All Questions

Filter by
Sorted by
Tagged with
0 votes
0 answers
6 views

How to include TLS-unique value in CSR?

I'm using a GlobalSign EST Go library that provides an implementation of the RFC 7030 (EST). So far doesn't provide any function to generate a CSR at runtime and therefore include the TLS-unique value ...
MoBe's user avatar
  • 1
0 votes
0 answers
11 views

Disabling UAC (Windows 10) for Administrator accounts

To help improve the user experience on admin workstations, would it be ok to disable the UAC or maybe set it with a more permissive mode?
IscarioteSXIII's user avatar
0 votes
0 answers
20 views

Are 2FA browser plugins sufficiently secure?

Regarding 2FA browser plugins, I follow the uneducated opinion that they usually provide sufficient security. Since a desktop computer is a unique device (even a virtual machine) and provides that ...
Jonathan Root's user avatar
0 votes
0 answers
18 views

How to restore health of an hacked router(fritzbox)?

My fritz!box 5530 has been hacked. I know this because the upload is always very low under 10 mb/s also if my fiber connection would to be 1gb/s|300mb/s. And when you try router reset to factory ...
BlueHatJunior's user avatar
0 votes
2 answers
39 views

Over-Optimizing Security? Storing Encrypted Data on a Server While Private Key Remains With User

Assume that I have a server storing sensitive user information (think medical records). I want this data to be encrypted on my server at almost all times. Only when a doctor needs to access the data ...
Moritz_st's user avatar
1 vote
2 answers
31 views

Random High Ports - Firewall Config

I'm from a digital forensics background and it has been a while since I studied networking and so am a little rusty on a few aspects. I am looking to implement a remote forensics solution within an ...
forensicsguy0506's user avatar
0 votes
0 answers
20 views

What is the function of TCC.db? [closed]

I've made a huge mistake and I ran a script that appears to be malicious on my computer. Could someone please share with me what this allows the attacker to do on my computer? set homeDirectory to ...
Neel's user avatar
  • 101
0 votes
1 answer
23 views

Bypass Options -Indexes in htaccess to view content

My professor gave me this task and said "Easy" about it! I don't know how serious is he! The task : I have a directory for example www.example.com/items The "items" directory ...
karam E's user avatar
0 votes
0 answers
19 views

Is it possible to determine which Google account triggered Google Find My Device? [closed]

I received an alert that my phone was located by Google Find My Device. I did not do it. No one has accessed my account and I have 2fa enabled
Paul Bevan's user avatar
0 votes
0 answers
23 views

Invalid Syntax found via SPF record [closed]

Can a domain name of a mail address be spoofed or hacked when you find out that domain name of a mail address has a "invalid syntax found" by checking the SPF record? Or can the IP address ...
Fatih's user avatar
  • 1
1 vote
0 answers
17 views

What are the risks of SSO and logins in general in relation to privacy?

I recently started using the Brave browser for a little more privacy. However, I still don't understand much about the risks surrounding SSO and cookies. As an example, I am logged in to YouTube.com ...
EchtFettigerKeks's user avatar
0 votes
0 answers
26 views

Secure authentication method for creating an Excel data connection to SQL Server

My company has a website with data stored in Microsoft SQL Server on the production server. The production server is not in Active Directory. The firewall allows connections to the production SQL ...
DougM's user avatar
  • 1
11 votes
3 answers
3k views

What's wrong with the use of a WAF?

My SaaS company recently lost the bid for an enterprise software licensing deal. One of the reasons the prospect gave for not choosing us as a vendor was: the use of a WAF I'm not an information ...
Anon's user avatar
  • 111
1 vote
0 answers
11 views

Set a default GPG key id for email

If I have imported several keys (with different key ids that I can see when I gpg --list-keys) that all have the same email address, how do I set which one to encrypt to? and ditto encrypt from/with, ...
Sandra's user avatar
  • 111
0 votes
0 answers
18 views

verification of network security [closed]

is there any canonical way to verify that our web connection is actually secure ? e.g. "a smoke test" to check for leaks? I've noticed e.g. applications that can seem to check if the ...
R S's user avatar
  • 101
0 votes
0 answers
8 views

Local Machine certificate (certlm.msc) - choosing "Microsoft Software Key Storage Provider" on import [migrated]

When importing a device certificate/private key through CERTLM, the GUI seems to choose a deprecated Cryptography Service Provider (CSP) called "Microsoft Strong Cryptographic Provider"; I'm ...
tb1's user avatar
  • 101
0 votes
0 answers
21 views

How can we verify the security of a device? [duplicate]

I've recently been experiencing a situation as follows: How can I understand the IO of an unknown device? Say, for example, I am gifted a bluetooth speaker. How can I understand its potential for ...
R S's user avatar
  • 101
-1 votes
0 answers
38 views

WhatsApp Hack help [closed]

My friend was hacked and I've done all I know to do. I uninstalled WhatsApp from her phone, and reset the phone to factory settings. I cannot re-download WhatsApp. When her partner sees her account ...
Robin's user avatar
  • 1
0 votes
0 answers
15 views

Can Num2bits be used to guard against underflows?

