All Questions

Filter by
Sorted by
Tagged with
1 vote
0 answers
63 views

Oracle Kerberos authentication on Linux host with SSSD

I have Linux servers which are members of AD domain, running SSSD demon. SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication. NOTE: this is not purely about ...
ibre5041's user avatar
0 votes
0 answers
51 views

Prevent Session Hijacking with copying all metadata from a browser

For example, I'm signed in to my Gmail account. If I copy all data from all the places that Chrome uses (localstorage, all the cookies, all temp folders and so on) to another PC. How does Google ...
Ghost Rider's user avatar
11 votes
3 answers
6k views

Why do some websites require logging in twice? Not two steps, but two full username/password entries

There are a couple of web applications that I use that seem to require two successive logins. Not two steps, but two full logins. The behavior is such that I login in, get kicked out, then have to ...
Roy Hinkley's user avatar
2 votes
2 answers
635 views

Did Phantom Secure use the same level of encryption as WhatsApp?

I've been following a story for some time now about a high-ranking Canadian official who was charged in leaking operational data to the makers of Phantom Secure. There was a very deep level of concern ...
Kalamalka Kid's user avatar
0 votes
0 answers
55 views

do I need anti-csrf-tokens or double submit cookie pattern?

currently I'm working on a NestJs backend. I have already implemented the auth feature with jwt (access and refresh) stored in cookies. Originally I sent the jwt by the standard Bearer token way in ...
derstauner's user avatar
-1 votes
1 answer
50 views

ISO 27001 - Companies processing each other's data

If there are two companies, each holding a valid ISO 27001 certification, what type of formal relationship can be established in policy to allow each other to access, process and store each other's ...
Frank Jackson's user avatar
0 votes
0 answers
87 views

The safest and fastest way to upload files in Docker Container

In a docker project of Asp.net Core MVC 6.0, users must upload files to wwwroot of the project but nothing checks to see if the file is safe or not. I check file extensions with my file header library ...
mamad2559's user avatar
  • 101
0 votes
2 answers
85 views

Python: Does pip install allow escalation of privileges, e.g. through setuid?

I've read that pip install foo allows the developers of foo to run arbitrary code on my machine. I don't mind, as long as I can use Linux user permissions to sandbox it. However, I worry that maybe ...
David Knipe's user avatar
1 vote
1 answer
145 views

Should the use of the HTTP 'ETag' header be avoided for security and privacy concerns?

I'm looking into the risks associated with the use of the HTTP 'Etag' header and found the following relevant information already. Information Disclosure (inodes) This article titled: "...
Bob Ortiz's user avatar
  • 6,651
0 votes
0 answers
62 views

How can I know whether I'm infected by StripedFly malware?

I was reading this article, and decided to search for sd-pam in the processes of one of my laptops. I did ps -x | grep -i "sd-pam", and got 2864 ? S 0:00 (sd-pam) 29172 pts/0 ...
An old man in the sea.'s user avatar
3 votes
1 answer
153 views

Is Android private DNS using domain name a security risk?

Android has the option for using private DNS, but it requires a hostname, not an IP of the DNS server. Isn't entering the domain name of a DNS server a chance for MITM attacks and DNS poisoning? How ...
masterchief164's user avatar
0 votes
1 answer
70 views

How can I detect secondary internet connections?

I have a LAN. Is there a way, without installing any agent in each computer, to detect if any computer is accessing the internet without going through the LAN? For instance, via dongle, Wifi hotspot?
SUNITA GUPTA's user avatar
0 votes
1 answer
46 views

Does an official IETF-codified URN exist for PGP keys?

I've been able to locate http://www.aaronsw.com/2002/draft-swartz-pgp-urn-00, but it appears to be an unofficial proposal never submitted to the IETF. Does it hold any water?
RokeJulianLockhart's user avatar
0 votes
1 answer
51 views

Showing a license/id to a shopping website, worth it? [duplicate]

I'm wondering if anyone here has ever decided to show their driver's license or ID of any sort to be able to shop at a website. I was personally asked to do this along with a facial verification. I ...
skept1ca1's user avatar
11 votes
3 answers
5k views

What security risks are involved in using older HTTP protocols such as HTTP/1.x that would justify upgrading to HTTP/2 or HTTP/3?

As of 2023, still many webservers support HTTP/1.0 and HTTP/1.1 while not supporting recent HTTP/2 and/or HTTP/3 protocols. I understand that newer HTTP versions offer various performance enhancements,...
Bob Ortiz's user avatar
  • 6,651
0 votes
3 answers
142 views

Is HTTP/0.9 considered "End-of-Life" (EOL) due to security vulnerabilities or risks?

