Does UNIX have a dual approval mechanism?

One method which I have seen used: split the password. This was for SSH access to a sensitive server: a number of SSH keys were created, and marked as "authorized" on the server. Each private key was protected with a long passphrase, and every user knew only one half of the passphrase.

That's crude but effective as long as there are not too many administrators. For N "dual control" administrators, you need N(N+1)/2 such keys (e.g. 55 keys if you have 10 administrators), which is usually acceptable. Each administrator needs only remember one "half-passphrase". The same concept can be extended to sudo by setting N(N+1)/2 specific accounts (e.g. admin Bob and admin Dave type sudo -u bob_dave thecommand and account bob_dave is part of the relevant group, or maybe is given UID 0 so as to be an alias on root).

Dual control is preventative in the following sense: the attacker must bribe two admins instead of one (which means that it will cost him twice as much in pints of Guinness).


Security auditing - disabling IP forwarding and ICMP packets redirects

ICMP redirects are a "feature" of IP which allows a router to inform a host that there's a more efficient route to a destination and that the host should adjust its routing table accordingly. This might be OK on a trusted LAN, but on the wild Internet, where malice abounds, it may not be such a good idea to alter your routing table at someone else's whim. Nevertheless, ICMP redirects are enabled by default on Linux.

Text extracted from  https://www.agwa.name/blog/post/icmp_redirect_attacks_in_the_wild

About IP forwarding: The idea in disable it, is to avoid after partial control of a host (partial means here without root access) you are not able to use it as router, or masquerade some traffic, bypassing eventually a firewall or network gateway in general


Random IPs in ARP/RARP table with the same mac address?

It is actually expected that they would all have the same MAC address - MAC addresses do not survive the hop from router to router, so what you are seeing is likely the MAC address of your ISP's router (the closest MAC to your router).


Challenge authentication without roundtrip

Short answer:
No. By sending a response to the request, you are not challenging the client, making it a different kind of authentication scheme.
Longer answer:
The method you describe doesn't provide a challenge. There can be credentials provided such as a username/password pair, but it doesn't challenge the client to provide anything beyond what what it has already provided.
Let's take a look at an old example of challenge/response:
mappu sends me an email. Before my server accepts it at face value, it provides a challenge back to mappu. That is where mappu has the opportunity to confirm his identity and allow the email to be sent to my mailbox. Without that challenge, it is no longer a challenge authentication.


Generating RSA keypair (safety/performance) in REST service

If I understood you correctly, you are generating RSA keys on a server, keeping the public key on the server and sending the private keys to the users. I would recommend instead to generate the keys on the client side and send the public key to the server. This is how asymmetric encryption is supposed to be used.

The time needed to generate RSA keys is inherent to the RSA algorithm, there is nothing much you can do about it.

If you must generate the keys on the server, I would suggest you to switch from RSA to ECC. The key generation process is much faster. Many libraries exist to use ECC. The Curve25519 algorithm is a good choice, but there are alternatives.

Also, if you just need to protect communications between the client and the server, using TLS 1.2 (or 1.3) with client certificates is a better solution than rolling your own crypto.


Chrome showing cryptography as 'obsolete'

As described in this answer and in this commit to chrome only AEAD ciphers are considered state of the art security. It looks like that your server does not use the cipher preference of the client but instead has their own preference which looks like this:

ECDHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-SHA384
ECDHE-RSA-AES256-SHA
...
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES128-SHA
...

This means you prefer ECDHE-RSA-AES256-SHA to ECDHE-RSA-AES128-GCM-SHA256 and thus the chosen cipher based on Chromes offer will be AES256-SHA256, because it look like Chrome does not support the SHA384 ciphers. To fix it you might change the order and put the GCM ciphers on top of the preference list.


Many websites implement the ability to fetch remote resources that are requested by a user. The presence of this feature alone does not automatically imply that a vulnerability exists. However, it is easy to implement this type of feature insecurely, so it may be worth looking into it during a test.
While you seem to be able to change the URL to your own server, there doesn't seem to be much impact to that (it's not clear from the question alone whether the image is actually downloaded by the server or just used on the frontend). SSRF typically has the most impact when it can be used to hit services that are not normally publicly available, so you would likely need to abuse SSRF for this purpose in order to have it considered an impactful vulnerability.


Why do we encrypt ephemeral Public key in Encrypted Key Exchange

The "encryption" step is what makes EKE a Password Authenticated Key Exchange algorithm; the low entropy shared secret (the password) can be tolerated precisely because of that step.

Note that it is a special encryption; we are not talking about something like AES here. The idea can be roughly expressed in the following terms:

There is a base, unauthenticated key exchange algorithm, e.g. Diffie-Hellman.
Both parties encrypt their messages with the shared password as key.
The "encryption" must be such that it converts each message in what could structurally be another valid message for the base key exchange algorithm.
Each encryption represents a commitment.

The last point is the most important and yet the trickiest to grasp. When Alice sends her Ep(ga) (her half of DH, encrypted with password p), she commits to the password p. She may complete the DH computation, i.e. find the shared DH secret gab, only if she assumes that Bob also used the same password p. A fake Alice, trying to guess p, may try to change her mind afterwards and think: well, I sent Ep(ga) but maybe Bob was using password p', so Bob computed Dp'(Ep(ga)) and ended up with some group element ga' on which he based his DH computations... and there Alice fails, because she cannot know that value a'. The layer of "encryption with p then decryption with p'" puts Alice outside of the inner DH. The net result is that a transcript of a single protocol exchange between Alice and Bob can serve to test only one password, the password p that Alice used initially. This is what protects the password against offline dictionary attacks.

(Everything about EKE and PAKE is in the paragraph above. Read it again and again until you understand it or your head falls off.)


Problem in underscore.js with "new Function()" when CSP header is set

From html5rocks, set the nonce in the Content-Security-Policy header:

Content-Security-Policy: script-src 'nonce-EDNnf03nceIOfn39fn3e9h3sdfa'

Place the nonce somewhere on your page:

...
<body data-nonce="EDNnf03nceIOfn39fn3e9h3sdfa">
...

Call the function below with the nonce value in question before you start using underscore in your scripts.

function handleFnNonceRequirement(nonce) {
    window.Function = function () {
        var renderNode = document.createElement("script"),
            len = arguments.length,
            source = arguments[len-1],
            args = [];

        if ( 1 < len ) {
            for ( var i=0; i<(len-1); i++ ) {
                args.push(arguments[i]);
            }
        }

        renderNode.text = "function __ifYouAbsolutelyMustUseIt() { return function("+args.join(", ")+") {" + source + "}}";
        renderNode.setAttribute('nonce', nonce);

        document.head.appendChild(renderNode).parentNode.removeChild(renderNode);
        return __ifYouAbsolutelyMustUseIt();
    };
}

handleFnNonceRequirement(document.getElementsByTagName("BODY")[0].getAttribute('data-nonce'));

Hope there is a better way than this.


PKCS1 v2.0 in 1998 (rfc2437) called it P for encoding parameters; PKCS1 v2.1 in 2003 (rfc3447) changed it to L for label, but the ASN.1 had already been published and implemented using names like pSourceAlgorithm id-pSpecified pSpecifiedEmpty and it would have been disruptive to change that. This is noted in the description of pSourceAlgorithm in A.2.1

Although rfc4055 was published after 2.1 in 2005, since it is Standards Track work on it would probably have started earlier, apparently by enough to pick up the old terminology. It does reference 3447, but updating references is usually among the final steps done by the RFC editor. OTOH 2437 and 3447 are only Informational copies of documents from (then) RSALabs and could have moved faster because they didn't need consensus.


What kind of attacks against home router's NAT do exist?

There are some good lists of security issues here already. However I have not seen anyone mention NAT Pinning yet.

Quoted from Samy Kamkar's site on how NAT pinning work:

  Attacker lures victim to a URL by convincing them that there are pictures of cute kittens on the page.
  Victim clicks on URL and opens the page.
  The page has a hidden form connecting to http://attacker.com:6667 (IRC port).
  The client (victim) submits the form without knowing. An HTTP connection is created to the (fake) IRC server.
  The fake IRC server, run by the attacker, simply listens, unlike me according to former girlfriends.
  The form also has a hidden value that sends: "PRIVMSG samy :\1DCC CHAT samy [ip in decimal] [port]\1\n"
  Your router, doing you a favor, sees an "IRC connection" (even though your client is speaking in HTTP) and an attempt at a "DCC chat". DCC chats require opening a local port on the client for the remote chatter to connect back to you.
  Since the router is blocking all inbound connections, it decides to forward any traffic to the port in the "DCC chat" back to you to allow NAT traversal for the friendly attacker to connect back and "chat" with you. However, the attacker specified the port to be, for example, port 21 (FTP). The router port forwards 21 back to the victim's internal system. The attacker now has a clear route to connect to the victim on port 21 and launch an attack, downloading the victim's highly classified cute kitten pictures.


Why do browsers default to http: and not https: for typed in URLs?

Browsers are applications for end-users.
While the majority of sites is available by http (even if they just redirect to https) a significant part is not available by https.
Thus your proposal would break web surfing for a very large part of the users. It would break in a way they don't understand. Automatically downgrading to http if https fails would not make sense because an attacker could then just simply cause havoc with connections to port 443 to enforce downgrades.

Once all but a few insignificant sites switched to https one could make the switch to a more secure default, but not yet. End-users would not understand what happened and probably just switch to an alternate browser or get some tips from somewhere on the internet to get back the old behavior.

Security decisions have to be done with and not against the users.


Well, if you plan on having this per-user, I see no other way then to store a separate DEK for each user. You can then use a variety of ways to encrypt this DEK.