In circom, Num2bits() from circomlib is primarily intended for converting an Integer into an array of bits. But because of it’s optional parameter, it can be used to prevent overflows such as : inp = ...
user2284570's user avatar
  • 1,462
1 vote
0 answers
27 views

Is the ability to inject arbitrary CSS styles in an img tag a security vulnerability?

I've discovered a behavior in a popular service's markdown parser that allows the 'style' attribute to be used within 'img' tags through some crafted markdown code. This allows for the application of ...
LunaXenon's user avatar
0 votes
0 answers
73 views

I have received an email with pictures from the gallery on my phone [closed]

I've two email addresses: [email protected] and [email protected]. Today, "red" received an email from "pink". I didn't send this email. The email contained four pictures that were ...
100xln2's user avatar
  • 101
2 votes
0 answers
77 views

Windows AD - Fake User Account with Multiple Passwords to Detect Password Spray

TL;DR I'm trying to implement a fake user account that has multiple sets of credentials that can be used. Instead of a specific password, any one password from a list of them could be used to ...
CyberKnight's user avatar
1 vote
0 answers
22 views

Did Android remove Fingerprint/Passcode for WebAuthN and lower security to push Passkeys?

So, before this year, when you were using WebAuthN to create security keys on an up to date Android phone (Pixel 6 in my case), you had these options (iirc): When creating a platform authenticator, ...
xsrf's user avatar
  • 158
0 votes
0 answers
40 views

Codeigniter website is hacked regularly by an unknown method [closed]

I have developed a website with codeigniter 3 and I have also updated it to the latest version of codeigniter. My website has been hacked in the same way for several days. The hacker puts two files in ...
sam nikzad's user avatar
2 votes
1 answer
217 views

Should newly password links reset old ones? if so, why?

I have noticed on most websites that all previous password reset links are automatically expired when a new one is requested. Why is this so common and what are some possible consequences if this isn'...
user17886134's user avatar
1 vote
1 answer
34 views

How serious are npm module vulnerabilities?

Obviously any known vulnerabilities are not great, but I'm curious how much I should be concerned about them. I've seen plenty of articles that talk about the rise in malware/spam in npm packages: ...
fyrekcaz's user avatar
0 votes
1 answer
39 views

Difference between "circumstance" and "event" in the definitions of threat

On the Wikipedia page of threat (in textbooks too) various definitions are given where almost all agree in defining a threat as a "circumstance or event". I'm having trouble understanding ...
gomd's user avatar
  • 117
0 votes
1 answer
32 views

Do I need an IP whitelist on top of a VPN?

My company requires me to access resources through a VPN connection -- specifically, an OpenVPN client configured to require a password plus an authenticator token. But the company also restricts ...
Sasgorilla's user avatar
0 votes
0 answers
41 views

How can I understand the zip2john hash format?

I had a .zip file that was apparently encrypted with AES-256 deflate. 7z l -slt archive.zip | grep Method Method = AES-256 Deflate Then I used zip2john to get a "hash" out of it: archive....
IRP_HANDLER's user avatar
0 votes
0 answers
22 views

Inheriting Old Website Maintenance: Demonstrating Code Vulnerabilities [closed]

I've just inherited the maintenance of an old website. The code is awful and I'd like to demonstrate to my superiors that the code is bad and vulnerable. <?php if (!empty($_GET['page'])){ ...
arno's user avatar
  • 101
1 vote
0 answers
28 views

Why does Amazon make you enter specified digits upon calling their customer service switchboard?

If one calls the Amazon customer services number, a robotic voice asks one to enter three numbers. Along the lines of “to be connected to a customer service associate, please press [XYZ]” (where [xyz] ...
Seeking answers's user avatar
0 votes
0 answers
24 views

Default nmap script execution when specifying --script banner

I have a subscription for a NSE scripts feed for nmap. There are some of those scripts which have the default category (among others) I am running nmap in the following way nmap --privileged -oX - -T3 ...
alvaroalo's user avatar
0 votes
0 answers
20 views

How kerberos hashes its keys? [closed]

My manager said that kerberos passwords are hashed using aes256-cts-hmac-sha1-96 & aes128-cts-hmac-sha1-96 algorithms. I that these are hot hashing algorithms but encryption algorithms. My manager ...
sluge's user avatar
  • 1,085
0 votes
1 answer
48 views

Modern VPNs and average MITM attacks

I am trying to untangle a number of concepts (all of which i am unfamiliar with) in this question, but they all point to a seemingly basic question; With modern tunneling protocols, SSL ciphers and ...
myol's user avatar
  • 133
0 votes
0 answers
17 views

Does other frontend framework have similar issue like AngularJS?

