openssl s_server without PSK/certificate, but with client certificate validation

From RFC 5246 (TLS 1.2):

  A non-anonymous server can optionally request a certificate from
         the client, if appropriate for the selected cipher suite.

Thus, you need at least a cipher suite where the server is not anonymous, i.e. NULL as you've tried to use will not work.


What are requirements for HMAC secret key?

I've added my answer here as I feel the existing ones don't directly address your question enough for my liking.

Let's look at RFC 4868 (regarding IPSec, however it covers the HMAC-SHA256 function you intend to use - em mine):

  Block size:  the size of the data block the underlying hash algorithm
        operates upon.  For SHA-256, this is 512 bits, for SHA-384 and
        SHA-512, this is 1024 bits.

  Output length:  the size of the hash value produced by the
  underlying
        hash algorithm.  For SHA-256, this is 256 bits, for SHA-384 this
        is 384 bits, and for SHA-512, this is 512 bits.

As WhiteWinterWolf notes, longer than B is discouraged because the value must be hashed using SHA-256 first (i.e. 512 bits in this case) and less than L is discouraged (256 bits in this case). However, a 256 bit key is overkill as anything that is 128bits or greater cannot be brute forced in anyone's current lifetime, even if every computer in the world was working on cracking it.

Therefore I'd recommend a 128 bit key, generated with a cryptographically secure pseudo random number generator (CSPRNG). If you want to store this as text then a 128 bit key can be represented by generating a random 32 character length hex string, or alternatively you could generate 16 random bytes and then run them through a base64 function.


What hashing algorithm does VirtualBox use for passwords in its config files?

See the source code for vboxmanage internalcommands. The command passwordhash is mapped to the function CmdGeneratePasswordHash near the bottom of the file. Above the function definition, there is an elaborate comment detailing all the algorithm's properties:

  Generate a SHA-256 password hash

So it is a plain SHA-256 hash. No salt, iterations, or memory-hardness. And it's not encryption, so they are not encrypting your password: they are hashing it. But not very well.

SHA-256 by itself does not protect your password very well because it is fast to brute force. Only a very strong password is secure and will not be recovered from the configuration file, so a randomly generated password (stored in a password manager) is recommended. If you don't use a very strong password, consider the configuration to pretty much contain your password in plain text.

Testing the theory, the documentation you linked also mentions an example hash:

  2bb80d537b1da3e38bd30361aa855686bde0eacd7162fef6a25fe97bf527a25b

Googling the hash, we find not only the documentation page, but also that this maps to "secret".

While looking this up, I also found a passlib page mentioning virtualbox. I didn't know of that project, but it seems this might be useful for similar questions when you want to know what hash is used by various software.

Note that when generating your password with vboxmanage, your password will be saved in your command history. To avoid this, you could use the following:

$ read -s pwd
$ VBoxManage internalcommands passwordhash "$pwd"

After the read command, with the -s flag to not show the password, you type your password. When you press enter, the prompt will return and you can enter the second command. If you would do echo "$pwd", you will see that this variable contains your password.

Better yet, generate a password randomly instead of entering it:

pwd=$(</dev/urandom tr -dc a-zA-Z0-9 | head -c 16);
echo "Password: $pwd"
VBoxManage internalcommands passwordhash "$pwd"


The purpose of UPnP is that devices within the network can discover and connect to each other without further configuration by the end-user. That's why UPnP connections are registered by your router, but aren't editable. The only option you have (with your router) is to disable or enable UPnP entirely.

The description of the application might refer to the Teredo tunneling protocol, wich is used to enable ipv6 communication within a ipv4 network. It is suspicious that the ports you mention aren't de default Teredo ports (3544). You might want to check with devices within your network if they have ipv6/Teredo enabled, or if your ISP is providing ipv6 services through Teredo tunneling. As long as your ISP doesn't require ipv6 (most of them don't), then it is safe (and maybe even safer) to disable any ipv6 services within your network.

It is generally regarded a bad practice to leave UPnP open towards the internet, because it can be used to gain access to your internal network. You can test if UPnP is exposed to the internet with this site.

Consider if you have any devices or applications that need UPnP or if you can do without it.


How secure are phones in the context of 2-factor authentication?

NIST (National Institute of Standard and Technology) is recommending not to use SMS based 2 factor authentication.
According to NIST guidance.

  OOB [out-of-band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

This article by Brian Krebs has details on how the current 2 factor auth using SMS can be used by bad guys to scam people. It also has details on the alternatives which are more secure.

SMS is easy to intercept because of the SS7 protocol used by carriers which was designed with no security.


Should TLS clients put a limit on certificate chain depth?

I think this is DoS prevention: building the chain might be an exponential algorithm with backoff, so with the openssl default of 100 a malicious backend might cause denial of service in nginx. I would use 10. In practice, 4 should be enough.


The way to do everything you asked is if you developed a custom image type and your own image viewer. The viewer is the wrapper for the image that enables the functions you want. You could have end-user versions of the app as well as server versions of the app to be able to show the image online.

This is by no means foolproof, and you would also have to prevent screenscraping so that the image cannot be copied from the screen.

And this suggestion likely does not satisfy all the user experience requirements you likely have but have not disclosed.

DRM is very, very difficult to pull off and even the best in the world cannot do it perfectly. I would suggest that you revisit your need for control over these images and change your business need instead of trying to create a technical control for what cannot be controlled.


From This Site:

  Both /dev/urandom and /dev/random are using the exact same CSPRNG (a cryptographically secure pseudorandom number generator). They only differ in very few ways that have nothing to do with “true” randomness.


Can JavaScript code in browser be modified by hacker to gain access to unauthorized resource?

Every browser comes with powerful development tools. The usual hotkey to access them is F12.

Any user could use the JavaScript debugger of their browser to set a break-point in the line if (response.data), wait until the break-point is reached, edit the value response.data.accountType to read VIEW_GOLD while the execution is paused and continue the execution of the javascript.

Some browsers like Chrome even allow to edit the JavaScript code of a website while it is loaded.

There is nothing you can really do to prevent users from using these tools.

So follow the dogma never trust the client! do not handle anything related to permission handling on the client-side. The server should know the permission level of the user and simply refuse to serve any information the user is not supposed to have access to.

By the way: This dogma does not just apply to web applications but any form of client-server architecture. The debugging tools for a binary client might not be as readily accessible as those in web browsers, but they do exist.


Is it possible to have a key for encryption, that cannot be used for decryption?

What you are referring to is asymmetric encryption. A key is used for encryption, and a seperate key is used for decryption.

You would use the encryption key, aka public key, to encrypt the incoming log files, while the decryption key, aka private key, is stored on a different server/system/etc so there is no way to decrypt the logs.

Some good primers:

Asymmetric vs Symmetric Encryption
What's the mathematical model behind the security claims of symmetric ciphers and digest algorithms?
What are private key cryptography and public key cryptography, and where are they useful?


How to get a 'million rounds of PKCS#8 + PBKDF2' with OpenSSL?

Simplest method is still to patch OpenSSL, namely the command-line tool (not the library). Walk-through (assuming a Linux host):

Download the OpenSSL source code. Take the latest, which the page shows in red (right now, version 1.0.1g).

Unpack it in some directory:

cd /tmp
tar xvzf ~/Downloads/openssl-1.0.1g.tar.gz

Edit the source file /tmp/openssl-1.0.1g/apps/pkcs8.c: search the string "iter" until you want to find these lines:

            else if (!strcmp (*args, "-noiter"))
                    iter = 1;
            else if (!strcmp (*args, "-nocrypt"))
                    nocrypt = 1;

That's line 158 in version 1.0.1g. Edit these lines so that they look like this:

            else if (!strcmp (*args, "-noiter"))
                    iter = 1;
            else if (!strcmp (*args, "-iter"))
                    {
                    if (!args[1]) goto bad;
                    iter = atoi(*(++args));
                    if (iter <= 0) goto bad;
                    }
            else if (!strcmp (*args, "-nocrypt"))
                    nocrypt = 1;

In other words, just add the 6 lines which handle a new command-line argument called "-iter". Save the file.

Then compile the code:

cd /tmp/openssl-1.0.1g
./config --prefix=$HOME/local
make
make test
make install

And voilà! You have a brand new openssl command-line tool and library in the local subdirectory of your home directory (you can put it anywhere you wish with the --prefix option, but writing in your home directory does not need root access and won't interfere with your OS-provided tools). The command-line tool command pkcs8 now has a -iter option which can be use to select the number of iterations:

$HOME/local/bin/openssl genrsa -out rsaraw.pem 2048
$HOME/local/bin/openssl pkcs8 -topk8 -v2 aes128 -iter 1000000 -in rsaraw.pem -out rsapk8.pem

The resulting file can be used with a completely standard OpenSSL or OpenSSH, because the library has always supported PBKDF2 with one million iterations. Here we are just patching the command-line tool to be able to set that iteration count. A look at the resulting object will show that the iteration count was indeed taken into account:

openssl asn1parse -i -in rsapk8.pem

will show something which begins with:

  0:d=0  hl=4 l=1312 cons: SEQUENCE
  4:d=1  hl=2 l=  74 cons:  SEQUENCE
  6:d=2  hl=2 l=   9 prim:   OBJECT            :PBES2
 17:d=2  hl=2 l=  61 cons:   SEQUENCE
 19:d=3  hl=2 l=  28 cons:    SEQUENCE
 21:d=4  hl=2 l=   9 prim:     OBJECT            :PBKDF2
 32:d=4  hl=2 l=  15 cons:     SEQUENCE
 34:d=5  hl=2 l=   8 prim:      OCTET STRING      [HEX DUMP]:A4E21F4F210DEB6F
 44:d=5  hl=2 l=   3 prim:      INTEGER           :0F4240
 49:d=3  hl=2 l=  29 cons:    SEQUENCE
 51:d=4  hl=2 l=   9 prim:     OBJECT            :aes-128-cbc
 62:d=4  hl=2 l=  16 prim:     OCTET STRING      [HEX DUMP]:DAA184B3F6CC303B6A40A131E5C8C451
 80:d=1  hl=4 l=1232 prim:  OCTET STRING      [HEX DUMP]:2C15CF37D5ACC537AA92B
 (...)

