All Questions

Filter by
Sorted by
Tagged with
1
vote
0answers
7 views

Security requirements for small tax software business

I have a client who does payroll and taxes and is looking for a web app to easily communicate and transfer tax related documents for clients. I would assume that the IRS or someone would have some ...
1
vote
1answer
10 views

(How) can loosing 2FA render encrypted data inaccessible?

As per Bitwarden's FAQ If you don’t have your Recovery Code saved somewhere outside of your Vault, there is unfortunately no way for the team to recover the account or data therein. You’ll need to ...
0
votes
0answers
10 views

Compute a signature with private key in Server Key Exchange

On https://tls.ulfheim.net/ there is an example showing how to compute a signature in the section of " Server Key Exchange ". https://i.ibb.co/Y7fbkDw/1.jpg (This image shows the Server Key ...
0
votes
0answers
10 views

Comparing strength of passwords [closed]

Question: Assuming that passwords are made up using only upper case characters (A-Z), compare the strength of a password made from two words randomly drawn from an 8192 word dictionary versus a ...
-1
votes
0answers
11 views

Differentiating between multiple grabify IP addresses [closed]

When I used grabify I got numerous IP addresses. What does this mean and which IP address is the right address?
0
votes
1answer
12 views

Is there a security benefit to giving an SSH key a passphrase when using certificates?

https://goteleport.com/blog/how-to-ssh-properly/ I'm following this guide on setting up SSH certificates, and it says to NOT put a passphrase on keys, or that it's "my choice" whether to do ...
0
votes
1answer
41 views

Do websites send full URL over HTTP instead of HTTPS if there's an HTTPS connection?

I was learning to use wireshark when I noticed that opening a reddit url (reddit.com/r/privacy) sent a GET request for r/privacy over HTTP. Is this visible to the ISP or network sniffers? I was under ...
0
votes
0answers
34 views

Encrypting file = Overwriting file?

When thinking of encrypting a file (also how I implemented it in a program of mine), I think of getting the data of a file, encrypting it, and writing it back into the file (overwriting the file). But ...
0
votes
1answer
30 views

How can I prevent a C&C server from accessing my device?

Let's say I visited a malicious website and it downloaded malware that registered my phone to a C&C server And after realizing what happened I uninstalled the malware from my device Will my phone ...
0
votes
0answers
52 views

Can a file on your computer be the "something you have"?

I've read a lot of advice against storing your 2FA codes in your password manager and I don't understand why. Isn't a file on your computer something you have? There is the added benefit that you don'...
0
votes
0answers
14 views

How to utilise sqlmap's blind enumeration when you already know the SQL injection query

I am looking for some help on how to get the best out of sqlmap. I am practising on a web application that runs the following query when the login form is submitted: SELECT * FROM Users WHERE username ...
-2
votes
0answers
30 views

Does laptop camera records us always [closed]

Stop recoding keep us privacy for our laptop cameras stop hacking cameras
-1
votes
2answers
41 views

I accidentally clicked on ransomware link. Antivirus cleaned the files successfully

I am researching information regarding locker ransomware. I did a search for "Locker ransomware github". I clicked on the link in GitHub and found the link to view code and clicked that link ...
0
votes
1answer
45 views

How many bits of entropy should a password have to be reasonably future proof (10+ years)?

I’ve seen estimations that the NSA is capable of at least 1 trillion (PGP pass phrase) guesses per second, which would mean a password with 80 bits of entropy would take, on average, over 15,000 years ...
0
votes
1answer
19 views

Avoid re-encrypting persisted cipher texts when using certificates

An application uses RSA to encrypt small texts before persisting in database, using public key of the end node of the application. Only these end nodes must be able to decrypt thge ciphers and only ...
0
votes
0answers
29 views

Can open-source projects do anything about a single developer being the weakest link in their security?

