144 votes
Accepted

Does it improve security to use obscure port numbers?

Does it improve security to use obscure port numbers? If you're already using high entropy passwords or public key authentication, the answer is "not really". Mostly you're just getting rid of noise ...
user avatar
  • 21.5k
79 votes

Why can protocols on higher layers be left unchanged?

You should think of OSI layers as packaging. Let's say I want to ship a glass to you. I chose an original package for advertisement purposes, showing how nice is my product and what you can buy to ...
user avatar
  • 13k
74 votes
Accepted

Ensure that a file can only be decrypted after a specific date

Time is relative. Cryptography lives in the ethereal world of abstract computing machines: there are machines that can do operations. Bigger machines can do operations faster. There is no clock that ...
user avatar
  • 168k
59 votes

Does it improve security to use obscure port numbers?

Yes, it does. The real question is: By how much? Why it does? You already have basic security, so the everyday bot attacks don't worry you. But there could be a 0-day tomorrow and the attackers know ...
user avatar
  • 10k
57 votes

Ensure that a file can only be decrypted after a specific date

If you do not want to involve a third party, you (the party encrypting the file) could simply release the key to decrypt the file on the target date. I have seen this done for video game releases. ...
user avatar
49 votes
Accepted

Is Git crowdsourcing cryptographic attacks?

Is Git crowdsourcing the production of SHA-1 preimages? Not to any meaningful degree. Github doesn't say how many commits it's tracking, but it's probably not more than a few billion. For ...
user avatar
  • 34.4k
49 votes

Ensure that a file can only be decrypted after a specific date

Carefully place a spaceship broadcasting the decryption key in orbit around a black hole. The pull of gravity will delay the message until the appropriate time. Or you could just do like normal ...
user avatar
  • 1,560
41 votes
Accepted

Which protocols exist for end-to-end encrypted group chat?

Let me try to sum up what the landscape of end-to-end encrypted messaging protocols for group chat looks like: Protocols like PGP have been around for some time and offer "group messaging" by simply ...
user avatar
36 votes

Can proprietary protocols be considered as secured?

Secure communication protocols The one question that gets overlooked too often in the infosec industry is "secure against what?" The phrase "I want to be secure!" is like saying &...
user avatar
  • 123k
31 votes

Does it improve security to use obscure port numbers?

No, it will not improve security. It may reduce log clutter, as automated attacks will only try default ports for e.g. ssh. But the port will still show up as SSH in a port scan, and shodan.io. Those ...
user avatar
  • 12.5k
24 votes
Accepted

Why did TLS 1.3 drop AES-CBC?

The problem here is not so much with CBC, but with alternatives that are easier to implement safely, without losing mathematical security.In fact, AES-CBC turned out to be notoriously difficult to ...
user avatar
  • 4,783
22 votes

Can my ISP see which VPN protocol I am using?

Yes, probably. Most VPN protocols are not designed to hide the fact that they're VPN protocols, nor what kind of protocol they are. See for instance this paper which details fingerprinting OpenVPN. If ...
user avatar
  • 12.5k
21 votes
Accepted

Why would HTTP client only send authentication headers once an unauthenticated request was rejected?

This behaviour is specified by RFC2617. The reason for the extra round trip is that the server can request different kinds of authentication: basic, digest, etc. If you know in advance that the server ...
user avatar
  • 32.6k
20 votes

Is it already the right time to say goodbye to TLS1.1 support on web servers?

Let's put the question the other way: What do you gain by disabling TLS 1.1? Security You and your quote seem to be implying that you want to move to TLS 1.2 because it's more secure than TLS 1.1. ...
user avatar
18 votes

IKEv2 vs OpenVPN

OpenVPN vs IPSEC: IPSEC needs more time to negotiate the tunnel; OpenVPN uses strong ciphers and TLS ; (at the present moment it is considered to be the strongest encryption); Single and ...
user avatar
  • 356
18 votes
Accepted

What are non-standard ports and protocols

A non-standard port just means a service running on a port other than its default, usually as defined by the IANA port numbers registry. Running a service on a non-standard port doesn't really mean ...
user avatar
  • 132k
17 votes

Ensure that a file can only be decrypted after a specific date

Use secret sharing to split a private encryption key into N parts, parameterized to allow reconstruction of the key with K or more parts, where K <= N. Best done using CRM, as described on the ...
user avatar
  • 1,098
17 votes

What are locked domain names technically?

Locked domains are domains which require additional hoops be leapt through in order to change ownership. The lock is requested by the owner of the domain and implemented by the registrar of the ...
user avatar
  • 71.7k
16 votes
Accepted

Secure communication between two applications on the same system

These are the golden rule of computer security: "It is impossible to hide anything from a competent user with system administrator privilege" and "any competent user with physical access to the device ...
user avatar
  • 31k
15 votes
Accepted

Is it already the right time to say goodbye to TLS1.1 support on web servers?

The only reason to delay in saying goodbye is because of the potential impacts. In fact, the only reason to use any particular technology is that it does something for you and the cost/benefits are ...
user avatar
  • 123k
14 votes

Why did TLS 1.3 drop AES-CBC?

CBC is a good mode for encryption if implemented correctly. In one short sentence, I've pointed out two defects of CBC. CBC is an encryption mode only: it provides confidentiality, but not ...
user avatar
13 votes

In a browser web server communication, who decides which encryption protocol to use

To complement the answer from @raz, one must be aware of Protocol Downgrade Attacks. Browsers like IE send their maximum supported version, and then the server chooses (in your case, IE says "I know ...
user avatar
  • 168k
13 votes

Why can protocols on higher layers be left unchanged?

While OSI is just a model, and in reality the layers can be blurred or nonexistent, the concept of layering protocols is specifically to allow a change in a particular layer to leave the layers above ...
user avatar
  • 61.4k
12 votes

Can Poodle be fixed in SSLv3 or will it go the way of TLS compression?

There have been some discussions about mitigating issues with some record splitting. Namely, what makes Poodle efficient is that padding may use up to a full block (8 bytes with 3DES or RC2, 16 bytes ...
user avatar
  • 168k
12 votes

Why is the deprecated SSL 2.0 protocol considered insecure and how can it be exploited?

SSL 2.0 is not a vulnerability; it is a protocol which happens to contain structural vulnerabilities, and, as such, should not be allowed. There is a RFC which says just that, and lists the main known ...
user avatar
  • 168k
12 votes

Is Git crowdsourcing cryptographic attacks?

You could probably compute your own SHA1 hashes quicker from small arbitrary texts than that you harvest the hashes that someone else computed. But there's a lot of possible SHA1 digests, about as ...
user avatar
  • 166
11 votes

What's the need of multiple implementations of SSL/TLS?

Competition is a good thing, and so is redundancy/diversity. While Heartbleed affected a lot of systems and services due to how widespread OpenSSL is, it certainly didn't effect 100% of systems. ...
user avatar
  • 8,434
11 votes
Accepted

In a browser web server communication, who decides which encryption protocol to use

The server chooses which cipher suite to use for establishing the secure channel. The client (browser) poses the protocols and encryption algorithms that it will accept. The server chooses the one ...
user avatar
  • 12.3k
11 votes
Accepted

Is SSL more secure than encoding?

What you have defined is not security. SSL can give you security. So...your question is easy to answer: Yes - SSL is up to 100% more secure than encoding. While elements of your 2nd paragraph have ...
user avatar
  • 61.4k
11 votes
Accepted

difference between public key and host key and security of host key

The host has a key pair, consisting of a public key and a private key. (It can have multiple key pairs in different formats; at the beginning of a connection, the client and the server negociate to ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible