All Questions
68,283
questions
0
votes
0
answers
10
views
which DH protocol is safer in communication with given condition?
I am self learner high school student interested in cryptography nowadays, so I am trying to understand some concepts such as DH problem and its variants, so I have the following question from the ...
0
votes
0
answers
15
views
What can be practical vulnerabilities in an email setup? [closed]
I am trying to set up an email server using postfix, dovecot and roundcube, I am following the official documentation. I have set up separate servers for intranet and internet emails as well as set up ...
- 133
-1
votes
1
answer
29
views
Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone?
I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones.
There are several third party tools they can use, but one of the most popular is '...
1
vote
1
answer
36
views
Can an email trace be maliciously removed by an admin on a default Outlook setup?
I'm doing some research into email servers and how they work.
There is a function in Outlook 365 where an admin can perform several traces on emails for the past 90 days. For example, an 'enhanced ...
0
votes
0
answers
37
views
Secure boot disabled for Potential BIOS compromise on Tails OS machine
I have an ASUS computer that I use strictly for booting Tails OS from a USB. A few weeks ago I went into the BIOS and noticed that secure boot was disabled.
This computer has secure boot enabled by ...
0
votes
1
answer
22
views
Does keeping an JDBC SQLite URI in source code safe?
If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI?
Should I replace the name of the SQLite db with ...
- 101
0
votes
0
answers
21
views
should I redirect user to login screen after validate email and set password?
I'm working on authentication on the backend of an application and I want to know which of the following methods is the best.
after the user registers in the application an email is sent to his email ...
- 101
0
votes
0
answers
22
views
Potential XSS bug in email form?
I have a invite users via email form on my website and I was wondering if this could be a potential XSS flaw?
I captured the request via Burp, and this is how it looks:
Input:
{
"toEnvWithEmail&...
0
votes
0
answers
12
views
Documentation on mobile-webview.gmail.com link masking?
Several google products (mainly Gmail) masks links using a fake-dns mobile-webview.gmail.com
That domain doesn't resolve anywhere, not even Google's own NS https://dnschecker.org/#A/mobile-webview....
- 213
0
votes
0
answers
54
views
How to prevent public key tampering
I have to store a document (e.g. a JSON file) on a remote PC (that my App is running on) alongside a signature to be able to verify that this file was signed by me. I have no access to this PC nor ...
- 1
3
votes
1
answer
54
views
Format string vulnerability in Java?
Can a non-sanitized user input result in a vulnerability if passed to System.out.printf (Or any equivalent function that takes a format)?
Example:
public class Demo {
public static void main(...
- 31
1
vote
0
answers
36
views
CrypTool - How to determine what type of encryption has been used?
I have a few questions about CrypTool.
How can you use the text analysis tools available in CrypTool to determine the encryption algorithm for a given ciphertext?
How can you use CrypTool's text ...
- 11
0
votes
1
answer
56
views
Is This Perfect Forward Secrecy?
I have a textbook that contains the following problem:
In practice, one master key, KM, is exchanged in a secure way (e.g. Diffie-Hellman key exchange) between the involved parties. Afterwards, ...
- 101
1
vote
1
answer
43
views
Anything I can do to combat malicious domains?
On Facebook, malware is currently trying to spread itself using the domain googlediver (dot) com, one sample of a malicious url is https://googlediver (dot) com/list-of-traveling-staff , and I believe ...
- 573
0
votes
1
answer
33
views
Can you retrieve messages from instagram or messenger off of a SIM card?
Can you retrieve personal information ie; messages from browsers, off of a SIM card?
1
vote
2
answers
64
views
Do predictable bank account numbers pose a vulnerability?
Let's say my significant other and I go to the bank to open our accounts and our account numbers end up 14682-4 and 14683-5. They are clearly sequential. Can this detail be used in any sort of attack?
- 113
0
votes
2
answers
34
views
Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?
