Most Popular

more tags
1500 questions
40
votes
1 answer

Why can't I use the same key for encryption and MAC?

I wrote a simple file encryption program as an example of how to do encryption correctly, but after reading a questions about encryption + MAC , I think I made a mistake by using the same key for both. I'm about to fix my program to generate a…
Brendan Long
  • 2,928
  • 1
  • 22
  • 27
40
votes
5 answers

Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?

I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately. They seem to have raised VC funding and are offering a free password management and storage tool. Their team does not seem to have…
Mallory
  • 401
  • 4
  • 5
40
votes
1 answer

Passive and active attacks via X11. Is Wayland any better?

In The Linux Security Circus: On GUI isolation - The Invisible Things Lab's blog , Joanna Rutkowska describes attacks from one X11 app on another and the general problem of the lack of GUI-level isolation, and how it essentially nullifies all the…
nealmcb
  • 21,051
  • 6
  • 74
  • 120
40
votes
2 answers

How is OpenSSL related to OpenSSH?

Is OpenSSH using OpenSSL to encrypt traffic? Or something else?
LanceBaynes
  • 6,379
  • 12
  • 66
  • 94
40
votes
1 answer

TLS: RC4 or not RC4?

I was reading another interesting article by Matthew Green today, saying that if you're using RC4 as your primary ciphersuite in SSL/TLS, now would be a great time to stop As far as I'm aware RC4 has been up 'd on the list of ciphersuites to protect…
Yoav Aner
  • 5,459
  • 3
  • 29
  • 37
40
votes
3 answers

Why do PGP master keys only have a single subkey, and tie certification with signing by default?

After learning more about PGP subkeys and how to split apart the roles of (S)igning, (E)ncryption, (A)uthentication and (C)ertification, I discovered that in most cases(?) a default master key has a subkey to separate out the job of encryption: pub…
ap.
  • 501
  • 1
  • 4
  • 6
40
votes
8 answers

Are password complexity rules counterproductive?

In creating a login for this site I chose a nondictionary password that would be extremely hard to guess, but easy to remember. I was told that it did not meet complexity rules. After several iterations of this, in frustration and just for the hell…
IanR
  • 511
  • 4
  • 4
40
votes
4 answers

If email is insecure, why do we use it for password resets?

I found myself telling a coworker today "Email is insecure, that's why we developed our secure report application." But then it struck me, Why is email considered insecure? If it is so insecure, why do we trust it for password resets? I never…
John
  • 2,302
  • 4
  • 30
  • 48
40
votes
5 answers

What's the difference between VPN over TCP vs UDP?

My VPN provider gives me the option between using UDP and TCP for connections. According to this site UDP is faster over short distances. I'm on the same continent as my server, is that considered short distance? Is there a test I can run to compare…
David Drohang
  • 463
  • 1
  • 4
  • 5
40
votes
2 answers

Did a Huawei modem just try to do a Man-In-The-Middle attack on me?

I have a replica of Huawei B535-333 LTE modem. While I was working from home on my computer I randomly got a security alert saying that certificate for connection with outlook.office365.com was issued by untrusted company and the certificate name…
gtu
  • 503
  • 1
  • 4
  • 6
40
votes
6 answers

Software vendor refuses to fix security vulnerability - what to do?

I work as a consultant for a large corporation that uses some software, in which I have found a security vulnerability. I notified both my client and the software vendor about a year ago. They referred the case to their account manager (!), who (in…
TravelingFox
  • 433
  • 1
  • 4
  • 7
40
votes
8 answers

Can the manufacturer remotely turn off my device?

In connection with recent events, I, as an ordinary citizen of Russia, wonder - can smartphone manufacturers (Google, Apple, Huawei, etc.) or any another (such as Microsoft, Cisco etc) remotely turn off my phone (or any another device)? I see…
RoyalGoose
  • 1,055
  • 1
  • 9
  • 9
40
votes
2 answers

How did this paypal spoof email pass SPF, DKIM and DMARC

This mail that got through has me stumped. It appeared to me as being from PayPal <unclaimedproperty@paypal.com> in my Inbox. I happened to look at the original and it says SPF, DKIM and DMARC all passed. If I'm reading this right, 74.112.67.243…
ianw
  • 431
  • 1
  • 4
  • 6
40
votes
4 answers

How do open-source projects prevent disclosing a bug while fixing it?

I understand that many open-source projects request vulnerabilities not to be disclosed on their public bug tracker but rather by privately contacting the project's security team, to prevent disclosing the bug before a fix is available. That makes…
Heinzi
  • 3,938
  • 2
  • 30
  • 34
40
votes
12 answers

Is it safe to use a weak password as long as I have two-factor authentication?

I'm careful to use strong passwords (according to How Big is Your Haystack , my passwords would take a massive cracking array 1.5 million centuries to crack), I don't reuse passwords across sites, and I use two-factor authentication where it's…
Herb Caudill
  • 453
  • 1
  • 4
  • 9
1 2 3
…
99
100