What do key size and block size mean in cryptography?

A symmetric key algorithm is one which uses the same key for both encryption and decryption. Examples of symmetric key algorithms are AES, 3DES, Blowfish.

An asymmetric key algorithm on the other hand, uses 2 keys, one for encryption and one for decryption. An asymmetric key algorithm is designed in such a way that it is unfeasible to derive the private key from the public key. A common asymmetric key algorithm is RSA.

The term block size refers to the block cipher. Basically, there are 2 types of ciphers.

Stream cipher - The algorithm encrypts/decrypts the message 1 bit at a time.

Block cipher - The algorithm encrypts/decrypts the message block by block, a block referring to a group of bits. Common block ciphers include AES - which works on 128 bit blocks, and Blowfish - which works on 64 bit blocks.

All of this information can be found on their respective Wikipedia entries:

http://en.wikipedia.org/wiki/Symmetric-key_algorithm

http://en.wikipedia.org/wiki/Public-key_cryptography

http://en.wikipedia.org/wiki/Block_cipher

http://en.wikipedia.org/wiki/Stream_cipher


Why does MYSQL's LOAD FILE only read some files and not others?

It looks like this is the apparmor conundrum.  I had "stopped" apparmor, and retested, but it didn't seem to matter.

Enabling APPARMOR_ENABLE_AAEVENTD so I could get logs on apparmor related denys:

vi /etc/apparmor/subdomain.conf

and updated the line:

APPARMOR_ENABLE_AAEVENTD="yes"

and restarted apparmor

ori@myamdbox:/etc/apparmor$ sudo service apparmor restart

I then reran the load_file("/etc/shells") above and the log spewed out:

Oct 10 04:03:13 myamdbox kernel: [85739.145281] type=1400 audit(1381374193.268:132): apparmor="DENIED" operation="open" parent=1 profile="/usr/sbin/mysqld" name="/etc/shells" pid=22485 comm="mysqld" requested_mask="r" denied_mask="r" fsuid=115 ouid=0

Tearing down the profile for a test worked, so it's certainly the culprit.

To fix it simply I opened /etc/apparmor.d/usr.sbin.mysqld

and added the line:

...

/etc/shells r,

And yep, it works.

mysql> select load_file("/etc/shells");
+---------------------------------------------------------------------------+
| load_file("/etc/shells")                                                  |
+---------------------------------------------------------------------------+
| # /etc/shells: valid login shells
/bin/sh
/bin/dash
/bin/bash
/bin/rbash
|
+---------------------------------------------------------------------------+
1 row in set (0.00 sec)

To do the opposite I need only find the reference in the apparmor config and remove it.

Thanks Lekensteyn!


Unknown manufacturer of services in windows system configuration

That service is created by the ASUS PTP driver, which for Intel 7th and 8th CPU units/devices, is the official replacement of the "Smart Gesture" touch-pad driver.

For the new systems, it comes pre-installed and is update-able to the latest driver version by running the standard Windows Update.

The manufacturer tag will probably get and update and show correctly in future versions.

So if you use a 7th or 8th gen CPU it should be entirely legit. There's also no reason for a malware to name itself like that, as it would have a very limited coverage; a malware will most likely use a more universal name. Nothing prevents you though from running some anti-malware scans on your system.


Exploiting the PHP readfile function when a filename is appended to the path

Beside PHP is interpreted, version <= to PHP 5.3.4 are vulnerable to an attack commonly call null byte injection.

To declare a string in php, you use $var = "hey" which is then equivalent in C to char tab[4]="hey". Notice that we declared a 4 bytes array of characters while we only want to store 3 characters. This is because compiler automatically insert the null byte character. Your final string is then hey\0

tab is a pointer which point on the first character of your string. Your computer will read from the first character to the null byte character (0 in hexadecimal) represented by \0.

%00 is the representation of the null byte character in PHP.

When you are calling a function with a string, like readfile("pages/$path/index.html");, your string get stored in a variable. Let's call it $tmp=pages/pathFromVariable/index.html which in reality will be stored in memory as pages/pathFromVariable/index.html\0

Now, if you inject null byte at the end of your input, you can erase the end of the string. for example, if $tmp=pages/pathFromVariable%00/index.html it will be stored as pages/pathFromVariable\0/index.html\0 which will result into reading the file pages/pathFromVariable ! Pwned !


Can specific location be determined from an aerial image?

It's just a matter of time (I'm thinking of months) until a free online reverse map-image search becomes available. Something like this (which is just a demo, but still pretty cool) https://search.descarteslabs.com/?layer=naip_v2_rgb_2014-2015#lat=39.2322531&lng=-100.8544922&skipTut=true&zoom=5

So I wouldn't consider posting an image of a location that you want to keep secret safe at all.


Android side channels: what can one app observe about other apps?

On multi-core platforms at least (and most new smartphones are multi-core), all the side-channel attacks on branch prediction and cache should work, as long as the attacker can access a clock with enough precision. The ARM architecture has a "cycle counter" that application code can use, but it has to be first enable from privileged code (kernel); see this answer. Native code is possible for apps starting with Android 2.3 (with the NDK).

I don't know if the cycle counter is enabled by default with Android; it is disabled in a freshly booted CPU, but Android uses a Linux kernel and the cycle counter is very convenient for a number of tasks, including implementing the gettimeofday() system call, so it is possible that the Linux kernel enables it. This should be tested.

IF the cycle counter is enabled, then chances are that the Java method System.nanoTime() may also return the same information, for pure Java apps. So going native might not even be necessary to pull off a cache-timing attack on Android.

Also, there can be other accurate clocks. For instance, the GPS API provides one, with Location.getElapsedRealtimeNanos().

Side-channel attacks on cache access have been demonstrated on common AES implementations (in lab conditions, but still demonstrated). There has been quite some work done on such attacks against cryptographic algorithm, but there is nothing here really specific to cryptography. It just happens that cryptographic algorithms uses keys and keys concentrate secrets; knowing the key reveals a lot of things, so keys are high-value targets. Also, all such attacks were researched by cryptographers, and cryptographers work on cryptographic algorithm. However, side-channel leaks may occur on just every single implementation of any algorithm, cryptographic or not. Usually, when encryption occurs in a device, it is because some confidential data is processed by that device, and all that processing, not just the encryption, may leak like crazy. The issue is real and all-encompassing.

Under these assumptions, one must assume that a lot of data can be inferred from an app, about what other apps do. Defending against local attackers, who run their code on the same hardware as you and at the same time, is hard.


Authenticating REST API using Access Token

Yes and no.

What you are talking is like an authentication cookie.

Yes because unless the computer is compromised, physic access or virus, the cookie is safe and only the source computer can use it. Many site do that, for example this one. Even if I close my browser or computer, I'm still logged in because the cookie stay in my browser which reside on my personal computer.

But, only do that for non-critical service.

No because the longer an authentication cookie stay alive the more chance it has to be stolen. For example, would you like to stay logged in to your bank account? A "friend" come at your house, you leave your computer open. He access your bank account because you are still logged in and steal some money. Friend do that all the time with opened facebook account. Also the longer is stays active the more chance it has to be stolen, no matter how it is stolen.

