0
votes
0answers
4 views

How to verify personal information (Identity)

I've been trying to find this information but all I can find are answers saying to use a credit card for verification, not real answers. I am trying to figure out how/where companies get information ...
1
vote
0answers
6 views

Is it better to have a secure channel or secure PIN entry for Smartcards?

Assume I do own a computer, a USB-connected keyboard and a USB-connected contact-based (trusted) chipcard reader with a hardware pinpad. There are now two types of smartcards relevant to this ...
0
votes
0answers
22 views

How to check how I was hacked?

Today I was notified by DigitalOcean that my droplet was hacked and a DDOS attack was generated from it. It was a droplet I used as a staging server for a webapp I will send to production later, and I ...
0
votes
0answers
12 views

Firefox refuses to use X509 certificate, complaining “Cound not verify this certificate for unknown reasons”

I stumbled upon this question and answer. I have the same problem as the OP, and am sorry to report that the proposed answer does not resolve it. Certificate in question has been verified by OpenSSL-1....
-1
votes
1answer
18 views

Hosting CSRF Token at URL

When implementing CSRF protection, one generally uses a CSRF cookie that must be included in the body of the request. This prevents CSRF attacks because the malicious website cannot read the other ...
1
vote
1answer
9 views

Dealing with a misconfigured corporate SSL certificate

I work at an organization that inspects all HTTPS traffic by injecting its own SSL certificates. It wasn't configured properly though, so Firefox always shows a "Your connection is not secure" error ...
0
votes
0answers
8 views

How do I perform output encoding on text boxes having limited sizes? [on hold]

How do I apply output encoding for a text box which only allows a limited size? I cannot perform input validation for that text box because it expects '<' and '>' symbols. While I was trying to ...
0
votes
4answers
38 views

How are salts safe in the database? [duplicate]

I have read many and many of this type of question on the security stack community before I asked this question, but one thing that made me mad about salts and saving it in database is this ... I will ...
0
votes
0answers
7 views

How robust is a VeraCrypt Container against disk errors?

I am planning to encrypt backup data using VeraCrypt. How safe are the generated containers? My worries is not so much the encryption, but potential data loss due to degrading harddisk media over time....
4
votes
1answer
153 views

What's the advantage of sending an RST packet after getting a response in a SYN scan?

I'm reading about nmap's SYN scan, and it says Nmap sends an RST immediately after the server tries to establish the handshake. My question is - why bother with the RST? Is it to prevent the server ...
1
vote
0answers
24 views

Allow users to download files from outside of webroot [migrated]

I've got a folder where I'm storing a bunch of confidential documents and I authenticate the user when they log in, but I only want them to be able to download a specific file. How can I retrieve ...
1
vote
1answer
11 views

Hops encountered More for spam Mails than Legitimate Mails

Background I am working with email headers for spam detection.Each E-Mail header contains many "Received-from" fields,each "Received From" field added by an intermediate Smtp/Mail server in the path ...
4
votes
2answers
48 views

Can I test my own network?

I'm currently trying to enter the field of information security and I was just wondering if there was anything barring me from testing my own network for security vulnerabilities? I only have a couple ...
1
vote
0answers
7 views

JWT vs. Client Certificates

We have a transaction server that is connected to by different client applications. The requirement is to have a secure means of authentication for client applications to communicate with the ...
0
votes
1answer
52 views

Why is jailbreaking so easy [on hold]

Since the beginning of time people have been jailbreaking their iPhones/iPads (Sigh). Somehow, no one seemed to wonder "why is is the process of gaining full root access so easy?" there used to be ...
1
vote
0answers
24 views

How does SFTP work? Please help someone [migrated]

We run a system that automatically sends a swift message at the end of a process. But this messages are sent using FTP. We feel the FTP process is too prone to MITMA and wish to change the sending ...
1
vote
0answers
19 views

Recommended Crypto Security Setup (Implemented Algorithms)?

Firstly I'm not a crypto expert, however I know how to use algorithms that other people have defined before in practical usages, that is, as long as they live up to their promises. The thing is that ...
2
votes
1answer
31 views

Am I vulnerable while leaving a putty client connected to my Amazon Web Server?

I'm not worried or concerned, but I am curious as to what types of exploitation I might expose my home server to if I leave a putty client connected using SSH. I am using putty to connect to an EC2 ...
2
votes
1answer
39 views

What risks do I have now that I accidentaly opened a suspicious URL send to me by Skype?

The following URL was sent to me by a trusted Skype contact (from my university): http://bit.ly/28PPw3V#dahubas=my_skype_id I clicked on it bacause I thought it was the score of an exam. I got ...
1
vote
1answer
21 views

Login to social Media using Facebook Connect

I came here with a struggle issue. We run a social media website, where people can register by classical login (might be his email or his username) and password form but also using a Facebook Connect. ...
-1
votes
0answers
27 views

How to hack a unmanaged switched network [on hold]

Given the following scenario You have an unattended unmanaged switch (Netgear FS608) A system with Kali Linux with a USB to LAN adapter (ASIX Electronics Corporation AX88772B) Wireshark capture of ...
1
vote
2answers
35 views

Undeletable logging or file-writing

I want to log or write files automatically to a un-deletable storage device. Even if the attacker had offline access to the storage device he/she shouldn't be able to delete the files or logs. If ...
2
votes
1answer
7 views

Does SAML 2.0 define how to pass only username from SP to IDP?

