All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
33 views

SSL/x509 certificate/public key expiration [duplicate]

I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
  • 1
1 vote
1 answer
48 views

AEAD: Authenticating a digest of my data instead the data itself

Relevant question for Python: Stack Exchange: https://stackoverflow.com/questions/75739308/aead-authentication-with-huge-input-that-doesnt-fit-into-ram Top Answers: https://topanswers.xyz/python?q=...
0 votes
0 answers
30 views

CRIME and BREACH attacks, HTTP/2 and HTTP/3

I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them. From what I understood, those attacks require TLS encryption over HTTP compression and HTTP ...
  • 101
1 vote
1 answer
58 views

Website randomly downloading html files to visitors [closed]

Another behaviour I found on a website with malware issues. It keeps downloading random files like one named s2bbGoEJ.html to users computers. It actually tried to automatically download one such file ...
  • 11
0 votes
1 answer
42 views

How to pass authentication to iframe from host app?

I will implement a chat bot web app that can be used on other websites. I plan to to host this app in www.mysite.com and customers will be able display this chat bot inside an iframe on their sites. ...
  • 1
0 votes
0 answers
39 views

eSIM/eUICC relay attacks

I'm trying to understand how the eSIM is protected against cloning. Here is the diagram from GSMA standard: Now the ICT operator has its own security domain in which all the GSM related keys ...
  • 39
-1 votes
0 answers
13 views

pick a value from array [migrated]

i have a curl request which fetches response, response comes as plain text, i need to read a value from response. i have used below method it works using ID, i want to use name of field rather than ID ...
3 votes
1 answer
59 views

How can I validate the root DNS key-signing-key on the command line?

Consider the following dig command and its truncated output: dig . dnskey +dnssec +multi @a.root-servers.net ... ... ;; ANSWER SECTION: . 172800 IN DNSKEY 257 3 8 ( ...
1 vote
0 answers
19 views

Is SRP/PAKE equivalent to an asymmetric crypto challenge?

As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
  • 171
0 votes
1 answer
54 views

Does TLS 1.3 spec include additional privacy controls for avoiding URL category filtering?

I've heard second-hand that the TLS 1.3 spec includes additional functionality to avoid URL category list filtering by firewalls and cloud-based proxies. Is that correct? If so, is there any ...
  • 3,378
2 votes
2 answers
147 views

My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?

Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
1 vote
0 answers
35 views

Decrypting a Base64 ciphertext [duplicate]

I am working on a challenge that includes decrypting a piece of ciphertext. The sample decryption provided is as follows: ...
0 votes
0 answers
44 views

How safe is sharing keyboard mouse between work laptop & my own personal laptop

I'm not at all concerned more about wireless part of security, and I have also read through the risks of wireless MITM which is the least possibility in my scenario. What I need to know is if my work ...
0 votes
0 answers
35 views

Android FBE without screen lock

Is there any difference in the security of a factory reset with FBE (File-Based Encryption) on Android 10+ when not using a screen lock vs. using a screen lock before the factory reset is performed?
0 votes
1 answer
53 views

Is it possible to generate a read-only key for a symmetrical encryption (AES)?

I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable on the blockchain, without the encoding key being exposed. This is the ...
0 votes
0 answers
26 views

What is the best way to protect passwords? [duplicate]

I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
  • 1
0 votes
0 answers
18 views

Google Cloud Functions - discovery and billing attack

Unauthorized HTTPS triggers for Google Cloud Functions are required for external APIs to contact your function. Usually you cannot set a method of authentication relying on IAM for some random unknown ...
  • 153
0 votes
1 answer
71 views

Set cookie inside iFrame domain not seen

I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
0 votes
0 answers
34 views

Will enabling 4 only mode in a smartphone, prevent hackers from downgrading your connection to 3g/2g

My question is Will enabling 4 only mode in a smartphone, prevent hackers from downgrading your connection to 3g/2g through fake towers.
3 votes
1 answer
49 views

Laptop TPM with physical presence key operations?

It seems most systems have a TPM 2 module in them now, and it seems those modules often have a physical presence pin. Are these pins actually used by any typical laptop manufactures? I have a laptop ...
0 votes
2 answers
63 views

Does a certificate revocation list (CRL) keep it's entries at least as long as the certificate would have been valid?

This question is specifically about certificates that should have had a long lifetime, but were revoked quickly. Is every CRL issued by this CA guaranteed to include its revocation, as long as the ...
  • 3
-1 votes
0 answers
28 views

What are the security risks of storing sensitive documents on your android devices’s external storage?

Documents such as driving license, financial statements etc. with a lot of PII, how big is the risk of storing such type of documents on the shared external storage on android? Assumptions: Android ...
1 vote
1 answer
43 views

Encrypted semantic search

I want to implement semantic search but in an encrypted fashion. For storing passwords, we store Enc(password) in a database, and when a user logs in, we check if Enc(query) == entry in the database. ...
0 votes
1 answer
51 views

Is it dangerous to publicly surf the web while my browser is being run in an IDE?

