All Questions
67,191
questions
0
votes
0
answers
33
views
SSL/x509 certificate/public key expiration [duplicate]
I would like to know the process of how public keys/certificates are renewed for a website. I understand the concept of CA (Certificate Authority) chains, and how the public key/certificate for a site ...
- 1
1
vote
1
answer
48
views
AEAD: Authenticating a digest of my data instead the data itself
Relevant question for Python:
Stack Exchange: https://stackoverflow.com/questions/75739308/aead-authentication-with-huge-input-that-doesnt-fit-into-ram
Top Answers: https://topanswers.xyz/python?q=...
- 121
0
votes
0
answers
30
views
CRIME and BREACH attacks, HTTP/2 and HTTP/3
I have been reading on CRIME and BREACH attacks and I want to learn better how to protect against them.
From what I understood, those attacks require TLS encryption over HTTP compression and HTTP ...
- 101
1
vote
1
answer
58
views
Website randomly downloading html files to visitors [closed]
Another behaviour I found on a website with malware issues.
It keeps downloading random files like one named s2bbGoEJ.html to users computers. It actually tried to automatically download one such file ...
- 11
0
votes
1
answer
42
views
How to pass authentication to iframe from host app?
I will implement a chat bot web app that can be used on other websites. I plan to to host this app in www.mysite.com and customers will be able display this chat bot inside an iframe on their sites. ...
- 1
0
votes
0
answers
39
views
eSIM/eUICC relay attacks
I'm trying to understand how the eSIM is protected against cloning. Here is the diagram from GSMA standard:
Now the ICT operator has its own security domain in which all the GSM related keys ...
- 39
-1
votes
0
answers
13
views
pick a value from array [migrated]
i have a curl request which fetches response, response comes as plain text, i need to read a value from response.
i have used below method it works using ID, i want to use name of field rather than ID ...
3
votes
1
answer
59
views
How can I validate the root DNS key-signing-key on the command line?
Consider the following dig command and its truncated output:
dig . dnskey +dnssec +multi @a.root-servers.net
...
...
;; ANSWER SECTION:
. 172800 IN DNSKEY 257 3 8 (
...
- 133
1
vote
0
answers
19
views
Is SRP/PAKE equivalent to an asymmetric crypto challenge?
As an amateur cryptographer and professional slowpoke, I just learned about SRP (and other PAKE protocols), and my thoughts immediately wandered to asymmetric crypto challenge protocols, like WebAuthn(...
- 171
0
votes
1
answer
54
views
Does TLS 1.3 spec include additional privacy controls for avoiding URL category filtering?
I've heard second-hand that the TLS 1.3 spec includes additional functionality to avoid URL category list filtering by firewalls and cloud-based proxies. Is that correct? If so, is there any ...
- 3,378
2
votes
2
answers
147
views
My web application needs to have my users' private keys to sign documents on their behalf. How do I handle that?
Our web application issues governmental documents for our users. Every one of those documents needs to be signed with a private key. However, because our users find it cumbersome to point their ...
- 21
1
vote
0
answers
35
views
Decrypting a Base64 ciphertext [duplicate]
I am working on a challenge that includes decrypting a piece of ciphertext. The sample decryption provided is as follows:
...
0
votes
0
answers
44
views
How safe is sharing keyboard mouse between work laptop & my own personal laptop
I'm not at all concerned more about wireless part of security, and I have also read through the risks of wireless MITM which is the least possibility in my scenario.
What I need to know is if my work ...
0
votes
0
answers
35
views
Android FBE without screen lock
Is there any difference in the security of a factory reset with FBE (File-Based Encryption) on Android 10+ when not using a screen lock vs. using a screen lock before the factory reset is performed?
0
votes
1
answer
53
views
Is it possible to generate a read-only key for a symmetrical encryption (AES)?
I am working with hardware that can only encrypt with AES. The problem with this is that the message must be publicly verifiable on the blockchain, without the encoding key being exposed. This is the ...
0
votes
0
answers
26
views
What is the best way to protect passwords? [duplicate]
I noticed that I don't use many different passwords for all my stuff, which is very insecure. However, it is also difficult to remember really secure, long passwords which are different for every ...
- 1
0
votes
0
answers
18
views
Google Cloud Functions - discovery and billing attack
Unauthorized HTTPS triggers for Google Cloud Functions are required for external APIs to contact your function. Usually you cannot set a method of authentication relying on IAM for some random unknown ...