The shorter the live of your cookie the more secure it is. But for non critical applications, it's ok to have cookies that live a long time and persist after we close the browser.


What is the purpose of "gibberish" comments posted to my blog?

They're probing your site. First,  whether the comment will be published. Second, note how they use several popular syntaxes for links - it's an attempt to check which of them will result in an actual HTML link. If your site lets those posts through, expect more spam, this time more malicious.


XSS: Code payload gets displayed on the screen as a string

The Inputs are escaped.

In php there is a function for this:

htmlentities($str, ENT_QUOTES);

source: http://php.net/manual/de/function.htmlentities.php


This isn't a good idea. Using OAuth 2.0 or OAuth 2.0ish protocols for Authentication isn't correct. OAuth 2.0 was designed as an Authorization protocol. Using OAuth 2.0 as an authentication protocol carries a handful of security implications. OpenID Connect was developed to fix these deficiencies in OAuth 2.0 so OAuth 2.0 can be used for authentication. The OpenID Connect foundation recommends using https://github.com/IdentityServer/IdentityServer3 for OpenID Connect in C#.

Additionally, if you do end up implementing your solution passing the auth token using HTTP and not HTTPS is a big security risk. If an attacker can intercept the token in transmission while the server is redirecting the user back to the client, the attacker can use the token to authenticate as the user without needing the users password. Every part of an OAuth 2.0 flow needs to happen over HTTPS.


Based on what you are asking (testing physical access with NAC), I would suggest pwnie express' pwnplug (if you can afford it, I think the powerpwn is even better https://www.pwnieexpress.com/penetration-testing-vulnerability-assessment-products/sensors/pwn-power/).

As to how they are bypassing NAC, here is their explanation:

First, the Pwn Plug is placed in-line between an 802.1x-enabled
client PC and a wall jack or switch.
Using a modified layer 2 bridging module, the Pwn Plug transparently passes the 802.1x EAPOL
authentication packets between the client PC and the switch.
Once the 802.1x authentication completes, the switch grants connectivity to the network.
The first outbound port 80 packet to leave the client PC
provides the Pwn Plug with the PC’s MAC/IP address and default
gateway.
To avoid tripping the switch’s port security, the Pwn Plug
then establishes a reverse SSH connection using the MAC and IP
address of the already authenticated client PC.
Once connected to the
plug’s SSH console, you will have access to any internal subnets
accessible by the client PC. As an added bonus, connections to other
systems within the client PC’s local subnet will actually appear to
source from the subnet’s local gateway!

Source: https://www.pwnieexpress.com/support/product-documentation/

Disclaimer: I have never used the NAC bypass functionality of the pwnplug.

Hope that helps!


How to safely display html emails like gmail does it?

Google spends a lot of money each year in bug bounty to ensure that Gmail isn't susceptible to XSS. Part of this effort has produced Google-Caja, which is an open source project that filters HTML to a "safe" subset.

HTML filter sandboxes like Caja rely upon an "older" solution that uses complex parsing techniques, and thousands of regular expressions to filter out XSS payloads.  A "newer" solution is the Content-Security Policy, which allows the developer to build HTML pages that are totally immune to reflective and persistent XSS, and this is a stronger protection than what Caja is able to provide.  CSP would be the best solution,  but it is "too new",  IE and older browsers don't support it.

If I needed to jail HTML, I would use Caja with a strict CSP ruleset.


What are the point of these gibberish comments?

These are almost certainly incorrectly encoded foreign characters.  From some queries on "words" like âñåì and çàâåäåíèåì (chosen at ~random from the text), I'm guessing it's supposed to have been Cyrillic.  For example, this Russian book on Amazon has a similarly garbled description.

I do not know of a way of mapping those things back to Cyrillic in order to read (or translate) it.

It may also be comment spam, in which case perhaps the spamming software is the source of the bug rather than the site (I see Blogspot, WordPress, and Amazon in the search results; you'd figure they wouldn't all share this bug!).


Is address information sensitive for companies or individuals during registration?

Locking someone out after wrongfully entering their info for x amount of times for x hours/days is a good idea, but annoying to users, this helps preventing Bruteforcing.

What could be an alternative, is that instead of getting a list when you enter a SSN number, that you have to manually enter the address yourself, and a script checking if that address is used yet (if in use, it should tell you so, with a button to recover your login details, send to the email address assosciated, ofcourse not mentioning it in the warning).

That means the script should convert the address to a string that is always the same! (no capital letters or symbols. i.e.), for easy processing, or even if possible, a API/script that checks if the address is the right format/is valid.

its a small step that takes an extra 10 seconds of your life, but adds to security, atleast, thats how i would do it!


What can I do with an SQL shell using SQLMap?

Typically, one would use either the --sql-query flag (one line at a time) or your --sql-shell flag (which provides a SQLi REPL, or interactive shell) to test out functionality of the found SQLi against the target RDBMS' capabilities. This is often only needed when outside of the scope of what sqlmap can already perform, capability-wise.

Two prominent examples are:

https://websec.ca/kb/sql_injection#MySQL_Reading_Files

Finding the base directory for LOAD_FILE() by using select @@datadir against MySQL / MariaDB.
Hoping for the default file size allowed or querying it for a fit using select @@max_allowed_packet in this same attack scenario.

https://websec.ca/kb/sql_injection#MSSQL_Server_Hostname

Querying an MS-SQL Server Hostname (select @@servername) or even the productversion/productlevel/edition. In MySQL / MariaDB this same command would be select @@hostname from the sql-shell REPL.


Are there any class of systems where it is safe to disable spectre and meltdown patches

Like many other mitigations the fixes for Spectre and Meltdown address problems with running not fully trustable code. If these fixes are not applied than such code might bypass the normal restrictions to gain information information about the memory content of other processes or the OS kernel.
If definitely all code running on the system can be fully trusted then these mitigations are not needed. But note that even code from a trusted code or code you've written yourself might not be "fully trustable". There might still be unexpected code flows, especially if external input (user input, sensors ...) is processed. But the more one is in control of the code and it's behavior, the more one can control this risk and there might be a case where the risks of the code it sufficiently low to switch off mitigations against Meltdown and Spectre.
There might also be cases where not fully trustable code is run, but where an exploited information leak does not cause relevant harm. This might be the case where no important data are stored on the system in the first place or where there is no way to misuse gained information. For example if the system cannot make any connections to the outside world due to external protections (like firewalls) then the risk is low (but not zero) that captured secrets from the machine can be send to the outside attacker.


Understanding why this buffer overflow attack isn't working

CDEF in hexadecimal characters is 66656463 (little endianness), but this address doesn't point to any function and not permitted to access. So the program crashs. You have to modify your shellcode with a valid address who points to a function like execve syscall, with /bin/sh (for example) as parameter of the function.


How good is EMET at protecting Windows and should I enable it for every application?

