All Questions
68,265
questions
0
votes
0
answers
6
views
How to include TLS-unique value in CSR?
I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST).
So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
- 1
0
votes
0
answers
11
views
Disabling UAC (Windows 10) for Administrator accounts
To help improve the user experience on admin workstations, would it be ok to disable the UAC or maybe set it with a more permissive mode?
0
votes
0
answers
20
views
Are 2FA browser plugins sufficiently secure?
Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
- 101
0
votes
0
answers
18
views
How to restore health of an hacked router(fritzbox)?
My fritz!box 5530 has been hacked.
I know this because the upload is always very low under 10 mb/s also if my fiber connection would to be 1gb/s|300mb/s.
And when you try router reset to factory ...
0
votes
2
answers
39
views
Over-Optimizing Security? Storing Encrypted Data on a Server While Private Key Remains With User
Assume that I have a server storing sensitive user information (think medical records). I want this data to be encrypted on my server at almost all times. Only when a doctor needs to access the data ...
1
vote
2
answers
31
views
Random High Ports - Firewall Config
I'm from a digital forensics background and it has been a while since I studied networking and so am a little rusty on a few aspects. I am looking to implement a remote forensics solution within an ...
0
votes
0
answers
20
views
What is the function of TCC.db? [closed]
I've made a huge mistake and I ran a script that appears to be malicious on my computer. Could someone please share with me what this allows the attacker to do on my computer?
set homeDirectory to ...
- 101
0
votes
1
answer
23
views
Bypass Options -Indexes in htaccess to view content
My professor gave me this task and said "Easy" about it!
I don't know how serious is he!
The task :
I have a directory for example
www.example.com/items
The "items" directory ...
- 1
0
votes
0
answers
19
views
Is it possible to determine which Google account triggered Google Find My Device? [closed]
I received an alert that my phone was located by Google Find My Device. I did not do it.
No one has accessed my account and I have 2fa enabled
0
votes
0
answers
23
views
Invalid Syntax found via SPF record [closed]
Can a domain name of a mail address be spoofed or hacked when you find out that domain name of a mail address has a "invalid syntax found" by checking the SPF record? Or can the IP address ...
- 1
1
vote
0
answers
17
views
What are the risks of SSO and logins in general in relation to privacy?
I recently started using the Brave browser for a little more privacy.
However, I still don't understand much about the risks surrounding SSO and cookies.
As an example, I am logged in to YouTube.com ...
- 121
0
votes
0
answers
26
views
Secure authentication method for creating an Excel data connection to SQL Server
My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
- 1
11
votes
3
answers
3k
views
What's wrong with the use of a WAF?
My SaaS company recently lost the bid for an enterprise software licensing deal.
One of the reasons the prospect gave for not choosing us as a vendor was:
the use of a WAF
I'm not an information ...
- 111
1
vote
0
answers
11
views
Set a default GPG key id for email
If I have imported several keys (with different key ids that I can see when I gpg --list-keys) that all have the same email address, how do I set which one to encrypt to?
and ditto encrypt from/with, ...
- 111
0
votes
0
answers
18
views
verification of network security [closed]
is there any canonical way to verify that our web connection is actually secure ?
e.g. "a smoke test" to check for leaks?
I've noticed e.g. applications that can seem to check if the ...
- 101
0
votes
0
answers
8
views
Local Machine certificate (certlm.msc) - choosing "Microsoft Software Key Storage Provider" on import [migrated]
When importing a device certificate/private key through CERTLM, the GUI seems to choose a deprecated Cryptography Service Provider (CSP) called "Microsoft Strong Cryptographic Provider"; I'm ...
- 101
0
votes
0
answers
21
views
How can we verify the security of a device? [duplicate]
I've recently been experiencing a situation as follows:
How can I understand the IO of an unknown device?
Say, for example, I am gifted a bluetooth speaker. How can I understand its potential for ...
- 101
-1
votes
0
answers
38
views
WhatsApp Hack help [closed]
My friend was hacked and I've done all I know to do. I uninstalled WhatsApp from her phone, and reset the phone to factory settings. I cannot re-download WhatsApp. When her partner sees her account ...
- 1
0
votes
0
answers
15
views
Can Num2bits be used to guard against underflows?
In circom, Num2bits() from circomlib is primarily intended for converting an Integer into an array of bits.
But because of it’s optional parameter, it can be used to prevent overflows such as :
inp = ...
- 1,462
1
vote
0
answers
27
views
Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?
I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
- 11
0
votes
0
answers
73
views
I have received an email with pictures from the gallery on my phone [closed]
I've two email addresses: [email protected] and [email protected].
Today, "red" received an email from "pink".
I didn't send this email.
The email contained four pictures that were ...
- 101
2
votes
0
answers
77
views
Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray
TL;DR
I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
- 21
1
vote
0
answers
22
views
Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?
So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc):
When creating a platform authenticator, ...
- 158
0
votes
0
answers
40
views
Codeigniter website is hacked regularly by an unknown method [closed]
I have developed a website with codeigniter 3 and I have also updated it to the latest version of codeigniter.
My website has been hacked in the same way for several days.
The hacker puts two files in ...
- 101
2
votes
1
answer
217
views
Should newly password links reset old ones? if so, why?
I have noticed on most websites that all previous password reset links are automatically expired when a new one is requested.
Why is this so common and what are some possible consequences if this isn'...
- 285
1
vote
1
answer
34
views
How serious are npm module vulnerabilities?
Obviously any known vulnerabilities are not great, but I'm curious how much I should be concerned about them.
I've seen plenty of articles that talk about the rise in malware/spam in npm packages:
...
