144 votes
Accepted

Does it improve security to use obscure port numbers?

Does it improve security to use obscure port numbers? If you're already using high entropy passwords or public key authentication, the answer is "not really". Mostly you're just getting rid of noise ...
Steve Sether's user avatar
  • 21.6k
60 votes

Does it improve security to use obscure port numbers?

Yes, it does. The real question is: By how much? Why it does? You already have basic security, so the everyday bot attacks don't worry you. But there could be a 0-day tomorrow and the attackers know ...
Tom's user avatar
  • 10.4k
44 votes
Accepted

Which protocols exist for end-to-end encrypted group chat?

Let me try to sum up what the landscape of end-to-end encrypted messaging protocols for group chat looks like: Protocols like PGP have been around for some time and offer "group messaging" by simply ...
FredericJacobs's user avatar
36 votes

Can proprietary protocols be considered as secured?

Secure communication protocols The one question that gets overlooked too often in the infosec industry is "secure against what?" The phrase "I want to be secure!" is like saying &...
schroeder's user avatar
  • 129k
31 votes

Does it improve security to use obscure port numbers?

No, it will not improve security. It may reduce log clutter, as automated attacks will only try default ports for e.g. ssh. But the port will still show up as SSH in a port scan, and shodan.io. Those ...
vidarlo's user avatar
  • 16.1k
24 votes
Accepted

Why did TLS 1.3 drop AES-CBC?

The problem here is not so much with CBC, but with alternatives that are easier to implement safely, without losing mathematical security.In fact, AES-CBC turned out to be notoriously difficult to ...
J.A.K.'s user avatar
  • 4,833
22 votes

Can my ISP see which VPN protocol I am using?

Yes, probably. Most VPN protocols are not designed to hide the fact that they're VPN protocols, nor what kind of protocol they are. See for instance this paper which details fingerprinting OpenVPN. If ...
vidarlo's user avatar
  • 16.1k
20 votes

Is it already the right time to say goodbye to TLS1.1 support on web servers?

Let's put the question the other way: What do you gain by disabling TLS 1.1? Security You and your quote seem to be implying that you want to move to TLS 1.2 because it's more secure than TLS 1.1. ...
Mike Ounsworth's user avatar
19 votes
Accepted

What are non-standard ports and protocols

A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry. Running a service on a non-standard port doesn't really mean ...
Polynomial's user avatar
  • 135k
18 votes

IKEv2 vs OpenVPN

OpenVPN vs IPSEC: IPSEC needs more time to negotiate the tunnel; OpenVPN uses strong ciphers and TLS ; (at the present moment it is considered to be the strongest encryption); Single and ...
ETech's user avatar
  • 356
15 votes
Accepted

Is it already the right time to say goodbye to TLS1.1 support on web servers?

The only reason to delay in saying goodbye is because of the potential impacts. In fact, the only reason to use any particular technology is that it does something for you and the cost/benefits are ...
schroeder's user avatar
  • 129k
14 votes

Why did TLS 1.3 drop AES-CBC?

CBC is a good mode for encryption if implemented correctly. In one short sentence, I've pointed out two defects of CBC. CBC is an encryption mode only: it provides confidentiality, but not ...
Gilles 'SO- stop being evil''s user avatar
10 votes

IKEv2 vs OpenVPN

IPSec / IKEv2 are so customizable I have a hard time believing that OpenVPN can support any cipher suite that for example StrongSwan can't, I think the supported suit list is big enough x'D. I guess ...
HenriqueMS's user avatar
10 votes

Should I disable TLS 1.0 and TLS 1.1 support on my web servers

To answer your first question: If you have clients that do not support TLS 1.2, and these clients connect to your server using TLS 1.0 or TLS 1.1, and you disable TLS 1.0 and TLS 1.1 on your server, ...
mti2935's user avatar
  • 23.4k
9 votes
Accepted

Why does TLS 1.3 deprecate custom DHE groups?

With TLS 1.2 the server first needed to tell the client within the ServerKeyExchange message about the parameters of the DHE group it supports. Only then the client could act on these. With TLS 1.3 ...
Steffen Ullrich's user avatar
8 votes
Accepted

Why is the DANE protocol depending on DNSSEC?