One idea would be to use the password to derive the key for decrypting the DEK. Of course this has to be derived in a different way than the hash of the password stored in the DB, for example by prepending "key-" in front of the password.

Another option is to user something like SCRAM-256 and then use for example Client-Key to encrypt the DEK (client key is not stored on the server in SCRAM).

Another option of course would be just keeping an additional key stored on the user computer, but this has the disadvantage of the user having to protect and backup this file.


DMZ-Hosting for VOIP services...To Use or Not To Use?

No. Its not a security issue itself since the DMZ hosting would only apply to the VOIP device, not your computer - eg you enter the IP of the device to open all ports for. However, if the VOIP device would have security vulnerabilitys, the VOIP device could be used as a hop to reach your computers.

A better idea is to ask your VOIP provider which incoming ports the service provider uses, and manually opening these in port forward.

The reason they ask you to DMZ it is to keep it simple for newbies.

The reason the service works, is because outgoing calls use outgoing traffic. Also the device "probe" the VOIP service with regular intervals. This keeps the UDP ports open so incoming calls work. But sometimes, it can happen that the Connection in the state table would timeout, and then you wouldn't be able to receive calls until the next probe or the next time you make a outgoing call.

NAT devices can also cause "one-way" audio problems with VOIP, where one party does hear the other party, but the other party does not hear one party.

Keep DMZ closed, but if you get reports on people not being able to call you (eg friends that say that it was difficult to reach you) or one-way audio problems, they hear you but you dont hear them, or the opposite, you should manually open the indivual ports the VOIP service uses instead.


I assume that you have the authorization to pentest your network in the scope you described. You may not only break operations but also expose information.

responder is a tool to, well, respond to requests. These requests may be benign (in some legacy environments there are LLMNR requests for some servers which are not in a domain) or business critical (where someone actually relies on the responses to these requests).

Your machine may not be able to process the requests of your users (either because of its configuration or performance, or other reasons). Your users will bypass the official proxy and therefore they will not be logged and/or filtered, which opens legal issues (depending on the country). Inversely, you may log their connexions, which may not be legal.
Finally, you will may get their credentials, which again opens legal issues.

So your users may not get access to the resources your company provides and you may be at risk because you actively performed actions which may not be legal.


How good is validating source with request.referer than checksum?

You're right that the referrer header can easily be spoofed or be completely missing. There are browser plugins that block the sending of the referrer, so if you add a check on the referrer, you would be stopping users with those plugins from using your site.

A better option would be for the first portal to generate a long random token for each user, and somehow share that token with the second portal. Then portal 1 shows the user a link that includes the token as a parameter, for example https://SecondPortalDomain/someServlet?token=13a82b00-b17e-11e2-9e96-0800200c9a66. You have plenty of options for how the portals could share the token - for example they might share a database, or portal 1 could send it to portal 2 via SOAP or a RESTful post.

If this option doesn't work for you, then another alternative would be to do something time based. Portal 1 could encrypt the current time and use it as the token in a link to portal 2. Then portal 2 would decrypt it, and check whether the time from the token was within the last 10 minutes (or whatever tolerance you want).


In Windows 7, the requirements for code signing were as follows:

For applications, SHA1 is preferred, MD5 is accepted.
For drivers, SHA1 is required.

In Windows 8, the requirements changed to the following:

For applications, SHA1 is required, and SHA256 is optional.
For drivers, SHA1 is required, and SHA256 is optional.
For cross-compatibility, Microsoft supports dual-signing, in which the payload is signed with both SHA1 and SHA256. On Windows 7, the old SHA1 hash will be checked. On Windows 8, the SHA256 hash will be checked.

It's not known whether this is in response to Flame, or just a standard progression of security technology.

The problem with altering the requirements in Windows 7 is two-fold. First and foremost, there are tens of thousands of existing applications signed using MD5-based certificates. Second, it's a lot of effort to modfiy the kernel, code signing utilities, Visual Studio, etc. to reflect the new requirements. However, Microsoft have (supposedly) taken steps to ensure that no internal code-signing certificates allow MD5, and have revoked offending certificates.


How to handle decomissioned/donated/RMAed printers?

There's 2 types of MFP's that I have seen:

Those meant for SOHO/Consumer. Those does rarely have any permanent storage for documents, rather its a little flash area that stores configuration data only. If the configuration contains sensitive information, a factory reset is enough to clear information.
They very often use standard SDRAM sticks (either SODIMM or standard DDR) or customized variants of these, to maintain temporary storage during printing. To clear these, its enough to leave printer unplugged from Power socket, with the power button on, for a day, to clear any resudial data and charge in capacitors.

Then we have those large copier Machines like Konica Minolta C224 and such. Those variants do have a harddrive. The harddrive does not contain any inportant information (with "important", I mean data Worth keeping. Non-important information, like cache, can be confidental too, but can be safely thrown away) for what I have seen. (only in the cases when the "storage box" function is used on the printer, the harddrive contains info Worth keeping, else the HDD only contains cache, and IMHO the "storage box" function is pretty useless)
Thus a standard "zeroization" can be done, that will do a "secure delete" on the drive. On Konica Minolta, this action can be initiated from the standard "administrator -> security" menu, without technician access code. However, such a action will disable the printer aswell because this also erases the second stage firmware that is also present on the harddrive, thus the harddrive has to be reloaded with the latest firmware for the printer to become functional again, and this can only be done with access to the technician access code.

Since the harddrive mostly contain non-important data, the harddrive can IMHO be safely zeroizated everytime Before the MFP leaves the premises, regardless of it it leaves temporarly or permanently.
In most times, the harddrive is also behind a access door, and can be removed to physically destroy it if requires. The harddrive can then be replaced with a new harddrive to recommision the printer somewhere elsewhere, so its NO NEED to destroy the whole printer.


Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

Use SELECT fields FROM table WHERE LOCATE(:user_input_placeholder, field1) > 0 but I have no idea how fast/slow it would be.

See https://dev.mysql.com/doc/refman/5.7/en/string-functions.html#function_locate for LOCATE(substr, str) definition

  Returns 0 if substr is not found in str, or returns the position of the occurence


Is the Amazon S3 Pre-Signed URL protected from brute force attack?

Yes. You should use AWS S3 SigV4 (various libraries support it, for example this version is required to use S3 bucket in Frankfurt region, while buckets in US Virginia might be accessible with older code using older versions of the protocol).
The signature is produced using HMAC-SHA256. Guessing a correct signature without knowing your secret access key is very hard (2 raised to the power of 128 hard). Bitcoin miners are doing a related task, and the entire bitcoin network achieves about 2^67 per second, or 2^82 per year. So 2^128 would be quite hard to achieve for your hypothetical attacker. They would get access by phishing someone who has access, not by brute force.


Why include a private key in a root certificate?

You need the private key of a CA certificate if you want to sign another certificate. This is the case with SSL interception proxies like various Antivirus products provide and also the infamous Superfish ad-injecting software.

The main problem is if the private key is easily retrievable by an attacker so it can be used (together with the certificate) inside a man in the middle attack. This is typically the case if the same certificate and key is used on multiple installations of the same software, as done by Superfish. SSL intercepting Antivirus products instead create a unique certificate and key for each installation and thus are not affected that much by the problem.

You also need the private key if the certificate should be used for client authentication, i.e. if the computer should identity itself in a secure way within TLS/HTTPS connections. But in this case you usually only have a leaf certificate which can not be used to issue new certificates. Contrary to that the certificates used in the Superfish and eDellRoot certificate are CA certificates, i.e. can be used to issue new certificates and thus can be used for man in the middle attacks.


How to remove my email from spam-lists/blacklists after malware issue?

If you are on one blacklist, you are likely to be on several now or in the next few days or weeks.  You will need to check several times.  Several services provide limited free ongoing periodic checks (more services for paid subscription).

Here are three tools you can try in addition to delisting with Barracuda itself (per answer by Nicholas Leader).  I know there are many others.  The first two provide direct delisting links or other information on how to get delisted.
https://www.ultratools.com/tools/spamDBLookup
http://mxtoolbox.com/blacklists.aspx
https://robtex.com -- RobTex site is being revamped, so for now follow the old site link, enter your ip, and look at the extensive blacklist section.

Many blacklists will delist once easily, but subsequent listing will be much harder to remove (e.g., mandatory 30 day wait since last report).  Be sure your Mac, server, etc., really are clean.  At the very least, try running several of the free scanners/tools from other (not Avast in this case) vendors on your Mac.


Do any OpenBSD protections mitigate the damage from Heartbleed?

No.

OpenBSD has measures (specifically, malloc() guard pages and wiping of deallocated memory) that should have turned Heartbleed into a crash or a leak of a whole bunch of "0x0d" bytes.  However, as noted in a blog post here, OpenSSL uses its own custom memory-management system which acts to defeat those measures.


I've heard that cookies is less secure than the session.

You must have misinterpreted  something. In fact HTTP sessions are usually implemented using cookies.

  I'm thinking that if I could get &^*Y()UIH|>Guho976879, I can still forge the cookie, right?

Sure you can change the cookie, but will it be accepted by the server as valid? If you take an actual look at the documentation you'll see:

  Cookies are not secure and can easily be modified by clients. If you need to set cookies to, e.g., identify the currently logged in user, you need to sign your cookies to prevent forgery. Tornado supports signed cookies with the set_secure_cookie and get_secure_cookie methods. ...
  Signed cookies contain the encoded value of the cookie in addition to
  a timestamp and an HMAC signature. If the cookie is old or if the
  signature doesn’t match, get_secure_cookie will return None just as if
  the cookie isn’t set.

Thus, if you try to manipulate the secure cookie the framework will notice and treat the cookie as invalid, i.e. like the cookie was never sent in the first place.