See the "0F4240" ? That's one million, in hexadecimal.

The patch is trivial; I will try to submit it to the OpenSSL maintainers.


Is it possible to craft a certificate signing chain that thwarts MITM corporate VPNs?

From my understanding you are essentially asking if a web server certificate can be setup in a way that the traffic cannot be transparently intercepted and decrypted by corporate MITM solution, which a new root CA is installed as trusted at the client. I.e. the question is not specific to VPN.

In a MITM setup the MITM proxy is basically the client to the original server and thus gets the servers certificate and chain. It then works as a server to the original client but sends a different certificate and chain. Since the client has no idea how the original certificate and chain looked like but trusts the CA for the new certificate, the client will trust the new certificate too. This means that simply with some magic on the certificate and chain it is not possible to protect against MITM.

Protection can instead be done if the client has more expectations to the server certificate than just being signed by a trusted CA. Such expectations can be achieved if the clients limits which certificates it accepts by certificate, the certificates public key or the certificates issuer (CA). Such pinning is implemented for  some commonly attacked domains in many browsers. But in order to facility legal SSL interception done in corporate proxies but also desktop Antivirus products, pinning is usually automatically switched off when the served certificate was issued by a root CA which was explicitly imported as trusted.

Another protection would be if the server has more expectations to the client. By requiring a client certificate issued by a specific CA the server can also make sure that the traffic cannot be successfully intercepted. Instead the TLS connection will usually just fail, unless there is an explicit exception for the target site in the MITM proxy. Of course, the client must actually have the client certificate installed in the first place to connect to the server without MITM which somehow limits this approach.

The target server could also try to detect interception by fingerprinting the TLS stack of the client and then block access if interception is detected - see Detect man-in-the-middle on server side for HTTPS for more on this. Note that this detection is not perfect, i.e. can have false positives and false negatives.


What does "key with length of x bits" mean?

For symmetric algorithms (symmetric encryption, Message Authentication Code), a key is a sequence of bits, such that any sequence of the right length is a possible key. For instance, AES is a symmetric encryption algorithm (specifically, a block cipher) which is defined over keys of 128, 192 and 256 bits: any sequence of 128, 192 or 256 bits can be used as a key. How you encode these bits is not relevant here: regardless of whether you just dump them raw (8 bits per byte), or use Base64, or hexadecimal, or infer them from a character string, or whatever, is up to you.

There are a few gotchas with some algorithms. The prime example is DES, a predecessor to AES. DES is defined to use a 64-bit key. However, if you look at the algorithm definition, you see that only 56 of these bits are used; the other 8 are simply ignored (if you number bits from 1 to 64, these are bits 8, 16, 24, 32, 40, 48, 56 and 64; they are supposed to be "parity bits" depending on the 56 others, but nobody really bothers with setting or checking them). So it is often said that DES has a 56-bit key. This is because key length is related to security: if an algorithm accepts keys of length n bits, then there are 2n possible keys, and thus trying them all (attack known as "exhaustive search" or "brute force") has time proportional to 2n (with n big enough, i.e. more than about 85, this is technologically infeasible). In that sense, DES offers the security of a 56-bit key (256 "really distinct" possible keys). Yet, if you use a library implementing DES, that library will expect DES keys as sequences of 64 bits (often provided as 8 bytes).

Another algorithm with a special rule is RC2. It accepts keys of length 8 to 128 bits (multiple of 8 only); but it also has an extra parameter called effective key length denoted by "T1". In the middle of the processing of the key, an internal value is "reduced" to a sequence of T1 bits, which means that subsequent encryption will depend only on the values of T1 specific bits in that internal value. The resistance of RC2 against exhaustive search is then no more than that offered by a T1-bit key, because one can try all possible sequences of T1 bits for that internal value. Yet, RC2 still has an actual key length (the length of the sequence of bits which is provided as key) which can be greater than T1.

For asymmetric algorithms (also known as public-key cryptography, encompassing asymmetric encryption, digital signatures, some key exchange protocols, and a few more esoteric algorithms), keys work by pairs consisting in a public key and a private key. These keys are mathematical objects with some heavy internal structure. The "key length" is then a conventional measure of the size of one of the involved mathematical objects.

For instance, a RSA public key contains a big integer called the modulus, as well as an other integer (usually small) called the public exponent. When we say a "1024-bit RSA key", we mean that the modulus has length 1024 bits, i.e. is an integer greater than 21023 but lower than 21024. Such an integer could be encoded as a sequence of 1024 bits, i.e. 128 bytes. Yet, the public key must also contain the public exponent, so the actual encoded length will be greater. And the private key is, on a theoretical point of view, knowledge of how the modulus can be factored in prime numbers; the traditional encoding for that knowledge is that of the prime factors, along with a bunch of helper values which could be recomputed from the factors (but that would be slightly expensive) and may help in executing the algorithm faster.

For distinct key types which work over distinct mathematics, other "lengths" are used, so you cannot directly compare security of algorithms by simply comparing the key lengths. A 256-bit ECDSA key is vastly more secure than a 768-bit RSA key. Also, the mathematical structure inherent to public/private key pairs allows for much faster attacks than simply trying out bunch of random bits, and there are many subtle details. See this site for explanations and online calculators for the various set of rules about comparing key sizes that many regulatory organizations have come up with.


No. The biggest risk I fear is some government closing down the service because of suspected illegal use, taking all disks for analysis and leaving me as sincere user without my file backups. eg. Megaupload (Megabackup)


Padding of 802.11 packet with 0's in libpcap

While i was reading your question i assumed you'd be on wireless, which is a broadcast medium. I assume you're also capturing on all interfaces.

Take note b = append_to_buf(b, "\x32\x04\x30\x48\x60\x6c", 6); there are six times 00 appended


Yes, it is possible for an attacker to gain access to your private and sensitive data during encryption or decryption.

This attack is known as memory sniffing attack. In my opinion this is very sophisticated attack. The attacker dump the machine memory (e.g. RAM, swap files, etc) and then analyze this data to retrieve sensitive data (e.g., password, cryptographic keys, etc)

When an attacker is executing this attack on your machine it simply means your machine is already compromised.

How to reduce the risk of this attack?
In my opinion, it is all about secure coding practices. In short, make sure when you are implementing your encryption/decryption algorithm that you apply secure coding standard.

The following link contains a post that explain the memory sniffing attack and explain how to prevent/reduce this attack

  You should read more about memory dump attack and secure coding. Several programming languages provide some guidelines and sometimes APIs to reduce the risk of memory dump attack. Here is another article.


Advised to block all traffic to/from specific IP addresses

If you spoke to the FI on a separate channel, you actually spoke to the FI, and they know about this, then by definition, it is not a phish.

What strikes me as odd is "but they can't (won't) provide any more information", and "refusing isn't really an option". These 2 facts cannot co-exist if you are a separate entity from the FI.

Your push-back is simple: your firewall policy requires a legitimate reason along with an end-date for the rule to be reviewed/removed. You don't just add firewall rules because someone outside of the organisation told you to. The FI has no idea if blocking those IPs may impact your operations.

what effect is this rule supposed to have?
how long does the rule need to exist?
who (named individual) owns this rule on the FI side?
what remedies are expected if the rule has a negative effect on operations?
what effect will there be between your companies if the rule is not implemented exactly as requested?

You will not add the firewall rule without knowing what the impact is, either positively or negatively. If they want greater control over your firewalls, then they can supply and manage your firewalls for you.

On the other hand, if they own you and the risks, then they take on the risks of this change, so then just add the rules.

As for a Director sending this request, it's not so strange. When you need someone to do something, you have the person with the most clout make the request. The Director may have no idea what a firewall is, but the request is being made in that person's name. I am also curious why so much clout is needed, though. It seems like they want to pressure you into doing it while not having to explain themselves. Don't let them dictate your policy and how you best protect your company.


Cant see data packets when capturing in monitor mode

This behavior isn't specific to Wireshark but is due to how wireless network cards work. Keep in mind that in monitor mode, your wireless card is completely passive and has no concept of being connected to any particular network. So, if a network is secured with encryption, the card itself won't know how to decrypt those frames and you should just see them identified as 802.11 QoS in Wireshark. Without any additional configuration, you will only be able to see the network traffic of an open (unsecured/unencrypted) network.
However, if it's your own network, you already have the network's PSK, and should be able to decrypt the traffic the way you expect using Wireshark. Note that in order to decrypt a particular session between a device and the access point, you need to capture the 4-way handshake that is performed during initial connection with the network. This can be forced by reconnecting the device(s) or by kicking the target device(s) off the network with a deauthentication attack.
Also, it is likely that you are only capturing your own wireless traffic if running Wireshark while connected to the wireless network.


In Chrome, how do I see a suspect HTTPS certificate before I visit the site?

Here's how you view the certificate:

Click the lock sign (it should have a red "x") in the address bar.

EDIT to Roger's request: This icon (which could also be a triangle on other versions of Chrome) is clickable on the warning page itself

Click the "Details" link after this text:"Your connection to this site is not private"

Click the "View Certificate" button in the new Developer Tools window that opens up.


