All Questions
68,278
questions
1
vote
0
answers
63
views
Oracle Kerberos authentication on Linux host with SSSD
I have Linux servers which are members of AD domain, running SSSD demon.
SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication.
NOTE: this is not purely about ...
- 41
0
votes
0
answers
51
views
Prevent Session Hijacking with copying all metadata from a browser
For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC.
How does Google ...
- 423
11
votes
3
answers
6k
views
Why do some websites require logging in twice? Not two steps, but two full username/password entries
There are a couple of web applications that I use that seem to require two successive logins. Not two steps, but two full logins. The behavior is such that I login in, get kicked out, then have to ...
- 223
2
votes
2
answers
635
views
Did Phantom Secure use the same level of encryption as WhatsApp?
I've been following a story for some time now about a high-ranking Canadian official who was charged in leaking operational data to the makers of Phantom Secure. There was a very deep level of concern ...
- 129
0
votes
0
answers
55
views
do I need anti-csrf-tokens or double submit cookie pattern?
currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
- 101
-1
votes
1
answer
50
views
ISO 27001 - Companies processing each other's data
If there are two companies, each holding a valid ISO 27001 certification, what type of formal relationship can be established in policy to allow each other to access, process and store each other's ...
0
votes
0
answers
87
views
The safest and fastest way to upload files in Docker Container
In a docker project of Asp.net Core MVC 6.0, users must upload files to wwwroot of the project but nothing checks to see if the file is safe or not.
I check file extensions with my file header library ...
- 101
0
votes
2
answers
85
views
Python: Does pip install allow escalation of privileges, e.g. through setuid?
I've read that pip install foo allows the developers of foo to run arbitrary code on my machine. I don't mind, as long as I can use Linux user permissions to sandbox it. However, I worry that maybe ...
- 101
1
vote
1
answer
145
views
Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?
I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already.
Information Disclosure (inodes)
This article titled: "...
- 6,651
0
votes
0
answers
62
views
How can I know whether I'm infected by StripedFly malware?
I was reading this article, and decided to search for sd-pam in the processes of one of my laptops.
I did ps -x | grep -i "sd-pam", and got
2864 ? S 0:00 (sd-pam)
29172 pts/0 ...
3
votes
1
answer
153
views
Is Android private DNS using domain name a security risk?
Android has the option for using private DNS, but it requires a hostname, not an IP of the DNS server. Isn't entering the domain name of a DNS server a chance for MITM attacks and DNS poisoning?
How ...
0
votes
1
answer
70
views
How can I detect secondary internet connections?
I have a LAN. Is there a way, without installing any agent in each computer, to detect if any computer is accessing the internet without going through the LAN? For instance, via dongle, Wifi hotspot?
- 133
0
votes
1
answer
46
views
Does an official IETF-codified URN exist for PGP keys?
I've been able to locate http://www.aaronsw.com/2002/draft-swartz-pgp-urn-00, but it appears to be an unofficial proposal never submitted to the IETF. Does it hold any water?
0
votes
1
answer
51
views
Showing a license/id to a shopping website, worth it? [duplicate]
I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
11
votes
3
answers
5k
views
What security risks are involved in using older HTTP protocols such as HTTP/1.x that would justify upgrading to HTTP/2 or HTTP/3?
As of 2023, still many webservers support HTTP/1.0 and HTTP/1.1 while not supporting recent HTTP/2 and/or HTTP/3 protocols. I understand that newer HTTP versions offer various performance enhancements,...
- 6,651
0
votes
3
answers
142
views
Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?
I'm exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It's clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 ...
- 6,651
0
votes
1
answer
73
views
Is HTTP/1.0 inherently more susceptible to denial-of-service (DoS) attacks?
I'm looking into HTTP version specific risks. HTTP 1.0 lacks support for persistent connections, meaning each request/response pair requires a new TCP connection to be established.
Considering the ...
- 6,651
0
votes
0
answers
14
views
macOS processes [migrated]
Anyone have any idea what the PerfPowerService and PerfPowerTelemetry...Service is on macOS (Sonoma?) I can't seem to find a lot of information on these processes. The second one isn't even mentioned ...
6
votes
2
answers
902
views
Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing
I received an email earlier today on my work email address. The email came from the same address—mine—but I didn't send it.
It was an email claiming that he was a professional hacker who had hacked my ...
- 161
-2
votes
2
answers
58
views
Should standard OAuth endpoints/configuration files be kept private?
Considering an attacker may be able to leverage the information gathered from standard endpoints/configuration files such as /.well-known/oauth-authorization-server and /.well-known/openid-...
- 11
2
votes
1
answer
84
views
Capturing packets in an android application or ios application?
I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
- 21
0
votes
0
answers
46
views
help in understanding hybrid analysis results? Mac
So I have a few PDFs on my computer I got online a few years ago on my Mac computer.
When I ran a virus total scan on some of them I got a couple that were concerning. Here is the one that most ...
1
vote
1
answer
98
views
How to prevent hackers from using my phone number to make accounts?
It seems a hacker is using my phone number to make fraudulent account, and I would like to prevent that.
Usually, if a person has your phone number, they're not able to make an account because a ...
- 11
1
vote
1
answer
112
views
How safe it is to view PDF file in browser without downloading the file into PC?
When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC?
I heard that FireFox has been sandbox heavily and ...
- 11
1
vote
1
answer
33
views
When referring to key types and lengths, is there a correct order to stating the type and length?