- 11
0
votes
1
answer
39
views
Difference between "circumstance" and "event" in the definitions of threat
On the Wikipedia page of threat (in textbooks too) various definitions are given where almost all agree in defining a threat as a "circumstance or event".
I'm having trouble understanding ...
- 117
0
votes
1
answer
32
views
Do I need an IP whitelist on top of a VPN?
My company requires me to access resources through a VPN connection -- specifically, an OpenVPN client configured to require a password plus an authenticator token. But the company also restricts ...
- 101
0
votes
0
answers
41
views
How can I understand the zip2john hash format?
I had a .zip file that was apparently encrypted with AES-256 deflate.
7z l -slt archive.zip | grep Method
Method = AES-256 Deflate
Then I used zip2john to get a "hash" out of it:
archive....
0
votes
0
answers
22
views
Inheriting Old Website Maintenance: Demonstrating Code Vulnerabilities [closed]
I've just inherited the maintenance of an old website. The code is awful and I'd like to demonstrate to my superiors that the code is bad and vulnerable.
<?php
if (!empty($_GET['page'])){
...
- 101
1
vote
0
answers
28
views
Why does Amazon make you enter specified digits upon calling their customer service switchboard?
If one calls the Amazon customer services number, a robotic voice asks one to enter three numbers. Along the lines of “to be connected to a customer service associate, please press [XYZ]” (where [xyz] ...
- 111
0
votes
0
answers
24
views
Default nmap script execution when specifying --script banner
I have a subscription for a NSE scripts feed for nmap. There are some of those scripts which have the default category (among others)
I am running nmap in the following way
nmap --privileged -oX - -T3 ...
0
votes
0
answers
20
views
How kerberos hashes its keys? [closed]
My manager said that kerberos passwords are hashed using aes256-cts-hmac-sha1-96 & aes128-cts-hmac-sha1-96 algorithms.
I that these are hot hashing algorithms but encryption algorithms.
My manager ...
- 1,085
0
votes
1
answer
48
views
Modern VPNs and average MITM attacks
I am trying to untangle a number of concepts (all of which i am unfamiliar with) in this question, but they all point to a seemingly basic question;
With modern tunneling protocols, SSL ciphers and ...
- 133
0
votes
0
answers
17
views
Does other frontend framework have similar issue like AngularJS?
I'm reading an article that talks about XSS exploitation on AngularJS,
AngularJS will render the template in ng-html, and it bypasses sanitize-html.
My questions,
I'm wondering if other frameworks ...
- 2,057
0
votes
1
answer
24
views
Necessity of CSRF Protection with ID Token Authentication in Firebase
I recently came across a statement in the Firebase documentation that suggests "CSRF protection should be taken into account." This guidance appears in the context of using an ID token for ...
- 101
-1
votes
1
answer
60
views
Is encoding random with module insecure? [closed]
The ID library Nano ID claims that modulo based encoding (e.g. Base64) would lead to uneven distribution in the output:
Uniformity. random % alphabet is a popular mistake to make when coding an ID ...
- 99
3
votes
2
answers
61
views
Benefit of permissive Content-Security-Policy
I am new to the concept of Content-Security-Policy (CSP) so please forgive my ignorance.
The site https://securityheaders.com parses headers and provides a score. For example unibet.com is awarded a ...
- 131
2
votes
1
answer
74
views
API key embedded in clients: how to defend against over-usage?
I am new to client-side development and I have a naive question. Right now, I'm using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include ...
- 157
0
votes
0
answers
63
views
Use a virtual machine to do risky stuff. How to stay as safe as possible? [duplicate]
I have a PC with Ubuntu and Windows in dual boot. I use this PC for basic stuff: Windows for gaming, shopping and common browsing, Ubuntu to do something such as home banking.
I was thinking to create ...
0
votes
0
answers
17
views
Is POST-based XSSI possible?
With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out.
I have an endpoint which returns sensitive Javascript code, but ...
- 29.5k
0
votes
0
answers
37
views
How to remove someone from our wifi network? [closed]
One of my mother's students, I don't know how, but he found out our home wifi password without our consent. He said he could scan it from our router. We didn't believe him at that time, but today he ...
0
votes
0
answers
42
views
MITM with forwarding between 2 hosts in the same network
I have 3 hosts in the same network, let's say their IP addresses end with:
.10 (Host A)
.11 (Host B)
.12 (Host C)
I want to sniff packets between A and C through host B, so that host B acts as MITM.
...
2
votes
1
answer
60
views
How to feasibly digital sign high volume documents with CA issued digital certificate?
My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
- 31
0
votes
0
answers
10
views
How Does a Database that Supports TDE Work In Practice? [migrated]
I'm very curious on how does TDE is implemented in practice. My goal is to get understanding on the usability constraint and possibility performance impact of applying such technique.
Thus I'm trying ...
- 101
0
votes
1
answer
104
views
My personal info was leaked on the dark web through my Gmail Account; is it still safe to continue using said Gmail Account?
I have been using my personal Gmail Account for years to create accounts on a wide range of websites like evite.com and Instagram.
Google conducted a dark web scan and created a report of instances ...
- 1
0
votes
0
answers
52
views
How does admin identify routers connected to a network?
In my campus, we are provided with a LAN port to each room to access the internet. Also, they didn't allow students to use routers in their respective room. The only way one can access the internet is ...
1
vote
1
answer
76
views
Does not storing passwords in browser really matter given cookie hijacking exists?
I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too.
But then I found out about ...
0
votes
0
answers
78
views
Is linux really that insecure? [closed]
Recently, I came across this article where the author complains about the slow response to exploit protections in the Linux kernel and also highlights that CVE is a poor way to address vulnerabilities....
0
votes
1
answer
33
views
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
- 9