Starting a new shell in a strcpy exploit using buffer overflow

First you need to know how program memory is organized. There are three areas:

Code section (you dumped this section)
Data section
Stack (the most interesting)

When main function calls myfunction, it pushes onto the stack in sequence return address into main and main's frame pointer. Then the space of 8 bytes size, needed for char array, is allocated on the stack.

When you copy more data into array than it's size, you first override main's frame pointer (4 bytes on 32-bit x86 architecture) and then you override return address (also 4 bytes). The fun part is overriding return address in such way that the return address will point to the beginning of the char array while filling this array with shell code. As the result, program executes array filled with your instructions.

The catch is that today's compilers adapt stack overflow protections by default. For learning purposed you can use simple tcc compiler instead of gcc. The former one doesn't protect against these kinds of overflows.

Finally, as a reference I recommend Open Security Training classes which can be found here: http://opensecuritytraining.info/Training.html. There's one called "Introduction to Software Exploits (Exploits 1)".


Can you pick up any device specific information by monitoring bluetooth signals?

Firstly, big fat warning: this is not secure.

Bluetooth devices have MAC addresses in a similar vein to 802.11X wireless cards and 802.3 ethernet cards. You could periodically scan for the presence of a known MAC address. There are nominally 2^48 (281474976710656) possible such addresses but as with ethernet cards the first 24 bits will be reserved for a manufacturer, so if an attacker has observed your phone, then there are only 16777216 possible combinations for a known manufacturer. Given that it is possible to have the same number of manufacturers (16777216) and given there probably aren't that many, the attacker only needs an assigned list of known manufacturer codes to greatly reduce a brute force.

If your device has ever been bluetooth-enabled near an attacker aware that you are depending on the MAC address, then chances are high this information has again been compromised. Any OTA transmission will reveal your MAC, much as is the case for wireless access points, the only difference being the level of proximity to you that would be needed. Anyone who has ever paired with you will also have that address.

I don't honestly believe such a system adds much security in and of itself. Blunders is correct, you need additional secure link information. But if you're happy with just a number and don't care that it's about as secure as leaving your laptop in a pub with a post-it on it saying "steal me", this should be fine.

Here's an article that backs me up.


Can an individual get an extended validation certificate?

According to Section 7.1 of the Extended Verification Guidelines a certificate verifies the following:

  (A) Legal Existence: The CA has confirmed with the Incorporating or Registration Agency in the Subject’s
  Jurisdiction of Incorporation or Registration that, as of the date the EV Certificate was issued, the Subject
  named in the EV Certificate legally exists as a valid organization or entity in the Jurisdiction of Incorporation
  or Registration;

Section 8.5

  The CA MAY only issue EV Certificates to Applicants that meet the Private Organization, Government Entity, Business Entity and Non-Commercial Entity requirements specified below.

I believe the answer is no.


Is filling up the empty space in a disk with any data enough measure against file recovery

This is enough, or not, depending on the disk technology, the budget of the attacker, and some other details.

When you fill a disk with zeros, you force the filesystem to reuse free blocks, and rewrite them. So, as first order approximation, this looks good for you: your file contents are overwritten. However, there are details:

On some operating systems and filesystem, filling the disk completely is a reserved privilege. Typically, on Unix-like OS, the last 5% of the disk are reserved for the root user. So do the filling as root.
Some filesystems do tail-merging: a file uses blocks of a given size (say, 4096 bytes), but the last block of a file is often not completely filled. Most filesystems just keep that unused space, but some strive to optimize the space allocation and will regroup the "tails" from several files into a single block. The consequence, here, is that "filling up" the disk with a big file full of zeros may fail to reclaim all free "tail space" (because a big file full of zeros is still one file, with a single tail). The final bytes of your file may thus avoid overwriting.
There is a neverending debate about whether old data may be recovered from an hard disk even after being overwritten. The short answer is: "probably not for a modern magnetic hard disk, plausibly yes (partially) for SSD". See this question and also that one. But such recovery will entail some non-trivial costs (opening the disk in a clean room, hooking extra circuitry...) so rational attackers will do it only if the data is worth it.

If the confidentiality of the data you want to wipe out is valuable, then the cautious course of action is to physically destroy the storage device (shredding, melting, degaussing,... there are several possibilities, with various degrees of efficiency, price and fun). If your data secrecy is not worth the 100$ for a new disk, then you can probably do a simple fill-up of the disk with dummy files: low-value data implies cheap, unmotivated attackers.

Next time use disk encryption. If data never makes it unencrypted to the disk, then wiping the data out is as simple as forgetting the key. This abstracts away physical details of the disk.


Why should one avoid chains of SSH sessions?

Each system along the way with the proper priviledge could "hijack" your session (see the man page about ssh-agent, for some warnings. And search on this site and on the web for some more info) (sorry I do not have time right now to properly give examples...) :

For example the SSH_AUTH_SOCK could be accessible to another instance of the user or to root (or, depending on the system's settings, to a wider group of users), and be used to access whatever system that you could access yourself using the keys stored in the agent.

Having only 1 base system to control and use the agent on is much easier to secure and control. Otherwise, each intermediary hop adds a (potentially weaker) point of entry for some of the users on that system.

Please note that there are also many other ways in which an intermediary system could compromise your ssh connection. Some via ssh mechanisms itself, but also some via the tty/terminals themselves, etc.

The more hop you go through, the more risk you take that one of those hops (including your original machine!) can be used to hijack your connection [to the final destination, or to any of the intermediary hops, or even to any other destination that your ssh keys could open access to ...]


Why do browsers not protect against scripts coming with images?

You did answer your own question already:

  Is this something exploited through vulnerabilities   ...   Buffer
  Overrun

Buffer overflows are not intended behaviour, but indeed exploitable vulnerabilities. Browsers vendors will fix B.O. when they find it => they do protect from it. The problem is, as with all vulnerabilities, someone has to recognize that there is an error in the code first.

What your chat log says, that browsers don't use some preventive additional security features which could help against an existing error being exploited (eg. because these methods have downsides too). But they will fix the errors itself.

  as I've had far too many of these malicious scripts

That could have thousands of reasons, other than images with scripts. Given that you seem to think that "buffer overrun" is always the same as "stack overflow", you probably didn't recognize some of the reasons.


Is gender considered PII (Personally Identifiable Information) under the GDPR?

The definition of personal data as mentioned in the GDPR:

  ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

As you state that you use the presence of the variable to target individuals, the gender definitely has an indirect reference to someone's identity and as such, is personal data. However, that doesn't mean that you have to stop processing the gender in the context you described.

From a risk perspective (which is what the GDPR is all about), I don't see an issue if you only share the gender - which is actually pseudonymised since you don't supply any other direct identification data along with it.

However, you do have other obligations w.r.t. the transparency principle, incorporating the processing activity into your processing register, determining legal ground for processing (and acting accordingly), determining processor-controller relationship with your third party and including the necessary clauses in the the contract, etc. To determine all this, much more information is required than you have supplied in your question and I highly encourage to seek (legal) professional advice to support you in this matter.


Client certificate for 2 way SSL works in some programs, and fails in most

The Firefox error is likely the key to the issue. It looks like the cert you have been given is tied to the API implementation using a custom critical extension. The x509 spec requires users of a cert to fail the operation if they encounter an extension marked critical that they do not understand. More info in rfc 5280
Look at the problem cert with openssl x509 -in certfile.pem -text
and look for a custom extension that is marked critical.
All the other failures you are seeing are just those systems trying to cope with the required error from the spec.


First of all your data probably isn't saved in database the way you presented. In all likelihood it's stored there without any encoding (as it should be).
EJS in itself, when used correctly, takes care of encoding output for you so that you can safely construct parameterized HTML. But in your case you want to disable this protection to render raw HTML, so yes, you must be careful. There are a couple of security controls at your disposal.
1. DOMPurify
I haven't used the xss library personally, it seems to have a lot of downloads and probably it's not a bad option. But DOMPurify is probably better. It also doesn't require configuration and has built-in support for trusted-types (I'll get to that in a minute).
You would use it twice. First on server-side when the HTML is submitted by the user, and second on client-side when the HTML is rendered by EJS.
If you are serious about security then you will connect anomaly alerts from the server-side purification to your SIEM/SOC etc. Then you will know when someone has attempted an XSS attack on your website.
2. Sandboxed Iframes
Another client-side control that you can implement is sandboxed iframes. Instead of just rendering the HTML on the page, you create an IFRAME, give it a properly configured sandbox attribute, and then set the purified HTML as the content. Now even if something goes wrong with the purification, the malicious HTML would be isolated in its own world.
3. Content Security Policy
The coolest and (when used properly) most effective defence against XSS is CSP. How it works is that you give your website restrictions such as "do not execute scripts", "do not load images", etc. And then you allow the scripts that you do want to execute, and nothing else. Now if an attacker manages to inject a script, link, form, etc. on the page, it will not work because it hasn't been specifically allowed.
I've written about CSP at length here, you will even find specific examples for your case (NodeJS and EJS) with CodeSandbox examples on that article. And in general about XSS protection you can read more here.
Hope this helps!


Brute-Force

Scanners can brute-force guess the names of files and find it that way, although if the names are non-standard, it might take a while.

Spidering

If the asmx is linked to by another page that is discoverable (like index.html), then a spider will find it easily.


Does the glibc getaddrinfo vulnerability affect Windows systems?

If you are using a vulnerable version of glibc in windows, then yes. It is vulnerable. Of course glibc is not commonly used in the windows environment.


Malicious Software alert from US Department of Health and Human Services

Just by reading the first paragraph, I'm now 99.9% sure that this is a phishing mail.

tl;dr: Ignore it.


Media files : how to protect from 0-day?

