All Questions

Filter by
Sorted by
Tagged with
1
vote
1answer
47 views

Does rust's Cargo provide cryptographic authentication and integrity validation?

Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...
12
votes
2answers
4k views

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

We are serving static content over the internet, and have a business requirement that the data must be encrypted at rest. Currently it is stored in AWS S3, where it can be accessed by authorized ...
0
votes
1answer
41 views

Is it secure to send messages between a WS Server and the client?

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...
-2
votes
1answer
170 views

Why are mobile phones OS easily hackable (Pegaus & Co)

Every now and then, you here a story about misuses of mobile OS' spyware softwares, developed by technology firms which usually sell their products to governments or groups with similar power. You ...
0
votes
1answer
54 views

Strange virustotal tags on pdf file

I've received PDF at work, which I then ran through virustotal scan out of habit. It turned out to be clean, but at the same time some tags caught my attention, namely: checks-user-input detect-debug-...
0
votes
0answers
32 views

Could "System Volume Information" be used to find out on which system the storage was used?

If one uses a storage device (USB stick or SD card) on Windows, then it leaves "System Volume Information" folder in the file system. Would there be a way so a forensic guy could definitely ...
0
votes
0answers
44 views

Acquiring true randomness for generating a key

Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...
0
votes
0answers
37 views

Are there differences on how storages are formatted between different OS?

If one formats the same USB stick (or SD card) to FAT32 file system on Windows, or on Linux, or on Android - would there be differences so a forensic guy could definitely tell on which OS or even on ...
0
votes
0answers
43 views

Which traces leave on a flash card after using it?

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android - would there be a way so a forensic guy could definitely tell on which computer the flash card was used by ...
1
vote
0answers
61 views

What traces are left on a flash card reader after using it?

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android, would there be a way to forensically determine on which computer the card reader was used? I know OS can log ...
1
vote
1answer
91 views

What traces are left on a USB stick after using it?

If one uses a FAT32-formatted USB stick on Windows, Linux, or Android, would there be a way to determine on which computer the USB stick was used by examining the USB stick? I know OS can log which ...
0
votes
1answer
36 views

Cookies Vs Headers For REST API User Authentication Token

I'm working on a small rest api project with user authentication. But I'm wondering whether I should store the users authentication token in a header or a cookie. The general idea is as follows: User ...
0
votes
1answer
41 views

Why not use a long life session ID for auto-login instead of a persistent cookie with a token?

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...
27
votes
7answers
13k views

Someone knows my IP and is threatening to DDoS me

Around 4 months ago, someone learned my IP, and is threatening to DDoS attack me if I am not his slave. He was breaking the Discord TOS with all kinds of stuff in my DMs. I blocked him, but one of his ...
-1
votes
0answers
27 views

I have an unknown hash. Can you help me identify it [duplicate]

I have an unknown hash (atleast i think it is something that got encrypted). Is there some way to identify what encryption algorithm has been used. This is it: UÐËÎ. ..àW²1&Ýta+./ÔR.úÇ.1Ýк é.}zgü½...
0
votes
0answers
33 views

Where could we get CIS Hardening Scripts for AWS EC2?

CIS has published hardening standards for all operating systems of EC2 in AWS. CIS also provides hardened images as well but they're quite expensive at $130/year/instance. Is there a place where we ...
0
votes
1answer
51 views

How do I import a private key from a hard copy?

I started playing with encrypting some personal files, and I exported the private key as an .asc file, but also on hard copy (plain paper) and can't understand a thing about how it says to import it ...
2
votes
1answer
73 views

What is extra 3 relays in .onion in Tor connection

When I visit any website in Tor browser and if I see the diagram of the circuit that Tor Browser is using for the current tab in the site information menu in the URL bar, it shows 3 relays: Guard, ...
0
votes
0answers
42 views

How wifi network MITM works?

I have seen a lot of tutorials showing how to MITM a network using various tools. But it usually says that we require a network adapter with monitor mode options. I own my wifi router and can connect ...
0
votes
1answer
48 views

Origin header reflected in ACAO header with ACAC set to true on an API

While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
0
votes
0answers
68 views

What's the alternative to storing plain-text passwords in a MySQL Database?

What's the alternative to storing plain-text passwords in a Database? For example, I'm using Node.js to get a POST request for signing up / logging in a user from a webpage. When signing up a user, I ...
7
votes
2answers
2k views

Is "Math.random" the same as "crypto.getRandomValues" (JavaScript security)

This question may be a little off-topic, but is Math.random the same as crypto.getRandomValues? (JavaScript) Here's an example: Math.random(); // 0.11918419514323941 self.crypto.getRandomValues(new ...
0
votes
1answer
47 views

Certificates generated by internal CA show Verification error: self signed certificate and other errors when using curl against URL

I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...
1
vote
1answer
39 views

What are best practices for handling user Unicode in a web application?

Lately, the security community has been asking interesting questions around surprising side effects of raw Unicode formatting characters in source code. That got me thinking about input validation and ...
0
votes
0answers
34 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
0
votes
2answers
78 views

Should login requests be padded to avoid revealing password length?

