All Questions

Does rust's cargo package manager cryptographically validate its payload's authentication and integrity for all packages after downloading them and before installing them? I see a lot of guides ...

We are serving static content over the internet, and have a business requirement that the data must be encrypted at rest. Currently it is stored in AWS S3, where it can be accessed by authorized ...

Is it secure to send messages between a WebSocket Server and the Client? An example of sending messages between a (Socket.io) server, is in Node.js: socket.on("myMessage", function(msg) { // ...

Every now and then, you here a story about misuses of mobile OS' spyware softwares, developed by technology firms which usually sell their products to governments or groups with similar power. You ...

I've received PDF at work, which I then ran through virustotal scan out of habit. It turned out to be clean, but at the same time some tags caught my attention, namely: checks-user-input detect-debug-...

If one uses a storage device (USB stick or SD card) on Windows, then it leaves "System Volume Information" folder in the file system. Would there be a way so a forensic guy could definitely ...

Recently starting to immerse myself into cryptography, the problem concerning the generation of true randomness being unachievable for computers at this point was raised. If computers were able to ...

If one formats the same USB stick (or SD card) to FAT32 file system on Windows, or on Linux, or on Android - would there be differences so a forensic guy could definitely tell on which OS or even on ...

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android - would there be a way so a forensic guy could definitely tell on which computer the flash card was used by ...

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android, would there be a way to forensically determine on which computer the card reader was used? I know OS can log ...

If one uses a FAT32-formatted USB stick on Windows, Linux, or Android, would there be a way to determine on which computer the USB stick was used by examining the USB stick? I know OS can log which ...

I'm working on a small rest api project with user authentication. But I'm wondering whether I should store the users authentication token in a header or a cookie. The general idea is as follows: User ...

On the PHP website it is stated that "Developers must not use long life session IDs for auto-login because it increases the risk of stolen sessions.". Instead it is recommended to use a ...

Around 4 months ago, someone learned my IP, and is threatening to DDoS attack me if I am not his slave. He was breaking the Discord TOS with all kinds of stuff in my DMs. I blocked him, but one of his ...

I have an unknown hash (atleast i think it is something that got encrypted). Is there some way to identify what encryption algorithm has been used. This is it: UÐËÎ. ..àW²1&Ýta+./ÔR.úÇ.1Ýк é.}zgü½...

CIS has published hardening standards for all operating systems of EC2 in AWS. CIS also provides hardened images as well but they're quite expensive at $130/year/instance. Is there a place where we ...

I started playing with encrypting some personal files, and I exported the private key as an .asc file, but also on hard copy (plain paper) and can't understand a thing about how it says to import it ...

When I visit any website in Tor browser and if I see the diagram of the circuit that Tor Browser is using for the current tab in the site information menu in the URL bar, it shows 3 relays: Guard, ...

I have seen a lot of tutorials showing how to MITM a network using various tools. But it usually says that we require a network adapter with monitor mode options. I own my wifi router and can connect ...

While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...

What's the alternative to storing plain-text passwords in a Database? For example, I'm using Node.js to get a POST request for signing up / logging in a user from a webpage. When signing up a user, I ...

This question may be a little off-topic, but is Math.random the same as crypto.getRandomValues? (JavaScript) Here's an example: Math.random(); // 0.11918419514323941 self.crypto.getRandomValues(new ...

I'm trying to enable TLS on a Nexus Container, while the browser shows HTTPS, if you use curl against the url, you'll get errors. I feel that I'm missing something in this process, so I'll go step-by-...

Lately, the security community has been asking interesting questions around surprising side effects of raw Unicode formatting characters in source code. That got me thinking about input validation and ...

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...

If an attacker who can watch network traffic knows a victim's username and can figure out which request is a login, then the size of the login request will reveal something about the password length. ...

I'm not an expert, only have basic knowledge about all this but I'd like to understand what's going on so please bear with me. I'm currently using a VPN (IKEv2 protocol) on a macOS system and I can ...

If reports are to be believed, Google and others are starting to force 2FA on user accounts starting late ~2021: https://www.theverge.com/2021/10/5/22710421/google-security-2fa-inactive-account-...

Let us say you have an app where the users will be required to deposit cryptocurrency. Is it safe to let users sign in with third-party authentication? For example "sign in with Google" or &...

Since SVG files can have JavaScript, which would get executed is it a potential threat for malware, tracking scripts and similar stuff?

A client wants to show a stream of his Motobix Webcam on his website. Its easy to show a jpg stream. But the problem is: The stream source is not protected with a valid ssl certificate. On the camera ...

The following scenario: We have a HTTP (not HTTPS, so unencrypted) server which contains an open (RSA) public key. The general sharing of the public key should not be a problem since it is the public ...

Say we have a remote transmitter that is not connected to a wifi router (neither wirelessly nor by cable), but which transmits information using electromagnetic waves. Examples include walkie-talkies, ...

I live in a location which is semi-rural. I also share this Internet access with some people nearby. Although bandwidth is a bit limited (VDSL), other then those imposed by the connection speed ...

First of all, this might be the incorrect place to post this question. Sorry in advance if that is the case. I am building a web application which involves a login system. Now once a user has logged ...

I have a Windows 10 OS, drives are encrypted with the latest version. UEFI is not encrypted, and I have recently installed a BIOS update. I wonder about the possibility of a hacker (if secure boot is ...

I am planning to purchase a security tool like fortify, or sonarqube or snyk. How do you evaluate if the scanner really picks up static vulnerabilities and malware, as well runtime attacks? Any good ...

In case you lose access to your two-factor authentication (2FA) codes, you are only required to enter one of the backup codes. So why do services like Google generate multiple codes if it doesn't ...

Based in this post in Google Chrome help they claim that they encrypt my username and password with a secret key known only to my device. What is the algorithm used to generate this secret which is ...

When using x509 certificates for authentication, I understand that there is a shared source of trust (the signing certificate authority). So that explains why a server is able to authenticate the ...

I'm looking for a process to replace the status quo of notepad and Excel. We've tested a market-leading password manager. An issue that comes up with this is that the secure sharing password facility ...

I want to use pwntools to generate a relative jump 0x20 bytes forward. It isn't described in the documentation how to do that. What's the command for doing a JMP SHORT 0x20 in pwntools?

I've been looking into trying to see if there are any authorization controls that can be implemented for a local, and offline, .NET application that are tied to the Windows local authentication. The ...

I have an application that stores the id_token in the localStorage of the browser. Since there is no CSP and Web Storage does not have the same protections such as cookies (HttpOnly, SameSite) this &...

I am trying to understand OIDC and i dont see the purpose of the ID token if with just the access token, i can make a request to the userinfo endpoint and get the user info. What then is the purpose ...

Suppose I have created an Attestation key (AK) and dumped the public portion for my use. Further using TPM2 Evict Control, I make the attestation key persistent on an address in TPM. $ tpm2_createak -...

I found an information leakage vulnerability on a company website and I found that the information includes all the usernames of the users. I also observed that the application uses a lockout ...

Let's suppose a Mac OS computer with two users: user1 and user2. These users are not administrators. FileVault is enabled. The computer is connected to an empty external hard drive for Time Machine. ...

On Mac OS preferences, there is a "Security and privacy" icon. In the "Privacy" tab, i can see "Full disk Access" and "Files and Folders". I can allow specific ...

For example, assume stackoverflow.com used a certificate issued by Google who is trusted. In the stackoverflow.com certificate, its own public key would be stored. However, is it also possible for ...