EMET implements various protection features which are lacking from Windows editions prior to Win10. It additionally adds some protection features which catch out common cut-and-paste shellcode. EMET is being deprecated because Microsoft has now rolled most of the features into Windows 10 natively, although not all of them are present.

I wrote an answer a while back which describes some of the standard EMET features.

The performance impact is negligible, even on more complex applications like Firefox, Chrome, Office, and Visual Studio. The only issue I've ever run into is false detection of the "Caller" or "Caller+" features when opening standard dialogs (e.g. load / save) from some applications. For those cases I just turn those features off.

I have enabled EMET against pretty much everything on my system which is likely to be opening lots of untrusted content. Browsers and document readers are the obvious primary choice, video and audio players (e.g. VLC, MPC-HC) too, as well as communications apps (IRC, Telegram), plus Windows Explorer, cmd.exe, PuTTY, image editing suites, and a bunch of other random applications. These all run fine, although some needed a little policy tweaking.

Keep in mind that EMET does not protect you from malware. It implements features which make it harder for someone to successfully achieve a code execution exploit against a vulnerability in the software running on your system (not including the kernel!). These features also help stop generic shellcode from executing properly, so an attacker would likely have to tailor an exploit payload specifically for an EMET-protected system.


Is it possible to defeat the OS detection capabilities of network scanning tools?

There are a wide range of ways to trick OS identification functions, and they work to varying degrees, depending on how much functionality is built into the tool.

For example, nmap doesn't just use one identification mechanism, but a few which feed in to it's confidence %age announced in it's OS identification.

  Nmap sends a series of TCP and UDP packets to the remote host and examines practically every bit in the responses. After performing dozens of tests such as TCP ISN sampling, TCP options support and ordering, IP ID sampling, and the initial window size check, Nmap compares the results to its nmap-os-db database of more than 2,600 known OS fingerprints and prints out the OS details if there is a match.

Some tools look for only one signature, for example banner grabbing, so will be easier to fool - by simply spoofing the banner or signature.

So if you want to fool OS detection, you will want to look at a pretty comprehensive set of TCP frame sizes, keepalive functionality, packet number sequences, service banners etc etc

And change them all... this can be pretty difficult.

Instead, do you want to think about using some kind of proxy - depending on how it is configured, the scanning tool is likely to identify the OS on the proxy, which may be enough to reduce or remove the risk you are trying to mitigate.


Do thin clients need Antivirus protection

Most of the above comments don't answer your question which was

  I know that thin clients have no hard drive, but are they vulnerable
  to virus/ malware through Internet or USB drive?

And the answer is yes, they are. There are many infections which don't need a user controlled hard drive. A vulnerable windows service is enough (because the infection happens in RAM memory, in the process space basically). Or that a user browses a vulnerable internet site. So the answer is: yes, they are vulnerable even without hard drive. The next 2 questions are:

How probable is such an infection
What is the impact?

1 depends on what the users do with those WinXP boxes. If they are using office/email/internet like normal PC users in an average office then I would say the probability is the same. And the security awareness of those users largely impacts the probability, as usual. Social engineering and stuff, you know.

2 Usually, the impact of such a compromise is

Ransomware, Encryption of the hard drive
Information leakage
installation of a root kit
denial of service
etc etc

I would say 1 is impossible if no hard drive is present, are there any network drives connected? 3 sounds difficult to me without hard drive, 4 is always possible (if the attacker gains admin level he can just shutdown the box) and 2 is probably possible and you have to assess the severity (basically: how sensitive is the data processed on these boxes).

Disclaimer: This is what I think is the situation for an average hacker who only sees "hey, an XP box!" and goes ahead and attacks it. Someone who knows more about your environment can, of course, better exploit the big attack vector called WinXP. So you should also try to find an answer to the question whether you are a high value target for someone or what could be a motivation to attack you and for whom.


The hash  md5(md5(password).salt) is just as secure as md5(password.salt) .

All the difference i can see is the additional MD5 calculation md5(password) which increases the computing time the attacker needs to spend by a little and it may not be going to make a big difference.

Lets say the attacker takes the most used 100 passwords like welcome,monkey with md5 values
40be4e59b9a2a2b5dffb918c0e86b3d7,d0763edaa9d9bd2a9516280e9044d885 respectively.

He need to brute force  password as well as salt in md5(md5(password).salt) using the list welcome,monkey .

Example:md5(md5("welcome").salt)

He can simple do away with that additional MD5 calculation by using the list of md5 values calculated one time.

Example: md5("40be4e59b9a2a2b5dffb918c0e86b3d7".salt)


Dealing with a misconfigured corporate SSL certificate

There is no way to accept these certificates globally because different tools use different trust stores. wget on Linux uses the certificates at /etc/ssl/certs, Firefox comes with its own CA store, with curl it is depending on the TLS library, Python might have its own store depending on the package used, Java has its own etc.


Sucuri giving false positive with their free online scanner because of an .htaccess RewriteRule

Interesting, just read the background. I assure you has nothing to do with drumming up business. We have no need to do that. If you send us your info at info@sucuri.net we'll see if we can't better understand what is going on.

The 404testpage is a test page we emulate to see output of a page when we can't pinpoint the issue but we can see the payload.

I am more interested on what is below the testpage. Do you have more information you can share? I wonder, the 404test page, below it, does it say 500 error or website disabled? Or something equivalent?

It might be that the scanner is being blocked.

Thanks


Can we use a public key scheme for performing cryptographic commitment

The answer can be yes or no depending on what you mean by commitment.

In a commitment scheme, you have a piece of data (d) from which you compute a value c which you publish; at a later date, you publish d. This is a commitment if the following is true:

From c, one cannot recompute d.
Everybody knowing c and d must be able to ascertain that they match.
It must not be possible, even for you, to find a d' distinct from d but which still matches c.

On the surface, this looks a lot like a cryptographic hash function, with some subtle details. If you compute c as h(d) for a hash function h (say SHA-256), then you fulfill the commitment properties, except that the commitment is vulnerable to exhaustive search on the data d. One could try potential data elements d, and hash them all, to see if one matches c. That's a problem also encountered with storing password hashes. The solution is randomization: you compute c as h(r||d) where r is some random padding (say 16 random bytes). When you open the commitment, you publish both r and d. The randomness of r protects against exhaustive search.

What would a signature scheme like DSA do in that picture? Not much, really. Instead of hashing, you could sign, but since everybody can verify the signature, you still would have the exhaustive search issue (DSA includes some random data, but not in the "right place" for a commitment scheme). Indeed, DSA begins by hashing the data, so you are really using a hash function, and the DSA around it is a needless complication.

Some commitment schemes provide more than just the ability to commit to an arbitrary value; they also allow to prove without opening the commitment that the committed-to value fulfills some algebraic properties. This is used, for instance, in some electronic voting protocols (the vote is encrypted, but the voter can show that the vote is either a 0 or a 1, not another integer). This kind of commitment requires mathematics besides just a hash: it may reuse some elements which are also used in some asymmetric encryption and signature algorithms (like operations modulo a big prime), but not just the asymmetric encryption or signature algorithms alone.