I'm reading an article that talks about XSS exploitation on AngularJS, AngularJS will render the template in ng-html, and it bypasses sanitize-html. My questions, I'm wondering if other frameworks ...
daisy's user avatar
  • 2,057
0 votes
1 answer
24 views

Necessity of CSRF Protection with ID Token Authentication in Firebase

I recently came across a statement in the Firebase documentation that suggests "CSRF protection should be taken into account." This guidance appears in the context of using an ID token for ...
Nobuhito Kurose's user avatar
-1 votes
1 answer
60 views

Is encoding random with module insecure? [closed]

The ID library Nano ID claims that modulo based encoding (e.g. Base64) would lead to uneven distribution in the output: Uniformity. random % alphabet is a popular mistake to make when coding an ID ...
deamon's user avatar
  • 99
3 votes
2 answers
61 views

Benefit of permissive Content-Security-Policy

I am new to the concept of Content-Security-Policy (CSP) so please forgive my ignorance. The site https://securityheaders.com parses headers and provides a score. For example unibet.com is awarded a ...
Andreas F's user avatar
  • 131
2 votes
1 answer
74 views

API key embedded in clients: how to defend against over-usage?

I am new to client-side development and I have a naive question. Right now, I'm using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include ...
Rififi's user avatar
  • 157
0 votes
0 answers
63 views

Use a virtual machine to do risky stuff. How to stay as safe as possible? [duplicate]

I have a PC with Ubuntu and Windows in dual boot. I use this PC for basic stuff: Windows for gaming, shopping and common browsing, Ubuntu to do something such as home banking. I was thinking to create ...
koxige9113's user avatar
0 votes
0 answers
17 views

Is POST-based XSSI possible?

With standard XSSI, an attacker can include a remote script which contains user-bound secrets across origins, and then read them out. I have an endpoint which returns sensitive Javascript code, but ...
tim's user avatar
  • 29.5k
0 votes
0 answers
37 views

How to remove someone from our wifi network? [closed]

One of my mother's students, I don't know how, but he found out our home wifi password without our consent. He said he could scan it from our router. We didn't believe him at that time, but today he ...
Fading Sketches7's user avatar
0 votes
0 answers
42 views

MITM with forwarding between 2 hosts in the same network

I have 3 hosts in the same network, let's say their IP addresses end with: .10 (Host A) .11 (Host B) .12 (Host C) I want to sniff packets between A and C through host B, so that host B acts as MITM. ...
SempriGno's user avatar
2 votes
1 answer
60 views

How to feasibly digital sign high volume documents with CA issued digital certificate?

My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request ...
BambiBundle's user avatar
0 votes
0 answers
10 views

How Does a Database that Supports TDE Work In Practice? [migrated]

I'm very curious on how does TDE is implemented in practice. My goal is to get understanding on the usability constraint and possibility performance impact of applying such technique. Thus I'm trying ...
Mycotina's user avatar
  • 101
0 votes
1 answer
104 views

My personal info was leaked on the dark web through my Gmail Account; is it still safe to continue using said Gmail Account?

I have been using my personal Gmail Account for years to create accounts on a wide range of websites like evite.com and Instagram. Google conducted a dark web scan and created a report of instances ...
lcd12375's user avatar
0 votes
0 answers
52 views

How does admin identify routers connected to a network?

In my campus, we are provided with a LAN port to each room to access the internet. Also, they didn't allow students to use routers in their respective room. The only way one can access the internet is ...
Corrupter's user avatar
1 vote
1 answer
76 views

Does not storing passwords in browser really matter given cookie hijacking exists?

I see lots of articles suggesting not storing passwords in the browser, and it made perfect sense to me, if I can access this data easily, an attacker probably can too. But then I found out about ...
Arthur Moraes Do Lago's user avatar
0 votes
0 answers
78 views

Is linux really that insecure? [closed]

Recently, I came across this article where the author complains about the slow response to exploit protections in the Linux kernel and also highlights that CVE is a poor way to address vulnerabilities....
Mark Kern's user avatar
0 votes
1 answer
33 views

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?

Is it necessary to implement both Content-Security-Policy and X-Content-Type-Options for ensuring the security of a website?
Vikas's user avatar
  • 9

15 30 50 per page
1
2 3 4 5
1366