AbhishekKr
  • Member for 10 years, 4 months
  • Last seen more than a month ago
Protecting cellphones from USB attacks (a.k.a. Juice Jacking)
Accepted answer
14 votes

The kind of attack you are talking is popularly coined as "Juice Jacking". Are there any "known bad" or "known safe" smartphones with regard to USB security? In my knowledge, NO. How does a ...

View answer
Can Central Authentication Service (CAS) do authorization?
Accepted answer
7 votes

No, CAS is just an Authentication Service, but you can surely impose Authorization using the mechanism, which is the base of doing authentication for your CAS. Say, if you are using LDAP to ...

View answer
Where can I find a collection of Threat Models?
3 votes

If you like to get into the basics of Threat Models, then Threat Modelling from Microsoft Press is a nice book. Don't be put off by the introduction-page, it is an overall fine beginner read.

View answer
IT Security and Ethical Hacking
3 votes

first suggestion: this thread will get better responses over "https://security.stackexchange.com/", so get it moved there answer: I've been a self-learner of Security for long time, and from my own (...

View answer
TLS 1.0 JavaScript injection vulnerability (BEAST): what to do client-side?
3 votes

from the way this exploit is supposed to work as a MitM from inside the browser attacking via blockwise-adaptive chosen-plaintext cryptanalysis..... the current and only solution (limited-security)...

View answer
Can I expect my e-mail to be routed securely?
2 votes

The secure connection on both ends just confirm secure transitions on network channel between User's end and the Mail Server connected to. End-to-End security also involves security practices adopted ...

View answer
Should a closed source website keep a secret key in its source?
2 votes

The first answer popped in my head is NO, it's not right practice. Though, sometimes people are supposed to follow practices which are not absolutely perfect but required for the early-release, ...

View answer
How to secure a MongoDB instance?
2 votes

Few very initial things to remember are: Remove IP Binding from all to just the IP (private or localhost), you expect to get Connection Request Change the default Port Bindings Give only required ...

View answer
What organisation(s) is able to recommend a baseline technology set for safe, secure, web browsing?
2 votes

What business/organisation(s) would have: Sufficient technical skill to evaluate technologies needed for safe, secure web browsing OWASP The capacity to publicly recommend a set of ...

View answer
Secure communication between server and client
1 votes

Unless you don't have a protocol boundation (like http for web-browsing or similar). I'll suggest you to use ZeroMQ libraries to utilize socket communication with encryption enabled. It'll not only ...

View answer
how can you view an HTTP request in transit?
1 votes

You can use any packet sniffer that you are comfortable with, the main feature allowing you to listen all packets at Ether belonging to your network is Listening in Promiscuous Mode. Normally, tools ...

View answer
Secure jquery ajax calls from a non secure page
1 votes

Attacks like 'SSL-Stripping' are a clear example of how such approaches could be exploited. This is a vulnerable design. A plain python-based tool by Moxie to exploit such design: http://www....

View answer
storing the third party credentials in the database/some secure place
1 votes

The Best Practice for your requirement is usage of OAUTH. So, if the 3rd Party (to be authenticated) provides OAUTH support..... then that is the best preferred way as in that case you wouldn't have ...

View answer
Where can we learn more about recursive encryption schemes?
0 votes

There have been a lot of good & in-use encryption algorithm in industry for long somewhat doing the same from what I understand you are suggesting... There have been good algorithms with multi-...

View answer
Google App Engine Security
0 votes

Few months back I did some self-experimentation over the Authorization & Authentication provide over GAE for its content using the Google Account based Access Control List. And noted down the ...

View answer
What can I do about TLS 1.0 javascript injection vulnerability on my server?
0 votes

You could get a better insight at SANS Diary Entry at http://isc.sans.edu/diary.html?storyid=11635 the only possible way (discussed at entry above) to counter it at Server is mentioned as disabling ...

View answer
How eavesdropping will be performed how can I prevent from eavesdropping
0 votes

[A Generic Answer] To prevent Eavesdropping in any kind of communication channel can be achieved by usage of "Secure Tunneling" of your channel data. on plain network connection, setting up a VPN ...

View answer
Forgotten password or reset link, which is more secure to email?
-1 votes

Email of forgotten passwords means you are storing the password in your database either in plain form or 2-way encryption. That is not a suggested security practice. You should store 1-way cryptic (...

View answer
How do software keygens work?
-3 votes

Well first of all I'd suggest you to stop seeing those keygen files, as they are hacked piece of softwares (mostly/sometimes) accompanied with some other non-harmful looking image/nfo/lnk files which ...

View answer
Is it ok to use computer while scanning for viruses?
-6 votes

Not preferred practice. I would suggest to schedule boot-time scans {available in Avast too}, those are more effective for the viruses. They take a time respective to number+size of files on your ...

View answer