I am looking at a use case where the service provider will need to capture the user id (not password) to identify the target IDP. In this case, the requirement is to send the user id (that is already ...
-1
votes
0answers
24 views

is it possible to get vpn server speed in client machine [on hold]

I have setup a vpn on my digital ocean droplet, is it possible to get the same bandwidth that i get on digital ocean on my client machine using vpn connection.
2
votes
1answer
27 views

Android N - Security Crypto Provider is deprecated

As mentioned in "android developer's blog" , http://android-developers.blogspot.in/2016/06/security-crypto-provider-deprecated-in.html , security Crypto provider is deprecated on Android N. And also ...
1
vote
2answers
29 views

Is using the 2FA secret on the same machine as using the credentials, removing one factor of 2FA?

In other words: Is saving or using the two-factor authentication (2FA) secret on the same machine to generate one-time passwords (OTP), breaking the two-factor authentication (2FA) concept since it's ...
2
votes
1answer
40 views

What might be the reason for an major antivirus software to not detect an malicious DNS entry?

I recently installed the trial version of Kaspersky as I had always a good impression of the features of their software. I also bought a 1 PC 1 year license, but didn't unsealed it yet as something ...
1
vote
1answer
24 views

Virus Infected: unable to open anti-virus web sites?

Recently I installed KMSPico, after that many unwanted softwares were installed on my system, later I uninstalled all of them and removed related folders. But strangely from my system I couldn’t open ...
1
vote
3answers
35 views

Is EV green extended validation slower than a regular SSL?

How does EV green extended validation SSL certificate affects the speed of my web site (if at all) comparing to a regular SSL? Also, my provider only allow the EV green certificates to be on the root ...
1
vote
2answers
36 views

How important is it to use a large encryption key for SSL certificate?

I'm trying to figure out which size of encryption key should I use for my SSL certificates (2k, 4k?) Is a 2k key "sufficient"? is it crackable...? and if so, is a 4k key not crackable? Also, how ...
0
votes
1answer
43 views

Should all web applications implement a security feature that stores historical passwords? [duplicate]

In addition to Is it safe to store a password hash history for preventing user to keep same password repeatedly in some cases?. Facebook, and other companies, are storing historical passwords of ...
1
vote
2answers
74 views

Store passwords as integers

I just came up with this idea that I can store passwords as integers which take up 4 or 8 bytes as opposed to a hash that takes like 150 bytes or something. I wrote this function that converts a ...
0
votes
1answer
39 views

Why doesn't Google uninstall or report, installed pirated apps? [on hold]

Why doesn’t Google do anything about pirated apps? It seems really easy to catch the users. You could go to a website and download an apk for an app which you normally pay for in the play store. ...
1
vote
1answer
29 views

Is Displaying Image on Profiles by URL is Security Implication?

I am Developing a Web Application Currently, in which users can Make a Profile and Fill out the User's information, In this i have also kept a Section for Profile Picture, in that i have used a logic ...
5
votes
0answers
44 views

Can I use disk encryption and track my device at the same time, in case it's stolen or lost?

I would like to encrypt a single user profile but have been told EFS isn't the solution. I have a laptop that I leave in my bag and use for work and private purposes. I want to secure data in case my ...
1
vote
0answers
17 views

File sharing solution with approval workflow [on hold]

Is there any solution out anyone is aware of that does secure file sharing but with the facility of an approval workflow. A case being a person can upload a file to the secure file sharing solution ...
3
votes
4answers
41 views

Is there a safe way use a private key from a shared server?

I am working remotely on a school server via SSH from home. I would like to access a private GitHub repository from the remote system with SSH. If I create a new public/private key pair on the remote ...
2
votes
2answers
44 views

Is it possible to use more than one certificate on the same server at the same time? [duplicate]

Is it possible to use more than one certificate on the same sever at the same time, on the same connection? If I have a certificate from Alice Keys CA and another from Bob Security CA, is it possible ...
1
vote
0answers
38 views

Is there any readily available rootkit that attacks Bitlocker systems? [on hold]

My 3rd gen Thinkpad X1 Carbon with Windows 10 (protected by Bitlocker) and Ubuntu installed asked for my recovery key. Thinking it was just a kid messing with it, I typed in the recovery key. But ...
1
vote
2answers
88 views

How secure is a password protected file?

I have a password-protected excel file that stores other personal passwords. Obviously there have been a number of ways to crack the password. community.spiceworks.com Where do you guys store ...
1
vote
2answers
47 views

Does a hash of a 32-bit integer make a better hash salt than the integer itself?

I have a scenario where I already have a table of resource passwords stored as unsalted 128-bit hashes. I'm unable to force owners to provide new passwords, so I'm trying to mitigate the situation by ...
-1
votes
1answer
18 views

What would you look at doing for a application review? [on hold]

what things would you ask if doing a 3rd party application review. Eg should we use this companies application and is it secure.
-6
votes
1answer
31 views

Someone tries to impersonate me on Snapchat [on hold]

Someone has created an account in Snapchat with my picture and email address but a different name. Can you please let me know what to do about it
-1
votes
0answers
10 views

Retrieve Imation Defender Management code [on hold]

I have an imation defender hard drive that uses hardware encryption. After not using it for a while, I forgot the management code of this drive. This code is needed to reset the drive, but don't give ...
0
votes
1answer
17 views

Can a non-PCI Compliant Service Provider provide SAQ A-EP compliance?

I am trying to find clarification regarding PCI Compliance SAQ A-EP and third party hosting solutions. In order to achieve SAQ A-EP PCI Compliance using "Hosting Company A" is it necessary for "...
2
votes
1answer
22 views

What are proper methods to automatically detect malware and are current methods reliable? [duplicate]

What I have seen so far is the ability to automate signing hashes and string offsets as a way for an AV-engine to detect possible malware. Does this prove to be a good strategy for malware detection? ...

15 30 50 per page