The idea of the DNS-based Authentication of Named Entities (DANE) protocol is that domain owners publish the fingerprint of a certificate that their server uses in a DNS resource record. It is a ...
Arminius's user avatar
  • 44.7k
7 votes
Accepted

Difference between Bluetooth LE Secure Connections security mode 1 and level 3 and 4?

Intro In relation to another question LE has two main occurrences: Secure Simple Pairing (4.0) Secure Connections (4.2) Both occurrences specify the algorithms that can/must be used in the ...
Michael's user avatar
  • 5,483
7 votes
Accepted

Minimum set of TLS features for an embedded device

It's unclear whether you're only looking at the TLS client, or whether you're reviewing both client and server implementation. I'll assume both. I recently completed a security review of WolfSSL (...
Mike Ounsworth's user avatar
7 votes

Can proprietary protocols be considered as secured?

"The issue is some of the systems have been telling me that they can fulfil this requirement by using proprietary protocols. I personally do not agree with this statement as it is very debatable. ...
Nullius in Verba's user avatar
6 votes

Is there a standard for printing a public key as a barcode?

I'm not aware of any standard, but it's quite common to create QR codes with the OPENPGP4FPR scheme containing the OpenPGP fingerprint of your key (and not the whole pubkey itself which can be simply ...
Flow's user avatar
  • 344
6 votes
Accepted

How does ndpi actually detect the HTTP protocol?

What is the high level view of categorizing the packet as HTTP (or any "x" protocol)? Standard port numbers are as close as you get to an an official classification of application-layer ...
Arminius's user avatar
  • 44.7k
6 votes

Does it improve security to use obscure port numbers?

Changing default port can save you from port scan and script kiddies but you may not be able to withstand against targeted attack where the attacker could identify the running services irrelevant to ...
Sayan's user avatar
  • 2,031
6 votes

Can proprietary protocols be considered as secured?

This is close to an opinion debate. What matters here is trust. A public protocol that has been scrutinized by experts in a specific implementation is generally seen as secure. And most security ...
Serge Ballesta's user avatar
5 votes

What is ECDHE-RSA?

What is the difference between ECDHE-RSA and DHE-RSA? Lets start with the similarities. Both ciphersuites use ephemeral keys for the Diffie-Hellman process. (that is the "E" in the name). This ...
Peter Green's user avatar
  • 5,300
5 votes
Accepted

Can data coming into my UDP server be sniffed?

It would be easy to sniff data using tools like WireShark from someone who can access the data path between your client and the server. This isn't something anyone on the Internet could do per se but ...
Trey Blalock's user avatar
  • 14.2k
5 votes
Accepted

SSL protocol analysis

I sneakily edit a sneaky MITM attacker into your image: The problem with this protocol is that Bob does not authenticate with Alice. That means a man-in-the-middle attacker who can manipulate the ...
Philipp's user avatar
  • 49.4k
5 votes

Bidirectional encrypted communication between two systems

all traffic is encrypted using RSA 4096 key pair So you don't like performance? HMAC Wait, HMAC — that requires a shared key. If you have a shared authentication key, why are you using RSA at all?...
Gilles 'SO- stop being evil''s user avatar
5 votes

Is it possible to have a protocol that sits on top of TCP/IP that encrypts packets?

What you're asking already exists, and you're already using it. SSL/TLS can be used as a wrapper around TCP/IP. As you've pointed out, it won't hide who you're communicating with or when. But it ...
S.L. Barth is on codidact.com's user avatar
5 votes
Accepted

What to do if you still have SMBv1 running on your network?

The real fix First of all, I would strongly recommend to only focus on convincing the decision makers that it is very irresponsible to continue the use of Windows Server 2003 in production ...
Bob Ortiz's user avatar
  • 6,665
5 votes

Why is caller ID spoofing so simple, and catching offenders so hard?

The simple answer is that this is not considered a vulnerability - the protocol stack is not designed to authenticate the caller. From @schroeder's Wikipedia link on Caller ID: Additionally, ...
Rory Alsop's user avatar
  • 61.5k

Only top scored, non community-wiki answers of a minimum length are eligible