Unanswered Questions
14
votes
0answers
796 views
Emacs and EasyPG not performing public key encryption
I have a file which I edit and encrypt following this guide.
I'm a noob as far as security goes and thought that the point of including the line which specifies the cryptographic key to use
-*- mode:...
11
votes
1answer
462 views
Why does this cache attack work?
I was recently reading the following paper about doing a cache attack in Javascript:
https://arxiv.org/pdf/1502.07373v2.pdf
But I was confused by how it could work. In the paper, an 8 MB buffer was ...
11
votes
1answer
679 views
How are TPMs provisioned for Intel Trusted Execution Environment (TXT)?
For Intel TXT to work, the TPM must be provisioned. Intel provides some tools for doing this but many are protected by non-public login or an NDA. Many OEM platform vendors provision their boards and ...
10
votes
2answers
604 views
How does MDK3 carry out deauth attacks?
With aireplay, you have to specify both the AP and client to send deauth frames to, but MDK3 doesn't require an AP mac address. Does it just scan the desired channel for beacons until it finds an AP ...
10
votes
1answer
10k views
How to do role-based authorization with OAuth2 / OpenID Connect?
I'm trying to use OAuth2 for authentication/authorization, but after much reading around, I am confused... I'm trying to understand how OAuth and OpenIDConnect relate to each other, and how exactly I ...
9
votes
1answer
252 views
Is it safe to send Content-Security-Policy header for text/html content-type only?
Is it safe to send Content-Security-Policy for dynamically generated pages with text/html and other hypertext content-types only or do I need to send this header for all files including static assets -...
9
votes
0answers
282 views
PHP eval code sandbox break
I noticed a heavily downvoted comment in here: http://php.net/manual/en/function.php-check-syntax.php
function eval_syntax($code)
{
$braces = 0;
$inString = 0;
// We need to know if ...
9
votes
0answers
415 views
OpenSSL EVP aes_256_cbc Initialization Vector Size
I'm looking at the crypto library examples (programmed in c) provided for OpenSSL EVP on OpenSSL Wiki.
Their example for a 128 bit Initialization Vector is as follows:
/* A 128 bit IV */
...
9
votes
0answers
889 views
Openid connect nonce replay attack
The openid connect specification adds a nonce parameter to the authorize endpoint, which must be echoed back as a claim in the id_token. It claims that the purpose of this parameter is to prevent ...
9
votes
1answer
253 views
Pin required for accessing (smartcard) Card Authentication Slot
So let me set the stage:
I have created an Intermediate Signing Certificate by way of the Yubico walkthrough: https://developers.yubico.com/PIV/Guides/Certificate_authority.html
I made a couple ...
9
votes
2answers
1k views
dnsspoof not spoofing (requests and forwards real DNS packet)
I was trying to use dnsspoof but it did not work as expected. These are the steps I followed:
Set IP forward in kernel to 1
arpspoof -i eth0 -t 192.168.1.39 -r 192.168.1.1 and arpspoof -i eth0 -t 192....
8
votes
1answer
907 views
Why isn't PKCE encouraged for Single-Page Apps?
A lot of services today still recommend the implicit flow for an OpenID Connect/Oauth2 token exchange when developing Single-Page Apps. (See Okta, Google, Auth0)
Some newer guidance out there points ...
8
votes
1answer
561 views
What is the purpose of JSON Web Token (JWS)'s issued at “iat” field?
RFC 7519 specifies an optional "iat" field, indicating when a token was issued. The RFC provides a terse commentary:
This claim can be used to determine the age of the JWT.
What is the purpose ...
8
votes
0answers
333 views
Brotli compression algorithm and BREACH attack
I spent a lot of time on BREACH attack implementations. In theory, Brotli compression, like other compressions that use lzz7 family algorithms, must be vulnerable to the BREACH attack.
Experiences ...
8
votes
2answers
508 views
Does Wannacry spread outside its private subnet to adjacent private subnets?
Does a Wannacry-infected computer on an internal network with a private IP address attempt to spread to other privately-addressed subnets?
I have not found a definitive answer online.
Cisco says:
...