Example from Wikipedia: In November 2012, The FreeBSD Security Team announced that hackers gained unauthorized access on two of the project's servers. These servers were turned off immediately. More ...
0
votes
0answers
18 views

'Metasploited' Problems [closed]

I installed Metasploit on my Windows machine a while ago. And on the first use, it worked. Trying to use it the next time shows errors saying ruby is not recognised as an internal or external command. ...
0
votes
0answers
19 views

Properly encrypt data fields in MariaDB [closed]

It's the first time I'm using encryption in MariaDB, so I need to assure that I'm getting it right. I need to simply store some identifiers in an encrypted way, and am wondering if I'm doing it ...
0
votes
0answers
16 views

What does a probe packet look like and how does it interact with a server to determine services [closed]

I have recently begun studying NMap. It offers a variety of options, each having clear advantages and disadvantages as to what information is disclosed and chance of being detected by possible layers ...
-1
votes
0answers
38 views

Employee ID instead of employee names for corporate login?

Our Active Directory logins are currently e.g. john.smith@mycompany.com (i.e. the same as our email addresses). A friend said his company uses numbers for login (e.g. 90210@mycompany.com) for security ...
0
votes
0answers
25 views

How does the searchfor.cc malware work? [closed]

I'm a professional web developer, but not a security professional. Tonight, I was selling an item on Facebook Marketplace, and I received a message saying, Hey is this the same item as [link] I did ...
0
votes
1answer
30 views

How are validation links getting triggered by a third party?

Question: It appears that somebody can intercept and read emails that I send from my server, although I have set up 2-Factor authentification for sudo-access I log all logins on my server (Did not ...
0
votes
0answers
39 views

Need help attacking my ethernet network [closed]

I'm forming a start up and want to make sure my COMPUSEC/COMSEC is airtight. We work with a lot of sensitive customer information (think SSNs, bank accounts, etc.), NDAs, and government contracts. At ...
2
votes
1answer
126 views

Reasons not to use TLS 1.3?

I was learning about TLS 1.3 recently, and I was wondering if there are any reasons not to use it. (Rather stay at TLS 1.2). Are there are any factors that refrain users or products from making the ...
0
votes
0answers
10 views

Python: Read RSA private key from file on disk and use it to create an AES Cipher [migrated]

I need to decrypt (using Python libs) a base64 encoded string that was encrypted using AES256/CBC/PKCS7: MIAGCSqGSIb3DQEHA6CAMIACAQIxggEwMIIBLAIBAoAUWwUA8cj6Bdcph9HPtFRinZS+...
1
vote
1answer
26 views

Is there any security reason to not allow adding authenticators for a certain account?

I have recently added 2FA for my Google account using an authenticator installed on my mobile phone. After doing this, I have realized that it would be nice to also have the authenticator installed in ...
0
votes
0answers
43 views

Is it possible to convert an IP packet into a grayscale image through the help of deep packet inspection? [closed]

I am working on building a malware classifier that works by using gray-scale images of the dissasembly files. This method has been outlined in multiple research papers, here is one: https://ieeexplore....
-1
votes
0answers
24 views

What's the current status of OTP over SMS? [closed]

Back in 2016, reputed sources reported NIST's plan to stop recommending SMS as a channel to deliver one time passwords out of band. Fewer (and to my eyes rather unexpected) sources reported the ...
0
votes
0answers
20 views

Error-based SQL injection to get next row [closed]

Next step to below command to get the second row data, ID = ColumnName and employee_details = TableName ‘ and 1=convert(int,(select top 1 ID from employee_details))-- -
1
vote
1answer
41 views

Git Signing commits in a private repo

Linus mentioned in 2009 that "Signing each commit is totally stupid". Has the common view evolved on this subject since then ? Doesn't it protect against someone usurping your identity to ...
0
votes
1answer
32 views

Benefit of asymmetric encryption vs trivial alternatives in compromised software?

Background information: I have a client application that communicates with a server through a web API. The data being communicated is not personally sensitive (no passwords, credit card details, ...
0
votes
2answers
55 views

In a network do we need both TLS and Firewall?

I need to set up a small network as shown below. Is it really required that the "switch should also host a firewall" when all the communication between the "computers" is over TLS?
0
votes
0answers
18 views

Which tests can I perform with OSSEC?

I would like to perform a few basic tests on a few of OSSEC's capabilities and be able to document them. I have no experience with HIDS and I am not really sure where I could start or which tests with ...
2
votes
2answers
67 views

Is it ok to skip validation of TLS validation if the request's host is targeting localhost?