Why must the master key be stronger than the session key?

I should not be distributing a 128-bit AES keys with a 56-bit DES key.
  Why?

If you think about this, it is trivially obvious: anyone can obtain the 128 bit key by brute forcing the 56 bit key that you distribute it under. The performance of your security is defined by the weakest point in the system.


Xbox 360 Security - Why must you be the data owner to move content?

This is to prevent you moving content belonging to another profile that has been password protected.

As you mention, this does not provide much security if the profiles are not so protected, because you can just switch between them: but having the XBox behave differently depending on whether the password is set or not adds complexity, which costs money and risks adding bugs. Remember too that some of content has DRM attached to it, adding to the complexity and requirements.

And it's not necessarily about security. Won't most XBox users only have a single profile? Won't most people moving content in multiple profiles be replacing the hardware in a shared XBox, and so can use Microsoft´s migration tool? So won't most users never encounter the scenario you have?

As an advanced user, of course, you have perfectly good reasons for having multiple profiles, and even better ones for not using Microsoft's tool, but it's hard for Microsoft engineers to justify features that only advanced users need in such a low margin product.


Exploiting printed _GET parameters in PHP

You won't be able to exploit code execution that way. Your code is vulnerable to cross-site scripting (XSS), but not code execution. For that you would need something like eval(), or a more subtle implicit php eval call.

However, you can exploit XSS in the above example by injecting Javascript, try something like <script> alert(1) </script> for your user input and see the popup come up in Javascript. :) An attacker could use this to pass a link with the attacker's javascript to an unsuspecting user, who when opens the link, runs the attackers javascript, potentially giving away anything from the application UI or client-side storages to the attacker. The attacker would then be able to do anything Javascript can do, when run in a user's browser in the application context (ie. running on the application origin).

A lot more info on XSS is here for example.

Update (exploiting code execution)

So you cannot execute PHP from user input this way. To make it vulnerable to code execution (ie. to be able to run PHP from user input) you need to use a variable with user input in something like eval(), like for example <?php eval($search_location) ?> in your example.

Another typical way an application would be vulnerable to this is include($_GET['myinclude']), in which case you could try providing http://some.site.tld/yourscript.php as myinclude and see how it is loaded and run on the application server.

Yet another example to make it run php code would be to use the e modifier to a regular expression with user input, as described here.

There may be many more, but simply printing a variable is "only" XSS, not code execution (fortunately, given how many websites are actually vulnerable to XSS). :)


Security concerns of RADIUS based server/workstation auth

If it helps you feel better, 99% of our encrypted communication uses symmetric cryptography (Like PSKs). We only use asymmetric cryptography (Certificates) to transfer symmetric keys and sign hashes.

Situation 1 is completely possible under three conditions:

The "evil dude" has presence on the network between the two switches (In most cases, to pull this off, he would actually have to be between them, and using a MITM
He would already have to have compromised the PSK(Not a simple feat, and if he was capable of pulling that off, he could probably have done worse while he was at it.)
Your RADIUS server authenticates with an insecure protocol.

If your RADIUS server authenticates with certificate based encryption, then even if they pull off 1 and 2, they'd also need the private key from the authentication server to pull off the MITM.

So, technically possible, but if your keys are compromised, you have bigger problems anyway.

Situation 2 is one of the reasons we have VPNs in the first place. Consider an Always-on VPN to mitigate the risk from leaving the VPN off, and NEVER EVER EVER click through to a web page that flags your browser's security feature.

Unsafe means UNSAFE.


What's the block cipher mode of my PEM certificate?

Certificates only contain public keys for an asymmetric algorithm such as RSA or ECC. They do not contain symmetric keys, which is what operates using block ciphers in the various modes.

Symmetric keys are established during the SSL handshake, and are based on the list of ciphers presented by the server and negotiated with the client at the time the connection is made. The mode of operation is defined as part of each listed cipher.

To assert your clients can use CBC or GCM, you will need to go to your server’s configuration and ensure those algorithms are on the list of valid ciphers. You don’t have to worry about including extra ciphers because your clients will not negotiate to use an algorithm they don’t support.

(You may want to remove algorithms from the list for other reasons. You probably don’t want to support using weak algorithms or very short keys, for example.)


What I would say about the options that you outline is that HTTP Auth with SSL is a simpler but less flexible option and Oauth2 is more complex but has more flexibility in what you can achieve with it.

One example, as you've noted in your ASCII art diagram, with OAuth2 it is possible to create a token which can be used in place of the password to authenticate requests. This is likely to be an advantage over HTTP Basic/Digest as it means that you don't have to store the users password on the client, you can just store the token.

So in general if you can implement OAuth2 well, I'd say go with that...


A computing environment that saves no data

You've described the principles behind a live CD boot. This can be most strongly ensured by having no permanent media within the machine. I'm going to gear my answer towards Linux as that's what I'm most familiar with in this context.

Having a hard drive with all disk partitions mounted as read-only and all read-write partitions mounted in memory would also provide this, but allow for easier updating of the underlying OS.

Careful use of SELinux, context switching, and UnionFS would allow you to persist selected configurations, etc. to disk while ensuring that everything else is only written to memory.


A lot of botnet are actually "commercial" software, in the sense that you have to pay like a licence to get them (even underground commerce remains a commerce... actually you may even find that botnet developers actually offer paid support for their tools!).

However, you may find older botnets or versions (ie. software widely known by current anti-viruses) for free on the web for your study (be careful where you put your steps, do not infect yourself during your searches!).

Be carefull to use only a dedicated and airgaped network for this, then a bunch of virtual machines will be able to act either as infected machine or C&C (Control and Command) roles in your own educational botnet.


How should I interpret, "access controls on the presentation layer are enforced on the server side?

It is simply reiterating the most basic rule of internet security - never trust anything from the client (aka presentation layer, aka browser, etc...).  Since the "presentation layer" operates on an external system (i.e. the computer of the person browsing your website) the server/website has no control over what happens over there, and therefore can't trust anything it says.  As a result, it must re-verify everything itself.  An example should help.

Imagine you have a user portal, and there is an admin portal that is only for users that have been given permission.  The presentation layer "enforces" this access restriction by simply not showing a link to the admin section if you are not an administrator.  This, by itself, is not a sufficient access control.  The server itself has to enforce that access control and deny access to the admin system to anyone who is not an admin.  If it doesn't then any user can access the admin system by simply typing its location in their browser, and automatically gain access to the admin system.  This is a simple example, but also the most common:

Presentation layer: don't show links to areas the user doesn't have
access to
Server side: Reject a request to an area that the user
doesn't have access to

If you only do the former you have a problem.

So that's the short summary.  The server cannot trust anything the browser says because an attacker has full control over what the browser says (in fact they may not even be using a browser, but may simply be pretending to be one).  Therefore, the server has to verify everything itself.


Can I use any ssl certificate to sign and encrypt AS2 message?

AS2 builds over S/MIME, so you need a certificate for S/MIME. Certificates for S/MIME are very similar to certificates for SSL, but some details may vary. See this answer for some details.