Here's a low-level programmer's point of view: yes, an IOMMU can mitigate DMA attacks. The IOMMU determines which part of the RAM devices can access. If the IOMMU doesn't let a device map a particular part of the memory then that part of the memory is immune to direct attacks from or through this device.

In practice, effectively leveraging the IOMMU can be difficult. Depending on the machine architecture, the IOMMU may have less flexibility and a coarser granularity that the MMU, so that the OS can't always implement the optimal security policy. Devices may be multiplexed on the same bus in such a way that different devices with different requirements and different levels of trust have a common IOMMU configuration, requiring compromises.

So having an IOMMU helps, but it is not an automatic defense. And, in practical terms from a system administrator's point of view, having an IOMMU is not enough, what matters is how the OS configures it.


Authenticating a device before accepting data from it

What you are describing is how some smart cards perform authentication checks. In your case however, the smart card is a USB device. The approach is similar:
One way authentication
If it is just the USB device that has to prove its identity, you should implement an authentication scheme that is run before the actual data exchange takes place. The USB devices stores a private key that it can use to prove its identity. For instance, the computer sends a challenge to the USB device, the device sends back a response that is signed using its private key. The computer (which knows the public key of the USB device) can now verify whether it is communicating with the USB device: only the 'real' device would know the private key and hence only this device is able to produce a valid response to the challenge.
You may consider a hard-coded private/public key pair if you want to deploy this solution to a small number of devices. If you want to deploy this solution on a larger scale or in a more dynamic environment, you may want to consider using certificates (e.g. X.509), like TLS does.
As deviantfan noted, be aware that revoking keys/certificates might become an issue under your conditions.
Two-way authentication
If you want mutual authentication (i.e. the USB device and the computer have to prove their identities to each other), it gets slightly more complex. The computer should in this case also have a private/public key pair, and the USB device should be aware of it. In addition to the aforementioned authentication steps, the USB device should now verify whether the computer produced a valid response to its challenge.


How can I prove that I adhere to stated privacy policy? What audits are effective for voluntary compliance?

In the European Union you have the GDPR (General Data Protection Regulation) that will be enforced on May 25th, 2018 for all member states (that includes United Kingdom).
Until now there has been a general framework that each member state would implement locally but that has led to different interpretations. This regulation will set the same terms for everyone (and very much welcome).

GDPR is not voluntary, it is mandatory for any business and institution that operates in the EU. There is not an official agency that would certify that a business is GDPR-compliant (I think this is even unfeasible as that would constraint how a business operates because an audit would be required for any minimal change in the business). But there are plenty of companies offering their services to become GDPR-compliant. Whether a business wants to advertise such compliance to its customers and whether the customers trust that is up to either party.

For your example of a website and app that does not store PII. If you have a website, you are already processing PII (the IP address for example), so you should not state that easily that you are not processing PII because it is likely that you are in probably most cases (at least, according to the GDPR, or if you prefer in the EU).

In US I cannot answer as I do not know the applicable legislation in detail, hopefully someone else can shed some light to it.


Where is Hashing Used in the TLS Handshake

There are several uses of hash functions within the TLS handshake.

Creating the master secret from the information exchanged in the key exchanged, see TLS 1.2 section 8.1. This is not using the hash function directly but a PRF (pseudo-random function) is created using hashes (see section 5).
Similar the key material used for symmetric encryption and HMAC is derived by using the PRF, see section 6.3.
And the PRF is used again in the Finished message to make sure that the TLS handshake was not tampered with.
On various places digital signatures are done which involve hashes too. You'll find these for example to protect the ServerDHParams for DH key exchange (section 7.4.3).
Another signature is done in CertificateVerify for making sure that the client actually owns the private key for the client certificate.
And of course digital signatures are used in the certificates itself, thus hashes are involved when validating the certificate chain.

And once the TLS handshake is done you'll again find hash functions used for the HMAC or in AE to protect the (encrypted) application data against manipulations.


Will changing the 'Action' for Heartbleed signatures in PAN from 'alert' to 'drop' have any production impact in my organization?

Very much depends on the signature that is used to match the Heartbleed attack. Unfortunately, most do generate false positives. I have customers with Fortigates, where they have used the rule with a 5-minute quarantine action. Results were pretty bad, they practically DoS-ed hundreds of legitimate customers. But there's a difference between quarantine and a simple "drop" policy. Your case should be a milder one.

I'd like to suggest that you monitor that alert for a period of time, e.g. 1 week and investigate the alerts, and follow up with the alerts to examine whether these are coming from a legitimate source, or are malicious scans/attempts to exploit the bug.

Also suggest carrying out a pilot/trial with a smaller team over a limited period of time.


Is it safe to install Anaconda/Spyder/Python on laptop with netbanking?

It is not "safe" in the meaning of "no risk at all" to install any kind of software on the same device you use for online banking since you don't know what the software is actually doing. This does not matter if this is open source or closed source software.

But, it is also not "safe" in the same "no risk" meaning to use online banking at all or to use a laptop, because you cannot fully trust the online banking, the browser you use, the operating system or the hardware and firmware of the laptop. Additionally you cannot fully trust your internet provider, the vendor of the router etc.

This means, that there is no such thing as "safe" in the meaning of "no risk". There is always some risk and the question is if this risk can be accepted. In the case of installing a widely used software from a well known source and keeping the software up-to-date the risk is probably acceptable. But, if you got the software on an USB stick from a suspicious person I would probably not trust it even if the person claims that this is the well known and widely used software you can also download. And, if the download was not done from the original site I would be suspicious too.

But, even if the download was done from the official site it still might be malicious in case the download site was infected. Thus, again, the risk is not zero. But, this is true not only for open source software but also for closed source.

In summary: the risk is never zero and the more software you install your on your system the larger the attack surface gets. You have to decide yourself if the risk is acceptable or not based on various factors. Closed source vs open source software might be such a factor but there are way more relevant ones, like download source or reputation of the vendor or author of the software.


What info to log/store about a user login?

You didn't provide any specifics about your app, but you generally should log much more than you're currently storing. See this logging Cheat Sheet for more details.

Generally: if you only store info about "last" actions, you have very little to work with if you need to use any of that data at a later date.

Even for a "simple" web app I've found it extremely useful to store a full log of login/logout actions, with associated IP addresses and even the User-Agent string (if it's a web app).
You should probably also log invalid login attempts (user_id, time, ip_address) to do some sort of rate limiting and/or password brute-forcing detection.

Simple example: if a user contacts you about his account being "hacked" (password was stolen or guessed), you need to have a full log of logins to do any meaningful analysis.


iOS application pentest without jailbreak

Recently, I was able to downgrade my iOS 8.4.1 to 8.4 and jailbreak. However, as you alluded to, this is no longer possible especially without the SHSH blobs.

There are ways to perform a security assessment on a jailed iOS device. The method was first detailed here -- http://forum.unity3d.com/threads/urgent-mac-app-review-team-rejected-because-gamekit-framework-linked.261354/

but further elaboration to modern mobile app penetration testing needs was discussed by Carl Livitt on the Bishop Fox blog in a two-part series:

http://www.bishopfox.com/blog/2015/02/rethinking-repackaging-ios-apps-part-1/
http://www.bishopfox.com/blog/2015/05/rethinking-repackaging-ios-apps-part-2/

You will find that some services, such as IBM's BlueMix AppScan Mobile Analyzer for iOS, will perform similar (but perhaps not the same) assessments using jailed iOS devices.

Once you have enabled use of Cydia Substrate (or cycript), it shouldn't be much of a challenge to get the standard Theos, Logos, idb, and Frida tools working. You can read more about Theos and Logos (and associated infrastructure) in the "Tweak Development Using Theos and Logos" subsection of the Mobile Application Hacker's Handbook, as well as Frida and Cydia Substrate in its section on "Attacking the iOS Runtime". More information on idb can be found in the book, "Learning iOS Forensics". Hooking some functions that accept a variety of arguments can be an additional challenge, but there is some concept code capable of hooking variadic functions.


Can I Prevent Internet Explorer from Storing Login Requests in Memory?

On a Windows machine, inspecting the memory of the IE process is limited to the owner user, and administrators. If an attacker can inspect the memory of your IE process, then that attacker has taken control of your machine and/or your account, and you are already doomed.

If the machine is "shared" then there is no really good solution: if an hostile entity can take control of the machine after you have finished using it, the same attacker could probably take control of the machine before you begin to use it, and plant a key logger, at which point your password is toast. No amount of closing/rebooting will save you. The conclusion is grim but unescapable: do NOT type passwords (or anything secret) on a shared machine.

If you are in a context where you only fear attackers who grab the machine after your usage (the "laptop theft" model), then the best you can achieve is probably to employ full-disk encryption (there are various products for that; some versions of Windows already include one called BitLocker). If you take care to shut down the machine when you are not using it, or if you mind the details about sleep/hibernation mode, then this should protect your data, including the pieces that linger in RAM.

For attackers with little competence, you could simply ensure that the IE process is dead, by closing all windows, but this would not necessarily remove all traces of the data from RAM. Your passwords may also have been written to the virtual memory file. Full-disk encryption is a more comprehensive solution.


Well, I don't see why you need to create a dictionary. You could just generate the letter combinations as the program runs. No need to generate all the combinations ahead of time.

As for generating every combination, your alphabet has 62 characters in it. So, the number of combinations up to 8 characters in length, having at least one character is:

62 + 62^2 + 62^3 + 62^4 + 62^5 + 62^6+ 62^7 + 62^8 = 221,919,451,578,090

That is about 222 trillion combinations. So, you would need to buy about 200 terabyte hard drives to store your dictionary. Are you sure you want to do that?

