All Questions
69,331
questions
11
votes
4
answers
5k
views
Using computer random number generators to produce keys, it is secure?
Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ....
- 405
6
votes
1
answer
5k
views
Email Spoofed. Explain?
So, I think my email id might have gotten hacked. Can some one offer their comments and suggestions on this email ? It seems this email went from my mail id to my friend's email id. The subject is ...
- 563
2
votes
0
answers
4k
views
Store PGP keys in HSM
Is anyone storing the PGP encryption key in a Hardware Security Module (HSM)? Company policy mandates this, so I need to store the private key to decrypt pgp file in HSM. But as much i know PGP uses ...
- 173
15
votes
5
answers
14k
views
Use RSA keypair for PGP encryption and decryption
Is there a way that I can use a RSA keypair with PGP?
What I mean is that I have 2048 length keypair and i want to use that to encrypt and decrypt data. But all I have found is that the PGP uses some ...
- 173
11
votes
5
answers
559
views
Government / State cyberwarfare organizations
I am working on some research regarding advanced persistent threats. Within this effort, discussion of cyber-warfare started. Looking further into the subject, I have found a plethora of links ...
-11
votes
3
answers
1k
views
Would this kind of encryption be good at anything?
I have put much thought into this very simple algorithm and I have no clue if it was thought before... But I think it should have.
I also know nothing about other encryption algorithms so I can't tell ...
- 121
6
votes
4
answers
7k
views
MySQL AES_ENCRYPT key length
AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how MySQL handle longer or shorter keys? I found out that PyCrypto for instances recomend to transform the key by using MD5, SHA-1, SHA-2, ...
- 419
15
votes
2
answers
2k
views
HSM track records?
What are the track records of popular Hardware Security Modules (HSMs)? Have any been found vulnerable to hacking via creative use of the API, timing or power-monitoring attacks, etc?
- 20.9k
2
votes
3
answers
437
views
Help me find the right Security Consultant for the stage our organization is in
We are a small company (< 20 ppl), have developed a fairly complex backend platform that exposes a web services API and we are currently productizing a SaaS-based offering that is a client to the ...
- 591
23
votes
14
answers
4k
views
How can you become a competent web application security expert without breaking the law?
This question was asked here on Programmers Exchange, but it was suggested I ask here as well since most of the experts would likely hang out on IT Security exchange instead.
I find this to be ...
user3127
15
votes
3
answers
10k
views
How does FaceNiff work?
FaceNiff is an Android app that sniffs Facebook session ids. You must be connected to the same WiFi as the victim. It is said to be working even when WPA2 is present. How is it possible? I can decrypt ...
- 245
3
votes
2
answers
565
views
How to "get in sync" with what is happening in the security scene right now? [duplicate]
Possible Duplicate:
What security resources should a white-hat developer follow these days?
A colleague of mine already has some understanding of security fundamentals but still needs "get in ...
- 2,833
68
votes
6
answers
18k
views
How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext?
I thought How can a system enforce a minimum number of changed characters... would answer my question, but it seems this is a different case.
When I sign on to my online banking account, I'm prompted ...
- 1,061
16
votes
2
answers
11k
views
How bad is the leaking of Internal IP addresses through external DNS
If an external DNS server is leaking internal IP addresses are there any significant security threats associated with this information leakage?
Apart from most the obvious - gaining an understanding ...
- 161
-1
votes
1
answer
246
views
Theorical question on encryption methods [duplicate]
Possible Duplicate:
Encryption strategies for multi users access in production systems
I would like to develop a service on wich clients would connect and retrieve informations. These ...
3
votes
1
answer
4k
views
Mod_security for Apache2 blocks cURL!
I'm trying to get my users lat. and lng. from their address using Google's geocoding API but when mod:security is enabled, it prevents it and the script times out. How can I add an exception by IP or ...
- 141
20
votes
4
answers
18k
views
Can home routers get infected?
I am behind a router(linksys that runs dd wrt on it) and I was infected with sality. I'm curious, can my router get infected too? If yes, how can I remove the infection?