I'm exploring the history and evolution of the HTTP protocol and I know that HTTP/0.9 is generally not used anymore. It's clear how features evolved in newer HTTP versions and how primitive HTTP/0.9 ...
Bob Ortiz's user avatar
  • 6,651
0 votes
1 answer
73 views

Is HTTP/1.0 inherently more susceptible to denial-of-service (DoS) attacks?

I'm looking into HTTP version specific risks. HTTP 1.0 lacks support for persistent connections, meaning each request/response pair requires a new TCP connection to be established. Considering the ...
Bob Ortiz's user avatar
  • 6,651
0 votes
0 answers
14 views

macOS processes [migrated]

Anyone have any idea what the PerfPowerService and PerfPowerTelemetry...Service is on macOS (Sonoma?) I can't seem to find a lot of information on these processes. The second one isn't even mentioned ...
Blurfquarf's user avatar
6 votes
2 answers
902 views

Spoofed email sent to me from my email address with SPF/DKIM/DMARC passing

I received an email earlier today on my work email address. The email came from the same address—mine—but I didn't send it. It was an email claiming that he was a professional hacker who had hacked my ...
PaulMcF87's user avatar
  • 161
-2 votes
2 answers
58 views

Should standard OAuth endpoints/configuration files be kept private?

Considering an attacker may be able to leverage the information gathered from standard endpoints/configuration files such as /.well-known/oauth-authorization-server and /.well-known/openid-...
registry4059's user avatar
2 votes
1 answer
84 views

Capturing packets in an android application or ios application?

I've an android and ios app. They run on the same application server on Linux. I want to capture the packets when users are trying to log in to the app. How do I proceed? I'm thinking of doing it with ...
barnyard9's user avatar
0 votes
0 answers
46 views

help in understanding hybrid analysis results? Mac

So I have a few PDFs on my computer I got online a few years ago on my Mac computer. When I ran a virus total scan on some of them I got a couple that were concerning. Here is the one that most ...
DELL_GONEEE's user avatar
1 vote
1 answer
98 views

How to prevent hackers from using my phone number to make accounts?

It seems a hacker is using my phone number to make fraudulent account, and I would like to prevent that. Usually, if a person has your phone number, they're not able to make an account because a ...
user3041883's user avatar
1 vote
1 answer
112 views

How safe it is to view PDF file in browser without downloading the file into PC?

When I view the PDF file in a browser such as FireFox without downloading the file into my PC, does FireFox temporarily store the PDF file in my PC? I heard that FireFox has been sandbox heavily and ...
JUZ Aviewer's user avatar
1 vote
1 answer
33 views

When referring to key types and lengths, is there a correct order to stating the type and length?

When referring to key types and lengths, is there a correct order to stating the type and length? For example, would I use "2048-bit RSA key" or "RSA 2048-bit key" in documentation?...
Paul's user avatar
  • 131
1 vote
0 answers
51 views

Windows decrypting TC volume without passphrase?

I remember having read a blog post or a forum post, some years ago, about a TrueCrypt user whose Windows machine sometimes, at boot, did not ask for the TC passphrase and decrypted automatically the ...
dr_'s user avatar
  • 5,168
0 votes
0 answers
10 views

How to connect to AWS VPN from a country that blocks most VPNs [migrated]

For work, I must connect to AWS cloud services via the AWS VPN app that my company setup on the company laptop that I use. The AWS VPN only provides access to my company's space in AWS (EC2, S3, ...
cmo's user avatar
  • 101
0 votes
0 answers
41 views

unsafe-hashes an alternatives

I need to run the following inline script to inject some Thymeleaf model variables into a javascript file of mine. <script th:inline="javascript"> /*<![CDATA[*/ var ...
Shaunyl's user avatar
  • 101
3 votes
1 answer
266 views

What exactly is the security model of pass?

Linux pass is a program that lets you store passwords in regular text files, which you it then encrypts with your GPG key. I'm confused at how this is considered secure. The GPG key has a passphrase ...
gomennathan's user avatar
1 vote
0 answers
64 views

Do code signing certificates build reputation only for Microsoft, and is reputation maintained across releases?

I have a Windows executable file that has been code signed with a certificate from a Certificate Authority. The CA is listed in the official Microsoft Trusted Root Program list of participants. The ...
Ron's user avatar
  • 111
3 votes
0 answers
197 views

I want to track my android phone using IMEI [closed]

My phone was stolen last week. I went to the police to track it but still now no result. What software can I use to track my device just using the IMEI of the phone?
Mu'azu S. Ahmed's user avatar
1 vote
0 answers
66 views

Code to detect HTTP/2 Rapid Reset Attack vulnerability

Is there code/library to detect this vulnerability? I have been searching online and do not find any We are using Cloudflare which has fixed the issue but government says "we may" have the ...
Matias Haeussler's user avatar
0 votes
1 answer
78 views

Methods to bypass Windows security policy: All Removable Storage Classes - Deny All Access

My partner recently got given work laptop and if you try and put in a USB mass storage device you get an error saying it is not allowed. Without having administrator access I assume this is via the ...
user2334659's user avatar
0 votes
2 answers
83 views

Why does turning on encrypted DNS unblock some geo locked websites?