Also, if you could generate and write to disk 1 billion combinations per second, then it would take 479 years to write all the combinations, so you would have to have your descendants continue the project after you had passed on.


Why is validating the integrity of the plaintext necessary in addition to validating the integrity of the cipher text?

What does this additional signature component add to the authenticity of the message?

Actually I think you got it reverse here. The ECDSA signature was there first. It turned out it wasn't sufficient. This is (part of) the content of the paper "Dancing on the Lip of the Volcano" (PDF).

The idea is that an attacker like Apple can just strip the signature and replace it with a "trusted one" (as they provide the public key directory service) where they actually control the signing key. After the authentication was defeated this way the paper describes a way to send malicious ciphertexts to the recipient to slowly learn the message.

The "fix" you see here, is that they've now part of the AES-CTR key depends on the public keys of the sender and recipient. Of course these are different when the attacker strips the signature and generates a new one and then the recipient should notice the integrity check failing.

Also note that the actually sane way to fix this issue would have been to use sign-then-encrypt with authenticated encryption rather than signing AES-CTR ciphertext...

Though one has to admit, that this "fix" somewhat solves the problem assuming they really couldn't change any of the previous message format given that this simply a bit of (undetectable) structure into the previously fully-random AES key.


No, in order for network traffic to be handled correctly, it needs to have MAC and IP addresses. Encrypting these would prevent switches and routers from sending responses to the broadcasts back to the broadcaster.

However, you can use a VPN, which will allow you to connect to a different network, with a different IP address, but an outside observer will only be able to see the IP address on the IPsec traffic, not the IP address of the network you connect to.

On a side note, you can also change your MAC address on a per-network basis. While this doesn't encrypt the MAC, it will prevent MAC address tracking between networks.


Is sending plain passwords over SSL as part of a password update process bad?

Actually, I'd argue that it's better UX to clear the fields. Assuming the password fields are full of asterisks, the user is going to delete the whole field anyway when they retype their password.

In addition, you're opening yourself up to a new security risk. There are possibilities for XSS, shoulder surfing, and also any time you send passwords anywhere you've increased your risk in general.

I've never visited a site that's kept the password fields filled had I entered something incorrect. The only field that has been filled was the email field, and possibly address/phone number.

You always have to assume the worst, and if you can plug a hole do so. I don't think the security auditor is over the top, especially since this is an easy fix for a really non-existent UX issue -- and if you're sending back their passwords and showing them without changing each character to an asterisk, then you definitely have a security issue. The only time somebody should see a password they enter is if they select an option to allow them to see it temporarily.


How can you check the installed Certificate Authority in windows 7/8?

To view your certificate stores, run certmgr.msc as described there. The "root" store contains the root CA, i.e. the CA which are trusted a priori. certmgr.msc shows you an aggregate view of all root CA which apply to the current user; internally, there are several relevant stores (the "local machine" stores apply to all users, the "current user" stores are specific to the current user; and there also are "enterprise" stores which are similar to "local machine" but meant to be filled automatically from the AD server of the current domain).

See this page for a list of all CA that Microsoft puts in Windows by default; any discrepancy would be a local variation. The list is occasionally updated, and this is propagated to your computer through the normal Windows update mechanisms.


Do wifi access points and routers get some kind of data from devices when a device is able to see them?

That depends on the scenario, and what kind of information you are worried about.
In order to make the following examples less cluttered, I will always be calling the access point "AP" and the client device "Client".

AP Broadcasts, Client does not want to connect

Depending on how the client is set up, it is possible that the client regularly sends out broadcast messages, containing SSIDs they have connected to before. This is required if those SSIDs are "hidden".

As such, a malicious AP (or anyone else listening) could gain information about SSIDs the client has been connected to. These broadcasts also contain the MAC address of the W-LAN interface of the client.

AP Broadcasts, Client wishes to connect

In this case, the AP absolutely gains information about the client. Afterall, it needs this information to send data to the client.

The client has to disclose their MAC address, and like above, may disclose other information about previously connected to networks.

What information does my MAC address show?

By default, it shows the manufacturer of the NIC (the network interface card), which could give information about the nature of the device. For instance, a MAC address starting with 00:22:AA belongs to a NIC manufactured by Nintendo. So it's probably a game console. Further investigation into the MAC addresses might reveal more information about the device.

How reliable is this information?

Not at all. In fact, anyone is able to change their MAC address as they please. The only thing required for their MAC to work properly is to be unique within the domain. And if it's not, that opens up all kinds of attacks, which I am not going to get into.

The key point is that MAC addresses can be changed quite easily, and thus any information received by a MAC should be taken with a grain of salt.


Is it insecure to temporarily save user's data in a session while they register?

It is never ok to store a user's password in plain text. Let them retype their password.

Perhaps letting their browser's form filler remember the data will work better. Those are generally careful about doing the right things with passwords.


Spam/Phishing detection when there is no MX record

I tested with a simple email spoofer and Office 365 (Forefront), and the spoofed email gets scored as suspicious (score of 5/9). The headers are inscrutable so it is difficult to see just how much the lack of MX record contributed to the score.

The same test to Gmail, a couple of times, and it never even got delivered.

Both of these tests should be repeated with much more rigor, however.

SpamAssassin has a rule NO_DNS_FOR_FROM for domains without a MX or A record. (Thanks @pornin)

So, it seems that a lack of MX records does factor into the spam score. Perhaps we do not need to add SPF to all our unused domains since spam filters appear to account for this problem.


Is Bluetooth on cellphone a reliable protocol for encrypted text transmission?

Is Bluetooth here a good solution?

From the perspective of security it does not matter if the communication channel (Bluetooth) itself is secure since only encrypted messages are transferred anyway in your design. Attacks at the Bluetooth stack on the senders device might be possible though which can compromise the senders device - see for example the Blueborne attack. This might give the attacker access to the messages before encryption.

Additionally, a bug in your encryption application might allow an attacker to hijack your encryption application with corrupted messages and thus also get access to the plain messages. This is actually independent from the communication channel used.

As for non-security properties like reliability or bandwidth: it is possible to create a reliable protocol on top of some unreliable. And for the usual text messages send by a single person the bandwidth should be enough. Even if bandwidth is no longer sufficient (like when sending videos) you can use WiFi - the risk is about the same (i.e. also vulnerable drivers) but the bandwidth is higher.


Can a 32-bit virus infect a 64-bit executable in Windows or Linux?

It depends on what vulnerability is exploited by the virus. Some vulnerabilities are highly specific and would only work on a specific version of the library, even within the same architecture. Others are more general and can only be used against a wide range of versions and can be easily portable between architectures and even operating systems. For example, browser exploits (JavaScript or browser plugins) often runs cross platform, so it's often used to then select and deliver a platform-specific exploit.


Hiring an AppSec Engineer - What to look for?

When you hire someone, you do so because you expect that they provide value to your company. What are your expectations for your Application Security Engineer?

If you answered "To make our product more secure", then it seems to me that you have not really thought too much about security. Perhaps it's also not your area of expertise, which is fine too. We all started at some point.

Ask yourself, what do you actually want this person to do? Are you looking for someone who finds flaws and suggest reactive measures? Or are you looking for someone who improves your processes and overall code architecture to improve your security proactively?

Once you have settled for what you actually want the future employee to provide for your company, ask yourself how their skill set fits into this. For instance, if you are dealing with a codebase that is very broken due to no existing security knowledge at all, then perhaps someone who has good experience building secure architectures may be a good option.

But don't be discouraged if a future employee does not 100% fit the role you had hoped for them to do. People evolve, and if you actively aim to getting this employee where you want them to have (e.g. by offering them specialized training, sending them to conferences, etc.), then you will inevitably end up with someone very valuable to your company infrastructure.

I know that "It depends on what you want" is not the answer you may have hoped for. It certainly would have seemed to be much easier if I had listed a number of skills and certifications that person would need to have, but ultimately this isn't the way you would want to go.


Failure to capture any packets on wlan0 in monitor mode

tcpdump will dump all IP packets captured from the network you are currently connected to. According to your explanation and elements, you've made the interface be up but you haven't connected to any Wi-Fi network: no network, no network packet to capture, so no tcpdump output, it's all simple as that.

You must first connect to an Access Point, then you can examine IP activity of other devices connected to the same Access Point as you.

At last, do not confuse tcpdump which will capture clear Network layer packets, with lower-level and wifi dedicated tools like airodump-ng which will allow to capture raw "Wifi" frames as they go on the air (ie. mostly ciphered). However, not all wifi adapters allow this (the chipset being classified as "Unknown" by airmon-ng leaves me quite pessimistic about yours...). It is frequent even on devices already equipped with an internal Wifi adapter (laptops, etc.) to use another external one, generally USB, for Wifi security testing.


PCI - prohibiting direct connections to the Cardholder Data Environment

The Guidance column of PCI DSS 1.3.3 (v3) states:

  Examination of all inbound and outbound  connections allows for
  inspection and restriction of  traffic based on the source and/or
  destination  address, as well as inspection and blocking of  unwanted
  content, thus preventing unfiltered  access between untrusted and
  trusted  environments. This helps prevent, for example,  malicious
  individuals from sending data they've  obtained from within your
  network out to an  external untrusted server in an untrusted network.

This means firewall controls and content controls (IDS/IPS, WAF, DLP proxies) should be used to limit CDE ingress/egress.  Permitting traffic in to limited, necessary ports is okay.  Permitting broad traffic in to unnecessary ports is not okay.  Permitting unregulated outbound traffic which could allow an attacker to exfiltrate data is not okay.