When referring to key types and lengths, is there a correct order to stating the type and length?
For example, would I use "2048-bit RSA key" or "RSA 2048-bit key" in documentation?...
- 131
1
vote
0
answers
51
views
Windows decrypting TC volume without passphrase?
I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
- 5,168
0
votes
0
answers
10
views
How to connect to AWS VPN from a country that blocks most VPNs [migrated]
For work, I must connect to AWS cloud services via the AWS VPN app that my company setup on the company laptop that I use. The AWS VPN only provides access to my company's space in AWS (EC2, S3, ...
- 101
0
votes
0
answers
41
views
unsafe-hashes an alternatives
I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine.
<script th:inline="javascript">
/*<
- 101
3
votes
1
answer
266
views
What exactly is the security model of pass?
Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key.
I'm confused at how this is considered secure. The GPG key has a passphrase ...
- 181
1
vote
0
answers
64
views
Do code signing certificates build reputation only for Microsoft, and is reputation maintained across releases?
I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The ...
- 111
3
votes
0
answers
197
views
I want to track my android phone using IMEI [closed]
My phone was stolen last week. I went to the police to track it but still now no result.
What software can I use to track my device just using the IMEI of the phone?
1
vote
0
answers
66
views
Code to detect HTTP/2 Rapid Reset Attack vulnerability
Is there code/library to detect this vulnerability? I have been searching online and do not find any
We are using Cloudflare which has fixed the issue but government says "we may" have the ...
- 153
0
votes
1
answer
78
views
Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access
My partner recently got given work laptop and if you try and put in a USB mass storage device you get an error saying it is not allowed. Without having administrator access I assume this is via the ...
- 43
0
votes
2
answers
83
views
Why does turning on encrypted DNS unblock some geo locked websites?
When I turn on Warp provided by Cloudflare or use 1.1.1.1, it unlocks some of the websites which are geo locked. How does it unblock the websites which are blocked by ISP?
- 11
10
votes
5
answers
4k
views
How to best obfuscate a built-in key in an application?
We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
- 219
0
votes
0
answers
78
views
How smart cards store their secrets? [duplicate]
How smart cards technically store their secrets?
I know smart card is whole computer on chip and it respond only to challenges. I know their software/firmware doesn't allow (it doesn't have the ...
- 1
0
votes
1
answer
90
views
TCP connection scrambling to evade tracking
There was a project on GitHub that (was going to, if it hadn't been abandoned) modify TCP fields in order to evade packet sniffing. It explains in specifics how this would work here. In particular, ...
- 209
0
votes
0
answers
70
views
Man in the Middle Attack for OAuth 2's Authorize endpoint
We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it's commonly called:
GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&...
- 1
1
vote
0
answers
65
views
Gmail app on Android can't send messages since months
I've got the issue that the Gmail app on Android (OnePlus One device) is unable to send messages (it stays in Outbox instead of Sent). Once in the past, I've solved this by clearing the Gmail app ...
- 47
1
vote
0
answers
51
views
Does the browser pass the name of the camera being used to the website [closed]
Does the browser pass the name of the camera being used to the website which is accessing our camera like when we use obs virtual cam so is the website able to detect that a virtual camera is being ...
- 11
0
votes
0
answers
32
views
TLS session keys [duplicate]
I Have a confusion here.
From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
- 133
0
votes
1
answer
59
views
Certification path building for 509 certificates
To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
- 1
1
vote
0
answers
65
views
Is having no driver installed better than having old driver?
How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates?
On older PCs and laptops where some components are no ...
8
votes
3
answers
6k
views
Pros & cons of including requesting IP address in password reset emails?
It has crossed my mind to include the requesting IP address in password reset emails. The intention being that if someone is receiving unexpected reset emails, this allows them to do a basic level of ...
- 33.4k
1
vote
2
answers
107
views
Is it possible to get an SSL certificate with a Subject Alternate Name of a different website?
If this is possible, what is stopping a malicious file from adding an entry to \etc\hosts that points example.com to a phishing clone of a website?
Usually, the browser warns you that the common name ...
- 11
2
votes
2
answers
81
views
Firewall to allow responses but block new connections
I wonder if a firewall can support this case. There are two servers: A and B.
A can send a request via an open port to B and B must respond to A during this connection.
B cannot send a request on its ...
- 123
0
votes
2
answers
83
views
OAuth2 authorization server dictating the resource server to the client
I am looking for any specifications, prior art, and known security considerations for a specific OAuth2 use case where:
an authorization code grant is being performed.
the client does not know the ...
1
vote
0
answers
68
views
Could a laptop fingerprint sensor be used as a webcam? [closed]
I have a Chromebook that normally only recognizes the actual webcam. However, I opened up a random webcam site and it was allowing me to use a second camera for some reason. When I enabled it, I ...
- 21
0
votes
2
answers
160
views
Implications of enabling Developer Mode in Windows 11
Windows 11 appears to have a Developer Mode. I was playing around with Flutter and got prompted to enable it. The setting looks like this:
When I enable it, I get the following confirmation prompt:
...
- 1,319
1
vote
0
answers
53
views
Old work laptop, how to remove Computrace / LoJack [duplicate]
The old company I worked for is no longer around, I have put the laptop in a drawer and forgot about it.
I wish to format the storage media and sell the whole laptop, as I could do make use of the the ...
- 21