When I turn on Warp provided by Cloudflare or use 1.1.1.1, it unlocks some of the websites which are geo locked. How does it unblock the websites which are blocked by ISP?
jinchuriki's user avatar
10 votes
5 answers
4k views

How to best obfuscate a built-in key in an application?

We're building an application that needs to log into a website using built-in credentials. It's not optimal to say the least, but we're stuck with "knowing" the username and password ...
glades's user avatar
  • 219
0 votes
0 answers
78 views

How smart cards store their secrets? [duplicate]

How smart cards technically store their secrets? I know smart card is whole computer on chip and it respond only to challenges. I know their software/firmware doesn't allow (it doesn't have the ...
Virer's user avatar
  • 1
0 votes
1 answer
90 views

TCP connection scrambling to evade tracking

There was a project on GitHub that (was going to, if it hadn't been abandoned) modify TCP fields in order to evade packet sniffing. It explains in specifics how this would work here. In particular, ...
R-Rothrock's user avatar
0 votes
0 answers
70 views

Man in the Middle Attack for OAuth 2's Authorize endpoint

We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it's commonly called: GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&...
Joms DV's user avatar
1 vote
0 answers
65 views

Gmail app on Android can't send messages since months

I've got the issue that the Gmail app on Android (OnePlus One device) is unable to send messages (it stays in Outbox instead of Sent). Once in the past, I've solved this by clearing the Gmail app ...
nusch's user avatar
  • 47
1 vote
0 answers
51 views

Does the browser pass the name of the camera being used to the website [closed]

Does the browser pass the name of the camera being used to the website which is accessing our camera like when we use obs virtual cam so is the website able to detect that a virtual camera is being ...
jinchuriki's user avatar
0 votes
0 answers
32 views

TLS session keys [duplicate]

I Have a confusion here. From what I know, in TLS1.2, the Client sends Client Hello and then the Server Sends a Server Hello, Certificate(with its public key) and Certificate chain, and then a Server ...
RRHS's user avatar
  • 133
0 votes
1 answer
59 views

Certification path building for 509 certificates

To this date, is there a specification or a de-facto industry standard or how applications are supposed to perform certification path building in the context of X.509? I am specifically asking about ...
Nope's user avatar
  • 1
1 vote
0 answers
65 views

Is having no driver installed better than having old driver?

How safe are installed & genuine-vendor signed old drivers, specifically when attackers are spoofing Microsoft and other vendor certificates? On older PCs and laptops where some components are no ...
Shubham Deshmukh's user avatar
8 votes
3 answers
6k views

Pros & cons of including requesting IP address in password reset emails?

It has crossed my mind to include the requesting IP address in password reset emails. The intention being that if someone is receiving unexpected reset emails, this allows them to do a basic level of ...
paj28's user avatar
  • 33.4k
1 vote
2 answers
107 views

Is it possible to get an SSL certificate with a Subject Alternate Name of a different website?

If this is possible, what is stopping a malicious file from adding an entry to \etc\hosts that points example.com to a phishing clone of a website? Usually, the browser warns you that the common name ...
Sam Wilson's user avatar
2 votes
2 answers
81 views

Firewall to allow responses but block new connections

I wonder if a firewall can support this case. There are two servers: A and B. A can send a request via an open port to B and B must respond to A during this connection. B cannot send a request on its ...
Bằng Rikimaru's user avatar
0 votes
2 answers
83 views

OAuth2 authorization server dictating the resource server to the client

I am looking for any specifications, prior art, and known security considerations for a specific OAuth2 use case where: an authorization code grant is being performed. the client does not know the ...
Devin Ivy's user avatar
1 vote
0 answers
68 views

Could a laptop fingerprint sensor be used as a webcam? [closed]

I have a Chromebook that normally only recognizes the actual webcam. However, I opened up a random webcam site and it was allowing me to use a second camera for some reason. When I enabled it, I ...
Tele's user avatar
  • 21
0 votes
2 answers
160 views

Implications of enabling Developer Mode in Windows 11

Windows 11 appears to have a Developer Mode. I was playing around with Flutter and got prompted to enable it. The setting looks like this: When I enable it, I get the following confirmation prompt: ...
Pieter's user avatar
  • 1,319
1 vote
0 answers
53 views

Old work laptop, how to remove Computrace / LoJack [duplicate]

The old company I worked for is no longer around, I have put the laptop in a drawer and forgot about it. I wish to format the storage media and sell the whole laptop, as I could do make use of the the ...
Tele's user avatar
  • 21

15 30 50 per page
1
3 4
5
6 7
1366