If an attacker who can watch network traffic knows a victim's username and can figure out which request is a login, then the size of the login request will reveal something about the password length. ...
1
vote
1answer
55 views

How to know which IP address is used for my DNS queries on macOS?

I'm not an expert, only have basic knowledge about all this but I'd like to understand what's going on so please bear with me. I'm currently using a VPN (IKEv2 protocol) on a macOS system and I can ...
0
votes
2answers
144 views

Virtual Yubikey [closed]

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...
0
votes
1answer
50 views

Using SSO for a cryptocurrency app

Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...
0
votes
0answers
36 views

Can SVG be a potential threat for tracking scripts and similar?

Since SVG files can have JavaScript, which would get executed is it a potential threat for malware, tracking scripts and similar stuff?
0
votes
0answers
20 views

Hot to validate X.509 Certificate [duplicate]

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...
2
votes
1answer
726 views

Is it secure to share a public (RSA) key over http?

The following scenario: We have a HTTP (not HTTPS, so unencrypted) server which contains an open (RSA) public key. The general sharing of the public key should not be a problem since it is the public ...
0
votes
1answer
63 views

Can a wifi Access Point be reconfigured to receive other radio signals?

Say we have a remote transmitter that is not connected to a wifi router (neither wirelessly nor by cable), but which transmits information using electromagnetic waves. Examples include walkie-talkies, ...
0
votes
0answers
37 views

Using address for WIFI SSID - Is this a bad idea?

I live in a location which is semi-rural. I also share this Internet access with some people nearby. Although bandwidth is a bit limited (VDSL), other then those imposed by the connection speed ...
0
votes
1answer
36 views

How to control authorized access to specific data for specific users

First of all, this might be the incorrect place to post this question. Sorry in advance if that is the case. I am building a web application which involves a login system. Now once a user has logged ...
0
votes
1answer
56 views

Compromising the UEFI recovery partition

I have a Windows 10 OS, drives are encrypted with the latest version. UEFI is not encrypted, and I have recently installed a BIOS update. I wonder about the possibility of a hacker (if secure boot is ...
2
votes
3answers
101 views

How do you test security tools

I am planning to purchase a security tool like fortify, or sonarqube or snyk. How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks? Any good ...
0
votes
1answer
68 views

Why do services generate multiple 2FA backup codes?

In case you lose access to your two-factor authentication (2FA) codes, you are only required to enter one of the backup codes. So why do services like Google generate multiple codes if it doesn't ...
1
vote
0answers
28 views

How Firefox and Google password managers protect your password [duplicate]

Based in this post in Google Chrome help they claim that they encrypt my username and password with a secret key known only to my device. What is the algorithm used to generate this secret which is ...
2
votes
2answers
274 views

When using certificates as authentication, what identities the "who" part?

When using x509 certificates for authentication, I understand that there is a shared source of trust (the signing certificate authority). So that explains why a server is able to authenticate the ...
0
votes
1answer
55 views

Does a solution exist to permit account sharing without revealing the account password?

I'm looking for a process to replace the status quo of notepad and Excel. We've tested a market-leading password manager. An issue that comes up with this is that the secure sharing password facility ...
0
votes
1answer
46 views

How to use pwntools to generate a relative jump?

I want to use pwntools to generate a relative jump 0x20 bytes forward. It isn't described in the documentation how to do that. What's the command for doing a JMP SHORT 0x20 in pwntools?
0
votes
1answer
34 views

Authorization Controls for Offline Windows C# Application

I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The ...
0
votes
0answers
36 views

What can attacker do with OpenID Connect id_token?

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...
1
vote
1answer
33 views

What is the purpose of the ID Token if I can get the user info from the userinfo endpoint?

I am trying to understand OIDC and i dont see the purpose of the ID token if with just the access token, i can make a request to the userinfo endpoint and get the user info. What then is the purpose ...
0
votes
0answers
35 views

TPM2-TOOLS: Dump TPM2 Attestation Key after it has been created

Suppose I have created an Attestation key (AK) and dumped the public portion for my use. Further using TPM2 Evict Control, I make the attestation key persistent on an address in TPM. $ tpm2_createak -...
18
votes
2answers
3k views

Will this Account Lockout mechanism increase the severity of a information leakage vulnerability that leaks usernames?

I found an information leakage vulnerability on a company website and I found that the information includes all the usernames of the users. I also observed that the application uses a lockout ...
1
vote
1answer
42 views

How does FileVault work with Time Machine?

Let's suppose a Mac OS computer with two users: user1 and user2. These users are not administrators. FileVault is enabled. The computer is connected to an empty external hard drive for Time Machine. ...
0
votes
0answers
5 views

Mac os applications disk access authorizations [migrated]

On Mac OS preferences, there is a "Security and privacy" icon. In the "Privacy" tab, i can see "Full disk Access" and "Files and Folders". I can allow specific ...
0
votes
1answer
42 views

Is it possible for the public key of the issuer to be stored in a subject's certificate?

For example, assume stackoverflow.com used a certificate issued by Google who is trusted. In the stackoverflow.com certificate, its own public key would be stored. However, is it also possible for ...

15 30 50 per page
1
3 4
5
6 7
1282