Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Unanswered Questions

6,967 questions with no upvoted or accepted answers
17 votes
1 answer
3k views

TPM PCR value unchanged with BIOS configuration changes

I have been experimenting with the TPM on a Dell R710 (BIOS version 6.3.0). My goal was to detect changes to BIOS settings through TPM PCRs. The research I have done leads me to believe that BIOS ...
12 votes
0 answers
525 views

PGP security with Thunderbird 78 email client

I have a query regarding best practice of using PGP to sign emails with Thunderbird 78. Thunderbird 78 took an existing system by Enigmail and brought it "in-house" to be built into the ...
11 votes
1 answer
555 views

SolarWinds Orion SAML compromise mass cert update

SolarWinds Orion customers have suffered some network compromises according to news reports. One report says, right at the end of the article, that SAML2.0 signing certificates may have been ...
11 votes
1 answer
1k views

Entropy sources used by modern Windows

A comment on a Microsoft blog from 2005 mentions over 150 sources of entropy for the Windows CryptGenRandom function. The majority of sources come from low-level system information (precise stat ...
11 votes
0 answers
410 views

Penetration-resistance of a HaLVM unikernel

A HaLVM unikernel is a Haskell program compiled with a modified version of the Glasgow Haskell Compiler to produce a standalone Xen kernel, which will boot on any Xen PV machine instance. A HaLVM ...
11 votes
0 answers
32k views

How to make Firefox ignore the X-XSS-Protection response header?

I have two questions: How can I make Firefox ignore the X-XSS-Protection header? I have a website which sends an X-XSS-Protection: 1 header and I want my Firefox to ignore that header, because it ...
11 votes
1 answer
4k views

Do fTPM implementations protect against physical attacks?

I see that there is an increasing number of PCs shipped with firmware based TPM (fTPM), e.g. the Intel NUC. As far as I understand, these solutions practically emulate a TPM chip using the CPUs ...
9 votes
0 answers
1k views

How could I block or at least detect the use of ultrasonic side channels or Google Nearby Messages API on my smartphone?

My question is about the use of ultrasonic messages that are part of the modern advertising ecosystem and are also used by the Google Nearby Messages API. When it comes to advertising, the type of ...
9 votes
1 answer
2k views

What is the difference between TEE and HSM in Android Pie?

Android has the concept of hardware backed security as TEE and in latest Android i.e., Android Pie devices can have a HSM (Strongbox). What is the actual difference between TEE and HSM? Does ...
9 votes
0 answers
917 views

How does Facebook Pixel's new first-party cookie work?

Facebook recently announced that they will begin offering a first-party cookie option for the Facebook Pixel. Previously, they only used third-party cookies. From their documentation: You can now use ...
9 votes
0 answers
405 views

Authentication using SysRq

The general idea here is the feasibility of adding Windows UAC-like "consent prompts" to a Linux system, designed in such a way that cannot be bypassed in software. Giving consent should ...
9 votes
1 answer
4k views

Session fixation in Java

In the process of developing a vulnerable jsp/servlet based application I made an attempt to introduce the session fixation vulnerability. Referring to the documentation I came up with the following ...
8 votes
0 answers
275 views

Why is iOS sending HTTPS requests even with background refresh disabled?

I've installed NextDNS on my iPhone and started noticing random connection requests to *.aliexpress.com, live.musical.ly, amazon.sa, and others. What made me wonder is that I don't have "...
7 votes
0 answers
5k views

Are there any security benefits to enabling the PIN on an eSIM?

For physical SIMs, I'm aware of a number of security benefits to enabling the SIM PIN, because for an attacker with access to a lost or stolen SIM, a PIN prevents transferring the SIM to a different ...
7 votes
0 answers
554 views

Can SRP be implemented using libsodium

I am using libsodium for cryptography and I want to use SRP for key exchange. The wikipedia page lists a python example, but I am not sure if and how I could convert this to libsodium function calls. ...

15 30 50 per page
1
2 3 4 5
465