Unanswered Questions
21
votes
1answer
888 views
What attacks, if any, are possible against Security Support Provider Interface (SSPI)?
I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
10
votes
2answers
353 views
CSP Reports: Ignoring Client Malware
I'm seeing a lot of Content Security Policy (CSP) reports raised because of client-side malware. Many have "blocked-uri" entries like randomstring.cloudfront.net, something.akamaihd.net and so on.
I ...
10
votes
1answer
151 views
Does any OpenID identity provider allow site-unique arbitrary email addresses?
Since OpenID officially furnishes email address to sites (with the user's permission) as a convenience rather than an attestation, is there any OpenID identity provider who'll allow you to ...
8
votes
0answers
670 views
MPPE-Send and Receive key derivation from MS-CHAPv2
I am trying to get the MS-MPPE-Send-key and MS-MPPE-Recv-key from the MS-CHAPv2 challenge material. I am able to follow the RFCs 2548 3078 and 3079 to the step of getting the GetNewKeyFromSHA() it is ...
7
votes
4answers
387 views
Decentralised password recovery
Are there good/established techniques for password/key recovery in situations without a centralised service?
(Anything goes, but I'd prefer solutions that distribute the recovery information across ...
7
votes
0answers
172 views
Maximum number of nodes with IPSec?
From my understanding, for incoming packets over IPSec, the Security Association (SA) is identified by the SPI field of the ESP header.
Then let's say I have a bunch of nodes where each node wants to ...
7
votes
1answer
200 views
Security Risks of BD+
I have recently been reading about the DRM measures on commercial bluray disks, in particular BD+. It seems that this technology involves Java software running in a virtual machine, with full access ...
7
votes
1answer
203 views
Bootstrapping an EC2 Spot Instance
I'm considering using EC2 Spot Instances in an automated fashion (ie create a script that will request EC2 Spot Instances that will run unattended).
For this specific use case, I'm happy to lock down ...
6
votes
0answers
24 views
I want trusted SMIME certificates for 3rd parties. Is this a reasonable configuration?
I want to send out SMIME certificates with my emails, and want to deploy the following PKI
Root01 (All EKU, All Constrants, No Restrictions)
PolicyInt01 (Internal applications, not trusted by 3rd ...
6
votes
0answers
406 views
Attackers of Google DNS hijacking
As we know Google DNS server (8.8.8.8) in 14th and 15th March was hijacked in Sao Paulo. And subsequent to this event, BGPmon.org announced an alert
Now, In a course assignment, we are asked to ...
6
votes
0answers
218 views
Use token for Windows Server 2008 AD RMS
I have a Windows Server 2008 configured for AD RMS (Active Directory Rights Management Service), another Windows Server 2008 machine that is the domain controller, and a third machine that is a member ...
5
votes
1answer
97 views
Prevent location being exposed through VPN
I use the Astrill VPN service to access websites that my country has blocked. There is nothing sinister going on here. Sites like google and youtube have all been blocked. This VPN service offers ...
5
votes
0answers
70 views
AES encryption on embedded device: Can this be secure?
I plan to create an encryption program for an embedded device with the following characteristics:
CPU is Intel 80186 compatible @ ~20 MHz
128 KB RAM, of which I have ~20 KB at my disposal for ...
5
votes
2answers
80 views
which memory hard hashing algorithm can equalize low-computational and high-computational power devices to utilize blockchain in the IoT?
Recently IBM and Microsoft showed their interest (IBM post, Microsoft post) in utilizing bitcoin's blockchain for internet of things (IoT) development. Let's assume that in close future the blockchain ...
5
votes
1answer
106 views
PKI Installation
I must install a PKI in my organization. I work in a windows environment. I already set an offline CA. I must now install a subordinate CA. I have the choice between installing the subordinate CA on a ...
