Gh0stFish
  • Member for 5 months
  • Last seen this week
Why does this attack check the location of the server?
Accepted answer
82 votes

Certain governments tend to ignore hacking/cybercrime carried out by their own citizens, as long as they only target people from other countries. Brian Krebs talks about this in an article earlier ...

View answer
Is it insecure to display the number of characters when users enter a new passphrase?
39 votes

Knowing how long a password is doesn't really make much difference to how easy it is to guess or crack it. If the password is something easily guessable or in a dictionary, then the length is ...

View answer
Why use random characters in passwords?
24 votes

Attackers try the most common passwords first, because they're the most likely ones that will work. So they might start with things like password or Password1 or common patterns such as 123456, ...

View answer
What are the risks of desktop personalization on Windows?
22 votes

Sometimes blocking desktop personalisation can be a HR issue rather than a security one. For example, if you allow people to set their own backgrounds, sooner or later someone is going to set ...

View answer
Is a BitLocker recovery key an unavoidable brute-force attack vulnerability?
21 votes

Can a Bitlocker-locked drive be brute-forced within hours by guessing the recovery key by an actor with a supercomputer? With a couple of GPUs? (assuming Microsoft put as much effort as possible into ...

View answer
Do I need to use TLS if data is already encrypted and gets decrypted client-side?
9 votes

Firstly, you don't need need to faff around with CloudFront or an Nginx proxy - you can just enforce TLS with an S3 Bucket Policy. It's hard to know whether there are any specific benefits in your ...

View answer
What does it take to brute force 42 hex characters
4 votes

You can't. 32 hex characters is 16^32, which is equal to 2^128. 128 bits is impossible to brute-force with any hardware that exists today (and that is unlikely to change in the near future). Edit: OP ...

View answer
Do Key-Derivation Functions pose a Denial-of-Service Threat for APIs?
3 votes

Yes, they can potentially be a DoS issue (either for CPU or memory) if you don't have any kind of rate limiting in place. But then if you're not rate-limiting login requests, you have all kinds of ...

View answer
Does combining a non-cryptographically secure string with a cryptographically secure string result in a cryptographically secure string?
3 votes

This type of approach can reduce the overall randomness of the string, but whether or not this will be significant depends on exactly how you're using the string. We know that str_shuffle() not ...

View answer
Can a ransomware attack succeed with no root privileges, but instead if it does have privileged user access?
Accepted answer
3 votes

Yes, if an attacker has domain admin rights they can usually encrypt anything on any system that's joined to the domain. You don't even need administrative rights for most ransomware attacks - normal ...

View answer
Effective ways to hash phone numbers?
2 votes

You could use a slow salted hashing algorithm (such a bcrypt or Argon2id), and tune the work factor/parameters to make them even slower. It's not a huge keyspace (especially if you have a smart ...

View answer
How to maintain and enforce an approved list of software?
Accepted answer
2 votes

There are really two questions here. If you're looking at how to actually enforce the use of approved software only, you need to application whitelisting (using something like AppLocker) to only allow ...

View answer
Hacked list of AD logins and passwords
2 votes

On-premise Active Directory stores NTLM hashes of passwords in the NTDS.dit file on the domain controllers. If you have Domain Admin rights (or a backup of the domain controller) then you can extract ...

View answer
Is an IP based whitelist practical for controlling internet use?
Accepted answer
2 votes

In the vast majority of cases, no. Lots of sites will use CDNs and other mechanisms that mean they may have multiple IP addresses, so whitelisting them all will be impractical. You may also have ...

View answer
To lighten server load, is hashing a client-side Argon2-hashed password with SHA-256 on the server-side at least as safe as server-side only Argon2?
2 votes

So here comes my question: is it safe to directly hash "a password already hashed with Argon2 on the client-side" on the server-side with SHA-256? Here I mean "safe" by it's at ...

View answer
Is it safe to open email links in a private window?
Accepted answer
2 votes

It may protect against certain session hijacking attacks, but if the link points to a browser exploit then it doesn't matter whether or not you're in a private window. If you don't trust the links, ...

View answer
A stolen security key enables full access; why are such keys considered more secure than authenticator apps?
2 votes

It all comes down to what kind of threats you're protecting against, and which kind of compromise is most likely. Sure, a YubiKey can't be protected with a PIN/pattern/fingerprint (although how much ...

View answer
How to encrypt http traffic in an offline enterprise network?
2 votes

Deploy the application with a digital certificate that is trusted by all of the client systems. That way, you can just use HTTPS to perform the encryption. The best way to do this is by setting up ...

View answer
PCI : scope debate : API consumers
1 votes

Even though system A doesn't store card data, it very much sounds like it processes and transmits it. So it will most likely be in scope for SAQ-D. This needs to be done before the system starts ...

View answer
Vulnerabilities in Receiving User-Submitted PDF Files Through HTTP(S)
Accepted answer
1 votes

You don't "execute" a PDF (although technically it can contain executable code such as JavaScript), but there are still risks from the approach you're taking. The main things that spring to ...

View answer
What's the threat model of mobile security?
1 votes

There is no single threat model for "mobile security", any more than there is a threat model for "workstation security". Your threat model depends on your circumstances. If your ...

View answer
What is an attacker looking for when they try to get me to go to their website?
1 votes

It's possible that they have browser exploits or other things on their site, but cold calling people to try and deliver them is a rather convoluted way to do that. It's much more likely to just be a ...

View answer
How to exclude my attack box from the security compliance audit
1 votes

It should be possible to convince the auditor not to apply all of the usual security controls to a testing/attack system (especially ones that will stop it working effectively). They may still want ...

View answer
can HSTS be considered as a remediation for not using secure flag for a pci dss auditor
1 votes

From a technical perspective, as long as the HSTS lifetime was greater than the maximum cookie lifetime, and the HSTS covered all domains that the cookie would be sent for, then it would protect ...

View answer
Blocking online file conversion tools
Accepted answer
1 votes

It sounds like what you're looking for is a Data Loss Prevention (DLP) system, which can identify sensitive internal data or documented (based on various factors), and then prevent people from sending ...

View answer
Encrypting Drive before Online Proctor Exam
1 votes

You could encrypt the drive with something like BitLocker (with automatic unlocking disabled) or VeraCrypt. That way they wouldn't be able to access the contents without your encryption key (although ...

View answer
Forget Me Not? Abandoning the Forgot Password Functionality
1 votes

When talking about security, the three main areas that are considered are Confidentiality, Integrity and Availability (known as the CIA model). A weak password recovery mechanism can compromise the ...

View answer
John The Ripper does not load password hash, how can I fix it?
0 votes

That's not the correct format for an md5crypt hash. They typically start with $1$ - you can see examples of the various md5crypt formats that John accepts in the source code. When John reads your ...

View answer
Do relative paths mitigate HTTP Host Header attacks?
0 votes

Why would anyone use an absolute path for resources served by the same server? One of the more common way that you can actually exploit the Host header is in something like a password reset form. You ...

View answer
Safety assessment vs. Security assessment. What's the difference?
Accepted answer
0 votes

They certainly can be interconnected, which means that they usually need to be considered together. Sometimes they will have the same requirements, and sometimes they will have conflicting ...

View answer