All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
10 views

which DH protocol is safer in communication with given condition?

I am self learner high school student interested in cryptography nowadays, so I am trying to understand some concepts such as DH problem and its variants, so I have the following question from the ...
curious_student's user avatar
0 votes
0 answers
15 views

What can be practical vulnerabilities in an email setup? [closed]

I am trying to set up an email server using postfix, dovecot and roundcube, I am following the official documentation. I have set up separate servers for intranet and internet emails as well as set up ...
SUNITA GUPTA's user avatar
-1 votes
1 answer
29 views

Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone?

I'm currently studying forensics, and one thing that keeps coming up is the authorities breaking into phones. There are several third party tools they can use, but one of the most popular is '...
Elizabeth Vogue's user avatar
1 vote
1 answer
36 views

Can an email trace be maliciously removed by an admin on a default Outlook setup?

I'm doing some research into email servers and how they work. There is a function in Outlook 365 where an admin can perform several traces on emails for the past 90 days. For example, an 'enhanced ...
Elizabeth Vogue's user avatar
0 votes
0 answers
37 views

Secure boot disabled for Potential BIOS compromise on Tails OS machine

I have an ASUS computer that I use strictly for booting Tails OS from a USB. A few weeks ago I went into the BIOS and noticed that secure boot was disabled. This computer has secure boot enabled by ...
blacksangria's user avatar
0 votes
1 answer
22 views

Does keeping an JDBC SQLite URI in source code safe?

If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI? Should I replace the name of the SQLite db with ...
Setu Kumar Basak's user avatar
0 votes
0 answers
21 views

should I redirect user to login screen after validate email and set password?

I'm working on authentication on the backend of an application and I want to know which of the following methods is the best. after the user registers in the application an email is sent to his email ...
DarkSide77's user avatar
0 votes
0 answers
22 views

Potential XSS bug in email form?

I have a invite users via email form on my website and I was wondering if this could be a potential XSS flaw? I captured the request via Burp, and this is how it looks: Input: { "toEnvWithEmail&...
Sarthak Goyal's user avatar
0 votes
0 answers
12 views

Documentation on mobile-webview.gmail.com link masking?

Several google products (mainly Gmail) masks links using a fake-dns mobile-webview.gmail.com That domain doesn't resolve anywhere, not even Google's own NS https://dnschecker.org/#A/mobile-webview....
gcb's user avatar
  • 213
0 votes
0 answers
54 views

How to prevent public key tampering

I have to store a document (e.g. a JSON file) on a remote PC (that my App is running on) alongside a signature to be able to verify that this file was signed by me. I have no access to this PC nor ...
Croksie's user avatar
3 votes
1 answer
54 views

Format string vulnerability in Java?

Can a non-sanitized user input result in a vulnerability if passed to System.out.printf (Or any equivalent function that takes a format)? Example: public class Demo { public static void main(...
M0ngi's user avatar
  • 31
1 vote
0 answers
36 views

CrypTool - How to determine what type of encryption has been used?

I have a few questions about CrypTool. How can you use the text analysis tools available in CrypTool to determine the encryption algorithm for a given ciphertext? How can you use CrypTool's text ...
Qmails's user avatar
  • 11
0 votes
1 answer
56 views

Is This Perfect Forward Secrecy?

I have a textbook that contains the following problem: In practice, one master key, KM, is exchanged in a secure way (e.g. Diffie-Hellman key exchange) between the involved parties. Afterwards, ...
Paul Ratazzi's user avatar
1 vote
1 answer
43 views

Anything I can do to combat malicious domains?

On Facebook, malware is currently trying to spread itself using the domain googlediver (dot) com, one sample of a malicious url is https://googlediver (dot) com/list-of-traveling-staff , and I believe ...
user1067003's user avatar
0 votes
1 answer
33 views

Can you retrieve messages from instagram or messenger off of a SIM card?

Can you retrieve personal information ie; messages from browsers, off of a SIM card?
Josh Coleman's user avatar
1 vote
2 answers
64 views

Do predictable bank account numbers pose a vulnerability?

Let's say my significant other and I go to the bank to open our accounts and our account numbers end up 14682-4 and 14683-5. They are clearly sequential. Can this detail be used in any sort of attack?
Capi Etheriel's user avatar
0 votes
2 answers
34 views

Is using TOTP from Authenticator app on a mobile device instead of passwords inherently 2FA?

A related discussion can be found, specifically addressing the security implications of using only TOTP for single-factor authentication However, in my view, using a TOTP code from a Google ...
Luka Demetrashvili's user avatar
1 vote
1 answer
40 views

Are JWT's needed when implementing passwordless magic link authentication?