You might want to generate your own certificates with some tool like OpenSSL. Godaddy is an established CA whose main asset is that their root public key is already known to most OS and browsers in the World, and that's very convenient when you want to establish a communication channel with someone that you do not know beforehand. But for a business partner that you already know, you do not need Godaddy to come and say "yeah, that's his real name". You could simply manually exchange the certificates (the public keys) in a formal "key ceremony" between you and your partner. (Formalism can include a pint of Guinness.)


What does this forever loading behavior tell us?

Your request could automatically be getting rejected and the connection being dropped- since the data in the form was identified as being malicious by some network traffic monitoring utility (for example, a web application firewall).

Also, if you were given permission to pen test the target you should also be able to work with the owner of the website to investigate the error from their perspective.

(Copied from my comment made on the original question)


Any non alert() based non malicious XSS payloads?


QiHoo 360's antivirus false positive rate

Per your request, I formulated my comment as an answer:

To answer your first question, you can compare test scores over time using this tool: https://fatsecurity.com/tools/test-results-calculator?purposeId=1&groupId=1&startDate=2014-3-1&endDate=2017-3-1&companyId=19

In the table next to the graph, you can pick "False Alerts" instead of "Average Score":

http://imgur.com/zy71fJ8

You can access each test for a thorough review by clicking the data points:

http://imgur.com/yQVyDTx

@MarcusMüller is correct in his comment, Qihoo360 tricked AV testing labs in the past by activating the Bitdefender AV engine in the versions submitted for testing, while it's inactive by default on user versions.

I'm guessing that you could activate the Bitdefender engine in order to reduce the false alerts (although I'm not 100% sure about this), but the better solution would be to simply get Bitdefender or another antivirus which is more reliable than this (or another) Chinese AV.


Does the EICAR test work on Linux based antivirus scanners?

EICAR is so simple it doesn't need any Windows COM files or anything !

Have you actually looked at the EICAR code ?  Its all self contained in one tiny file.

As for

  why would Linux antivirus need to look for a Windows virus?

Lots of people use Linux machines as servers (mail,web,file etc.) ... all of which may serve Windows clients.  Seems fairly obvious to me why you would want an AV scanner with a decent detection library.

Quite frankly, I would publicly name and shame any anti-virus software that only detects linux "viruses" ... it would be a waste of space and resources on your Linux machine.


How does Meltdown/Spectre impact Intel SGX?

Spectre.
Intel SGX enclaves are indeed vulnerable to the Spectre attack as recently shown by researchers [1]. Their sample code manages to read a secret from protected SGX memory.

Update Mar 7th, 2018. Meanhwile, another paper on the matter was published:
SgxPectre Attacks: Leaking Enclave Secrets via Speculative Execution [2].

[1] https://github.com/lsds/spectre-attack-sgx

[2] https://arxiv.org/abs/1802.09085


How do I diagnose client-side SSL errors?

In SSL, things go like that: the client looks up the server name in the DNS; then it connects to the IP address the DNS came up with; then the SSL handshake occurs, during which the server sends its certificate. Note that the actual URL has not been sent anywhere at that point, only the server name; so we can ignore the URL for the diagnosis.

Since the problem impacts several machines with distinct OS and browsers, we can probably rule out browser and OS bugs.

Google, Barnes and Noble, Facebook... are human creation which, as such, are imperfect and may fail occasionally; but it is quite improbable that they all fail simultaneously.

If you are the target of a Man-in-the-Middle attack, then the attacker is singularly incompetent. That's quite improbable too.

To sum up, the problem is probably somewhere between your router and your ISP. The symptoms you observe are coherent with the hypothesis that the TCP connection from your browser, formerly directed at www.google.com, ends up on Apple's iCloud servers. A first potential scenario is the following:

  Your router is a DNS relay. Over DHCP, it actually configures your home machines to use the router as DNS server, and that router will feed on the external DNS server you configured (Google's DNS server). In that case, if the router mixes its internal tables (due to a software bug or bad RAM), then it may gives wrong IP addresses to your machines.

In that scenario, the problem is not limited to SSL. Indeed, when the browser wants to connect to any server, it asks for the server name but not for the port or protocol. Therefore, if that hypothesis is correct, then non-SSL, plain HTTP connections should also occasionally fail. For instance, if your connection to www.facebook.com is redirected to the IP address of www.google.com, you will get a Google answer (actually a redirect to Google's main page), and nothing Facebook-like.

If only your SSL connections have trouble, then this is not a DNS issue. This would point to a second potential scenario:

  Your ISP has some problem with its dynamic routing. It tries to route traffic optimally, moving packets between several destinations. These routing decision can be port-specific, thus explaining why the problem occurs with SSL only. For some reason (possibly bad RAM again, in one of the ISP routers), packets can get misdirected.

I have known an old Cisco router (with bad RAM) which behaved a bit like that. When a router processes an IP packet, it must copy and partially modify the header (at least to modify the TTL) so bugs in the router can result in destination address being mangled.

This scenario has a variant in which your router has bad RAM (again...) and trips on its own feet when doing NAT.

To further diagnose the problem:

When the problem occurs, from the same machine, do a nslookup www.google.com (if you wanted to contact Google but was redirected somewhere else) then openssl s_client -connect www.google.com:443 (using the OpenSSL command line tool -- if you use Linux or MacOS X, then you already have it). This will tell you what IP address is returned by the DNS, and what certificate is returned by the server which purportedly answers at that address.
If the problem is intermittent (i.e. the browser connection fails, but trying again immediately works), try running a network capture tool like Wireshark or Network Monitor to observe exactly what went on when the problem occurred. You will see the IP addresses as seen from your machine.
Change your home router. For instance, borrow an old router from a friend, or buy a new one (these cost 40$). If the problem is at your ISP, then the ISP support staff will probably first claim that your router is at fault, so this step cannot really be avoided anyway. If changing the router removes the issue, then you know that bad RAM stroke once again.


Why do we trust US Certificate Authorities?

Why do big companies (...) not fully use CAs from countries with strict privacy laws like Switzerland or Sweden?

Because any CA can issue a certificate for any domain anyway (with some caveats).

If your ISP wanted to intercept all your future connections to https://example.com/ by exchanging its certificate with a rogue one, they wouldn't have to ask the original issuer of the certificate for help. They just needed to get any issuer in your local root certificate store to issue the certificate, and your browser would accept it as valid (you'd see the green lock icon and not be aware of the attack without examining the certificate).

So switching to a more reliable CA wouldn't help the site owner a whole lot against a government actor. (If you personally distrust some CAs, you could also revoke their trust locally in your root cert store.)

Instead, what a site owner can do is use certificate / public key pinning. E.g., a website can send a HPKP header to announce hashes of public keys that must be part of the certificate chain when connecting to the site. If a site has implemented HPKP correctly and your browser is aware of the pins (either by having seen the header before or by preloading), a rogue certificate would be rejected by the browser even if it was issued by a trusted CA because the attacker (or any CA) can't produce one whose fingerprint matches the pin.


