144
votes
Accepted
Does it improve security to use obscure port numbers?
Does it improve security to use obscure port numbers?
If you're already using high entropy passwords or public key authentication, the answer is "not really". Mostly you're just getting rid of noise ...
- 21.5k
79
votes
Why can protocols on higher layers be left unchanged?
You should think of OSI layers as packaging.
Let's say I want to ship a glass to you. I chose an original package for advertisement purposes, showing how nice is my product and what you can buy to ...
- 13k
74
votes
Accepted
Ensure that a file can only be decrypted after a specific date
Time is relative. Cryptography lives in the ethereal world of abstract computing machines: there are machines that can do operations. Bigger machines can do operations faster. There is no clock that ...
- 168k
59
votes
Does it improve security to use obscure port numbers?
Yes, it does. The real question is: By how much?
Why it does? You already have basic security, so the everyday bot attacks don't worry you. But there could be a 0-day tomorrow and the attackers know ...
- 10k
57
votes
Ensure that a file can only be decrypted after a specific date
If you do not want to involve a third party, you (the party encrypting the file) could simply release the key to decrypt the file on the target date.
I have seen this done for video game releases. ...
- 671
49
votes
Accepted
Is Git crowdsourcing cryptographic attacks?
Is Git crowdsourcing the production of SHA-1 preimages? Not to any meaningful degree.
Github doesn't say how many commits it's tracking, but it's probably not more than a few billion. For ...
- 34.4k
49
votes
Ensure that a file can only be decrypted after a specific date
Carefully place a spaceship broadcasting the decryption key in orbit around a black hole. The pull of gravity will delay the message until the appropriate time.
Or you could just do like normal ...
- 1,560
41
votes
Accepted
Which protocols exist for end-to-end encrypted group chat?
Let me try to sum up what the landscape of end-to-end encrypted messaging protocols for group chat looks like:
Protocols like PGP have been around for some time and offer "group messaging" by simply ...
- 626
36
votes
Can proprietary protocols be considered as secured?
Secure communication protocols
The one question that gets overlooked too often in the infosec industry is "secure against what?" The phrase "I want to be secure!" is like saying &...
- 123k
31
votes
Does it improve security to use obscure port numbers?
No, it will not improve security. It may reduce log clutter, as automated attacks will only try default ports for e.g. ssh. But the port will still show up as SSH in a port scan, and shodan.io.
Those ...
- 12.5k
24
votes
Accepted
Why did TLS 1.3 drop AES-CBC?
The problem here is not so much with CBC, but with alternatives that are easier to implement safely, without losing mathematical security.In fact, AES-CBC turned out to be notoriously difficult to ...
- 4,783
22
votes
Can my ISP see which VPN protocol I am using?
Yes, probably. Most VPN protocols are not designed to hide the fact that they're VPN protocols, nor what kind of protocol they are. See for instance this paper which details fingerprinting OpenVPN.
If ...
- 12.5k
21
votes
Accepted
Why would HTTP client only send authentication headers once an unauthenticated request was rejected?
This behaviour is specified by RFC2617. The reason for the extra round trip is that the server can request different kinds of authentication: basic, digest, etc. If you know in advance that the server ...
- 32.6k
20
votes
Is it already the right time to say goodbye to TLS1.1 support on web servers?
Let's put the question the other way: What do you gain by disabling TLS 1.1?
Security
You and your quote seem to be implying that you want to move to TLS 1.2 because it's more secure than TLS 1.1. ...
- 57.4k
18
votes
IKEv2 vs OpenVPN
OpenVPN vs IPSEC:
IPSEC needs more time to negotiate the tunnel;
OpenVPN uses strong ciphers and TLS ;
(at the present moment it is considered to be the strongest encryption);
Single and ...
- 356
18
votes
Accepted
What are non-standard ports and protocols
A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry.
Running a service on a non-standard port doesn't really mean ...
- 132k
17
votes
Ensure that a file can only be decrypted after a specific date
Use secret sharing to split a private encryption key into N parts, parameterized to allow reconstruction of the key with K or more parts, where K <= N. Best done using CRM, as described on the ...
- 1,098
17
votes
What are locked domain names technically?
Locked domains are domains which require additional hoops be leapt through in order to change ownership. The lock is requested by the owner of the domain and implemented by the registrar of the ...
- 71.7k
16
votes
Accepted
Secure communication between two applications on the same system
These are the golden rule of computer security: "It is impossible to hide anything from a competent user with system administrator privilege" and "any competent user with physical access to the device ...
- 31k
15
votes
Accepted
Is it already the right time to say goodbye to TLS1.1 support on web servers?
The only reason to delay in saying goodbye is because of the potential impacts. In fact, the only reason to use any particular technology is that it does something for you and the cost/benefits are ...
- 123k
14
votes
Why did TLS 1.3 drop AES-CBC?
CBC is a good mode for encryption if implemented correctly. In one short sentence, I've pointed out two defects of CBC.
CBC is an encryption mode only: it provides confidentiality, but not ...
13
votes
In a browser web server communication, who decides which encryption protocol to use
To complement the answer from @raz, one must be aware of Protocol Downgrade Attacks. Browsers like IE send their maximum supported version, and then the server chooses (in your case, IE says "I know ...
- 168k
13
votes
Why can protocols on higher layers be left unchanged?
While OSI is just a model, and in reality the layers can be blurred or nonexistent, the concept of layering protocols is specifically to allow a change in a particular layer to leave the layers above ...
- 61.4k
12
votes
Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?
There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes ...
- 168k
12
votes
Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?
SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed.
There is a RFC which says just that, and lists the main known ...
- 168k
12
votes
Is Git crowdsourcing cryptographic attacks?
You could probably compute your own SHA1 hashes quicker from small arbitrary texts than that you harvest the hashes that someone else computed. But there's a lot of possible SHA1 digests, about as ...
- 166
11
votes
What's the need of multiple implementations of SSL/TLS?
Competition is a good thing, and so is redundancy/diversity.
While Heartbleed affected a lot of systems and services due to how widespread OpenSSL is, it certainly didn't effect 100% of systems. ...
- 8,434
11
votes
Accepted
In a browser web server communication, who decides which encryption protocol to use
The server chooses which cipher suite to use for establishing the secure channel.
The client (browser) poses the protocols and encryption algorithms that it will accept. The server chooses the one ...
- 12.3k
11
votes
Accepted
Is SSL more secure than encoding?
What you have defined is not security.
SSL can give you security.
So...your question is easy to answer:
Yes - SSL is up to 100% more secure than encoding. While elements of your 2nd paragraph have ...
- 61.4k
11
votes
Accepted
difference between public key and host key and security of host key
The host has a key pair, consisting of a public key and a private key. (It can have multiple key pairs in different formats; at the beginning of a connection, the client and the server negociate to ...
Only top scored, non community-wiki answers of a minimum length are eligible