I'm writing a canary for monitoring which will be deployed to the same host as the monitored application. The underlying application validates certificates for incoming requests and validates that the ...
29
votes
3answers
4k views

Is a USB security key trackable among websites?

If I have a security key (U2F key) like yubikey and use it on websites A and B and the owner of these two websites is the same, can the website owner know that I am the same user?
0
votes
0answers
48 views

How does this site know what I do online? [closed]

There was a website I discovered a while back called "spur.us". The site collects information on IP addresses. Some of the information they collect is somewhat easy to find: If the IP is ...
0
votes
0answers
6 views

A added after Bearer while sending token in Internet explorer [migrated]

I am sending Bearer token in IE in React js.But A is appended with Bearer in IE. This issue is there only in IE Example : Authorization : BearerA ewtewyetwytewyt; A should not be added after Bearer ...
0
votes
0answers
21 views

Is braintree clientToken supposed to be public?

I'm building an app that uses Braintree for processing payments. According to the documentation, I need a server-side endpoint that returns the clientToken, which is then used to manage a user's vault ...
2
votes
1answer
44 views

Likelihoods for risk assessment

I have been looking at risk assessments lately and I am looking for a way to practically estimate likelihood. Most people recommend assessing based on historical precedent which sounds great to me, ...
1
vote
1answer
63 views

Does using IP address over Tor with a one essential website expose me to any attack surface?

I routinely access www.email-provider-of-my-choice.com via browser over Tor. My browser enforces https-only mode and I opt for never saving my credentials with this provider. I tend to use the domain ...
0
votes
1answer
41 views

Cracking hashes of trivially modified passwords

If I started with “password”, then change it to “password2”, “password3” etc, is that easier to crack the hashes of the set of passwords than if I used only the original password? Does having the ...
0
votes
0answers
13 views

Tools for "scanning" container (hardening) vulnerabilities vs tools for "performing" the hardening [closed]

CIS has published a list of container vulnerabilities that should be addressed to complete the hardening process. Are there separate sets of tools that only point out the vulnerabilities and then ...
0
votes
0answers
11 views

I think there's an implementation bug in my eID (eIDAS) when preparing to change the PIN; is it?

I had to renew my eID card. Possessing an EAL-4+ certified card reader (cyberJack RFID komfort by REINER SCT) I tried to activate the ID function by replacing the transport PIN with a personal PIN. ...
0
votes
0answers
37 views

About password ciphertext [duplicate]

I need to decrypt a password. I have the ciphertext for this however, I have many plain text and encrypted equivalents. This device can only be given passwords with a maximum of 8 characters from the ...
1
vote
1answer
42 views

Is it safe to view video files on Google Drive online?

I have a video file on my Drive which is very old but I am not sure whether it's infected or not. Is it safe to view this MP4 on Google Drive (no downloading only viewing it in the Drive app)?
0
votes
1answer
30 views

How to secure this simple radio communication against replay attacks

In my current project i have few ESP32's connected to server over TCP. These ESP's are distributed across a range of 300 meters. Once per hour server requests (randomly) selected ESP's to beacon a ...
0
votes
0answers
24 views

Data-only attack using buffer overflow

For school I need to use the buffer overflow in the program below to get the shell to launch. For this exercise we need to perform a data-only attack, i.e. the stack is non-executable and stack ...
0
votes
1answer
36 views

Will secure boot prevent any non signed firmware from running?

Wonder if secure boot can protect my computer from usb drives with infected firmware after Debian os is booted ?
0
votes
0answers
23 views

How easy is it to hack a laptop using android phone assuming it's firmware is infected?

Wonder about if it is possible for an android device with infected firmware and fully controlled by hacker to compromise my computer remotely (assuming hacker has already locally flashed a different ...
0
votes
1answer
21 views

Windows Defender Exclusions

If a virus added itself to windows defender exclusions, it will never be scanned. However would windows defender still remove its startup registry keys and scheduled tasks? Windows defender is the ...

15 30 50 per page
1
2 3 4 5
1282