How to protect a legacy Android smartphone from new exploits?

It's actually impossible to keep an unsupported device completely up-to-date, since device-specific binary-only drivers often have vulnerabilities, and only the manufacturer has the sources necessary to update these. This is why CopperheadOS stops supporting phones as soon as the phone's own manufacturer stops.

If you ignore that issue (as most people do), your only real option is to completely replace the ROM. Since you mention CyanogenMod and not LineageOS, I assume you haven't tried it since 2016, if not earlier. I'd recommend trying LineageOS to see if it resolved the compatibility issues. If not, and if they're deal breakers, your only real option is to look for other custom ROMs. In theory, it'd be possible to hexpatch vulnerabilities in stock ROMs, but this very quickly becomes completely impractical.


Sorry to say that, but that self-proclaimed Microsoft employee was (most likely) a scammer,
and is responsible for your unknown virus too.

There are not 4 hackers or anything. Having 4 hackers who "care" for your private computer personally at the same time is very unlikely, and even if, no caller on the phone could tell you this and just fix it. It's just that person you talked to (and maybe others who work with him/her, but not independent people).

What you should do now is getting some help outside of phone and internet. Maybe you know someone personally who is good enough with computers, else visit a repair-shop-something, to save what's to save and wipe/reinstall everything.

And never trust such call stuff again. If you ever get some software requiring to call and/or pay someone to be able to work with your computer normally again, don't do it, but get offline help.


The URI scheme is composed like so:

scheme:[//[user:password@]host[:port]][/]path[?query][#fragment]

As you can see, the @ is used to include (in this case, HTTP) authentication directly in the url.  The question then becomes "Why would a url that includes authentication be a sign of phishing?".

I don't know the author's reasoning, but the most common argument I've seen is that it's an easy way to confuse the user about what the domain is.  For example, http://www.mozilla.org&login3:141592653589793238462643383279502884197169@example.com/evil looks very much like it's loading www.mozilla.org, but if you look close enough it's actually example.com/evil.  Tricking the user into trusting a false website is the core of a phishing attack, so this provides a really nice attack opportunity for a phisher.


Apache server compromised with apache backdoor redirect referer

(this started off as a comment, but its getting a bit long)

  I have root access of cpanel and whm

Yes, you need a lot of help - and more than can be sensibly provided here. You're probably going to need at least 2 days work from a competent web administrator. They are going to need to root access to the server via ssh.

If its not a dedicated host or if you don't have access to the root account via ssh, then only your service provider can help you.

In addition to removing the backdoor, whoever fixes this will also need to find the vulnerability which was exploited to install the backdoor.

Your problem is finding someone competent in them you can have some faith, and since your first port of call appears to be a free bulletin board, someone who is very very cheap. Unfortunately that's a near impossible task unless you're already well connected in certain IT circles.

I'm guessing from your post that English is not your first language. In the UK, if I were in your shoes I would be expecting to spend at least £2500 (Sterling) / $3000 (US) on consultancy services to resolve the problem (could be a lot more).

Leaving your site as is or removing the backdoor without addressing the underlying vulnerability will likely lead to it being used for other practices harmful to the internet / society. And as the site owner you might be called to account for its behaviour.

I estimate that it would take you around 2 years of full time study to acquire the skills you would need to tackle this yourself.

You need to have a long think about whether to

engage someone to restore your site and eliminate the vulnerability
scrub the site and start again (and how are you going to avoid the same errors you made last time?)
shut down the site and walk away

While I would like to encourage you to develop your skills this is way too much to take on without good security skills and a strong knowledge of systems admin/programming. Meanwhile your site is causing harm.


How can I maintain my two factor authentication when my phone is in for repairs?

Consider using an emulator such as BlueStacks and move your 2FA to the emulator. You don't need another device for this since BlueStacks is free.

There's also a chrome extension called Authy as stated by user in the comments to this answer.


Does s2k hold any use in symmetric encryption with GnuPG

OpenPGP uses the string-to-key function for both encrypting the private key with a passphrase and symmetric encryption. The function is used to derive a session key (cipher block) for symmetric encryption.

You can easily analyze what options GnuPG is applying by using the --list-packets command.

Default value of AES128 (algorithm ID 7) for the cipher algorithm:

$ echo foo | gpg2 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 7, s2k 3, hash 10
    salt 6E6B107661BD9B19, count 102400 (105)
[snip]

Switching to AES256 instead using the --cipher-algo parameter (cipher ID 9):

$ echo foo | gpg2 --cipher-algo AES256 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 9, s2k 3, hash 10
    salt 44F97F3EE31F2E46, count 102400 (105)
[snip]

And by using --s2k-cipher-algo:

$ echo foo | gpg2 --s2k-cipher-algo AES256 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 9, s2k 3, hash 10
    salt 2BFDAE2630AB5D5C, count 102400 (105)
[snip]

The same applies to setting the iteration count:

$ echo foo | gpg2 --s2k-count 2048 -c | gpg2 --list-packets
[snip]
:symkey enc packet: version 4, cipher 7, s2k 3, hash 10
    salt 6A08AD73CC36741A, count 2048 (16)
[snip]

With other words: you can use both options, they have the same effect, and you can also use the other --s2k-* options for symmetric encryption.


What are the risks associated with a vulnerable javascript in a client context?

Yes. One type is DOM based XSS. In this case user input is reflected on the page through JavaScript, without having been to the server. Consider the following:

document.getElementById('#message').innerHTML = location.href + " does not exist";

In this case, an attacker can put HTML on the page by putting it in the URL. This makes it possible to run JavaScript in the context of the site.


How to bypass .Net 4.5 request validation, for an XSS attack?

There area a number of places that Request validation may be bypassed, depending on the architecture and function of the application under review, which is likely why Microsoft don't recommend relying on it.

Data which enters the application via another channel (e.g. an API) will not be affected by request validation and so could cause XSS issues if that data is rendered without any additional controls.
Request validation only really helps where data is placed into an HTML context, where it's placed into a JavaScript context for example it won't provide good protection.
Request validation doesn't cover all data sent from the client.  For example if the application processes data from user HTTP headers (e.g. User agent) it can render the site vulnerable to XSS.
Data can enter the application via areas such as file upload, which again won't always trigger request validation.

Update Another one that might bypass Request Validation is the use of certain Unicode characters in place of the blocked ones.  In some cases MS SQL server will convert these characters into the ASCII equivalent when the data is saved to the database.  This can allow for an ASP.Net application to be vulnerable to XSS even with an HTML vector.  for example
＜script ＞alert(1)＜/script＞
if saved and returned, could result in xss.


Because virtualization software is not perfect, it is in some cases possible to escape out of the virtual environment and do bad things on the host.  It is important to keep your virtualization (and other software) up to date, because security patches to prevent this attack are sometimes released.  I believe that malware could indeed then be put onto the host network if other vulnerabilities were exploited.  So, yes, I believe it would be possible... however, it would be very difficult.  This would be a significant hurdle that should keep most attackers out of the host network.  I believe virtual networks are a great safety measure to take, as long as the security implications are considered.

Another attack to consider (not quite malware on the host network) is a Denial of Service (DoS), or Distributed Denial of Service (DDoS) attack in which network traffic is flooded.  If the virtual host shares the same network resources with the host network, then if the virtual network is flooded with traffic, it would also flood the host network, bringing both to a crawl / halt.


What is a simple example of a trap door function?

The most basic answer is simply factorization.  It's easy to compute the product of two prime numbers.  It would take a minute or two, but you can calculate on pen and paper that 1093*1039=1,135,627.  Going the other way is much harder.  If I just gave you the number 1,135,627 and asked you what two numbers I multiplied to get that number, it might take you hours of trial factorization with pen and paper to factor it.  To do it quickly you'd need a computer.

But if I asked you to factor 15, you'd quickly answer 5 and 3.  So the difficulty of factoring goes up as the primes go up in value.  If the two primes are chosen sufficiently large even a computer, or even thousands of computers aren't sufficient to arrive at the two factors.


What scenario are 'extra' strong passwords and hashing algorithms actually protecting against?

In the case you constructed, even a 4-digit PIN would be fine. In fact, it's very similar to the iOS (and maybe Andriod?) PIN lock screen that wipes your phone after 10 incorrect guesses.

No real hacker will try brute-forcing passwords against an application server, it's just too slow. Over the internet you can get at best what, a couple of hundred guesses per second, assuming the server doesn't lock you out. The real risk is that the hacker has access to your password hash and can go to town with an offline brute-force attack using their fancy GPU hashing rig which can do millions to billions of guesses per second, per GPU [nice article], [raw speedhashing data]. Long passwords mean they have to make more guesses before they get lucky, and slow hash functions means they have to spend more time / power per guess.

Answering your questions:

Just because a hacker got a copy of your password hash does not mean they have any kind of access to any other part of the server. For example, check out haveibeenpwned.com, by clicking through those links, I can download long lists of password hashes for gmail, adobe, Ashley Madison, etc. Having those lists of hashes does not in any way give me access to "the data" on those servers.
I guess so, but the assumptions that A) no two users in the database have the same password, B) no user ever re-uses a password between sites, and C) "password hashes are only good for determining passwords for other sites" are very strong assumptions.


Penetration testing by ethical Hackers/Crackers should be trusted?

There are a few drawbacks to hiring a blackhat "hacker" instead of a security company.

They are harder to trust

Apart from backdooring your system, I would not trust a blackhat I pick off the street to keep his findings about my network confidential. Hackers like to boast to their peers. The knowledge they obtain about your security can bite you in the ass in more than one way.

They are adrenaline junkies

OK, that's a bit strong. But a hacker who is just in it for the fun and not for the money, will focus on what he finds fun. I have worked with both professional penetration testers and "recreational hackers", and the latter kind performs a different kind of test. If you find yourself a good hacker, he may have more knowledge than the professional penetration tester, but he will not deliver the same quality report. He will find a fun way to enter your network and exploit that fully, while the penetration tester will see if there are multiple ways in, will weigh the issues he finds against the actual risk, and can give you a less black-and-white advice about how to solve the issues.

They are harder to do business with

Think in terms of planning, deadlines, availability for status updates et cetera.

So, if you find yourself the perfect gentleman hacker with knowledge of the underground, who will keep your findings confidential, propose realistic solutions, and do the test from the perspective of what is useful to you instead of just what is fun for him, then you have a winner. Good luck finding him :-)

By the way, if you already have a security company you hire for regular penetration tests and such (which imho a big company should have), then hiring some hackers for an ``extra'' test to see if the company misses anything, can be a great move. The confidentiality issue stays though...


Can streaming services, movies, series, be used to infect my computer?

The short answer is : yes your computer can be infected by visiting a streaming site.

However, the risk is not necessarily unacceptable and this is not especially related to streaming : browsing the web in general always creates a small risk, notably of Drive-By Download

I would recommend to avoid any provider that is still relying on Flash, as HTML5 is doing the job perfectly for streaming and does not require you to expose your machine to Flash vulnerabilities.

There are a few things you can do to decrease the risks, like making sure that your software (browser, any plugin etc) are up to date, or, if you are paranoid, watch the streams in a VM that you rollback for each session ;)
Make sure that you do not download any third-party plug-in to watch whatever you are looking for.


What characters need to be escaped or replaced to prevent xss jsonp callback attacks?

It sounds like you are asking from the context of the service provider protecting a remote client in which case the answer is simple:

As the service provider, you can't protect against XSS at all, and you might as well not bother

Keep in mind, I'm normally big on "defense in depth" and putting in security walls every step of the way.  However I think this is literally one of the few places where your concern isn't worth worrying about.  There are two reasons why:

1. Under normal usage the executing client has full control over the request, and so there is no reason to expect payloads like this

There isn't much more to say about this actually, because this isn't what you are concerned about.  But just to say out loud: the client itself is providing the JSONP callback, and so if they choose to ask you to return actual javascript, then there isn't much of a reason for you to stop them (especially since doing so would be silly and I doubt anyone would bother).  The only other time someone might request a "dangerous" callback from your server is if The remote client has had an XSS breach and malicious javascript has taken over their system.  However, if that happens:

2. The malicious javascript has full control over the remote client and doesn't need you to execute arbitrary javascript anyway

Which is equally simple: if an attacker has managed an XSS attack against a client using your service, they don't have to inject malicious javascript into the callback.  They can just replace the callback method in the local client with their own. In fact, that's much easier.  As a result, there is literally no reason why someone would attempt to use your service as an XSS injection endpoint into the remote client.  To put it simply:

If an attacker has managed an XSS attack against a client using your service, then they've already won and they have no reason to pass XSS payloads into your service.  It would just reflect back on the page they have already taken over.

I suppose there might be some developer out there that came up with some crazy (dangerous) scheme whereby user input on their site is used to build the JSONP callback passed into your service, and it becomes a first-order XSS vulnerability weakness.  However, there is no practical reason why anyone would ever do something like that (having used lots of these kinds of services myself, you would have to go out of your way to setup something that dangerous), so much so that I don't think it is worth spending any amount of your time trying to protect your users from that level of silliness.  You're more likely to accidentally introduce negative side-effects to your regular users than protect someone against the level of poor-planning that would be required for this protection on your end to do anything.


How can a keylogger gather and transmit data from a client-only webapp run from file?

I am not sure if I understand the question or not. But it happen that in my work, we wrote several javascript keystroke logger for keystroke biometrics. where the collected events (key-up/keydown) are sent to another server that not hosting the key logger script.

We do it either using Web Socket as you suggested or using JSONP


The only thing that fits your requirements is HttpOnly cookies. They can be normally exchanged in the HTTP headers, can be easily accessed by the user (you know, being client-side), but it is enforced by all major browsers that these cookies cannot be accessed by normal JavaScript running in the page (for example, document.cookie).