There's no silver bullet for this, but the one reasonable approach is to convert all media into a canonical format in a sandboxed environment (e.g. a dedicated VM which is isolated externally and periodically restored to a known-good snapshot).

As an example, you might convert all videos to H.264 and AAC in an MPEG-4 container, using something like ffmpeg. You could also convert images to JPEGs and strip EXIF in the process using ImageMagick. The idea here is that corrupted files containing exploits would fail to convert, and any extraneous data would be stripped. Both of these packages would have to be kept up-to-date and you'd need to keep an eye on the bug trackers and release pages to ensure you're aware of common problems.

You can also run an antivirus solution to scan each video before attempting to re-encode it.


What will happen to older browsers if I disable SSLv3 on my webserver?

If you disable SSLv3 on your site, then older browsers that do not support TLSv1 or higher will not be able to connect to your site by SSL/TLS.

Having said that, SSLv3 has been deprecated for some time, thanks to POODLE.  As a result, many web sites that employ SSL/TLS have stopped supporting SSLv3 for a while now.  So, users that are still using older browsers that do not support TLSv1.0 or higher are likely to be having problems connecting to many sites by SSL/TLS (in addition to yours if you've disabled SSLv3).

In fact, in addition to the payment card industry (PCI) requiring sites that accept card information to disable SSLv3 - they are in the process of mandating that these sites phase out support for TLSv1.0 as well.  Soon, all sites that accept card information will be required to support TLSv1.1 or higher.

Edit:  See this Wikipedia page for a good reference on SSL/TLS protocols supported by various browsers.


Checking if a web application uses known vulnerable components

how can you check if a web application (as the attacker) has known vulnerabilities in it without already having exploited the application successfully?

There are various ways of fingerprinting a web application without having privileged access.

A common way to start is by identifying the versions of used libraries, frameworks and their respective plugins. This can be done by inspecting the source code, headers, guessing paths of readme files, etc. You'd then check if these versions are up-to-date or if there are any published vulnerabilities for them on the web.

As an example, take Facebook's blog https://newsroom.fb.com/. By looking through the source code, you'll quickly find strings indicating that they're using Wordpress, e.g.:

<meta name="generator" content="WordPress.com" />

Knowing that they employ Wordpress you may want to look for popular plugins that are known to be vulnerable. E.g., they seem to be using the AMP plugin, because there is a readme.txt at:

https://newsroom.fb.com/wp-content/plugins/amp/readme.txt

This readme reveals that they use the latest version 0.5.1, so the plugin seems up-to-date.

Another example would be https://stackoverflow.com where you can discover which version of jQuery they use:

<script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.4/jquery.min.js"></script>

Although 1.12.4 isn't the latest version, there don't seem to be any immediately exploitable flaws.

As you can see, checking an application for known vulnerable components doesn't necessarily require privileged access since versions and configurations are often leaked.


Filter TLS in Wireshark or other monitoring tool

Try filtering by ssl.record.version

For example, if you wanted to only display TLS v1.2 traffic then you could run ssl.record.version == 0x0303

You can choose from the hex values below for the version that fits your needs.

Versions:

0x0300 SSL 3.0
0x0301 TLS 1.0
0x0302 TLS 1.1
0x0303 TLS 1.2

To avoid using the GUI or to automate this further you could also filter by using tshark.

Resources:

http://blog.fourthbit.com/2014/12/23/traffic-analysis-of-an-ssl-slash-tls-session


How do I know a certificate is not faked?

The certificate is digitally signed by a 3rd party, e.g. a CA (certificate authority). This signature can be verified using the public key of the CA.

If the attacker modifies the public key, the signature won't match any longer.

If the attacker also finds a way to modify the public key of the CA, then you lost I'd say.


Are passport stamps a reliable security feature?

As @BobBrown said in comments, we need to ask what problem the passport stamps are supposed to be solving. Turns out it is a security problem, but not in the way you are thinking (I think). Let's say I'm a Canadian visiting the UK. In addition to providing a record for the UK gov - which surely they're also recording in a database - it acts like a receipt for me in case, at some point during my visit, I'm asked to prove that I entered the UK legally. For most airline travelers, the stamp is the only legally-binding entrance paperwork that you're given. The stamp is placed in your passport to tie the stamp to your name and for your own convenience, but I believe many countries will give you the stamp on a slip of paper if you're concerned about the privacy issue of putting it in your passport.

You might think "there should be a central database that tracks entries and exits". Problem: 1) this information is for domestic tracking only, countries will object to letting other countries see their border records, and 2) I - the Canadian citizen - am the person who needs the proof. If it's stored in a UK federal database, why should I trust that it won't be tampered with, or modified to frame me?

"Ok, ePassports now contain smart chips, your entry / exit info should be stored encrypted on the chip". Problems: 1) you - the random citizen - don't have the tech to verify that the entry info placed on your chip is accurate (whereas with a stamp you can look at it when it's handed back to you). And 2) given that every country has different policies about passport stamps (like Israel who gives a separate "Landing Slip" rather than putting it on the passport), and given how much trouble we're having getting the current specs for ePassport adopted by all countries, good luck with that.


how can an executable delete itself while is running?

Windows uses memory mapping to load executables into memory so unfortunately the executable file (unlike in Unix based OSes) cannot just be removed.

Unix is slightly different (since there's some debate on this on the other answer) - however, it still uses mmap() to load executables (you can verify this with strace). It turns out what happens when you overwrite such executables is quite complicated but it comes down to how you do the overwriting. Since Unix uses inodes, as I understand it the reference count to that inode would decrease, but one is held (for the executing program), hence self deletion is possible - the reference for the dentry (disk path) disappears, but not for the mmap().

Windows does not have an inode concept, and so the file must exist whilst the program is running. This is a problem almost anyone who has written an uninstaller will have experienced - or even a temporary utility. The first link I gave you runs through the techniques you can use; these are, briefly:

Batch file to delete the program.
Move the file to nowhere, delayed until reboot (via MoveFileEx)
DELETE_ON_CLOSE via CreateFile.

and several others. I won't spoil the article - and I think I've seen other techniques used as well, so you can take it that there are many ways an executable might self delete.


What does a website see if I am connected on my native IP and then enable my VPN?

Since you asked specifically what the website will see, rather than any intermediary watching your network connection, we should think in terms of requests:

Your old ("native") IP will disconnect any long-running requests, and stop making any new requests.
Your new (VPN) IP will connect and start making requests.

On their own, those two events will be unconnected as far as the web server is concerned, however there may be various things which can be used to guess, with reasonable confidence, that they are related:

A cookie may have been set for your browser to send with each request, and the old and new requests will send the same cookie.
A client-side script (code running in your browser) may be feeding additional stateful data with the content requests, possibly stored in LocalStorage so that it will resume if you reload the page.
The URLs for the content may have been dynamically generated for you, so any request to that URL is assumed to be the same user.
The site may take a "fingerprint" of your browser - User Agent, detection of features and settings, etc - and recognise that before and after you connect to the VPN.
The server could log where in the stream you had got to, and line up the first position the new IP requests (e.g. with the Range HTTP header) with the last position the old IP requested.

All of these things are technically information which you are providing to the website, and can be altered, spoofed, or removed; but doing so will not happen automatically in a standard browser.


What to do when GSM/Wifi is jammed and ethernet cables are cut?

No, there is no way to communicate without being jammed.

You can create redundancy so that the system has several ways of communication. If the system detects that any one way is jammed it can send an alarm another way.

Another possibility is to send the alarm from an external system. Your alarm system regularily contacts the external system sending a status and the exteral system sends an alarm if either a message indicating an alarm is received or it receives no message for some time.


Limiting account access based upon NIC used to connect on Linux

There's no good way to restrict accounts based on network interface in Linux (by the time a packet reaches a layer that understands the concept of "account", it's forgotten which interface it came in on).  However, there are two easy ways to restrict access to an application based on which interface is used:

At the OS level, the iptables firewall has options you can use.  The -i option to iptables lets you filter packets based on which interface they came in on.  Combine that with the --dport option, and you can selectively drop or accept packets bound for a given program, based on which interface the packet came in on.
At the application level, most server programs let you restrict which IP addresses they'll listen on.  For example, you might have an SSH server listening on the address belonging to the "management" interface, and a webserver listening on the external address.

You can sometimes combine the above with application-level options to get the per-account filtering you want.  For example, you could have one sshd instance listening on the "management" interface and permitting administrator logins, and a second instance listening on the "external" interface and only permitting logins from ordinary users.


Can users read client SSL certificates from a react native mobile apps APK?

You cannot realistically hide the data stored on the device from the device owner. Both jailbreaking and offline analysis of a device can reveal it, as well as simple glitches in your app.

So you are better off using an established security protocol, like oauth2.  Together with a principle of only downloading or storing data the user owns, and accepting that they manipulate it, you have reasonable security.  If data must be kept secret from the user, it must be stored on the server.

Mutual TLS with the app's private key generated during installation, can also give you a reasonable expectation that the device connecting to your server is always the same. In practice, a strong device linking.  No other apps will be able to present the same device certificate.  But expect the owner to be able to read its private key.


How to prove that something happened before some time in a distributed way?

This has been discussed in more detail here:

Is there any functional distributed timestamp server available? If not what about this homebrew solution?
https://en.wikipedia.org/wiki/Trusted_timestamping

In short, get a digitally-signed timestamp from several Time Stamping Authorities (RFC 3161) or post a hash of the data on a cryptocurrency's blockchain.

If you're talking about a physical event that needs to be timestamped, you have to turn it into data first. For example, you can take a video of the event and timestamp that video using the above methods as soon as possible.


