Unanswered Questions
6,695 questions with no upvoted or accepted answers
16
votes
2
answers
2k
views
What unique fingerprinting information can an iOS 10 app collect?
As a follow-on to these questions:
What unique fingerprinting information can an iOS7 app collect?
What unique device fingerprinting information can an iOS8 app collect?
What unique device ...
CommunityBot
- 1
14
votes
0
answers
3k
views
TPM PCR value unchanged with BIOS configuration changes
I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
- 1,825
12
votes
1
answer
863
views
Random seed not propagating to the entropy pools in a timely manner
The Linux kernel's randomness driver collects entropy from the environment. Because there will be little entropy during boot, a random seed is often kept at /var/lib/misc/random-seed or a similar ...
CommunityBot
- 1
10
votes
1
answer
4k
views
Meterpreter (Metasploit) anonymous reverse connection over Tor2web
The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box.
I've ...
CommunityBot
- 1
10
votes
0
answers
328
views
Penetration-resistance of a HaLVM unikernel
A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
CommunityBot
- 1
9
votes
0
answers
414
views
SolarWinds Orion SAML compromise mass cert update
SolarWinds Orion customers have suffered some network compromises according to news reports.
One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
- 124k
9
votes
0
answers
356
views
PGP security with Thunderbird 78 email client
I have a query regarding best practice of using PGP to sign emails with Thunderbird 78.
Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
- 5,225
9
votes
1
answer
689
views
Entropy sources used by modern Windows
A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
CommunityBot
- 1
9
votes
1
answer
2k
views
Using the authorization code grant without using cookies?
I've been reading up on this for months and it seems like the whole thing could converge on what I'm summarizing below. I'm trying to arrive at the most ideal:
OAuth2
OpenID Connect
SPA / Mobile ...
CommunityBot
- 1
9
votes
1
answer
30k
views
How to make Firefox ignore the X-XSS-Protection response header?
I have two questions:
How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
CommunityBot
- 1
9
votes
1
answer
4k
views
Do fTPM implementations protect against physical attacks?
I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC.
As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
- 1
8
votes
0
answers
1k
views
What is the difference between TEE and HSM in Android Pie?
Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox).
What is the actual difference between TEE and HSM?
Does ...
- 181
8
votes
0
answers
307
views
Authentication using SysRq
The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
- 64.7k
8
votes
0
answers
385
views
How to determine the number of characters changed between two passwords as per DISA Application Developer STIG rule SV-84187r1_rule?
The DISA Application Developer STIG specifies:
Group ID (Vulid): V-69565
Rule ID: SV-84187r1_rule
Rule Version (STIG-ID): APSC-DV-001730
Rule Title: The application must require the change of at ...
CommunityBot
- 1
7
votes
1
answer
2k
views
iOS & Android Certificate Pinning with Lets Encrypt
We use cert pinning when developing for iOS and Android. We use regular 12 month certs that are paid for.
We recently switched to Lets Encrypt (LE) for our general website certificates and would like ...
CommunityBot
- 1