Questions tagged [theory]

The tag has no usage guidance.

3
votes
2answers
340 views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...
2
votes
1answer
60 views

Does the subject HAVE to dominate the object in order to access the object?

Lets say Paul, is cleared for (TOP SECRET, {A,C}) where top secret is his clearance and A & C privledges. He wants to access a Document classified (Secret,{B,C}).. Top secret trumps Secret but in ...
1
vote
0answers
108 views

Detecting web visitors controlled via RDP or compromised by RAT/RAT-in-the-Browser (RitB)

Is there a way to detect whether visitors to a website are using Remote Desktop Connection (RDP) or have been compromised via a type of Remote Access Trojan(Tool)/RAT-in-the-Browser (RitB)? So a 3rd ...
0
votes
1answer
100 views

Security implications of storing encrypted snapshots on cloud

We have to deliver a zero-knowledge SQLite based accounting/reviewing app running on Mac 10.6 and above. We are asked to upload snapshots of database to cloud (AWS S3 or GCP) at regular intervals; so ...
4
votes
2answers
154 views

Way of categorising and organising types of security issues and areas

I have recently done a security review and uncovered 200 or so areas to improve upon covering a very diverse range of topics; Some points are process, some are config, some are new systems to be ...
4
votes
2answers
618 views

Examples of Federated Identity Management, Third Party Identity Services and Single Sign-On

I am studying the domain of Identity and Access Management in CISSP, and I come across the three terms Federated Identity Management (FIM), Third Party Identity Services (3PIS) and Single Sign-On (SSO)...
5
votes
1answer
646 views

How many known time/result combinations does it take to guess a HOTP/TOTP secret?

I thought about "recovering", "determining", "guessing", "calculating" or "reproducing" the HOTP/TOTP secrets when only the outcome (6-digit code + time) is known. In case we can view the live ...
1
vote
1answer
210 views

Why is the BLP access control model a mandatory one?

In my lecture on formal methods in IT security as-well as on Wikipedia it is stated that the BLP model is a mandatory access control model. It is not clear to me why this is the case. We have defined ...
-1
votes
4answers
1k views

Theoretical - Password salting with concatenation vs. salting with HMAC

I was looking through different methods of salting and tried to compare which is more secure for password storage. I know HMAC wasn't meant at first for password hashing but it is widely used for that ...
4
votes
1answer
105 views

Is there any technology that allows to run code in untrusted environment?

Imagine, your computer is controlled and your traffic is watched (MitM) . For example environment can create a snapshot of process and record a traffic. Is there any chance to run code and prevent it ...
2
votes
1answer
282 views

What is the meaning of 'Default to Zero' that must be keep in mind in Authorization?

I learned that in authorization there are somethings to keep in mind, there are: -Authorization Creep this happens when an employee switch roles and the previous authorization isnt removed. -Default ...
54
votes
4answers
9k views

Are non-English speakers better protected from (international) phishing?

After I received dozen of spam mails over the last year with my thrashmail (used for "You must log in once to check out this product.."-Sites, etc.) I noticed they were mostly translated (if they are ...
3
votes
3answers
118 views

Theoretical - Is it possible for an attacker to leave an irreversible software artifact?

Assumimg that... the target is some server (> 2010) that could be running any OS the attacker has gained access to everything remotely, (with maybe some physical access as well) Is it possible for ...
2
votes
0answers
50 views

Bad security vs no security [duplicate]

In our company we currently have a disagreement about imperfect security. Our current main project is an embedded device with a web server running on it. One of our customers wants HTTPS for that web ...
1
vote
0answers
189 views

Is control theory of any use in the Infosec disciplines? [closed]

I'm currently studying Engineering in a European university (not CEng, though), and I've always been fascinated by the network security/information security field. As far as I know, crypto is the ...
2
votes
2answers
329 views

Is this password inside a file secure? A security paradox

Preamble: I have been a long time lurker but first time poster to the Information Security site, so please be gentle with me. The Situation: I ran into a situation where I needed to securely store a ...
19
votes
8answers
5k views

A destructive force can always leak information through HTTP packets. Should I bother configuring outbound rules on my firewall?

I know my way around firewalls, but I am in no way a security expert. And recently, I am wondering how to effectively configure the outbound rules of any company's firewall. For the question's sake, ...
1
vote
1answer
152 views

Why is my answer to this security exam prep question incorrect?

I'm studying for a security exam and am confused by one of the chapter review questions in the book I'm using. It reads: When scanning a network via a hardline connection to a wired-switch NIC ...
4
votes
2answers
238 views

Theoretically, what are the best “reverse social engineering” methods for your password, and how good would they be?

I just saw this SMBC comic: http://www.smbc-comics.com/index.php?id=3955 I realize that this is not actually "reverse social engineering" as typical usage of the term. However, I'm wondering in ...
2
votes
2answers
583 views

Good book about general methods of exploit [closed]

I suppose that a lot of users hate this type of 'noob' questions, but I really eager to become a Cyber Security specialist and I need a little advice. As for now I'm learning Networking/Routing &...
2
votes
4answers
89 views

Layer model for information security - scientific name?

Some days ago, I was talking with a friend about the Snowden revelations and its impact on Infosec awareness and how quite a number of (supposedly) secure alternatives to established services have ...
-2
votes
2answers
226 views

Will cyber security be around forever? [closed]

As time goes on, won't computers be able to automatically test for vulnerabilities to the point where they will not be prevalent any more? What I'm essentially asking is will information security be ...
2
votes
1answer
152 views

Long passwords and key derivation functions

Not being a security expert, I have a rather theoratical question that I have been thinking about for quite a while now: Let's imagine an encryption software that takes a user-provided password, ...
1
vote
2answers
1k views

ISAKMP and OSI layer

I'm trying to find out on which OSI layer the ISAKMP protocol resides on? It isn't listed under the wiki's list of network protocols, and the internet says it's either on the transport, network or ...
4
votes
1answer
1k views

Safety in Access Control Matrix and Take-Grant Model

I'm learning about the Take-Grant Model and Access Control Matrix, and I have a couple of questions regarding leaking and the safety question. Definitions These are the definitions I am using (see ...
4
votes
2answers
1k views

Do `sudo` and `su` belong to capability-based security?

In Linux, do sudo and su belong to Capability-based security ? For example, when editing a system file, we usually need sudo or su to temporarily switch to user root. Does this example belong to ...
5
votes
1answer
522 views

Capability-based security vs protection rings: in what sense are they diametrically opposite?

From https://en.wikipedia.org/wiki/Capability-based_security Capability-based security is to be contrasted with an approach that uses hierarchical protection domains. From https://en.wikipedia.org/...
4
votes
1answer
202 views

Principles of memory forensics tools

I am currently writing a thesis about digital forensics which includes a chapter about memory forensics. Besides the tools and the methods of acquiring various data with them, I am kind of desperate ...
3
votes
1answer
159 views

How long do HTML password fields (sent to the server as postdata) remain in memory?

In any major server-side web framework, there is usually a mechanism to read HTML form input, e.g. in ASP, for an HTML element, <input type="text" name="the_field" />, it is Request.Form("...
4
votes
2answers
4k views

Nowadays, what is the difference between Cyber Security and IT Security?

Lately (and not so lately), you can hear a lot about cyber security. It is really hard to find an official description about this matter so, let's take the ISO 27032 description: "Cybersecurity” ...
1
vote
1answer
160 views

Any known protocol for establishing trust between an inherently untrustworthy source and a server without a 3rd party?

Is there any kind of protocol, scheme, or theoretical paper out there that implements or examines the problem of establishing trust between two parties (communicating, listening) where the ...
4
votes
3answers
884 views

Fully encrypted social network theory

I have this idea about building a social network that stores all its data encrypted. The idea is that a member's data is stored on multiple 'base servers' (of the member's choice). Each member has 3 ...
12
votes
1answer
15k views

Will double encryption increase the security of cipher vs bruteforce?