Is truecrypt a good choice to work with file that are generated and manipulated via browser

As I've commented, I find your first question a bit vague, so I'll go on with the rest:

  Moreover using a software like this, would you keep a security not encrypted copy of your private data, for example on a dvd or a usb hard disk, in case of software failure or error, or you would only rely on the software?

  How much is Truecrypt reliable ? Can it be cause of data losses, due to a malfunction, I mean not due to a forgotten password, but to an internal error of the software ?

Truecrypt is widely used, but you can never guarantee that it's completely free of bugs. For example, when it's in the middle of a write operation and the power fails, the disk won't complete the write, possibly leaving the file corrupt. Not Truecrypt's fault, but it can happen.

So yes, if the data is important to me, I would always keep a backup. You can keep an unencrypted backup, but what's wrong with storing an older version of the encrypted file? (Truecrypt stores the encrypted virtual drive as a single file.) Mount the file, read/modify it, and unmount it when you're done, just like you normally would. Then, test if you can decrypt the saved file (so that you know it's stored correctly), and copy the file. That makes sure you won't loose (much) data because of something caused by Truecrypt itself. The more regularly you copy the file, the less work you could loose of course. Just like with normal backups.

Then there are issues like drive crashes, the chance on fire... So an off-site redundant backup would best protect your data (all the wile keeping it encrypted). Just like with normal backups.


Why do I receive phishing mails from my bank shortly after visiting the bank's site?

The key question is whether this is systematic and repeatable or not. Does it happen every time you visit your bank or even most of the time? If not, it's more likely you are dealing with a psychological phenomenon called confirmation bias. People tend to search patterns in everything, including random occasions.
Considering the amount of spam & scam email you get and the number of sites you visit it's probable you occasionally get a matching email right after visiting a site. Most of the time there's no correlation whatsoever, but the confirmation bias makes you ignore those occasions and concentrate on the coincidences.
I believe people here can come up with most imaginative explanations of different kind of possible ways your browsing could be compromised – and those are real mechanisms, too. However, the confirmation bias is a more probable explanation. Building targeted attacks like this would take a lot effort compared to any possible profit. Sending those phishing emails to random addresses is already profitable enough. Adjusting the scam based on browsing patterns wouldn't simply add anything, e.g. it does not increase reliability.


What kind of hash does the VeraCrypt tool use?

Veracrypt is supporting multiple hash algorithms, which are listed in the documentation.

It supports the following Hash Algorithms:

RIPEMD-160
SHA-256
SHA-512
Whirlpool
Streebog


If I only know part of a password and part of the hash is it possible to get the full password?

Considering that I am reading your question correctly you know the first section of an SHA1 hash and then the characters in plain text after the hash.

To successfully pull off this attack you would need to write a script that guesses passwords as Password1! + randombytes# and hashing the full combo with SHA1 and then checking to ensure the beginning of the hash of the guessed password equals e921a7cde9e64d612b and adding it to a list of potential passwords.

You mentioned using hashcat however due to the nature of your attack method as mentioned above it would be easier to write a simple script in a language of your choice to pull off your attack.

In short the attack is possible but would be more difficult since you do not have the full hash.


Use the hash of the password to encrypted password

Is this is bad mechanism ?

Yes. Use SSL/TLS and do not attempt to roll your own cryptograhy scheme.


Closing an HTML element without using literal slashes?

Here are some more you can try.  I betcha that one of these will work (in fact, I bet that the first one will work, and then you can stop reading):

Try .  No user interaction involved.
You're giving up too easily on onmouseover.  Create a giant element that covers most of the page, and then use onmouseover.  While technically user interaction is involved, I think you can make it almost automatic.
Try onreadystatechange, e.g., .  It is IE-only (IE7 and later, I think) but powerful.
Try onfocus="alert(0)" autofocus, e.g., <input autofocus onfocus=alert(0)>.  I don't know if this will work.
On Opera, try
.  It might work.
Try  and  (unlikely to work on most browsers, but you can try it).
If the server doesn't specify the content-encoding type in the headers of the HTTP response, try UTF-7 shenanigans (only works on older browsers).

Note that these techniques are likely to be highly browser-dependent.

If you are still stuck, try asking on Sla.ckers; there are a bunch of folks who hang out there who are super knowledgeable about this sort of thing.  For the basics, I recommend RSnake's XSS cheat sheet.  For more advanced XSS vectors, try Gareth Heyes' blog and Sla.ckers.


What's wrong with SHA-1 having collisions?

Its been a while that SHA-1 collision was successfully achieved by Google researchers As proof of concept, the research presents two PDF files [PDF1, PDF2] that have the same SHA1 hash, but display totally different content.

You can learn more in this academic paper.

Its also worth to mention that this cryptographic hash function is 22-year old but as far as I'm concerned we still far from seeing real world attack conducted especially in the scenario you described except if you are targeted by a government or a a wealthy criminal enterprise:

  A practical collision attack against SHA-1 would cost $700,000 in
  2015 and $143,000 in 2018. He surmised at that cost attacks,
  especially if they were carried out by a wealthy criminal enterprise
  or government entity, could be feasible. (Bruce Schneier)

Now to be more practical, a SHA-1 collision may affect the Microsoft Kernel-Mode Code Signing Policy for instance. This attack relied on signature verification for loading only signed kernel-mode drivers. You can find more here but for now I'm not sure you need to worry about a MITM attack delivering an altered file..


What attacks are prevented using Session Timeout or Expiry?

It prevents damage from a very common and low tech attack: device theft.

If my laptop walks away while i'm in the potty, I'd rather the thief have just 5 mins to flee and hide and start hacking than my online access being available to the more savy fence it's pawned to hours, days, or weeks later...


Rationale for "install software on computer" functionality in browsers

I suspect that what you describe is a feature Firefox implements for the HTTP protocol. Whenever a browser downloads a file from a HTTP(S) server, its reply does not contain only the requested file. The reply is augmented by a few "HTTP headers" that provide details about the file. One of the most important headers is called "Content-Type".

The easiest view to display this information is the built-in http monitor feature of Firefox
Menu -> Tools -> Web developper -> Network -> Content-Type will be listed as column "Type".

When the server replies with "Content-Type: application/x-xpinstall", a  similar mesage appears:
"sourceforge.net Firefox prevented this server from asking to install software into your computer"
Those who do not fear javascript can see it for themselves for example here

This behaviour is different, when you visit the offending URL directly. In that case the message is roughly:
"Application Firefox prevented this server from installing an unsigned addon. Find out more"
Example of this behaviour is this URL, which is the actual x-xpinstall URL from the example above.

The behaviour is also different if the downloaded file is properly signed.

Note that the last example had no JS/CSS/HTML. The only role HTML plays in the story is, that it triggered a download (a normal thing), which just happened to be Content-Type: application/x-xpinstall. This feature can only install potentially unsigned Firefox addons (.xpi), which is bad enough.

This MozillaKB article describes how to disable xpinstall:


There is actually more to putting certificates on the card than just a software. You have two options when putting certificates on the card:

The private key is generated on the card alongside with the CSR that is sent to the CA for signing and the cert is then installed on the card. This is the preferred option for authentication certificates, the fact that the private key is on the chip and can't be extracted provides additional security.

The keystore is generated outside of the card (including private key) and the keystore is then pushed to the smart card (installed). This is the preferred option for private keys that may require archival (e.g Mail encryption certificates that you want to use to decrypt your old emails). Private key must be generated outside of the smartcard as the one generated on the card can't be extracted (for archival).

Usual process of getting certificates on the smart card consists of two steps:

Pre-personalisation (some vendors deliver blank cards that require this step on your side, others take care of it for you as a part of solution they're selling) of the card where:

the firmware is installed on the card (different cards allow different versions of the firmware, each with different functions and capabilities)
generation of the private keys (this is sometimes done as a part of personalisation
generation of the PIN/PUK and operator PIN (pin used to access the card for administration purposes like installation of the certificates, key generation and certificate removal)

Personalisation of the card, this step involves:

generation of the CSR (if key is stored on the card) or creation of the keystore (with the private key and CSR) if the private key can exist outside
issuance of the certificate
installation of the certificate or the keystore on the card
generation/change of the PIN may be part of this process

So your question is not only if you need a software for the installation of the certificates. Depending on the type of the card you have, you need to know if they are pre-personalised (do you need to install firmware on them or not) if yes which version of the firmware is required and how do you go about the installation. If the cards is pre-personalised by the vendor, then you most likely need vendor specific software to generate the key and CSR and install the certificate. On top of that you need a card reader/printer capable of writing to the card and its driver. From my experience the drivers provided by MS are often having trouble writing to the cards.
Considering that you are creating MFA system, the key should be generated on the card, you may consider automating the issuance process with your CA to make it one smooth operation.
You should also think about PIN encryption and how you are going to take care of that (the PIN on the card should be encrypted) and many more things.
Short answer to your question is: yes you need a software.


inject update-motd.d 00-header to run a script on ssh login

The exact implementation is going to vary depending on which GNU+Linux distribution you are using, but it is probably safe to assume that those scripts are running under a separate user/process and not in a way that would ever allow you to interact with a command; it looks like the output may be written to a file and then displayed to you.
Also, you will probably need to make that script executable if you haven't already.
Instead, do something that doesn't require interactive input, such as creating a setuid shell binary or granting your user increased privileges.


Creation and deployment of self-signed certificates for a two-machine scenario

Your principles are correct, but the particulars can be a devil to set right.

Indeed, the general schema is that:

The client needs to validate the certificate from the server, i.e. verify that the certificate has been issued (signed) by a trusted CA, and that the alleged server certificate contains the name of the server.
Similarly, the server needs to validate the certificate from the client, i.e. verify that the certificate has been issued (signed) by a trusted CA, and then obtain the "client name" from the certificate.