While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode: { // Use IntelliSense to learn about possible attributes. // Hover to ...
0 votes
1 answer
55 views

icmp smurf attack

I am learning about ICMP smurf attack and for this, I have forged a packet with the following details: source_mac_address = **??** destination_mac_address = router mac address char ...
14 votes
1 answer
3k views

SSL issue captures Facebook app send out traffic

I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis. I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
0 votes
0 answers
12 views

Online Judge running on root [duplicate]

My college has a website which allows students to submit coding assignments by running them on an Online IDE which checks the output against several test cases. I noticed by running system(“whoami”) ...
  • 1
1 vote
2 answers
108 views

Why is cert for localhost not trusted when using ssh tunnel?

I've created a developer cert with my companies CA for my development box. The CN is the FQDN of my development box mybox.example.com, but I've also added subjectAlternative names that include ...
  • 121
1 vote
2 answers
71 views

How am I meant to back up my second factors?

I currently use MFA wherever possible. To do so, I mainly use the Google Authenticator app, as well as a YubiKey. However, I recently realized that backing these up is very, very difficult. YubiKey ...
  • 111
0 votes
0 answers
24 views

Securing the keystore key?

My program, is installed on specific computers that use a shared, common login. The program decrypts variously sized (1KB-1GB) data assets which were encrypted elsewhere, and transferred over. Each ...
  • 121
0 votes
0 answers
11 views

Do using Invoke-Command with a domain admin account create a security issue?

Invoke-Command with a domain admin account is an easy way to do stuff across a domain. However, running Invoke-Command will create a win32 user profile that I believe has a hashed password attached to ...
  • 1
0 votes
1 answer
34 views

Certificate Propagation Service CertPropSvc immediately stops

Trying to use my smartcards, suddenly the certificates do not propagate. I try starting and restarting the Certificate Propagation Service, but it immediately stops. An event is created in the Event ...
0 votes
0 answers
4 views

Does TurboTax store information locally if tax file is saved removable media [migrated]

Does TurboTax store "sensitive" or "personal information" locally if tax file is saved on removable media?
  • 147
1 vote
1 answer
33 views

MSTG-ARCH-3 What means?

In the OWASP Mobile Application Security Checklist there is a requirement called MSTG-ARCH-3 which describes: "A high-level architecture for the mobile app and all connected remote services has ...
0 votes
3 answers
76 views

Avoid checking passwords for dos attacks

A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
  • 2,109
0 votes
1 answer
38 views

Is there a difference between text described as a cipher or ciphertext?

I've noticed both "cipher" and "ciphertext" being used to describe text encrypted with a cipher. Here are some definitions from Merriam Webster: cipher: a message in code ...
0 votes
0 answers
3 views

Recover deleted file that was already overwritten [migrated]

I'm using Mac OS Ventura. Got a 128GB SSD using APFS. I deleted a pdf from the Trash about a month ago. I used a trial of EaseUS and it was able to recover the file. However, I couldn't download as it ...
0 votes
1 answer
71 views

How to decrypt LockBit encrypted files

I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I ...
0 votes
1 answer
17 views

Misuse of trusted certificate authority [duplicate]

Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
0 votes
1 answer
33 views

Why doesn't client_secret prevent authorization code OAuth2 redirect attacks?

OAuth2 requires clients to register allowed values for redirect_uri. Otherwise, an attacker could receive the authorization code. For example: https://authorization.example/oauth/authorize ?client_id=...
0 votes
1 answer
31 views

Is it possible to use hashcat or john the ripper on a .drmz file?

I have n .drmz files which I can read with Javelin PDF Reader. Obviously to access the content I need a password, which I have, the same for each file. In case I don't have the password is there a way ...
  • 3
0 votes
1 answer
68 views

Do viruses survive in other drive and than re infect after resetting the PC?

Backstory: I got infected while installing some shady software and at that time I kept Windows Defender off, (I have very much faith on my shady website) by turning its features off. But when I ...
0 votes
0 answers
28 views

How to proceed once your machine has been infected? [duplicate]

I have a Windows 10 machine. Around a week ago, someone was able to purchase stuff using my credit card, before I was able to lock my card. For a few weeks before then, I'd noticed that my computer ...
  • 1
0 votes
2 answers
60 views

Web request TLS

What version of TLS would be required for a router that separates client requests from a web server behind a router? Let's say the supported TLS client is 1.2 and so is the web server, BUT the router ...
  • 3
0 votes
0 answers
38 views

sqlmap UNION query based injection, fix certain column values

I am going through some basic security training involving exploiting an SQL injection in a test service. I am trying to get sqlmap to dump the DB contents. I found a vulnerable endpoint, I can ...
  • 109
0 votes
1 answer
62 views

As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?

From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
0 votes
1 answer
74 views

How does this app "hash" their passwords with MD5, but still know the plain-text?

There is a public application that has terrible security practices. When performing an API call to such application, and succesfully logging in, it will return a "user" JSON that includes ...
0 votes
1 answer
45 views

Are verified publisher docker containers safe?

I need to create a virtual machine that it stays up and running on my Synology NAS and it has to use a web browser where I need to insert some credentials. I saw a downloadable firefox container ( ...
  • 155
1 vote
1 answer
41 views

Does a web access token need to be encoded?

Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
  • 111
0 votes
1 answer
60 views

How to defend my home lab from bots

I have my homelab set up so that public IP traffic HTTP and HTTPS is forwarded to my internal LAN VM where I'm running NGINX which then works as reverse proxy for my other services. So basically there ...
  • 33

15 30 50 per page