Assume I have a function encrypt(mes,key) where mes is the message, and key is the key. The length of key is 64 bits. Last but not least: assume the only way to crack my cipher is a brute-force attack....
2
votes
4answers
606 views

Strategies to store/remember very long password?

If future proof encryption is - in theory - possible it will require long password. What are some of the strategies for storing or remembering very long - in this case rarely used - password? For ...
9
votes
2answers
888 views

What applicability does the Halting Problem have to infosec?

I was reading an infosec blog recently, and I was caught off guard by the following statement: Sure you can run up to date software and firewalls and that network appliance in your data center that ...
5
votes
1answer
1k views

How big is the risk of hash fixed points/cycles?

It's established wisdom to hash password multiple times with a salt to increase the time it takes per brute force iteration. At the same time (unless the algorithm guarantees otherwise) there's a ...
17
votes
4answers
3k views

Future proof encryption possible in theory?

Let's say I have a message that I want to keep safe for the next 100 years. Is it theoretically possible? Let's say the message is unique (raw picture data, raw video video data, raw text data) and ...
7
votes
4answers
572 views

provable security and sandboxes

Maybe this can be answered by an answer to a more general question, such as what programs can be proven secure. Can it be (or has it been) formally proven that a sandbox is secure?
46
votes
5answers
7k views

How valuable is secrecy of an algorithm?

On the surface, the inadvisability of security through obscurity is directly at odds with the concept of shared secrets (i.e. "passwords"). Which is to say: if secrecy around passwords is valuable, ...
0
votes
1answer
416 views

Detecting end-state of decryption process with unknown key

Note: this question arises purely from a theoretical interest in security research. Frequently in popular fiction we see white-hat hackers decrypt secret information in a matter of seconds. While ...
1
vote
2answers
5k views

authorization vs federation vs entitlement

I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and ...
1
vote
2answers
2k views

BLP Lattice structure with missing top and bottom levels

I designed a system similar to the above diagram. However There is no (Top Secret, {nuclear,crypto}) and no (Secret,{}) levels. Meaning that there is no top and bottom level. Would it make the BLP ...
1
vote
1answer
245 views

Appilicability of Theoritical Computer Science/Formal methods in Malware research

I would like to know the importance of Theoritical CS/Formal methods in Malware research. Due to the large volume of new malware variants received per day (~50,000 samples/day according to McAfee), ...
4
votes
1answer
71 views

Are viewable permissions an issue?

Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some resource....
7
votes
1answer
2k views

Open Problems in Security?

I know it might seem a bit too much theoretical, but I was wondering if there was some list of known open problems in security? In a similar way that there are open problems in Theoretical Computer ...
15
votes
2answers
2k views

Are there some good papers (or discussions) on using Markov chains or Hidden Markov Models for password auditing/cracking?

As a programmer and language enthusiast I've been very interested in Markov chains for some time. Considering the influence of natural language on password and passphrase selection (by humans of ...
171
votes
4answers
40k views

Amount of simple operations that is safely out of reach for all humanity?

Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, ...
39
votes
8answers
29k views

Where can I learn cryptography/cryptanalysis the hard way, without going to school ? Any good book?

I'm not so bad at mathematics: I know what are p-list and p-combinations, I know matrix algebra, I know what a XOR is, I know how to tell if number is a prime, etc: I'm not the programmer who hates ...
8
votes
7answers
3k views

Definition of Software Security

I'm looking for a theoretical definition of Software Security. And I need to quote some book in an article. Most of the books starts already assuming that the user knows what that is, and they're ...
4
votes
2answers
194 views

Is it correct to consider audits as exclusively “detective” in nature?

I'm studying for the CISSP exam and one of the video lecture points didn't quite make sense to me. The instructor was discussing access control administration areas and began categorizing certain ...