So both client and server need to trust some root CA certificate -- not necessarily the same (but it does not hurt that they both trust the same). Moreover, both client and server can be a bit picky about what they find in their own certificate, and in the certificate from the peer. The server certificate will have to contain the server name as prescribed by RFC 2818 (section 3.1). If you include the Extended Key Usage extension, then IIS and Internet Explorer will tend to require the "server authentication" key usage (1.3.6.1.5.5.7.3.1). For the client certificate, IE and IIS will again want to see a specific key usage, namely "client authentication" (1.3.6.1.5.5.7.3.2).

The server (IIS) must also make something out of what it finds in the client certificate. There are several methods. "Account mapping" is about associating the client certificate with a client account, accounts being the notion of identity which prevails within a Windows operating system. If an Active Directory domain is in force, the mapping can be direct (the certificate is mapped to the account which, on the AD server, contains a copy of the certificate) or indirect (the certificate contains a copy of the User Principal Name of the account, in its Subject Alt Name extension). Non-mapped authentication is possible, too, in which case the application is responsible for making sense of the certificate.

Certificate revocation can be a problem, too. Conceptually, a CA who has issued a certificate can "express remorse", and announce to the World at large that a given certificate, though seemingly all signed and signed and valid, must nonetheless be rejected. This supports emergency situations such as a stolen private key. This announcement uses a Certificate Revocation List, a short-lived object signed by the CA. Both the server and the client may want to obtain a fresh CRL which covers the certificate they are trying to validate. Your homemade PKI does not publish CRL regularly, so if the client or the server gets into its head to verify revocation status, things will fail.

Whether IIS and/or IE will engage into revocation check depends on what they find in the certificates, but that's not documented with the utmost clarity. IIS can be configured to disregard revocation checks. For Internet Explorer, this can also be done, apparently on a zone basis (IE categorizes servers in "zones", such as "local intranet" or "Internet", and can apply different security settings for each zone, one of which being "enforce revocation status check").

This blog post seems to cover your situation. I suggest you follow its indications. Don't fiddle with revocation unless you get some error messages stating that some revocation status check could not be obtained, in which case you may have to build a CRL and push it on both client and server (with mmc.exe), or deactivate revocation checks (as indicated above).


I have seen this happening on some machines, with different target IPs (last one was in Texas, of all places: the actual server should have been in Northern Italy, not even on the same continent).

Verify your network configuration and manually set the DNS entry to Google's 8.8.8.8, and see whether this continues to happen or not.

What happened in my cases was that something had hijacked the routers, thanks to the fact that the users had left them with remote access enabled and trivial passwords (but I am advised that there somethings that can brute force entry or exploit router vulnerabilities), and reprogrammed the DNS sent via DHCP to the internal network so that DNS queries were routed to a rogue server.

The rogue server then replies to "most" DNS queries with the address of another rogue server, which is then able to hijack all of your communications. Google mail, home banking site, and so on. HTTPS encrypted connections will receive faked signed certificates, which may trigger a browser security alert... or not, depending on the browser.

I would carefully review the logins you've used while being hijacked, and consider those passwords compromised.

If the DNS trick works, your router is in all likelihood compromised also; I'd reset it to factory and secure it, unless you already secured it when you installed it, in which case it must be considered vulnerable and replaced with a new model, or its firmware updated if possible. You may want to Google your router's make and model and keywords such as "vulnerability", "botnet", "CVE".


Dmarc: Why do I have dkim=fail, spf=fail and result=pass

TL;TR: someone send a mail with the SMTP envelope of otherdomain.com but the mail header From mydomain.com. Since the SPF check passed for otherdomain.com it might have been someone from otherdomain.com which tried to spoof the sender to mydomain.com.

<identifiers>
    <header_from>mydomain.com</header_from>
</identifiers>

This means that the From of the mail shows mydomain.com as the sender domain. This is the domain expected in SPF and DKIM records for identifier alignment.

<auth_results>
    <spf>
        <domain>otherdomain.com</domain>
        <result>pass</result>
    </spf>

This is a successful SPF record. The success of this record is only seen in relation to the SPF specification and not in the context of DMARC as can be seen from RFC 7489 Appendix C:

<!-- This element contains DKIM and SPF results, uninterpreted
    with respect to DMARC. -->
<xs:complexType name="AuthResultType">

Only it the email address in the SMTP dialog ("SMTP envelope") used otherdomain.com. Since otherdomain.com is not mydomain.com the identifier alignment fails and thus:

    <policy_evaluated>
        ...
        <spf>fail</spf>
    </policy_evaluated>

policy_evaluated is the result based on DMARC as can be seen from the specification:

<!-- Taking into account everything else in the record,
     the results of applying DMARC. -->
<xs:complexType name="PolicyEvaluatedType">


Vulnerability management solution evaluation criteria

Bandwidth requirements
System requirements
Training offerings
Reporting
Accuracy (number of false positives)
Time to scan
Extra offerings

Example: Nessus has web app tool; Nexpose doesn't

Vulnerabilities detected (make a vulnerable device have all three scan it)


When using public/private keys to secure app licensing info, couldn't someone simply replace your public key to defeat it?

Yes, what you describe is a possible vector to crack your software.
The question is how likely it is that someone really goes that route. After all the public key needs to be stored somewhere where it is accessible to the program. And if that program runs on the computers of your customers, they can potentially can access that area too and change it.
But Ask yourself:

What's the audience of your program? Could they really do such things on their own? Hiring some developers to do the job might be more expense than just paying the license. And they'd need to redo that for every update.

How "honest" is the audience? Most people are.

Do you offer support and is it likely users, at least occasionally, need it? Usually support is bound to a license. And if someone phones for support and you look them up and discover you haven't issued them a valid license... Call the lawyers.

Or is the software popular enough that crackers could make money out of it on their own?

I mean if someone's eager enough, they can also just patch any license check away... But is it likely?


Virtual Penetration Test Lab - Figuring Out Its Market Size

The market for a penetration testing lab is probably a tiny subset of the market for penetration testing services and an even tinier subset of the market for information security. I'd encourage you to do your own investigation by reaching out to potential prospects, but a resource which may be of use is the Delling Institute. See: http://www.dellingadvisory.com/blog/2013/4/29/extrapolating-the-us-penetration-testing-market-size


How reliable is a write protection switch on a USB flash drive?

Physical write protect on a USB drive should work in all cases. The write controller is in the drive itself. Thus, excepting a wholly insane implementation, the physical write protect switch is secure.

Physical write protect is always kind of a semi-soft thing, but it's usually at the drive internals. With a floppy drive where the controller is external to the device, one could craft a drive that ignored the write-protect slider. I think SD cards are the same as floppy drives in that regard, though I won't make a bet on it because I know those include some circuitry for things like wear-leveling.


What guarantees does GPG-signing a git commit provide?

With git, a cryptographic signature at the tip of the branch provides strong integrity guarantees of the entire history of that branch going backwards, including all metadata and all contents of the repository, all the way back to the initial commit. This is possible because git records the hash of the previous commit in each next commit's metadata, creating an unbreakable cryptographic chain of records. If you can verify the cryptographic signature at the tip of the branch, you effectively verify that branch's entire history.

For example, let's take a look at linux.git, where the latest tag at the time of writing, v5.5-rc4, is signed by Linus Torvalds. (This is slightly different from your question because you asked about signing commits, while we're looking at signed tags -- but in every practical sense this is exactly the same.)

$ git cat-file -p v5.5-rc4
object fd6988496e79a6a4bdb514a4655d2920209eb85d
type commit
tag v5.5-rc4
tagger Linus Torvalds <torvalds@linux-foundation.org> 1577662169 -0800

Linux 5.5-rc4
-----BEGIN PGP SIGNATURE-----

iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl4JNtkeHHRvcnZhbGRz
...
=rNsn
-----END PGP SIGNATURE-----

The entire contents of this tag are signed, so this tells us that when Linus signed the tag, the "object hash" on his system was fd6988496e79a6a4bdb514a4655d2920209eb85d.

But what exactly is that "object hash?" What are the contents that are hashed here? We can find out by asking git to tell us more about that object:

$ git cat-file -p fd6988496e79a6a4bdb514a4655d2920209eb85d
tree 30efc38ed890f113f9e1f0cbc801bab7090365eb
parent a99efa00891b66405ebd25e49868efc701fe1546
author Linus Torvalds <torvalds@linux-foundation.org> 1577662156 -0800
committer Linus Torvalds <torvalds@linux-foundation.org> 1577662156 -0800

Linux 5.5-rc4

The above contents in their entirety (slightly differently formatted) is what gives us the sha1 hash fd6988496e79a6a4bdb514a4655d2920209eb85d. So, thus far, we have unbroken cryptographic attestation from Linus's PGP signature to two other important bits about his git repository:

information about the state of his source code (tree)
information about the previous commit in the history (parent)
information about the author of the commit and the committer, which are the one and the same in this particular case
information about the date and time when the commit was made

Let's take a look a the tree line -- what contents were hashed to arrive at that checksum? Let's ask git:

$ git cat-file -p 30efc38ed890f113f9e1f0cbc801bab7090365eb
100644 blob 196ca317bd1f24ad57ad9ded549bc0b7994d8111    .clang-format
100644 blob 43967c6b20151ee126db08e24758e3c789bcb844    .cocciconfig
100644 blob a64d219137455f407a7b1f2c6b156c5575852e9e    .get_maintainer.ignore
100644 blob 4b32eaa9571e64e47b51c43537063f56b204d8b3    .gitattributes
100644 blob 72ef86a5570d28015d0ccb95ccd212bf8820c1c2    .gitignore
100644 blob a7bc8cabd157b89adbc2d8f6c4d6e3c88b14e3cd    .mailmap
100644 blob da4cb28febe66172a9fdf1a235525ae6c00cde1d    COPYING
100644 blob 9602b0fa1c958da4b605127c2b8da0628efeb34e    CREDITS
040000 tree b239b5eaacf2619bf564d152661ee425c4ee76f9    Documentation
...
040000 tree 82dd6833b421625c7b15d4d1c26964fc65874eb4    virt

This is the entirety of the top-level Linux kernel directory contents. The blob entries are sha1sum's of the actual file contents in that directory, so these are straightforward. Subdirectories are represented as other tree entries, which also consist of blob and tree records going all the way down to the last sublevel, which will only contain blobs.