I'm working on a web application where a user gains access by clicking on a magic link sent to them by an internal co-worker. Upon clicking this link, the user is automatically authenticated and a ...
Luka Demetrashvili's user avatar
0 votes
0 answers
18 views

How to crack luks crypto 2, encryption? [closed]

I recently forgot my phrase to unlock my laptop which i bought a new one several month's ago i needed some document then suddenly i can't remember the password, can anyone help!!! Note: I tried ...
Dr.aka's user avatar
  • 1
0 votes
0 answers
33 views

YubiKey Bio for SSH login: Do I have to reauthenticate?

I'd like to use YubiKey Bio for SSH-logins. I'm wondering how often I have to show my fingerprint for authentication when I start new sessions. What's the interval? If I start a new session every 5 ...
Kevin Meier's user avatar
0 votes
0 answers
25 views

When using a VPN is the device DNS cache still written to? [duplicate]

When I am using ProtonVPN, does the VPN server run DNS resolution upon receiving the request, similar to a Tor exit node, thereby bypassing the device's DNS cache? Or do my browser's DNS queries still ...
yellow-saint's user avatar
0 votes
0 answers
44 views

Difference between running executable from disk vs removable media

I came across a strange group policy setup once and was wondering if anyone can make sense of it. We were NOT allowed to run executables that were stored on the local disk or network drives, but we ...
user2334659's user avatar
0 votes
0 answers
38 views

Web application rate limiting, IP blocking using different cellular networks [closed]

While testing a web application for rate limiting and IP blocking I noticed the following: while using 4g through a GSM service provider, the server is blocking me after 300 requests while using lte ...
Khalid Mahyoub's user avatar
0 votes
1 answer
47 views

wireshark captures vpn tun0 smtp as unencrypted, why?

I am trying to learn more about cryptography and am stumped, i dont know what direction to move to even research an answer myself so would appreciate any input. I have a vpn set up to an adapter, tun0,...
joboi_lax's user avatar
0 votes
1 answer
53 views

How to safely download files from Telegram using Sandboxie?

I need to download certain files from Telegram. It is mostly images and videos. I am aware that even this kind of files can contain malicious code, so I want to be 100% safe. (The files usually ...
Martin L's user avatar
  • 103
1 vote
0 answers
30 views

How GitHub Advisory assigns vulnerabilities to same components coming from different package managers?

I am trying to understand how GitHub Advisory filters vulnerabilities, particularly in the context of Bootstrap 3.3.7. In the National Vulnerability Database (NVD), the following vulnerabilities are ...
Sandeep 's user avatar
0 votes
1 answer
79 views

Is Using an Authenticator App on the Same Device as the Passwordless Application a True 2FA?

I am building an application that a user can receive an access to by an internal worker. This works using a magic link, where the user will receive a one time link to authenticate in the app. Now I ...
Luka Demetrashvili's user avatar
0 votes
0 answers
52 views

RSA vs Shor's Algorithm/Fast Factoring — Server Credentials & MITM

I've watched a lot of videos on Shor's Algorithm and Quantum Computers. Most of these videos say these two things undermine RSA via fast-factoring, but they never really explain how fast-factoring is ...
Sam Z's user avatar
  • 1
0 votes
0 answers
10 views

Webauthn: Access control for the public key credential uploaded by the user's device

I'm experimenting with adding passkeys to Drupal. I'm using webauthn-lib 4.7. When registering a passkey, the device generates a Public Key Credential, which is then sent to the server as stringified ...
Patrick Kenny's user avatar
0 votes
0 answers
6 views

VPN over VPN using Amazon EC2 instance [migrated]

I have a OpenVPN configuration file for TryHackMe that I need to connect to. However, I also need to connect to another OpenVPN Access Server hosted on an Amazon AWS EC2 instance. Is there a way that ...
Rhythm Bansal's user avatar
0 votes
0 answers
23 views

How do I create a certificate with subject containing Octet string?

I need to create a certificate with: subject.attribute1: 2.5.4.3 {Common Name} UTF8String subject.attribute2: 2.5.4.92 {tagAFI} OCTET STRING subject.attribute3: 0.9.2342.1920.0300.100.1.1 {userId} ...
J K JoCriSem's user avatar
0 votes
0 answers
34 views

any group to inspect txt attachments? [closed]

I received a sketchy email with a text file. I'd like to know if there's a group that enjoys investigating files and let me know who/what group sent it or if I should reset my computer. I used to live ...
Hoffaisdead's user avatar
0 votes
0 answers
14 views

Double-factor auth to unlock iPhone in general and, especially, Passwords app in particular? [migrated]

Is it possible to make iPhone require both FaceID and passcode when unlocking the device? Especially Passwords app is guilty of relying solely on FaceID to pull up a password for a website or an app. ...
InfiniteLoop's user avatar
-1 votes
0 answers
36 views

Looking for tips on hiring malware consultant - suspected repeated android compromise [closed]

I very strongly suspect that my devices (phones, but possibly also home pcs and work network) have been hacked repeatedly by the same person. I am trying to hire a consultant that can help me look for ...
AnteahLV's user avatar
0 votes
0 answers
44 views

How to include TLS-unique value in CSR?