It really boils down to "preventing unfiltered access between untrusted and trusted environments."  I'll grant you the wording isn't directly useful.

(There is no guidance column in PCI DSS v2, but the requirement itself is the same, and the whole point of adding a guidance column with v3 was to provide, um, guidance to clarify the intent of the requirements.  So it's valid whichever version you're working with.)


Is it possible to use Gutmann method for single SQL cell ?

No. A database is several layers of indirection above the actual storage while the Gutmann method relies on writes getting more or less directly passed through the hardware. Changes to data in the database will often not even overwrite data (which is a fundamental requirement of the Gutmann method) but instead write the new data on a different position and once the transaction is completed declare this new data the current one. Additionally older data remain in transaction records and backups.


Who (Designer or User) Should be Resposible for the Correct/Secure Usage of a Tool Intended for Developers/Admins?

Many forms of restricted usability exist to protect developers from negative perceptions resulting from widespread misuse. It's a numbers game. If RunAs was less restricted, related security failures would be the fault of the script authors (IMHO), but the industry might believe that the underlying software was insecure. If a junior admin got in trouble for embedding passwords in their scripts, they might also get angry that the mistake was so easy to make.
The "Right to Repair" discussion has a similar reasoning. It's partly about preventing shoddy repairs from being associated with the brand. If a "reconditioned" iPhone breaks easily, it's likely Apple that will be blamed to some extent, even if the reconditioning itself was at fault. It comes down to control over the quality of a product after it's in the hands of the user.
Who is responsible? Whoever is most likely to be blamed when something goes wrong. Perception is reality, especially when money is at stake. RunAs can be used in so many ways... the "misuse surface" is huge, which was likely a factor in their decision. It makes sense, even though the resulting annoyance factor is obvious.
Where should the line be drawn? Where enough users can't reasonably blame the developer for something that the user had control over. This is usually a function of how competent the user/team/company is when it comes to articulating their level of due diligence and ability to mitigate issues that arise. How much risk is acceptable vs. how many users will complain.
What design responsibilities do developers have? Developers should strive to provide idiot-proof security measures, while still allowing super users the flexibility they need. Elegant solutions do exist, and we should have enough empathy for the users to seek those solutions out.


MacOS able to access data without password

If the disk is not encrypted, there is simply no way to prevent such attacks. Sure, you can make it slightly more cumbersome by requiring the attacker to insert the disk into another computer to modify files, but this is a trivial task that can be accomplished in five minutes.
The antidote to this is encrypting the disk volumes. This effectively blocks access to data, even if you're able to read and write the raw disk volume.


Difference between binary malware and script-based malware?

In an interpreted programming language the interpreter is compiled for each architecture but the scripts they interpret can generally be interpreted on any platform. Generally functions which might be operating system dependent (such as various system calls) are abstracted so the functions available in the interpreted language work the same regardless of OS.

Also relevant:
Can a .sh file be malware?
http://en.wikipedia.org/wiki/Interpreted_language


How do I protect my passwords from WebBrowserPassView?

You're really asking the wrong question here
Really what you should be asking is:

Should I be worried that I can use tools to look at passwords stored in my Chrome browser?

And the answer to that is... Kind of. Really the best way to prevent that from happening is to keep your systems hardened. If someone gets access to that data, you've already lost everything. That's because at that point they have gained access to your OS/Computer as a whole and can do whatever they want. They have access to your browser, which means they can hijack your sessions easily, and do any damage they want all without ever having to sign you out of that session. This is true of any open sessions you have on your browser at the time, regardless of whatever password manager you use.
Why?
Because Chrome already stores your passwords in the encrypted user area of your disk.
Really using a master password as an encryption versus the already encrypted areas of your OS is nothing more than security theater. If they get that sort of access to your machine where they can get that file anyways, it's game over man. They have full control over your entire system.
How do I prevent this from happening?
By keeping your computer safe and secure. Don't lend access to it to people you don't trust, don't leave it unlocked, don't use a weak password, and don't just leave it unlocked when you walk away. Did I mention don't leave it unlocked if you aren't using it?
A great post on it from Justin Schuh:

I'm the Chrome browser security tech lead, so it might help if I explain our reasoning here. The only strong permission boundary for your password storage is the OS user account. So, Chrome uses whatever encrypted storage the system provides to keep your passwords safe for a locked account. Beyond that, however, we've found that boundaries within the OS user account just aren't reliable, and are mostly just theater.
Consider the case of someone malicious getting access to your account. Said bad guy can dump all your session cookies, grab your history, install malicious extension to intercept all your browsing activity, or install OS user account level monitoring software. My point is that once the bad guy got access to your account the game was lost, because there are just too many vectors for him to get what he wants.
We've also been repeatedly asked why we don't just support a master password or something similar, even if we don't believe it works. We've debated it over and over again, but the conclusion we always come to is that we don't want to provide users with a false sense of security, and encourage risky behavior. We want to be very clear that when you grant someone access to your OS user account, that they can get at everything. Because in effect, that's really what they get.


Sending database name in request headers

This is not a good idea. An attacker could change the database name, supply an invalid one, or put special chars on the database name and possibly exploit a SQL injection. It's possible to do a lot of damage depending on your setup.

You could use server-side sessions, and send only the session token to the user. The database he is connecting to should be stored on the server side session.


Can I resubmit my GPG key to a keyserver?

Yes, of course. Sending should update the copy on the keyservers adding the new signatures (note that it is possible that they already had those signatures which would lead to no changes on their copy).

Additionally, while this would be the traditional action by the keyservers, please note that some keyservers may be read-only (not allowing you to upload keys by hkp), or even discard signatures automatically if they are from unknown keys.


Typically, this is done simply to save space and performance reasons. No one can reasonably keep logs forever, as this would take a lot of space, and huge logs don't make Web servers happy.

Moreover, there is simply no reason. As far as I know, there is no regulation forcing you to keep logs literally forever. A few decades, at most, depending on your industry. So it would be an unnecessary expense.

Finally, I am not a legal, but there might be regulations (probably GDPR) forcing you to not keep logs forever, i.e. to delete them after a while.


Determining the entropy of a string if each character has a slight bias

My concern is that my character selection is biased. Because 10 doesn't divide evenly into 256, the first 6 VALID_CHARS are slightly more likely to occur.
The secret space is 10^32, but my generated secrets have less entropy than that. How can I calculate precisely how much entropy I actually have?

Because not every digit is equally likely you can not set
p(i) = 1/10

for all the digits.
Rather, you have
p(0) = p(1) = ... = p(5) = 26/256

and
p(6)=...=p(9) = 25/256

So, use the usual formula for entropy:
e = -Sum[ p(i) log(p(i)) ] = -6*(26/256)*(log2(26/256))-4*(25/256)*(log2(25/256)) = 3.32166...

to get the numerical value of "entropy" e for one digit (n.b., if p(i) were 1/10 for each digit then this would be e=log(10), but it is not)
Then the entropy for the full string of 32 characters is:
32*e = 106.293...


Can a DH param .pem file force the usage of only a single type of diffie-hellman exchange

No. The type of exchange is set by the cipher suite, which agreed upon by the client and server during the handshake. As such you cannot specify, say, DHE vs. ECDHE in the DH parameters file. If you want to control that you should configure the supported cipher suites and the preferred cipher suite order on your server.


Compliance with an industry recognized framework - ISO27k

Because this is a client requirement and not an internal motivation to naturally "grow into" a security program, this is not a trivial task because you have time constraints (One would assume).

Assuming, then, that you need 3rd party verification of your alignment to a framework, you are going to need to find a qualified, certified person in the framework you hope to align with. ISO2700 has certified consultancies that help organizations do exactly this. COBIT also has a certification that individuals can get to prove that they know how to audit an organization against COBIT.

Seek a firm that will help you through it and ask for their certifications and experience.


Why is Windows Explorer making external connections?

This is normal and expected behavior for windows system.
The IP you mentioned resolves to sinwns2012412.wns.windows.com.

The Windows Push Notification Services (WNS) enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.

How it works:
The following diagram shows the complete data flow involved in sending a push notification. It involves these steps:

Your app sends a request for a push notification channel to the Notification Client Platform.
The Notification Client Platform asks WNS to create a notification channel. This channel is returned to the calling device in the form of a Uniform Resource Identifier (URI).
The notification channel URI is returned by Windows to your app.
Your app sends the URI to your own cloud service. This callback mechanism is an interface between your own app and your own service. It is your responsibility to implement this callback with safe and secure web standards.
When your cloud service has an update to send, it notifies WNS using the channel URI. This is done by issuing an HTTP POST request, including the notification payload, over Secure Sockets Layer (SSL). This step requires authentication.
WNS receives the request and routes the notification to the appropriate device.

Reference: https://msdn.microsoft.com/en-us/library/windows/apps/hh913756.aspx


Pros/Cons to OpenVPN vs "VPN over OpenSSH"

I don't see any security issue there. SSH is supposed to be secure and all the data are passed thru the SSH tunnel. So, yes, I believe it is secure enough. The only issue I see is efficiency. SSH is TCP protocol. TCP traffic is passed through an another TCP protocol. The packets are double "acknowledged" by the 2-layer of TCPs. Better protocols are built on UDP or even IP.

I've never used SSH tunnel like this. I have only experience with SOCK V5 protocol (ssh -D), and I haven't realised any significant network speed degradation issue.

Sorry for trolling, but I can't help myself... Unsupported windows platform isn't an issue for me, since I don't use any window :-)


Which of these ports are safe to leave open, which are not?

Assuming you scanned from outside your network, nmap is showing you what you're listening on.  It only affects inbound.  You can close the ports.


How does verifying the chain of trust for certificate based authentication work on the server side?

