user
  • Member for 10 years, 9 months
  • Last seen more than a month ago
What does EIP stand for?
18 votes

One of the basic things that a computer needs to keep track of is where in memory are located the instructions currently being executed. This is normally done by the CPU using what is often known as ...

View answer
Data too large for key size while trying to sign then encrypt
1 votes

You are using openssl primitives to put together an encrypt/sign chain. Doing so is only a tiny step above implementing your own cryptography. Instead of using openssl to sign and encrypt, consider ...

View answer
Why is STARTTLS used when it can be downgraded very easily?
14 votes

Downgrade attacks are active attacks. Active attacks are much easier to detect, and are typically more difficult to perform, than their passive counterparts. Opportunistic encryption, such as optional ...

View answer
Does safe removable media exist?
3 votes

I'll go with a bit of an unorthodox suggestion. Don't connect storage media directly to the laptop at all. Treat the laptop as completely untrustworthy, and potentially disposable. Quite simply: ...

View answer
How to forget LUKS keys during emergency?
4 votes

There are two ways to approach this, depending on just how inaccessible you want to make the data. If you simply want to require knowledge of the LUKS passphrase to regain access to the data (more or ...

View answer
In PGP how can I be sure about the public key?
Accepted answer
5 votes

Actually, the naiive approach of just grabbing a key from a keyserver isn't vulnerable so much to a man-in-the-middle attack as to a poisoning attack. In a poisoning attack, an attacker provides an ...

View answer
Don't trust the client?
0 votes

As already said, the idea behind "don't trust the client" is that the client can be sending anything. It is at the mercy of the user, who could be an attacker, and therefore must be considered a ...

View answer
Is there some hidden worm attached with whatsapp messages that state forward this messgae to 20 people?
2 votes

First thing first, the very link you cite says "hoax" right in the URL. Wiktionary defines the noun hoax thus: Anything deliberately intended to deceive or trick. That should be a pretty big clue ...

View answer
Can a new signature be added to an already signed message?
Accepted answer
2 votes

Bob can create a detached signature, and distribute that along with the message. This can be done with or without leaving the original signature in place in the message that is being signed. With a ...

View answer
Securing Home Network using 3rd Party Firmware / Access Points
0 votes

It is impossible to tell whether running OpenVPN on one host as compared to on another would make it easier or more difficult for someone to carry out an attack. My hunch is that it wouldn't make any ...

View answer
How do I check that users don't write down their passwords?
13 votes

First off, I agree with the answers that say that this is a bad idea for a variety of reasons. Second, it appears that you are trying to use technology to solve a human problem. It is very, very rare ...

View answer
SSH - If Eve has the passphrase and public key, can she derive the private key?
50 votes

The private key is unrelated to the passphrase. So is the public key. The public key is also generally stored unencrypted, even when the private key is protected by a passphrase. (Exceptions may exist ...

View answer
Using SUID program to avoid having entries in sudoers
1 votes

In summary, you mention two possibilities: adding sudoers entries for apt-get, dpkg, etc. – yes, this sounds dangerous making your application setuid root – yes, this is a problem; even ...

View answer
Is an 80 bit password good enough for all practical purposes?
8 votes

It has been stated (for a reasonably authoritative source, see Passphrases That You Can Memorize — But That Even the NSA Can’t Guess on The Intercept) that the NSA is capable of (at least) "one ...

View answer
Why 2FA is not considered flawless when used to secure an account?
Accepted answer
2 votes

Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of traditionally the triad "something you have" (...

View answer
Why is some meta data not encrypted in Proton Mail?
11 votes

As already discussed, Proton Mail uses OpenPGP (RFC 4880). OpenPGP traces its roots to the original Pretty Good Privacy, written by Philip Zimmermann in 1991. At that time, while Internet (SMTP) e-...

View answer
Is it ok to delete SSH configuration files?
Accepted answer
1 votes

If you don't want a SSH server running on your system at all, the better approach is to remove the package that provides the SSH server software. Doing so will remove it cleanly, though it is possible ...

View answer
Debian server invalid loging attempts and high bandwidth use
0 votes

This isn't a honest mistake. If it was, whoever is on the other end would recognize their mistake pretty soon when they can't log in, or when whatever services need something like a SSH tunnel stop ...

View answer
How to protect a small company?
2 votes

I don't know exactly what you get from a Zone Alarm account, or exactly which capabilities the Sophos firewalls you've been recommended have, so I'm going to keep this pretty generic. It sounds like ...

View answer
Sharing a PGP Private Key
2 votes

You tagged this question as pgp and mention PGP in the question title, so I am assuming that this is what you are asking about. PGP (PGP, OpenPGP, GnuPG) has supported encrypting a file asymmetrically ...

View answer
Cryptography: Encrypting with password without storing it
Accepted answer
1 votes

TL;DR: Use a proper key derivation function instead of some homegrown scheme. the hash can easily be extracted and brute-forced externally. I think you are very much underestimating the difficulty ...

View answer
Encrypting a few TB of Data
41 votes

I find some of your comments curious. Particularly, I'm trying to stay away from methods that are reliant on an application, and do it manually - as I'd feel more in 'control'. and I don't need ...

View answer
ProtonMail security concerns
Accepted answer
11 votes

However, the server must store some form of the mailbox password so that the user can be authenticated. Should a security breach occur on the server, wouldn't it be just a matter of time for a ...

View answer
Security concerns issuing wildcard certificates to individual employees
3 votes

I'm going to assume that your developers need locally trusted SSL certificates. As pointed out previously, it might be worth considering if they really do need those in the first place. A wildcard ...

View answer
Is it safe to store my passwords in a text document protected by a password?
8 votes

For modern versions of Word (Word 2007 and later), it appears that Microsoft has got the encryption pretty much right: They use multiple iterations of SHA-1 (since Office 2013, this has been replaced ...

View answer
Am I affected by the Intel AMT/ISM/SBT escalation of privilege vulnerability?
9 votes

Based on Matthew Garrett - Intel's remote AMT vulnerablity, which is among the most reasonable (in terms of amount of hyperbole) articles I've seen so far, you can only be affected if your system ...

View answer
browser can visit the url but other application can't
Accepted answer
5 votes

My question is why can a browser can connect to it A browser will connect over TCP, by default to a port that is normally open on a web server. Web servers normally use port 80 (plain-text HTTP) or ...

View answer
Is encryption key length limitations by governments norm?
5 votes

Permission limit for Encryption is 40 bit key per length in RSA algorithms This is totally nonsensical. First some history: There was a time when key lengths were commonly restricted, particularly ...

View answer
Ipod Classic w/ torrented files
2 votes

Should I be worried about plugging it in? (Could malware transfer onto my machine?) You probably don't need to worry, but there's no real harm to being careful either. You don't say which operating ...

View answer
Is there a common standard for evaluating the Security of an IoT device?
0 votes

As has been pointed out, "IoT" ("Internet of Things", or more aptly "Internet of Threats") is such as broad classification as to likely be useless. "IoT", in this regard, is little more useful than "...

View answer