I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST). So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
MoBe's user avatar
  • 1
0 votes
0 answers
33 views

Disabling UAC (Windows 10) for Administrator accounts

To help improve the user experience on admin workstations, would it be ok to disable the UAC or maybe set it with a more permissive mode?
IscarioteSXIII's user avatar
0 votes
0 answers
61 views

Are 2FA browser plugins sufficiently secure?

Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
Jonathan Root's user avatar
0 votes
0 answers
36 views

How to restore health of an hacked router(fritzbox)?

My fritz!box 5530 has been hacked. I know this because the upload is always very low under 10 mb/s also if my fiber connection would to be 1gb/s|300mb/s. And when you try router reset to factory ...
BlueHatJunior's user avatar
0 votes
3 answers
87 views

Over-Optimizing Security? Storing Encrypted Data on a Server While Private Key Remains With User

Assume that I have a server storing sensitive user information (think medical records). I want this data to be encrypted on my server at almost all times. Only when a doctor needs to access the data ...
Moritz_st's user avatar
1 vote
2 answers
47 views

Random High Ports - Firewall Config

I'm from a digital forensics background and it has been a while since I studied networking and so am a little rusty on a few aspects. I am looking to implement a remote forensics solution within an ...
forensicsguy0506's user avatar
0 votes
0 answers
26 views

What is the function of TCC.db? [closed]

I've made a huge mistake and I ran a script that appears to be malicious on my computer. Could someone please share with me what this allows the attacker to do on my computer? set homeDirectory to ...
Neel's user avatar
  • 101
0 votes
0 answers
33 views

Bypass Options -Indexes in htaccess to view content

My professor gave me this task and said "Easy" about it! I don't know how serious is he! The task : I have a directory for example www.example.com/items The "items" directory ...
karam E's user avatar
0 votes
0 answers
26 views

Is it possible to determine which Google account triggered Google Find My Device? [closed]

I received an alert that my phone was located by Google Find My Device. I did not do it. No one has accessed my account and I have 2fa enabled
Paul Bevan's user avatar
0 votes
0 answers
27 views

Invalid Syntax found via SPF record [closed]

Can a domain name of a mail address be spoofed or hacked when you find out that domain name of a mail address has a "invalid syntax found" by checking the SPF record? Or can the IP address ...
Fatih's user avatar
  • 1
1 vote
0 answers
26 views

What are the risks of SSO and logins in general in relation to privacy?

I recently started using the Brave browser for a little more privacy. However, I still don't understand much about the risks surrounding SSO and cookies. As an example, I am logged in to YouTube.com ...
EchtFettigerKeks's user avatar
0 votes
0 answers
34 views

Secure authentication method for creating an Excel data connection to SQL Server

My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
DougM's user avatar
  • 1
22 votes
6 answers
6k views

What's wrong with the use of a WAF (Web Application Firewall)?

My SaaS company recently lost the bid for an enterprise software licensing deal. One of the reasons the prospect gave for not choosing us as a vendor was: the use of a WAF I'm not an information ...
Anon's user avatar
  • 221
1 vote
0 answers
17 views

Set a default GPG key id for email

If I have imported several keys (with different key ids that I can see when I gpg --list-keys) that all have the same email address, how do I set which one to encrypt to? and ditto encrypt from/with, ...
Sandra's user avatar
  • 111
0 votes
0 answers
21 views

verification of network security [closed]

is there any canonical way to verify that our web connection is actually secure ? e.g. "a smoke test" to check for leaks? I've noticed e.g. applications that can seem to check if the ...
R S's user avatar
  • 101
0 votes
0 answers
8 views

Local Machine certificate (certlm.msc) - choosing "Microsoft Software Key Storage Provider" on import [migrated]

When importing a device certificate/private key through CERTLM, the GUI seems to choose a deprecated Cryptography Service Provider (CSP) called "Microsoft Strong Cryptographic Provider"; I'm ...
tb1's user avatar
  • 101

15 30 50 per page
1
2 3 4 5
1366