- 153
0
votes
1
answer
71
views
Set cookie inside iFrame domain not seen
I'm trying unsuccessfully to set a cookie in an iframe cross-domain. I've found elsewhere (https://stackoverflow.com/questions/2117248/setting-cookie-in-iframe-different-domain, https://stackoverflow....
- 1
0
votes
0
answers
34
views
Will enabling 4 only mode in a smartphone, prevent hackers from downgrading your connection to 3g/2g
My question is Will enabling 4 only mode in a smartphone, prevent hackers from downgrading your connection to 3g/2g through fake towers.
3
votes
1
answer
49
views
Laptop TPM with physical presence key operations?
It seems most systems have a TPM 2 module in them now, and it seems those modules often have a physical presence pin. Are these pins actually used by any typical laptop manufactures?
I have a laptop ...
- 31
0
votes
2
answers
63
views
Does a certificate revocation list (CRL) keep it's entries at least as long as the certificate would have been valid?
This question is specifically about certificates that should have had a long lifetime, but were revoked quickly.
Is every CRL issued by this CA guaranteed to include its revocation, as long as the ...
- 3
-1
votes
0
answers
28
views
What are the security risks of storing sensitive documents on your android devices’s external storage?
Documents such as driving license, financial statements etc. with a lot of PII, how big is the risk of storing such type of documents on the shared external storage on android?
Assumptions:
Android ...
- 219
1
vote
1
answer
43
views
Encrypted semantic search
I want to implement semantic search but in an encrypted fashion.
For storing passwords, we store Enc(password) in a database, and when a user logs in, we check if Enc(query) == entry in the database.
...
0
votes
1
answer
51
views
Is it dangerous to publicly surf the web while my browser is being run in an IDE?
While developing web software, I typically run a browser (chrome) from my IDE. Here's an example launch.json in VSCode:
{
// Use IntelliSense to learn about possible attributes.
// Hover to ...
- 878
0
votes
1
answer
55
views
icmp smurf attack
I am learning about ICMP smurf attack and for this, I have forged a packet with the following details:
source_mac_address = **??**
destination_mac_address = router mac address
char ...
- 101
14
votes
1
answer
3k
views
SSL issue captures Facebook app send out traffic
I tried to capture the send-out traffic of the Android app (Google Drive, Facebook, etc.). This is my security thesis.
I succeed capture send-out traffic on the Google Drive app with Mitmproxy but ...
0
votes
0
answers
12
views
Online Judge running on root [duplicate]
My college has a website which allows students to submit coding assignments by running them on an Online IDE which checks the output against several test cases.
I noticed by running system(“whoami”) ...
- 1
1
vote
2
answers
108
views
Why is cert for localhost not trusted when using ssh tunnel?
I've created a developer cert with my companies CA for my development box.
The CN is the FQDN of my development box mybox.example.com, but I've also added subjectAlternative names that include ...
- 121
1
vote
2
answers
71
views
How am I meant to back up my second factors?
I currently use MFA wherever possible. To do so, I mainly use the Google Authenticator app, as well as a YubiKey. However, I recently realized that backing these up is very, very difficult.
YubiKey
...
- 111
0
votes
0
answers
24
views
Securing the keystore key?
My program, is installed on specific computers that use a shared, common login. The program decrypts variously sized (1KB-1GB) data assets which were encrypted elsewhere, and transferred over. Each ...
- 121
0
votes
0
answers
11
views
Do using Invoke-Command with a domain admin account create a security issue?
Invoke-Command with a domain admin account is an easy way to do stuff across a domain. However, running Invoke-Command will create a win32 user profile that I believe has a hashed password attached to ...
- 1
0
votes
1
answer
34
views
Certificate Propagation Service CertPropSvc immediately stops
Trying to use my smartcards, suddenly the certificates do not propagate. I try starting and restarting the Certificate Propagation Service, but it immediately stops.
An event is created in the Event ...
- 141
0
votes
0
answers
4
views
Does TurboTax store information locally if tax file is saved removable media [migrated]
Does TurboTax store "sensitive" or "personal information" locally if tax file is saved on removable media?
- 147
1
vote
1
answer
33
views
MSTG-ARCH-3 What means?