I used the search bar but ...
- 201
4
votes
7
answers
4k
views
Sharing passwords and credentials between founders and employees
What's the best way to share passwords and credentials from the business's various accounts in a secure manner?
For example, email doesn't work because if someone gets into one of your employee's ...
- 143
45
votes
6
answers
62k
views
Most secure password hash algorithm(s)?
What is/are currently the most cryptographically secure hashing algorithm(s)? (available in PHP)
Speed is irrelevant, because I'm iterating the hash over a fixed time (rather than a fixed number of ...
- 545
18
votes
2
answers
1k
views
How to handle security issues of someone else's website
A few weeks ago I found that someone has posted admin account details for a certain website on a public wiki by mistake. As I found that data to be real (i.e. I could log into their website run by ...
- 285
13
votes
5
answers
2k
views
Detection and analysis of unknown malware
Suppose I have a binary which is suspicious. How can I determine whether it is malicious, and if it is, reverse-engineer how it works and what it does? For example, maybe using static analysis?
Are ...
- 318
3
votes
2
answers
429
views
Can ipopts be used to circumvent a pf or iptables firewall source IP based blocking?
Can one use ipopts, and in particular IP source routing, to circumvent source-based blocking in pf or iptables?
For example, with OpenBSD's pf:
block in all # default deny
block out all
pass in on ...
- 537
5
votes
1
answer
970
views
SQL Injection on URL, not on parameters
Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
- 51
1
vote
3
answers
522
views
List of notable security breaches [closed]
Is there a list of notable (i.e. those reported in the mainstream media) security issues such as hacks, viruses, worms and any other unauthorized or improper access or use of computers for malicious ...
10
votes
4
answers
6k
views
How can I detect and block bots?
For example, if I am on stackoverflow and I refresh my page several times in a row, it starts to think I am a bot and blocks me.
How can I build something like this into my own site?
- 375
16
votes
7
answers
7k
views
Pursuing a career in Malware Analysis
When I was a kid, I want to become a Malware Analyst and work in a Antivirus company. At that time, I love to try out different antivirus solutions and did a research project on Computer virus/...
- 163
48
votes
2
answers
22k
views
Web Application encryption key management
In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:
...
- 591
11
votes
4
answers
11k
views
moving from MD5 to SHA-512
This question is more of a security policy than a technical security question.
Many years ago I developed an asp.net site, implemented Forms Authentication, and stored the user passwords as MD5 hashs....
- 882
8
votes
1
answer
447
views
Collision attacks on OCB?
I've been looking into the OCB cipher mode and everything I hear sounds good. I was planning on implementing it.
Everything except for this lone voice, that is: Collision attacks on OCB:
We show ...
- 1,782
11
votes
4
answers
4k
views
PCI restrictions on using using (hashed) credit card number to identify a repeat customer?
Question for any PCI experts out there:
Airport ticket kiosks can use your credit card to find your reservation at checkin time. So clearly PCI must allow use of credit card numbers to identify ...
- 211
6
votes
3
answers
584
views
Forensics on a SOHO router
I am interested in how reliable the information determined from doing forensics on a SOHO router is. Most of these routers don't seem to be very advanced, so I question if it would be possible to ...
- 3,606
3
votes
1
answer
912
views
Two questions about learning Linux exploit development fundamentals
getting ready to delve into the technical world of vulnerability assessment, and I have two questions about where to find certain information.
First, I plan on reading "Understanding the Linux Kernel"...
- 93
49
votes
5
answers
13k
views
Should usernames be kept secret?
Help me settle an discussion among colleagues and guide future design:
Even in a high impact scenario: e.g. protecting payment application or government gateway but in an Internet accessible ...
- 5,833
4
votes
3
answers
10k
views
Vigenere Cipher - help with decryption (by hand)
So this is a Vigenere cipher-text
EORLL TQFDI HOEZF CHBQN IFGGQ MBVXM SIMGK NCCSV
WSXYD VTLQS BVBMJ YRTXO JCNXH THWOD FTDCC RMHEH
SNXVY FLSXT ICNXM GUMET HMTUR PENSU TZHMV LODGN
MINKA DTLOG HEVNI ...