A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
1
vote
1
answer
40
views
Are JWT's needed when implementing passwordless magic link authentication?
I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a ...
0
votes
0
answers
18
views
How to crack luks crypto 2, encryption? [closed]
I recently forgot my phrase to unlock my laptop which i bought a new one several month's ago i needed some document then suddenly i can't remember the password, can anyone help!!!
Note: I tried ...
- 1
0
votes
0
answers
33
views
YubiKey Bio for SSH login: Do I have to reauthenticate?
I'd like to use YubiKey Bio for SSH-logins. I'm wondering how often I have to show my fingerprint for authentication when I start new sessions. What's the interval? If I start a new session every 5 ...
- 101
0
votes
0
answers
25
views
When using a VPN is the device DNS cache still written to? [duplicate]
When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache?
Or do my browser's DNS queries still ...
- 101
0
votes
0
answers
44
views
Difference between running executable from disk vs removable media
I came across a strange group policy setup once and was wondering if anyone can make sense of it. We were NOT allowed to run executables that were stored on the local disk or network drives, but we ...
- 51
0
votes
0
answers
38
views
Web application rate limiting, IP blocking using different cellular networks [closed]
While testing a web application for rate limiting and IP blocking I noticed the following:
while using 4g through a GSM service provider, the server is blocking me after 300 requests
while using lte ...
0
votes
1
answer
47
views
wireshark captures vpn tun0 smtp as unencrypted, why?
I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input.
I have a vpn set up to an adapter, tun0,...
0
votes
1
answer
53
views
How to safely download files from Telegram using Sandboxie?
I need to download certain files from Telegram. It is mostly images and videos. I am aware that even this kind of files can contain malicious code, so I want to be 100% safe. (The files usually ...
- 103
1
vote
0
answers
30
views
How GitHub Advisory assigns vulnerabilities to same components coming from different package managers?
I am trying to understand how GitHub Advisory filters vulnerabilities, particularly in the context of Bootstrap 3.3.7. In the National Vulnerability Database (NVD), the following vulnerabilities are ...
- 11
0
votes
1
answer
79
views
Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?
I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
0
votes
0
answers
52
views
RSA vs Shor's Algorithm/Fast Factoring — Server Credentials & MITM
I've watched a lot of videos on Shor's Algorithm and Quantum Computers. Most of these videos say these two things undermine RSA via fast-factoring, but they never really explain how fast-factoring is ...
- 1
0
votes
0
answers
10
views
Webauthn: Access control for the public key credential uploaded by the user's device
I'm experimenting with adding passkeys to Drupal.
I'm using webauthn-lib 4.7.
When registering a passkey, the device generates a Public Key Credential, which is then sent to the server as stringified ...
- 101
0
votes
0
answers
6
views
VPN over VPN using Amazon EC2 instance [migrated]
I have a OpenVPN configuration file for TryHackMe that I need to connect to. However, I also need to connect to another OpenVPN Access Server hosted on an Amazon AWS EC2 instance. Is there a way that ...
0
votes
0
answers
23
views
How do I create a certificate with subject containing Octet string?
I need to create a certificate with:
subject.attribute1: 2.5.4.3 {Common Name} UTF8String
subject.attribute2: 2.5.4.92 {tagAFI} OCTET STRING
subject.attribute3: 0.9.2342.1920.0300.100.1.1 {userId} ...
0
votes
0
answers
34
views
any group to inspect txt attachments? [closed]
I received a sketchy email with a text file. I'd like to know if there's a group that enjoys investigating files and let me know who/what group sent it or if I should reset my computer. I used to live ...
0
votes
0
answers
14
views
Double-factor auth to unlock iPhone in general and, especially, Passwords app in particular? [migrated]
Is it possible to make iPhone require both FaceID and passcode when unlocking the device?
Especially Passwords app is guilty of relying solely on FaceID to pull up a password for a website or an app. ...