In the OWASP Mobile Application Security Checklist there is a requirement called MSTG-ARCH-3 which describes:
"A high-level architecture for the mobile app and all connected remote
services has ...
- 13
0
votes
3
answers
76
views
Avoid checking passwords for dos attacks
A server gets requests with a username and password. Checking the password can be expensive, so a hacker can do a DoS attack by sending lots of requests with random passwords. No attempt to break in, ...
- 2,109
0
votes
1
answer
38
views
Is there a difference between text described as a cipher or ciphertext?
I've noticed both "cipher" and "ciphertext" being used to describe text encrypted with a cipher.
Here are some definitions from Merriam Webster:
cipher: a message in code
...
- 109
0
votes
0
answers
3
views
Recover deleted file that was already overwritten [migrated]
I'm using Mac OS Ventura.
Got a 128GB SSD using APFS.
I deleted a pdf from the Trash about a month ago.
I used a trial of EaseUS and it was able to recover the file.
However, I couldn't download as it ...
- 101
0
votes
1
answer
71
views
How to decrypt LockBit encrypted files
I've got an emergency on my PC. I remotely connected to it using Remote Desktop Connection a couple of days ago and I worked on my PC for a while and logged off. Later, when I went to log back on, I ...
0
votes
1
answer
17
views
Misuse of trusted certificate authority [duplicate]
Currently I'm working with mitmproxy and intercepting some HTTPs traffic using it. Before I could use it in my browser, I had to trust the certificate via my OS settings. After that, the certificate ...
- 41
0
votes
1
answer
33
views
Why doesn't client_secret prevent authorization code OAuth2 redirect attacks?
OAuth2 requires clients to register allowed values for redirect_uri.
Otherwise, an attacker could receive the authorization code. For example:
https://authorization.example/oauth/authorize
?client_id=...
- 988
0
votes
1
answer
31
views
Is it possible to use hashcat or john the ripper on a .drmz file?
I have n .drmz files which I can read with Javelin PDF Reader. Obviously to access the content I need a password, which I have, the same for each file.
In case I don't have the password is there a way ...
- 3
0
votes
1
answer
68
views
Do viruses survive in other drive and than re infect after resetting the PC?
Backstory:
I got infected while installing some shady software and at that time I kept Windows Defender off, (I have very much faith on my shady website) by turning its features off. But when I ...
0
votes
0
answers
28
views
How to proceed once your machine has been infected? [duplicate]
I have a Windows 10 machine. Around a week ago, someone was able to purchase stuff using my credit card, before I was able to lock my card. For a few weeks before then, I'd noticed that my computer ...
- 1
0
votes
2
answers
60
views
Web request TLS
What version of TLS would be required for a router that separates client requests from a web server behind a router?
Let's say the supported TLS client is 1.2 and so is the web server, BUT the router ...
- 3
0
votes
0
answers
38
views
sqlmap UNION query based injection, fix certain column values
I am going through some basic security training involving exploiting an SQL injection in a test service. I am trying to get sqlmap to dump the DB contents. I found a vulnerable endpoint, I can ...
- 109
0
votes
1
answer
62
views
As long as an Android device does not get rooted, is it safe to assume that the main phone app has not been modified?
From a forensics standpoint, is there any technical possibility that WITHOUT rooting the device the potential cybercriminal used a manipulated system phone app to have hidden functionalities like ...
- 1,542
0
votes
1
answer
74
views
How does this app "hash" their passwords with MD5, but still know the plain-text?
There is a public application that has terrible security practices. When performing an API call to such application, and succesfully logging in, it will return a "user" JSON that includes ...
0
votes
1
answer
45
views
Are verified publisher docker containers safe?
I need to create a virtual machine that it stays up and running on my Synology NAS and it has to use a web browser where I need to insert some credentials.
I saw a downloadable firefox container ( ...
- 155
1
vote
1
answer
41
views
Does a web access token need to be encoded?
Our sports site is unlocking one of its main services so it is no longer necessary to sign up to use it for a few days. Anonymous users would have access for a few days, then we would lock them out ...
- 111
0
votes
1
answer
60
views
How to defend my home lab from bots
I have my homelab set up so that public IP traffic HTTP and HTTPS is forwarded to my internal LAN VM where I'm running NGINX which then works as reverse proxy for my other services. So basically there ...
- 33