So, tree 30efc38ed890f113f9e1f0cbc801bab7090365eb in the commit record is a checksum of other checksums and it allows us to verify that each and every file in linux.git is exactly the same as it was on Linus Torvalds' system when he created the commit. If any file is changed, the tree checksum would be different and the whole repository would be considered invalid, because the object hash would be different than in the commit.

Finally, if we look at the object mentioned in parent a99efa00891b66405ebd25e49868efc701fe1546, we will see that it is a hash of another commit, containing its own tree and parent records. If we cared to, we could walk each commit all the way back to the beginning of Linux git history, but we don't need to do that -- verifying the checksum of the latest commit is sufficient to provide us all the necessary assurances about the entire history of that tree.

So, if we verify the signature on the tag and confirm that it matches the key belonging to Linus Torvalds, we will have strong cryptographic assurances that the repository on our disk is exactly, byte-for-byte the same as the repository on the computer belonging to Linus Torvalds -- with all its contents and its entire history going back to the initial commit.

Since you asked specifically about signing commits as opposed to signing tags, I have to mention that it's generally a good practice to PGP-sign commits, particularly in environments where multiple people can push to the same repository branch. Signed commits provide easy forensic proof of code origins (e.g. without commit signing Alice can fake a commit to pretend that it was actually authored by Bob). It also allows for easy verification in cases where someone wants to cherry-pick specific commits into their own tree without performing a git merge.

If you are looking to get started with git and PGP signatures, I can recommend my guide here: https://github.com/lfit/itpol/blob/master/protecting-code-integrity.md

Important note: sha1 is not considered sufficiently strong for hashing purposes these days, and this is widely acknowledged by the git development community. Significant efforts are under way to migrate git to stronger cryptographic hashes, but they require careful planning and implementation in order to minimize disruption to various projects using git. To my knowledge, there are no effective attacks against sha1 as used by git, and git developers have added further precautions against sha1 collision attacks in git itself, which helps buy some time until stronger hashing implementations are ready to go.


Unsafe to not provide full path to powershell script?

.\test.ps1 is a relative reference to a file in the current subdirectory.

There is no way that I am aware of to change how the OS will treat that path reference via a PS profile.

Note that if your batch file is located in the system path, and it is invoked from a directory other than the one where it is located, the .\test.ps1 reference will fail.

In that case, you need to use a full path to reference the file EG -File c:\scripts\test.ps1


Is LocalStorage in web browsers safe enough to store passwords?

Terrible idea. Don't store the password in clear text between pages, not on the client and not on the server. Redesign your page flow (for instance by only entering the user name on the first login page, then branch to the registration page if it does not exist), or if you can't, let them re-enter the password.


How do I get the RSA bit length with the pubkey and openssl?

ssh-keygen -lf /etc/ssh/rsa_key.pub
2048 d1:cb:15:df:5d:44:...

2048 is the keylength


"Hashes" are one-way, deterministic functions. If you hash a password, you get some value. If you try again to hash the same password, you again get the same value. Therefore, a hash value can serve as a password verification token: to verify a password, just hash it and see if it matches the hash value.

The attacker does just that: he tries passwords until a match is found.

The attack is a more or less efficient process; if the hash function is unsalted, then various optimizations are possible (precomputated tables, parallel attacks...).

More on the subject in this answer.


How will Certificate Transparency be enforced?

Will certificates from corporate (or "internal") CAs be rejected by Chrome?

This is already answered in the exact sentence you've cited: "... require Certificate Transparency for all newly issued, publicly trusted certificates ". Since internal CA are not publicly trusted no certificate transparency will be required for these.

  Will every certificate observed by the browser now trigger a query to Google's CT server?

Certificate Transparency in Chrome describes the verification process as follows:

  Chrome may check that an SCT has been honoured by the CT log that issued it, i.e. that the corresponding certificate is indeed published in that CT log. ... Chrome does this by sending a specially-crafted DNS query that requests an inclusion proof from the log. Using DNS allows the user to remain anonymous from the CT log's perspective and enables caching of inclusion proofs.

From my understanding it will check always if the required CT information are in the certificate. But I don't think that this means it will check always that these information are correct and are reflected in the CT logs. My guess is that it will check not always but often enough so that certificates with fake CT information get detected.


As far as I can see, you can easily spoof all of the fingerprinting data, and potentially change it with every request. All this information is sent by your browser in the HTTP headers of the request (or obtained via browser client-side scripts). I am not aware of a particular plugin that supports this fully, but there are some plugins for changing your user-agent, manipulating headers and managing cookies. The user-agent is one of the main identifying pieces of information of the fingerprinting process and most other pieces are in other various headers. Blocking javascript/flash scripts is also possible, e.g. using the noscript plugin

Changing this fingerprinting info however does come with a price. It might cause the website to display pages in a different way, which will cause the site to look wrong or not to function properly. Lots of website developers rely on (at least some of) this fingerprint information in order to make the pages they display compatible with your browser. Hiding/spoofing this info will therefore affect this process and your browsing experience may be altered.

It's also possible that this fingerprinting is performed for legitimate security reasons. For example, a security-aware website might tie in the fingerprint info to the session or logged-in user, and will reject requests where the fingerprinting doesn't match (this would suggest to the server a request is now coming from a different browser). Here's one more example from another question where the website owner wants to test browser plugin versions of your browser (which is part of the fingerprinting data) before allowing access. I don't know of any specific sites that use this technique, but it is definitely feasible. Changing fingerprint data with every request will again cause unwanted behaviour.

I suppose that performing some minor randomized tweaks to specific headers will achieve a better degree of anonymity against fingerprinting without compromising the browsing experience. This requires some experimentation and will probably mean a compromise between security and usability.


Securely notify users about account changes

You should always assume that registration information is what your real user wants, any later change and the user should be notified, especially when it comes to critical information such as username and password.

When the email address is changed, an confirmation email should be sent to the new address containing a link to activate the new email address. A notification email should be sent to the old address as well (containing a link to revoke/report this change).
When the password is changed, a notification email should be sent to the current email address containing a link to report/revoke the change.
First name and last name are a special case. They're non-critical information, but they're unlikely to change very often. So I'd say go with what best suits your application.
Other information such as age, about me, likes, sports, hobbies, etc... are clearly non-critical information. Personally, I'd like to have the option to be notified about them, so it's nice to have an opt-in checkbox for that.


gpg --edit-key <KEY_ID> addkey

Choose

   (5) Elgamal (encrypt only)
   (6) RSA (encrypt only)

source: gpg manpage


The host header can be seen by the application, and requests with non-existent hosts are submitted to the default virtualhost, so the answer can be yes.

In order to have a SSRF vulnerability on the host header all the following factors must be present:

The web server must be configured with a default virtualhost
The server-side code must use the server name (or the host header directly)
The server side code must not check the server name against a whitelist
The server-side code must use the server name in a dangerous way (e.g. as code or as part of a network request)

In this blog post you can find the theory behind it for PHP.


XSS via JSON: Why does a web application not sanitize either its incoming params hash or its outgoing JSON values of malicious tags like Script?

This is often brought up everywhere, partially because everyone keeps repeating the mantra that input sanitation is the answer. It isn't. It's dangerous, bug-prone, and it needs to go away. Of course, you should always check to see if your input lengths are correctly corresponding to their appropriate columns.

Sanitizing Input vs. Sanitizing Output.

Sanitizing input gives people a false sense of security since there are so many ways to get around it, and because it's difficult to properly implement, forcing developers to search google for an outdated implementation that may or may not be secure. For this reason, it's best to sanitize output.

Part of the reason this is done later is because you want to preserve the correct data, but also to protect against SQL injection attacks. SQL injection attacks are largely defeated by prepared statements, not really input sanitation. You should replace all script tags and dangerous outputs  with html entities.

Here's an example of replacing potential script characters with html entities on output, not input:

< becomes &lt;, still displays as < on the page, but without messing with the layout, or the database.
> becomes &gt;, still displays as > on the page, but without messing with the layout, or the database.

So Why Not Sanitize Input? What If We Correctly Implement It?

Most developers aren't IT security experts. Most developers wouldn't have a clue what to do in this area. By teaching them these two common methods of protecting data, you save development time and significantly increase the overall security of your web application. Better yet, you help your developers understand why this is necessary, instead of why 2340939403424 different types of input sanitation are needed, and prevent a lot of implementation issues that will invariably pop up later on.

Like I said before, searching google for outdated input sanitation functions is not security. That's a false sense of security. You need to understand what is acceptable, and what is not, and the process that data goes through.

With output sanitation, you don't have to worry about some weird bug happening later down the road that you forgot about. You don't have to mess with tons of different complicated functions that could be implemented incorrectly, and give a false sense of security. You don't have to worry about scripts being injected either.

But what if we replace all html entities before they're inserted? If you try that on the client side, anyone could modify the request. If you check it on the back-end before putting them in the database, that could work too... but then there's a problem:

What if there is a field that requires an actual HTML entity to be placed on it? Let's say a packaging, an address, or something silly like that. Maybe it's a file name, maybe it's something you have implemented in one way.

