All Questions
9,215
questions
944
votes
11
answers
329k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73.5k
1292
votes
3
answers
692k
views
How does SSL/TLS work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
- 136k
1288
votes
23
answers
291k
views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
188
votes
6
answers
37k
views
How do I deal with a compromised server?
I suspect that one or more of my servers is compromised by a hacker, virus, or other mechanism:
What are my first steps? When I arrive on site should I disconnect the server, preserve "evidence", are ...
- 54.6k
182
votes
11
answers
38k
views
Help! My home PC has been infected by a virus! What do I do now?
This is an attempt to ask a canonical question as discussed in this old meta post. The goal is to create something helpful that can be used as a duplicate when non experts ask about virus infections.
...
- 65.7k
184
votes
9
answers
705k
views
How to determine what type of encoding/encryption has been used?
Is there a way to find what type of encryption/encoding is being used?
For example, I am testing a web application which stores the password in the database in an encrypted format (WeJcFMQ/8+8QJ/w0hHh+...
- 2,324
290
votes
11
answers
92k
views
Why shouldn't we roll our own?
Why shouldn't we create our own security schemes?
I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.
With that in mind, I'm ...
- 136k
671
votes
4
answers
335k
views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
- 6,795
629
votes
7
answers
243k
views
How to store salt?
If you expect to store user password securely, you need to do at least the following:
$pwd=hash(hash($password) + salt)
Then, you store $pwd in your system instead of the real password. I have seen ...
- 6,477
171
votes
13
answers
108k
views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
- 1,945
67
votes
21
answers
71k
views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
- 51k
174
votes
4
answers
154k
views
Where to store a server side encryption key?
I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely ...
- 1,843
164
votes
2
answers
23k
views
I found unknown PHP code on my server. How do I de-obfuscate the code?
We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on ...
- 22.6k
94
votes
4
answers
87k
views
SSL Certificate framework 101: How does the browser verify the validity of a given server certificate?
(I have a basic understanding of public/private key, hashing, digital signatures... I have been searching online & stack forums last couple days but cannot seem to find a satisfactory answer.)
...
- 1,051
179
votes
10
answers
205k
views
How secure are virtual machines really? False sense of security?
I was reading this CompTIA Security+ SYO-201 book, and the author David Prowse claims that:
Whichever VM you select, the VM cannot cross the software boundaries set in
place. For example, a virus ...
- 2,379
128
votes
11
answers
456k
views
Can my employer see what I do on the internet when I am connected to the company network?
This is an attempt at a canonical question following this discussion on Meta. The aim is to produce basic answers that can be understood by the general audience.
Let's say I browse the web and use ...
- 4,017
272
votes
7
answers
117k
views
Password Hashing: add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
- 7,712
204
votes
4
answers
54k
views
Amount of simple operations that is safely out of reach for all humanity?
Cryptographic primitives usually assert some security level given as number of operations to mount an attack. Hash functions, for example, give different security levels for collision attacks, ...
- 4,601
625
votes
23
answers
154k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 6,801
372
votes
6
answers
344k
views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
- 3,845
892
votes
14
answers
178k
views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
- 8,241
547
votes
11
answers
95k
views
Is my developer's home-brew password security right or wrong, and why?
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. ...
- 4,749
421
votes
14
answers
70k
views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
- 4,515
106
votes
8
answers
47k
views
How can I reliably erase all information on a hard drive?
As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also.
Methods for flash drives ...
- 20.9k
219
votes
7
answers
221k
views
Does https prevent man in the middle attacks by proxy server?
There is a desktop client A connecting to website W in a https connection
A --> W
Somehow between A and W, there is a proxy G.
A --> G --> W
In this case, will G be able to get the ...
- 2,301
80
votes
6
answers
16k
views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
- 5,119
217
votes
4
answers
73k
views
Is a rand from /dev/urandom secure for a login key?
Lets say I want to create a cookie for a user. Would simply generating a 1024 bit string by using /dev/urandom, and checking if it already exists (looping until I get a unique one) suffice?
Should I ...
- 5,284
257
votes
8
answers
79k
views
Why are salted hashes more secure for password storage?
I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters).
My ...
user40448
38
votes
8
answers
16k
views
Client side password hashing
Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security.
After reading through a few discussions here about client side hashing of passwords, I'm ...
- 391
106
votes
4
answers
78k
views
Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?
Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
- 3,342
168
votes
3
answers
88k
views
What are rainbow tables and how are they used?
Where can I find one? Is there a pot of gold at the end?
How do I protect against them?
From the Area51 proposal
This question was IT Security Question of the Week.
Read the Sep 09, 2011 blog ...
AviD♦
- 73.5k
71
votes
6
answers
60k
views
Differences between using Tor browser and VPN
I can't quite figure out the differences between using the Tor browser and using a VPN (like concretely proXPN). From what I understand the idea is the same, that they both hide the IP address. The ...
- 3,861
166
votes
10
answers
26k
views
How do you explain the necessity of "nuke it from orbit" to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often ...
- 136k
106
votes
5
answers
148k
views
How does SSLstrip work?
I've been reading up on SSLstrip and I'm not 100% sure on my understanding of how it works.
A lot of documentation seems to indicate that it simply replaces occurrences of "https" with "http" in ...
- 3,248
51
votes
11
answers
5k
views
Does hashing a file from an unsigned website give a false sense of security?
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
- 27.2k
79
votes
3
answers
12k
views
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
For example, say the following are HTTPS URLs to two websites by one IP over 5 mins:
"A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".
Would monitoring of packets reveal:
nothing,
reveal only ...
- 5,072
116
votes
18
answers
20k
views
Does an established HTTPS connection mean a line is really secure?
From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
- 2,749
84
votes
6
answers
74k
views
Does SSL/TLS (https) hide the urls being accessed [duplicate]
Suppose I type this in my browser
https://www.mysite.com/getsecret?username=alice&password=mysecret
and an attacker is watching all traffic from me to my ISP.
What information is protected by ...
- 1,375
72
votes
3
answers
41k
views
Is it enough to only wipe a flash drive once?
According to the documentation for the "diskscrb" command for wiping conventional hard drives: http://www.forensics-intl.com/diskscrb.html
"Conforms to and exceeds the Government ...
- 6,289
71
votes
5
answers
99k
views
Does a Virtual Machine stop malware from doing harm?
I would like to know if it is safe for the host system of a virtual machine (VM - VirtualBox OSE in my case) to execute malware.
Can a virus break out and read or write data from the host system? ...
- 3,942
68
votes
6
answers
18k
views
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.
When I sign on to my online banking account, I'm prompted ...
- 1,061
97
votes
9
answers
110k
views
Can my company see what HTTPS sites I went to?
At work my company uses internet monitoring software (Websense). I know if I visit a https ssl-encrypted site (such as https://secure.example.com) they can't see what I'm doing on the site since all ...
60
votes
4
answers
16k
views
Are there DRM techniques to effectively prevent pirating?
A question on Skeptics.SE asks whether current DRM techniques effectively prevent pirating: Is DRM effective?
The question for IT Security is: Can DRM be made effective, and are there any examples?
...
- 703
139
votes
8
answers
71k
views
How hard is it to intercept SMS (two-factor authentication)?
A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
- 2,867
83
votes
7
answers
22k
views
Are random URLs a safe way to protect profile photos?
I would like to move from sequential to random user IDs, so I can host profile photos publicly, i.e. example.com/profilepics/asdf-1234-zxcv-7890.jpg.
How long must user IDs be to keep anyone from ...
- 933
82
votes
13
answers
26k
views
What are the pros and cons of site wide SSL (https)?
What are the pros and cons of encrypting all HTTP traffic for the whole site through SSL, as opposed to SSL on just the login page?
- 5,119
58
votes
6
answers
171k
views
Can wiped SSD data be recovered?
I was reading another post on destroying IDE drives, and how you could remove data, wipe it, or just destroy the drive. The removed data would still be there in some state, although not easily ...
- 1,753
23
votes
4
answers
7k
views
If the public key can't be used for decrypting something encrypted by the private key, then how do digital signatures work?
I'm learning asymmetric encryption in the use case of ssl/tls protocol.
I can understand that the public key (like a padlock) can encrypt (lock)
something and only the private key can decrypt (open)...
- 603
124
votes
5
answers
28k
views
How much can I trust Tor?
How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress.
I am a political activist from India and I do not enjoy the freedom of ...
- 1,275
90
votes
12
answers
19k
views
How feasible is it for a CA to be hacked? Which default trusted root certificates should I remove?
This question has been revised & clarified significantly since the original version.
If we look at each trusted certificate in my Trusted Root store, how much should I trust them?
What factors ...
- 51k