- 101
-1
votes
0
answers
36
views
Looking for tips on hiring malware consultant - suspected repeated android compromise [closed]
I very strongly suspect that my devices (phones, but possibly also home pcs and work network) have been hacked repeatedly by the same person. I am trying to hire a consultant that can help me look for ...
- 1
0
votes
0
answers
44
views
How to include TLS-unique value in CSR?
I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST).
So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
- 1
0
votes
0
answers
33
views
Disabling UAC (Windows 10) for Administrator accounts
To help improve the user experience on admin workstations, would it be ok to disable the UAC or maybe set it with a more permissive mode?
0
votes
0
answers
61
views
Are 2FA browser plugins sufficiently secure?
Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
- 101
0
votes
0
answers
36
views
How to restore health of an hacked router(fritzbox)?
My fritz!box 5530 has been hacked.
I know this because the upload is always very low under 10 mb/s also if my fiber connection would to be 1gb/s|300mb/s.
And when you try router reset to factory ...
0
votes
3
answers
87
views
Over-Optimizing Security? Storing Encrypted Data on a Server While Private Key Remains With User
Assume that I have a server storing sensitive user information (think medical records). I want this data to be encrypted on my server at almost all times. Only when a doctor needs to access the data ...
1
vote
2
answers
47
views
Random High Ports - Firewall Config
I'm from a digital forensics background and it has been a while since I studied networking and so am a little rusty on a few aspects. I am looking to implement a remote forensics solution within an ...
0
votes
0
answers
26
views
What is the function of TCC.db? [closed]
I've made a huge mistake and I ran a script that appears to be malicious on my computer. Could someone please share with me what this allows the attacker to do on my computer?
set homeDirectory to ...
- 101
0
votes
0
answers
33
views
Bypass Options -Indexes in htaccess to view content
My professor gave me this task and said "Easy" about it!
I don't know how serious is he!
The task :
I have a directory for example
www.example.com/items
The "items" directory ...
- 1
0
votes
0
answers
26
views
Is it possible to determine which Google account triggered Google Find My Device? [closed]
I received an alert that my phone was located by Google Find My Device. I did not do it.
No one has accessed my account and I have 2fa enabled
0
votes
0
answers
27
views
Invalid Syntax found via SPF record [closed]
Can a domain name of a mail address be spoofed or hacked when you find out that domain name of a mail address has a "invalid syntax found" by checking the SPF record? Or can the IP address ...
- 1
1
vote
0
answers
26
views
What are the risks of SSO and logins in general in relation to privacy?
I recently started using the Brave browser for a little more privacy.
However, I still don't understand much about the risks surrounding SSO and cookies.
As an example, I am logged in to YouTube.com ...
- 121
0
votes
0
answers
34
views
Secure authentication method for creating an Excel data connection to SQL Server
My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
- 1
22
votes
6
answers
6k
views
What's wrong with the use of a WAF (Web Application Firewall)?
My SaaS company recently lost the bid for an enterprise software licensing deal.
One of the reasons the prospect gave for not choosing us as a vendor was:
the use of a WAF
I'm not an information ...
- 221
1
vote
0
answers
17
views
Set a default GPG key id for email
If I have imported several keys (with different key ids that I can see when I gpg --list-keys) that all have the same email address, how do I set which one to encrypt to?
and ditto encrypt from/with, ...
- 111
0
votes
0
answers
21
views
verification of network security [closed]
is there any canonical way to verify that our web connection is actually secure ?
e.g. "a smoke test" to check for leaks?
I've noticed e.g. applications that can seem to check if the ...
- 101
0
votes
0
answers
8
views
Local Machine certificate (certlm.msc) - choosing "Microsoft Software Key Storage Provider" on import [migrated]
When importing a device certificate/private key through CERTLM, the GUI seems to choose a deprecated Cryptography Service Provider (CSP) called "Microsoft Strong Cryptographic Provider"; I'm ...
- 101