Providing the full chain (that is all intermediate certificates but not the root certificate) is actually the normal way to exchange certificates since the other party is only expected to have the trusted root certificate. This is true for both client and server certificates.

Still, it should be possible to provide chain certificates which the client does not send within the same CA file where the server has the trusted root CA(s) used for client authentication. Note that with SSLCACertificateFile you specify a file which can contain several certificates (simply concatenated) and not only a single one.


Can email services upload files from your computer without your permission/knowledge?

Depends what you mean by "email service", since as a general rule you're using some client to access an email service, and clients have different capabilities and restrictions.

For example, mobile clients (smartphones) usually provide some support for Mobile Device Management (MDM). While MDM doesn't often involve retrieving files from the device - it's more focused on things like "ensure your device has a strong PIN" and "allow the company to remotely wipe your device if it gets stolen" - in theory it's possible. Some MDM solutions allow the company to install arbitrary apps to your phone, and those apps could potentially access your files and send them back to the company. Mobile email clients vary in how much MDM they support, with the built-in apps usually having the most (though exactly how much that is depends on which mobile OS you're using) and third-party apps (from the store) usually having much less, if any.

Desktop PC clients (Outlook, Thunderbird, Mail.app, etc.) tend to be much more under your own control. Some offer a little bit of device managmeent, but I'm not aware of anything that would let the company read arbitrary files. The company may require you to install and run some other program (like a VPN client) before you can access the email server, and that other program could do things like you describe, but the email client itself probably cannot. At least, it won't do such things just because you connect to the mail server. One could certainly write a (for example) Outlook add-in that contains some sort of corporate spyware, but they can't automatically install that add-in on your computer; you'd need to do that yourself.

Webmail clients (Gmail, Outlook Web Access/App, etc.) are actually the most restricted. Webmail is, of course, accessed through a web browser, and web browsers have very tight restrictions on what a web site can do (among other things, these restrictions prevent accessing files on your computer unless you manually upload the file to the web app). Furthermore, most browsers (Firefox being the notable exception) have sandboxes so that even if a web site compromises the browser, they still can't access most of your computer. Of course, there's still the add-in/extension attack vector - if your company requires you to install a browser plugin before you can access their email, that plugin could do anything including read files - and also the potential VPN client issue.

So, technically speaking, no. An email service should not be able to monitor your files or computer usage. In the case of a mobile device, maybe it would be possible, but with a desktop PC or especially with webmail, nope. Not without completely compromising the security on your email client and taking it over.

That brings me to the second point, which is that employing spyware like that on privately-owned computers without the user's knowledge and consent would be illegal in most jurisdictions (even if they didn't need to compromise software on your computer - which is itself illegal - to make the spyware run). Now, spyware is not illegal per se; if you install a VPN client and it tells you it's going to monitor your computer usage and you click OK anyhow, then you've consented to having your computer monitored by that software. If it doesn't tell you that but does it anyhow, though, you'd probably have a solid case for a lawsuit (I am not a lawyer, this is not legal advice, please review your own employment contract and/or legal code, and hire a lawyer if you need legal advice).


Is a security association (SA) implemented in ESP and AH protocols?

My question is: Is SA implemented when using AH and ESP protocols, or
  only in ESP when confidentiality is required?

SA is also required in AH. To quote RFC 4302:

  3.3.1.  Security Association Lookup

  AH is applied to an outbound packet only after an IPsec implementation determines that the packet is associated with an SA that calls for AH processing.

There's no AH unless the SA says so; therefore AH requires an SA.

  How does the router know whether to use IPsec or not? By using the
  protocol field in the ip header?

Correct, IPSec runs over IP protocols 50 (ESP) and 51 (AH), as opposed to protocol 6 (TCP) or 17 (UDP) for more normal traffic.

More information about Security Associations and IP Traffic Processing can be found in the Security Architecture document, RFC 4301.  For example, section 4.1 of that document reiterates that AH requires SA in a more roundabout way:

  Security services are afforded to an SA by the use of AH, or ESP, but
  not both.  If both AH and ESP protection are applied to a traffic
  stream, then two SAs must be created and coordinated to effect
  protection through iterated application of the security protocols.


SSH over VPN blocked on certain networks

From my comment: The coffee shop B may be assigning you a local IP address in the 10.X.X.X range, (which is in the range of the host your attempting to SSH to through the VPN) and that may be your conflict.

Resolution: After a bit of searching I found a similar question and answer over on server fault. The easy solution is to change your internal IPs to a range that's not allocated by most coffee shops, hotels, etc 10.123.0.* maybe.  The complicated solution that's more reliable is not tricks as mentioned in the accepted and we're.


Can a malware infect just by right clicking?

You're basing this on the assumption that the scr file was the source of the infection as supposed to a backdoor downloaded by an established trojan. It is possible to get infected from a number of different ways, including a preview thumbnail. Hence why you should always perform malware analysis using virtual machines or seperate dedicated hardware.


How to generate ec256 private public key in hex format

This is using the NIST P-256 curve aka secp256r1 (RFC 4492) aka prime256v1.

You can create key pairs and print them in hex format using OpenSSL, e.g.

$ openssl ecparam -name secp256r1 -genkey | openssl ec -text -noout
using curve name prime256v1 instead of secp256r1
read EC key
Private-Key: (256 bit)
priv:
    2c:23:47:d5:a6:a2:9e:32:28:ae:7b:8d:7b:a2:67:
    87:eb:e6:57:e0:51:76:59:1a:6b:f8:a7:17:9b:d3:
    b9:18
pub:
    04:ab:e6:db:26:cc:b7:4c:d0:03:24:52:8e:96:33:
    50:19:21:ce:50:c5:34:b5:57:b7:bc:ac:63:d1:eb:
    06:e4:53:76:95:46:39:d2:54:38:e0:a7:52:3c:00:
    fe:0a:66:1d:10:cd:ed:ed:75:b5:72:50:e8:ee:17:
    99:d0:39:62:b6
ASN1 OID: prime256v1
NIST CURVE: P-256

Of course they are not in such a beautiful 4x8 alignment, but easy enough to replace : with , 0x

2c, 0x23, 0x47, 0xd5, 0xa6, 0xa2, 0x9e, 0x32, 0x28, 0xae, 0x7b, 0x8d, 0x7b, 0xa2, 0x67, 0x
87, 0xeb, 0xe6, 0x57, 0xe0, 0x51, 0x76, 0x59, 0x1a, 0x6b, 0xf8, 0xa7, 0x17, 0x9b, 0xd3, 0x
b9, 0x18

and then do the rest manually, if you use this hard coded into your program:

    {
        0x2c, 0x23, 0x47, 0xd5, 0xa6, 0xa2, 0x9e, 0x32,
        0x28, 0xae, 0x7b, 0x8d, 0x7b, 0xa2, 0x67, 0x87,
        0xeb, 0xe6, 0x57, 0xe0, 0x51, 0x76, 0x59, 0x1a,
        0x6b, 0xf8, 0xa7, 0x17, 0x9b, 0xd3, 0xb9, 0x18
    }


Intel AMT vulnerability - How is it a local threat?

As @polynomial explained above: "If the [LMS] service isn't running, it can't be exploited."

However, in terms of a local environment, it would be more accurate to state: "As long as the service is not running on the target computer or any computer with permissions to manage that computer" then the is no exploit to be had.

For example, if the DC has LMS running, but the CEO's computer did not, the DC could be compromised, and group policy could be used to install LMS on the CEO's computer, and then AMT could be accessed.


What actually happens in "low voltage fault attacks"

"Fault attacks" are something you do on some hardware:

that is in your physical hands,
but is shielded against intrusion ("tamper resistant"),
and does computations with values that you don't know but would like to ("cryptographic keys").

Example of such hardware are smart cards. A classic scenario would be: you have a smart card for a satellite-TV decoder; you got the card through a normal subscription to the broadcaster; you wish to make 3000 copies of that card so that you may resell them to people who want free/cheap TV. People do that.

A fault attack is when you induce the shielded hardware to get things wrong by changing its environment. For instance, you try to run the card in an oven, at a temperature which is beyond the nominal operating temperature of the card. The attacker's hope is that by analysing what the card returns when it failed, he may gain some insight on the secret values stored in the card (this is of course very specific to what the card computes and how things are implemented in that card). A low-voltage fault attack is a fault attack where the fault is induced by feeding the hardware with a lower-than-normal voltage (in the "smart card" model, the card has its own CPU, RAM and ROM, but the current and clock signals are provided externally, i.e. are under the control of the attacker). For instance, if the card expect 3.3V, you give it only 2V. The real trick here is that the attacker can lower the voltage for only very short durations, a few clock cycles, so as to induce a fault in a specific part of the algorithm execution.


Secure sharing between Windows computers

SMB 3.0 (Windows 8 / Windows Server 2012, or newer) supports encryption. To enable it, use the PowerShell commands on this page (verified on Win10 Enterprise, non-domain-joined). By default, once enabled on the server, unencrypted or legacy connections will be rejected. This also automatically enables integrity (signing) checks.

I don't know of any way to enable Win7 (or older) machines to connect to an encrypted SMB share (it's not possible to install SMB 3.x on legacy Windows versions). The next best option may be IPsec, which is supported in most Windows versions but is not trivial to set up (much harder than running a single PowerShell command, at least).


First of all, based on Kerckhoffs's principle, you must assume that an attacker knows the algorithm you used to hash the passwords, so doing things differently than others won't make you secure by default.

While your algorithm is  based on MD5, it's a entirely different algorithm. How do you make sure that you didn't reduce its strength by performing your own calculations on top of it?

