a feature called "auto|smart|dynamic|proximity lock" which enables to unlock your computer by simply carrying a (Bluetooth) support device ...
0
votes
1answer
122 views

Does it make sense to have something similar to IPSec at the data link layer?

We currently have security protocols for the application layer (e.g. S-HTTP, DNSSec, PGP, etc.), the transport layer (e.g. SSH, TLS, SSL, etc.) and the network layer (e.g. IPSec). Does it make sense ...
0
votes
1answer
611 views

Can firewalls detect and block outgoing by protocol [duplicate]

Or specifically, what can be done to detect or block the following (other than closing port 443)? If this is something that can or cannot be done based on the specific hardware used, please provide ...
2
votes
2answers
141 views

Does the choice of protocol affect the efficiency of a DOS attack?

I was wondering, to make a DOS attack you need to send something to the target you are DOS-ing. And to send something you need to use some protocol. My question is, are all protocols the same speed? ...
4
votes
3answers
299 views

Is it possible to have a protocol that sits on top of TCP/IP that encrypts packets?

I was wondering if it is possible to make a new protocol which sits on top of TCP/IP and encrypts the packet which is going to be sent. One of the issues I can see is the metadata being available ...
3
votes
2answers
167 views

Are Wi-Fi scanning programs reliable?

Recently, I scanned some Wi-Fi networks with wifite tool in Kali. This tool said that one of the available Wi-Fi networks is secured with WPA2. Ten minutes later, I scanned these Wi-Fi networks again. ...
7
votes
0answers
467 views

Has anyone had a look at DIME, the new Darkmail infrastructure, yet?

Background. In 2013, Lavabit and Silent Circle formed the Dark Mail Technical Alliance and launched the Darkmail project to create the Dark Internet Mail Environment (DIME) – a new mail architecture ...
6
votes
2answers
813 views

What are the security benefits or risks of HTTP/2?

Since HTTP/2 is starting to get adopted by more and more sites everyday. Are there any security benefits or known risks regarding HTTP/2?
4
votes
2answers
744 views

How does ndpi actually detect the HTTP protocol?

I have been digging the ndpi codebase and trying to understand how its actually detecting the HTTP protocol. What I found so far is that they are searching the request type in the payload and if not ...
0
votes
1answer
249 views

Bidirectional encrypted communication between two systems

I have two network peers that need to use custom, encrypted application protocol to communicate with each other. Exchanged messages are fairly small, usually less than couple of hundreds of bytes, and ...
1
vote
3answers
899 views

Which protocol should I use for secure message transfers between two servers?

There are two servers. I am going to transfer very secret messages from the first one to the second. The second server (the one that receives data) doesn't have access to any other resources except ...
1
vote
1answer
513 views

Why is the DANE protocol depending on DNSSEC?

Why is the DNS-based Authentication of Named Entities (DANE) protocol depending on Domain Name System Security Extensions (DNSSEC)?
1
vote
1answer
287 views

How does the DANE protocol make Certificate Authorities obsolete?

How does the DNS-based Authentication of Named Entities (DANE) protocol make Certificate Authorities (CA) obsolete? In other words: How is it technically possible that DANE does not need Certificate ...
23
votes
5answers
5k views

Why did TLS 1.3 drop AES-CBC?

I was watching this video about TLS 1.3: "Deploying TLS 1.3: the great, the good and the bad (33c3)" and was somewhat surprised to see that in their effort to provide "fewer, better choices" they ...
0
votes
1answer
137 views

In Real-Time, where do we deploy Extensible Authentication Protocol(EAP) in Wireless Networks?

I have heard that the EAP protocol has authentication capabilities for wireless networks too. But I am not able to get how it is deployed in real time as I know that whenever I need to connect to my ...
2
votes
2answers
130 views

Good publicly available unpredictable random number sources?

I wasn't sure whether to ask this on crypto or security, but since it involves real-world trust and services, I figured this is the better place. Consider that me and my friends (whom for the ...
1
vote
4answers
1k views

SSL Protocol Support

If I connect to a server using a specific SSL protocol version, but no cipher-suites are offered under that protocol, would that protocol still be considered supported? For example, connecting to a ...
2
votes
1answer
472 views

Can CMP (Certificate Management Protocol) be used to issue certificates to mobile devices?

The SCEP (Simple Certificate Enrollment Protocol) is the more like the defacto protocol for device enrollment. It pushes the digital certificates to the device which can be used for authentication, ...
2
votes
1answer
949 views

GRE DDOS — Wouldn't the firewall block it?

So I've been reading up on Mirai. And I found out that it implements a rather unique attack, described here, where it floods the victim with GRE packets. GRE is IP protocol number 47. Now here's ...
11
votes
2answers
9k views

Difference between Bluetooth LE Secure Connections security mode 1 and level 3 and 4?

In BLUETOOTH SPECIFICATION Version 4.2 [Vol 3, Part C], page 372, there is a section called LE Security Modes, which states: There are two LE security modes, LE security mode 1 and LE security mode ...
2
votes
1answer
175 views

Which Extensible Provisioning Protocol (EPP) status-values provide sufficient protection against domain hijacking?

The Extensible Provisioning Protocol (EPP) as described in RFC 5730, can possibly be protective against domain hijacked. The protocol consists of the 17 following status-values as described in RFC ...
3
votes
3answers
482 views

Does QUIC really solved IP spoofing problem

Many documents indicates that in QUIC solves IP spoofing problem by a server generated token. Specifically, server issues a token so that the client can use it to identify itself, then the server will ...
1
vote
0answers
620 views

Different versions of TLS in record layer and handshake layer [duplicate]

There is application that uses OpenSSL 1.0.2g. Application is able to receive incoming connections and initiate outbound connection. Application sends ClientHello message during create outbound ...
3
votes
1answer
217 views

Is there an advantage in using separate key pairs for encryption and signing? [duplicate]

Let's assume that we are designing a binary protocol for message exchange between devices. Part of the message will be RSA encrypted and there will also be an RSA signature block in the message. Is ...
1
vote
1answer
156 views

Meterpreter connections

If i setup a meterpreter reverse_https payload and send to multiple targets and they execute the payload whithout my handler running, when I setup the handler will they connect or do I have to have ...
1
vote
1answer
40 views

Secure communication protocol for equality test

I'm solving a theoretical problem with two entities, each having one secret number. They need to find out whether these number equal without disclosing their number when they differ. Easy solution is ...
3
votes
1answer
220 views

Hex string in TLS SNI field

I'm looking at packet captures of TLS traffic, and I see TLS-encrypted connections where the SNI field contains a long hex string (a sequence of 64 hex nibbles) -- not a domain name. What might ...
1
vote
1answer
103 views

CMP - Simply get certificate, knowing some information

My company is migrating its CAs. Actually, it's Unicert CA using a UPI client. But in the future, they want a CA supporting CMP (it should be EJBCA, I'm actually testing this). So I analyzed the ...
5
votes
1answer
2k views

MQTT over TLS using RabbitMQ

We want to use RabbitMQ over TLS for our mqtt messaging, so we did some testing and managed to get it working over port 8883 using this configuration guide and we need to connect on a url that starts ...