Example of Why Input Sanitation Sucks

Maybe someone has a funny keyboard that uses a different apostrophe for their name or address? This could leave some databases open to unicode-based smuggling.

Maybe you need a record that has < or > inside of it? What are you going to do? Search by the Html Entity? That's pretty inefficient, and requires a lot of hacks to get working right in many databases.

Maybe someone's name has an apostrophe in it - for example, Rory O'Cune. With input sanitation, you are destroying his name and requiring more code to deal with it. What if one of your employees is searching by last names and can't find him because it's been shortened to OCune? This is awful.

That's another reason why you use parameterized queries, and not input sanitation. With prepared statements and output sanitation, you can do this:

SELECT * FROM [table] WHERE [last_name] = @Lastname -- (or ?)

The @Lastname (would be a ? in Java) parameter/bound variable will be correctly translated to O'Cune. No funny business required. No bugs to hunt down. It's infinitely more secure, and you can just output the html entity if it's a page-breaking character.

So Why Isn't Ruby Fixing This Automatically?

Why should they? I've yet to come across any implementations of JSON in any language that will automatically remove these script tags. What if you want to use JSON to display script tags for some weird reason on your website?

By removing this feature, you are preventing anyone from outputting HTML through JSON, which I suspect could break a lot of things for a lot of people.

Thus, the answer is to do it yourself. Replace those script tags with Html Entities before they get serialized and returned.


is root@localhost the same as Unix root with GUID = 0 and ID = 0?

The MySQL root user is an account inside the database only. It is called root because it is the most privileged user on the database server, and has access to everything. The root user on Linux (or any other Unix) is a completely separate thing.

The maximum privilege that a MySQL user can have is equal to the privilege that the MySQL daemon runs at. On most modern package-based systems, a non-privileged mysql user will be automatically created on the system for this purpose, during the installation process.


Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name]

Check out Dan Kaminsky's blog post on mysterious Facebook certificates. The response from Facebook:

  We’re safe.
  Turns out we just ordered new (smaller) certs from Verisign and deployed them to a few test LBs on Monday night. We’re currently serving a mixture of digicert and verisign certificates.
  One of our test LBs with the new cert: a.b.c.d:443

But then have a read of @JeffFerland's blog post inspired by this week's discovery of a spoofed google.com certificate.

So it can happen, and unless you are au fait with certs and the trust assumptions, you should check any time you get an odd warning.


How are public/private keys used in code?

You are using the term "cipher" with the meaning it had up to, say, 1860. While this would be quite appropriate in case of a quick chat with queen Victoria, it so happens that Science has advanced a tiny bit since these times.

Your question is is rather broad since it is, mostly: "that field of cryptography which has occupied thousands of researchers for more than four decades, well, how does it work ?". This cannot be answered within the size constraints of this site. Well, I can tell that "it works pretty well" but, beyond that, you are in need of some introductory material on cryptography. For instance, this book, which is not bad, as far as these things go.


Can you extract memory contents from a hibernated Windows machine?

Yes, it does store it unencrypted on the disk. It's a hidden file at C:\hiberfil.sys, which will always be created on any system that has hibernation enabled. The contents are compressed using the Xpress algorithm, the documentation of which is available as a Word document from Microsoft. Matthieu Suiche did a comprehensive analysis of it as a BlackHat presentation in 2008, which you can get as a PDF. There's also a tool called MoonSols Windows Memory Toolkit that allows you to dump the contents of the file. I don't know if it lets you convert back, though. You might have to work on a way to do it yourself.

Once you've got the data out, it's possible to extract or modify data, including instructions. In terms of mitigation, your best solution is to use full-disk encryption like BitLocker or TrueCrypt.


As everybody else is saying, yes, it would. In theory, malware in an unprivileged account can do tons of damage. See this XKCD, which is as relevant to malware as it is to logging out. However, in practice, a lot of Windows malware is written with the assumption that the user is Administrator (either because the user foolishly runs as Admin all the time, or because the malware is something like a Trojan that is installed by an installer which the user will grant Admin to). Software (including malware) that expects to be running as Admin and isn't will usually fail. This "in practice" state may be changing, though; as fewer and fewer users continue the bad habit from the XP days of running with full privileges, malware authors are wising up to the new ecosystem.

One thing which has not been mentioned by the other answers and comments is the risk of local elevation of privilege (EoP) exploits. Again, most malware (not counting state-sponsored stuff against specific targets, like Stuxnet and FLAME) doesn't try to exploit local EoP unless it's expecting to start out sandboxed, because most malware just targets the large and easy target of people who run as Admin. However, it may become more important as malware authors start going for the huge number of non-admin accounts.

So far, people have mentioned (in addition to running less privileged) the need for anti-virus, anti-malware (which is different from AV somehow, in @Ulkoma's definitions), firewall, and backups. Of those, backups - real ones, that aren't permanently connected to the PC - are the most valuable, but the best bang for your buck will come from always staying up to date. True 0-days (bugs being exploited in the wild before the vendor addresses them) are actually pretty rare. On the other hand, every time MS releases a security update, lots of malware authors immediately grab it, look at the changes it makes vs. the old version, and reverse-engineer the code to find the security vulnerability it patches. The majority of the Really Bad exploits that have hit Windows went after vulnerabilities which had been patched weeks or months earlier; people simply hadn't updated when they should have done so.


Does Thunderbird Enigmail plugin decrypt attached files?

If you decide to send an attachment over with Enigmail install on Thunderbird, you are prompted to encrypt the attached file using Enigmail, which would then be decrypted once the recipient decrypts the email using Enigmail.

If you decide to encrypt that attachment on your own, and then attach and encrypt and send it using Enigmail, then no, Enigmail will only be able to decrypt it as deep as it's own encryption goes; Enigmail isn't able to automatically decrypt files encrypted by other means outside of Enigmail. Your recipient would still be left with an encrypted file after downloading the attachment (eg. putting a locked box inside of a locked box).


Hashing a password, and summing it with every byte in a file. How secure?

this is only brute-forceable if you know what to expect

Stop right there. What you're describing is security through obscurity. You're betting that an attacker won't be able to know or guess your scheme. This is a really, really, really terrible assumption. It's an alluring one, but time and again it's been proven wrong. Any proper security scheme must work even if the attacker knows the system you're using; an attacker who knows everything but your password should not be able to practically attack the system.

So, throwing out the assumption that an attacker doesn't know your scheme: The security is frankly terrible. First, it's very simple for an attacker who learns part of the plaintext to use that to recover other parts, because you add the same thing to each 64-byte chunks. An attacker who gets one password of yours can see what having it in one section of the ciphertext means; specifically, if they assume it's at position X, they can subtract it from the ciphertext and get a potential part of the keystream, then try that keystream elsewhere.

Second, your program is quite vulnerable to brute-force. SHA-512 is an extremely fast hash. Fast hashes are great, in general -- they mean your crypto is faster, which means you have less overhead, which means you're more likely to be able to use crypto everywhere with acceptable performances. But they're terrible for passwords, because passwords are almost invariably low-entropy. With SHA-512, an attacker who recovers the file can brute-force passwords extremely quickly. Hashes used for passwords need to be slow: the thing you're hashing is low-entropy, so your hash must take a while to run to make this slower. A GPU can compute millions of SHA-512 hashes per second; doing your decryption is also fast, so this is not suitable to resist brute-force.

You should not use this scheme. Rather, you should use proper cryptography. If you were to build it yourself, this would look like an actual secure cipher (e.g. AES in an appropriate mode), with the key derived with a slow function (e.g. PBKDF2). Can your scheme work? Well, if your password is very high-entropy, possibly -- at the extreme level, if your password is a 128-bit truly random string, you may as well use that directly as the key to AES. But your password is likely weaker than you think, so you should just use a slow hash.

However, you should not do that either. Cryptography is really hard to implement properly. Where possible, you should use well-tested secure systems instead of coding something yourself. For instance, you could use GPG to encrypt the file; you could also use a password management tool (I'm pretty sure there exist such tools that don't even store encrypted data on the cloud, but are entirely local). Don't implement your own system except for practice; if you do, don't use the scheme described here.

Looking at your other question, you seem to still think you can effectively hide your scheme from an attacker and rely on "no, they won't figure out what I'm doing." So, here's something beyond the (fully sufficient) "security by obscurity isn't effective:" The only reason to care about an attacker decrypting your file is that they already have the file. That means you failed to keep a file on your computer secure. Your program is also a file on your computer. Why assume you can keep that secure, even if the file containing the passwords isn't?


I think it's secure -- but I'm not certain it's what you want.

Assuming you have control over the $email_to, $email_subject, and $headers variables (as it appears you do in the code), you're definitely targeting the variables that could make you vulnerable to script injection -- $name, $email, and $message.

That said, it appears that the filter_var command (which, I will confess, I've not used before) will strip, rather than convert, text that doesn't correspond to its filter. And since you are applying the FILTER_SANITIZE_EMAIL filter to things that are not, in fact, e-mail (i.e., name and message), you may lose content that you want.

I think the htmlentities command is a better fit for what you need.


Looking for a presentation about information security for corporate employees

This is a hot issue right now and many people write high-quality education programs, so I'm not sure that you are going to find CC licensed options. Add to that the fact that every corporate environment is different (as you indicate), I don't feel like you are going to find something for free that meets your needs.

You ask for 'dangers, and possible solutions and guidelines'. That is WAY too broad. If you broke down what specifically you want your users to know and what behaviours you want to instil, you might find some options that could work. Going through the process of defining that knowledge set and response behaviours would also help you to define a way to measure the effectiveness of your training.