Finally, this question seems to be about password hashing. In this context, hash algorithms are expected to be slow. MD5 is fast. Shuffling an MD5 is fast. Your algorithm is fast. So you shouldn't use it for password hashing.


Is my website vulnerable if I use Access-Control-Allow-Origin * for a section?

This question has an answer here:
https://stackoverflow.com/questions/12001269/what-are-the-security-risks-of-setting-access-control-allow-origin
In short, it allows any website to make calls to your API throught your client's device. If your client enters malicious page and his browser executes the page's malicious JavaScript, then his browser can make malicious requests to your API, and your API won't know the difference. But if your API is not providing any sensitive/secret information (as I think is the case here) then it doesn't matter.


Protect session id without SSL - Accepted answer on Stack Overflow seems wrong?

What this answer is about is client-side storage.

The first premise is that all of this occurs in a SSL session, so this won't be intercepted by third parties. The remaining attacker, if any, is the user himself. In particular, only the actual user can send back the cookie value to the server.

Then the server wants to manage sessions, i.e. consider successive requests from the same client to be part of a whole "story". This implies that the server must remember session information from one request to the next.

Server-side memory implies two main issues:

The amount of storage on the server can grow quite high. Indeed, successive requests from a given client can occur with a rather large delay in-between (minutes, even hours or more). Also, a given client may stop sending requests altogether, and the server won't be warned about it. So on a busy server, we are talking about saving tens of thousands or more of "session information" objects. This can translate to a non-negligible number of megabytes of RAM.
If the server is multi-frontends, the user session information has to be shared between the frontends, which implies some extra communication, often with a shared database, which in turn can imply performance issues (a database is not as fast as pure local RAM).

So it would be neat if the user session information could be stored on the client himself. This is what this cookie+encryption+MAC scheme is about. The server packs what it wants to remember about a user session into a blob which is sent to the client; it is then up to the client to send it back with the next request. The server does not store anything on its side. This scales nicely to millions of users and dozens of frontends, since the server does not have to remember anything. It implies, however, its own challenges:

Since the data is stored on the client, the client may inspect it, which is not necessarily a good thing. Encryption solves that.
Since the data is stored on the client, the client may modify it, which is not necessarily a good thing. MAC solves that.
Since the server remembers nothing, it cannot prevent replay attacks where the client sends an old cookie value again. Including a date (under the protection of the MAC) mitigates this problem.
Cookie size is traditionally limited to about 4 kilobytes, so the server won't be able to make the client store much more data than that (well, the server could send several cookies, but reassembly becomes hard, especially if you want to do it securely).

The user name, SSL session identifier, or IP address, is just a non-secret identifier which is meant to prevent different users from swapping their cookies, voluntarily or not. For that matter, IP address is not a good identifier, because several users may share the same IP (in case of NAT or use of a Web proxy) and a given user's IP address may change (dynamic IP are not uncommon).

Now the specific scheme explained in the SO answer can be questionable; e.g. it applies the MAC on the cleartext data, not on the encrypted data, which is known to have potential issues: this is known as "encrypt-and-MAC". The potential problems can be avoided, but this requires some extra care in the implementation, so "encrypt-then-MAC" should be preferred. The reuse of the same key for the encryption and the MAC is also, generically speaking, a bad move; though it seems safe enough when the MAC is HMAC and the encryption uses some block cipher, we really prefer it when the two keys are somehow isolated from each other. A modern and more obviously secure way to do encryption and MAC would be to use one of the encryption modes which have been designed to do exactly that, e.g. GCM or EAX.

The idea is still sound (as long as all this occurs under the protection of SSL). The main remaining issue is dealing with replay attacks, which, depending on the application, may or may not be serious; the inclusion of the date in the cookie data allows the server to enforce an explicit expiration strategy to control this issue.


How can SharedArrayBuffer be used for timing attacks?

SharedArrayBuffer allows two threads to share state, so one can operate as a "clock" (incrementing the timing signal) and the other can read the "clock".  Additionally, the availability of the Atomics object allows performing operations on the SharedArrayBuffer in a fashion that makes incrementing efficient and can be seen by the reading thread without the risk of a race condition.

This timer is, admittedly, only in units of "how fast the other thread increments" and not "seconds", but for timing attacks, the interesting data for an attacker is relative timing.  Knowing that a given cache line (in the case of Spectre) loads faster than others reveals that it has been precached by the CPU.  The same holds true for timing attacks on things like password comparisons (correct characters take some proportion longer than incorrect characters).

It would be possible to calibrate a fast timing loop against a known clock reference (i.e., from performance.now()) to get an average time per increment, but there would still be some small jitter.


When checking a session variable to see if a user is logged in, is it enough to check to see if the variable is set?

There are other things to consider to get a secure session handling, like using SSL, regeneratig the session id, and more. But to get the login state from the session, it is enough to test if a certain value is set, like you did.

Of course you can store additional information about the user connetion in the session, but password and ip-address are not appropriate. Especially the password should not be stored plaintext on server-side, and that is what you need to check the hash in your example. The ip-address is not a reliable information, it could be dynamic and change during the visit of the user. In this case the user would be denied access, even if he had logged in successfully before.

If you want to store additional information, i would recommend to write this fingerprint into a separate variable like $_SESSION['client_fingerprint']. There is an article from Chris Shiflett (see section: Preventing Impersonation), it shows that there are not many informations appropriate to generate this fingerprint.


[Tor] without anyone being able to track my ip back

Yes, that's the purpose of the protocol. It does suffer some risks of exposure from protocols that run on Tor... e.g., accessing a website that has previously set a cookie identifying you address from when you visited before using Tor.

  in order to protect myself from hostile hacking

Keep in mind that any traffic of yours leaving an exit node is no longer encrypted. The exit node can read and alter your traffic if it wishes.

The full list of weaknesses (or "user control considerations" if you will) is long. I'd start with http://en.wikipedia.org/wiki/Tor_(anonymity_network)#Weaknesses and go from there.

Tor's increase to anonymity doesn't not correlate with an increase in security in other forms.


If the IP address's GPS coordinates is far enough from me, could a hacker be on my line?

Getting the location from the IP address is simply done by a database lookup and different providers might use the same database or at least similar sources. This explains why you find the same physical location with different providers.

The accuracy and precision of the entries within the database varies widely. To cite from whatsmyipaddress.com: How accurate is IP GeoLocation?:

  Accuracy rates on naming the city from an IP address vary between 50%-80%.
  Determining the nation of an Internet user is 95%-99% percent accurate, for reasons that have to do with how IP addresses are allocated and registered.
  Determining the physical location of the user, down to a city or ZIP code, is trickier and less accurate.


Security measures against packet sniffing

When you feel your local computer network is insecure, there are five main approaches.

Ensure that your computer and the destination computer use encrypted network protocols. (e.g. IPSEC) This encrypts any and all traffic from your machine to the destination machine over the whole of it's journey.
Establish an encrypted tunnel between your computer and a trusted network. (e.g. VPN). This encrypts any and all traffic from your machine to any destination over the untrusted part of it's journey.
Use only applications that encrypt their communications. (e.g. HTTPS). This encrypts your communications with just that application over the whole journey.
Encrypt sensitive files before sending them over the network. (e.g. zip them with AES enabled). This only works for the very specific scenario where you are sending discrete files.
Don't use the network at all. (e.g. go home) This is safest and should be your default position. If your attackers can sniff, they may well be able to alter, and then you have to start worrying about Man-In-The-Middle.

Which to use depends on precisely what you are doing. If it's just "read my private gmail and do my online banking" then HTTPS should be enough, but if you want to hide all your private online activity then a VPN to home might be a better idea.

Lastly, bear in mind that your employer may not want you to be doing any of this. Apart from stopping you goofing of, some organisations want to read everything you send out of their network to ensure you are not leaking confidential information. So may try and block any and all of these, either by policy or with technical controls. Again, the safest method is to do your private stuff somewhere else.


Security Onion VMWare + OpenWRT IPTables Mirroring

Update 1/13/18 - Resolved the issue. The wireless card was having troubles with vmware & promisc mode. Once I changed the medium (CAT5E), I was able to see all inbound traffic from other hosts in the subnet!


Is NTFS file compression vulnerable to a CRIME-like attack when using an encrypted volume?

According to this blog message, NTFS compression is per-file: it can be activated on each file individually, or on the whole volume, but even in the latter case, each file is compressed independently of the others. This makes sense because data redundancies are often intra-files, not inter-files, and doing otherwise would be quite hard anyway.
CRIME-like attacks work when the attacker can insert his own data which is compressed along with data that the attacker wishes to guess (in the case of CRIME, the secret data was an HTTP Cookie in a request where the attacker gets to choose the target path). To transfer that to NTFS compression, you must imagine a system with files that the attacker cannot read, containing data which is interesting to the attacker, but such that the attacker can insert some contents of its own in the file.
Also, CRIME-like attacks require that the attacker can observe the compressed size. I am not sure that Windows offers an access to that information, and, crucially, can yield this information for files which the attacker cannot read. To some extent, the attacker can observe the free space total count on the volume, and thus guess the efficiency of compression on a single write, but with a high granularity (that of a cluster, i.e. a few kilobytes). If the compressed size of the target files can be observed with byte granularity by the attacker, then I deem CRIME-like attacks a plausible thing.
For instance, imagine a file containing unencrypted user passwords, and user-chosen "display names". By registering new users with crafted names, the attacker would try to exploit similarities between the crafted names, and the passwords of the other users.


Executing external process from Java security

The pipes can be accessed via /proc//fd/.  This means that under a default configuration, only root and the process owner can open them.  Therefore, you can consider the pipe to be as safe as the local filesystem.


Does hashing a PRNG make it cryptographically secure?