- 143
0
votes
0
answers
138
views
How can I prevent SESSID stealing? [duplicate]
Possible Duplicate:
Can you secure a web app from FireSheep without using SSL?
How can I prevent someone on same network from stealing SESSIONID and using it in his own browser (it would mean ...
- 718
625
votes
23
answers
154k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 6,801
5
votes
3
answers
404
views
Choosing an authenticated encryption cipher mode without associated data
In the application I'm writing there is need for a huge amount of private data transfer on the order of eighty gigabytes, but there is no public data. I'm looking especially to gain bandwidth/...
- 1,782
10
votes
3
answers
3k
views
How to perform penetration testing on a Flex application?
Possible Duplicate:
What tools are there to inspect Flash SWF files?
I have decompiled it, verified the source. All seems fine. Appscan also is not able to find anything in this case. But I just ...
- 1,141
13
votes
1
answer
5k
views
What is the purpose of AEAD?
I think I need to correct some misunderstandings I have about AEAD. What is associated data used for in authenticated encryption?
- 1,782
5
votes
2
answers
512
views
OMAC: multiplication in a finite field - how can I compute the correct polynomial
From The EAX Mode of Operation:
We explain the notation used in the definition of OMAC. The value of iL (line 40: i an integer in {2, 4} and L ∈ {0, 1}n) is the n-bit string that is obtained by ...
- 1,782
4
votes
1
answer
2k
views
How to secure an application under iOS against jailbroken devices
I noticed that some apps, e.g. Skype, is capable to exit and not run in case one has jailbroken his iOS based device.
I couldn't find online how to check that a device is jailbroken. Please anyhelp ...
- 1,204
3
votes
1
answer
364
views
What is the benefit to using a two-pass AE scheme rather than one-pass?
What benefit is gained using a two-pass AE or AEAD scheme rather than a one-pass? Two-pass is roughly half the speed.
- 1,782
52
votes
4
answers
52k
views
Are salted SHA-256/512 hashes still safe if the hashes and their salts are exposed?
Scenario: a database of hashed and and salted passwords, including salts for each password, is stolen by a malicious user. Passwords are 6-10 chars long and chosen by non-technical users.
Can this ...
- 621
32
votes
3
answers
12k
views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
- 493
5
votes
6
answers
542
views
Spam fighting idea
I have this crazy idea that spam e-mail would not be worth the time of the senders. This is how it's going to work.
Someone sets up a reputation-based site, much like stackexchange sites, where ...
- 159
19
votes
6
answers
4k
views
Is this login security enough?
I'm coming up with my next login system for admins of an e-commerce website, which will have this:
login form is SSL secured
password is converted to SHA-256 before being transmitted (bcrypt is too ...
- 341
9
votes
3
answers
577
views
Should I restrict access to the username and passwords in a web app?
I'm starting to write my first serious web application and am thinking about how to store username and password information. There are plenty of articles detailing how storing plain text passwords is ...
Will
21
votes
3
answers
2k
views
Programmer to Security Professional
I am a software developer (mostly .NET and Python about 2-3 years exp.) looking to break into the Computer Security field. I have a GWAPT cert and will have both GSSP-NET and Network+ certs by the end ...
- 213
6
votes
2
answers
795
views
Is PCI DSS applicable to other solutions than those dealing with payment cards?
According to this quote from "applicability" section of PCI DSS it's not:
The primary account number is the
defining factor in the applicability
of PCI DSS requirements. PCI DSS
requirements ...
- 1,870
7
votes
4
answers
14k
views
Why are people saying that the X Window System is not secure?
Why are people saying that the X Window System is not secure? The OpenBSD team succeeded with privilege separation in 2003; why didn't the "Linux developers" do this?
To be clear: What security ...
- 6,289