Hashing the output of a RNG is typically a component of making a cryptographically secure RNG, but it's not magic. It can't make a crappy RNG suddenly secure.

A key component in a cryptographically secure RNG is absolute unpredictability. If you can predict the output, then you can use that prediction as part of your attack. Running the output through a hash doesn't change the predictability.

Say, for example, that my super awesome random number generator alternates between returning the number 4 and 7. You can argue that my RNG is horrible, and you'd be right. But let's say that you now run the output through SHA1. So it alternates between returning SHA1(4) and SHA1(7). Still not random. So the answer is NO.

But hashes are useful for crypto RNGs

On the other hand, lets say you have a true source of entropy (e.g. a geiger counter pointed at a block of plutonium) which generates provably random but in our case biased results. Due to our sampling apparatus, the output stream is 57% 1's and 43% 0's. It's random in that you absolutely cannot predict the results, but if you guess "1", you'll be right more often.

We can neutralize this bias by running the output through a cryptographic hash. One of the properties of a cryptographic hash is that the output is NOT inherently biased, no matter what the input is. Obviously we have to collect sample blocks of input long enough to prevent ever hashing the same value twice. But the final output will have an approximately equal number of 1's and 0's, which makes our crypto more secure.


Home Banking, antivirus safe environments OR Linux on virtual machines?

A virtual machine can't protect the guest OS from the host (without specialized hardware features to support it). You will not gain any security from running Linux in a VM if Windows gets infected, and if your VM gets infected then that's still the environment you intended to use for security sensitive things that's new insecure.

Have you tried live USB solutions? Unetbootin?


Did someone break into my email account?

It looks like a spammer spoofed their sender address, using your e-mail address instead of their own. Note that the subject of the mail is simply "sport" and the contents is a .zip file. This smells like spam.

What probably happened is that at least one of the intended receiving addresses didn't exist. The domain of the address did exist, however, and the mail server sent an error message to the apparent sender address - yours. It happens.

If the mail had been in your "Sent items" box, then yes, you'd probably been hacked.
The reverse does not hold, unfortunately - if you were hacked and a spammer (or botnet) sent a mail from your address, they might have removed the evidence.

However, I think the spammer just used your e-mail address for a mail they sent from their own machine.

Still, it won't hurt to change your password, just in case. And maybe apply 2-factor authentication on your e-mail as well, if you haven't already.


Verify that a second TLS connection comes from the same client

Rather than design your own scheme for this, you could look into JWT using x509: https://jwt.io/introduction/.

Oauth also has this kind of option (I think), but I can't find decent documentation.

I think there are some aspects of your solution that seem problematic currently - notably, rather than storing something on the server per client, using x509 means you only need to validate the client-presented cert is correctly issued, rather than needing to do more complex checks.

There is no need (AFAIK) for the certs you issue to your clients to be valid outside of your own environment (i.e. you can use your own CA for this), so that you could have your flow as:

client requests a cert based on a CSR it generates (similar to Oauth)
if the client request is properly authenticated, the CSR is processed into a valid cert for your needs
the client then stores this cert, and presents it when needed
the server validates that cert is valid, and extracts its public key for its own needs (if any).

So, yes, what you propose may be possible, but there seem to be some established schemes that provide a similar approach already, and which might be worthwhile looking into.


Thumb rule If there's Symmetric key involved, there must a secure key exchange algorithm.

In cryptography whenever they say Symmetric key is used to accomplish something, there's a need for secure transmission of that symmetric or Same key between the parties communicating. Such key exchange is done prior to any actual data being encrypted-transferred to arrive on an agreement which binds both parties to use certain parameters to be used in transmission of actual data. As this is seems to be critical process, cryptography provides certain key exchange algorithm and the most popular one is Diffie-Hellman. Be it SSL, SSH or any other protocol involving Symmetric key, DH is present.

ts;dr: Read about Diffie-Hellman


tag missing in nse output for http-drupal-enum script

Script output is in a <hostscript> element when the script is running as a host script with a hostrule function. If it is running as a service script with a portrule function, then the output will be nested under the associated <port> element in a <script> element.


Lost my custom data files for OWASP ZAP (Forced Browse) - where do I find the data in ZAP?

ZAP stores the custome forced browse files you upload in a directory called 'dirbuster' under the default directory. The default directory depends on the OS - eg its ~/.ZAP on linux - for full details see this FAQ: https://github.com/zaproxy/zaproxy/wiki/FAQconfig


What is 0xXXXXXXXX.asc.sig and how can I generate this?

The .sig file is a detached signature. You use your key to sign a file to certify its authenticity. If the file is changed in any way, the verification process will fail and the party that received the file will know that it has been tampered with after you sent it out.

I believe the .asc.sig you received is a certificate of that guy's public key certifying its authenticity.

You can append the signature to the file itself or have it in a separate file. In this case, instead of appending the signature to the file, the signature is in a standalone file.

To sign it: gpg -a --output doc.asc.sig --detach-sig doc

-a is to create an ascii armored output
doc.asc.sig is the filename you want for the signature
doc is the filename you wish to sign


What is a simple and secure method to transfer virtual assets?

I would agree with the managers that the process is way to complex. I think you could make this fairly straight forward by mimicking the process used to send e-gift cards.

Alice hands over the item to (your MMO's recruiting NPC) and gives Bob's email address.
Bob receives an email with a 12 digit alpha numeric code that can be typed in to the web form used to register.
When Bob logs in for the first time the item will appear in his inventory or bank.

You can even go 1 step further and have a direct link in the email when clicked that will automatically associate Bob's registration with the item.


How long would it take a single Processor with the AES-NI Instruction Set to bruteforce an AES Key?

To calculate this you need:

The block-size (16 bytes)
Cost per byte (1.30 cycles per byte)
Frequency of the CPU (3.8 GHz)
Number of cores (2)
Number of keys (2^128)

I'm using "amd64; Piledriver (610f01); 2012 AMD A10-5800K; 2 x 3800MHz; hydra9, supercop-20121016" from eBACS as my example CPU.

To calculate the keys tested per second you calculate:

(cpu-frequency * number-of-cores) / (block-size * cost-per-byte) =
(3.8E9 * 2) / (16*1.3) =
6.70E8 =
670 million

To get the keys tested per year you get:

 keys-per-second * seconds-per-year =
 6.70E8 * (365 * 24 * 3600) =
 2.11E16

This corresponds to breaking a 54 bit key in a year.

To get how long it takes, you divide half the number of total keys by the number of keys you try per-year, which gives you about 10^22 years, which is pretty much forever since the universe is only about 10^10 years old.

But no sane attacker would use such a CPU. He'd use specialized hardware that is much more efficient than a general purpose CPU. But even with such hardware, brute-forcing AES is far beyond what humanity can currently afford.


How to securely connect to a database with PHP?

Your approach looks good.

You are storing the credentials in a separate configuration file instead of having them written inline in the source code. This makes it safe when sharing the code with others and protects the credentials in case a misconfiguration lets the plain PHP code be printed out (which happens quite often).
The config file is outside the public document root, therefore it cannot be directly accessed by a user of the web application, unless there is another vulnerability (e.g. a directory traversal flaw).
In any case you should avoid running the server as root. Otherwise the permission model is worthless, since root can read and write to any file.

Note that you don't have to deal with parsing the credentials in your code at all - you can instead specify them as PHP runtime settings in the server configuration, as explained here.

Also see:

How do I make my database connection secure?
How to secure database passwords in PHP?


SendGrid Github Account Credentials Scanning

SendGrid is likely proactively using a service such as GitGuardian: https://www.gitguardian.com/

GitGuardian doesn't look for specific credential strings, it looks for telltale signs such as known API key prefixes, standardized variable assignments, etc.


Is it more secure to encrypt separate customers' data with separate keys?

One argument in favour of separate keys: assume at some point in the future your app has some sort of SQLInjection or Server-side request forgery (SSRF) vulnerability that lets a user logged in as CustomerA bypass the usual access control rules and fetch data belonging to CustomerB.

If all customers use the same key, then your application layer server will happily decrypt and serve it back through your UI. However if each customer has their own key, then your server will try to decrypt CustomerB's data with CustomerA's key and throw a decryption error. That would be a win for defense in depth.

While in general, using per-customer encryption keys doesn't do a lot (esp. if you store all the keys in the same place), there are some specific cases where it could save your butt.


How secure are password managers with account recovery?

Having a recovery option is perfectly fine as long as it is adequately secured. Whether you prefer losing your passwords if you lose the master password or want to trust the password manager company with access to your passwords is up to you.

Keep in mind that security is a means to an end. There are always trade-offs to be made. You can have a perfectly secure computer by not having a computer. Usability suffers, though.

Edit:

Since people in the comments want the specific question of "how secure are password managers with recovery option" answered, I will add some points:

It is possible to provide recovery options which are secure, but this always depends on the attacker model. Security ALWAYS depends on the attacker model: Passwords are very bad against-mind readers!

Here are some possible ideas for reasonably secure recovery schemes:

Encrypt a copy of the database under a different key and ask your users to print this key and store it in their safe. That's what keybase.io does, or the Ubuntu drive encryption.
Store a DB copy which requires a key from the company on the users machine.
Have two departments at the company, one storing a DB copy, the other storing necessary the key. If you want to recover, both verify your identity and send you their part.

However, none of these mean that it is impossible for somebody else to get your passwords. (not using "zero knowledge" because that has specific meaning which works completely different when applied to passwords) After all employees might collude or safes can be broken into.

Every recovery option for you is also a recovery option, or an alternative attack path for stealing your passwords.

Remember: If you want to ask "How secure is X?" your attacker model must be obvious or stated. Security always depends on the attacker model! There is no absolute security.