A closer look at your question shows that you already understand that if something is in the browser, it will be accessed by the user and there's nothing you can do about it. In the case of HttpOnly cookies, the browser itself regulates access to them and it imposes strict security rules preventing normal JavaScript code from accessing them. Addons and plugins have normal unregulated access to these cookies because they run on a higher "security clearance level".


No. In my experience, they are (almost) never used.

There used to be an idea that, if you could restrict the shell, you could limit the user's access to the system. However, for a determined user, the restricted shell does not pose a real hindrance.

It could be (and was in the past) used to limit users that have little computer knowledge, to prevent them from doing inadvertently something horribly wrong. However, nowadays, these kind of people do not log in to a shell, but most of the time, they will use a web interface.


how can an attacker access a system through a compromised router?

There could be a few scenarios here that might work.

As you say above forward a port/bunch of ports from an internal host to the external IP address. Attack that IP.
The router itself has an OS, usually a cut down 'nix of some sort. If you could gain access to that then you would have one NIC on the Internal network. You could potentially use that as a spring board onto the internal network.
If the device supports it, set-up a VPN to a device within your control. It might be feasible to set-up routing between your network and the target network. Technically harder but could be done with the right situation.


System for securely authenticating content acquisition

Whoa! You're overcomplicating the issue to a high degree; the matter at hand is way simpler.

Table 1 (products)

product_id - product_name - product_key

product_key can simply be the sha1() of product_id, product_name, and some random bytes. Or, better, just grab random 16 bytes and pass them to sha1().

Table 2 (requests/invitations)

request_id - product_id - request_key - valid

request_key is generated the same way: the sha1() product of request_id, product_id, and some random bytes. Or, simply, the sha1() of some 16 random bytes.

Now, when Alice wants to tell Bob about site.com, a row in "Table 2" will be generated, and she'll simply send him the link site.com/purchase/request_key.

Same thing happens when telling Charlie; a new row in "Table 2" will be generated (new request_key), thus, a new link. Once the link is visited, you check if valid is true. When the key is used, you set valid to false.

The key can only be used once.
The ID isn't exposed.
No fancy encryption.
Each request key is independent.


Make a little box connected to a 5V switching mobile charger. Get some breakout USB ports. Connect the 5V rail
to a LED across a 220 ohm resistor, and in parallel connect the 5V and GND rails to the USB port. If a USB killer is connected to this port, that LED will flicker. The charger will probably die, though I doubt it will begin burning. I expect you will hear a little pop as the capacitor in the 5V charger goes bye-bye. It shouldn't trip your breaker box, though. Cost: less than 5 USD.

If the LED stays on, nice and stable, you don't have any problem. The USB killer works very poetically by charging capacitors, then driving a negative ~100 volts against the positive 5 volts of the USB port, bypassing protection circuitry. Less would probably be enough to murder a motherboard, but its creator is from eastern europe. In any case, this negative voltage would disrupt the light of the LED, and so serve as an indicator of attempted vandalism.

Connections:

5V -> 220 ohms resistor -> anode of LED -> cathode of LED -> GND
5V -> 5V pin on USB port
GND -> GND pin on USB port

Use a stripped USB cable, you only need the red and black wires.

On second thought, a properly rated schottky diode forward biased to the 5V pin of the USB, and one reverse biased to the USB GND pin might be useful in a PC/laptop setup. From looking at the page, it seems to present -200V DC to the 5V pin. I have a nice 0.18V schottky here, but only rated for 40V@1A. Most USB chargers and PSUs offer ~5.10V, and a nice schottky (>200V, Vdrop 0.1V) here can probably be used.


Does entropy apply to passwords generation when some passwords are more likely?

The problem lies in the fact that you are considering a single password (i.e. one sample from a random distribution) alone rather than the full scope of possible passwords. When using information entropy as a means of quantifying the difficulty of a brute-force attack, we are interested in the latter.

What you describe as entropy is actually the information content of a single event. Entropy applies over the entire distribution and is sum{-p_i log_2{p_i}} for all i in the space of possible passwords. When considered like this then the uniform distribution has, as you correctly pointed out, a greater information entropy.


How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

SSL is not vulnerable to MITM, unless the client machine has malicious root CA certificates installed (in which case you can't do anything at all as you might as well assume that the entire client is compromised). If you get a certificate from a proper CA like Verisign you will be assured that any communications with your server will be secure (except in academic situations like quantum computing). If you use an encrypted channel during the authentication phase you can use whatever serialization/communication paradigm you want (REST, Protobuf, etc.).

In other words all you need to do at the end of the day is make sure that the passwords are salted and hashed in your DB, preferably double-salted so that your client 'remember password' functionality can store a salted hash on the hard-drive; instead of a clear-text password.

Alternatively you could look into:

SRP which doesn't need to occur over a secure medium.
Mutually-authenticated TLS/SSL (using a client certificate). The nice thing with this is that it enables offline (LAN) scenarios as clients can authenticate with each-other without the presence of your authentication server.

WS-Security is primarily geared toward federated services, i.e. cross-enterprise, (as are most of the WS-I extensions) - which is probably not a concern for you. At any rate the WS-Security has the associated overhead of SOAP (and the underlying frameworks/marshalling needed to handle SOAP calls). SOAP is a very heavy protocol and is probably an very poor choice for game development. I would avoid this entirely.


To restate: your system has users with assigned IDs. You receive periodic location data associated with these user IDs in real time.

You also have one (or more) clients who want to analyze your user locations. Each client needs to receive randomized tokens that each map to a user ID, and the tokens can refer to a specific ID for a period of no more than some maximum duration, say 24 hours. The client needs the location data. The client never needs the real user ID.

And you have a policy prohibiting you from internally retaining the location associated with your real user IDs.

Here's a possible solution:

First, obtain a public key from each of your clients. At the start of each day, for each client generate a random salt and store it internally in RAM, keeping it secret. Upon receipt of a new User ID and location pair, add the client's salt to the ID then compute the hash. After hashing, immediately encrypt the hash with the client's public key, applying randomized padding, then immediately discard the hash. The encrypted salted hash is now a client-specific encrypted token. Preserve only the client ID, the public key ID, the encrypted token, and the location data; place the data in the appropriate message queue. Repeat the tokenization process for each client who will receive the data; after tokenizing the user ID for each of your clients, discard the real user ID.  You can then send the encrypted tokens with the location data to each receiving client. Once per day, destroy each client's secured salt and generate a new one.

By destroying the intermediate hash and the user ID, you remove the only links you have tying the location record to a real user ID. You control the client's ability to correlate records by destroying their salt.


Tools to help test the security of Android applications

Wireshark is a good tool to see if the application is sending sensitive data in cleartext over the network.  Also, you can use ssh and adb to look at the data stored on the SD card and the file permissions, to see if sensitive data is being stored in cleartext.

Some free static analysis tools for Android applications:

Comdroid checks for vulnerabilities related to the use of Intents.  See this presentation for description of those vulnerabilities, and other pitfalls.
Stowaway checks for overprivilege: i.e., it checks to see if the application requests permissions that its code doesn't seem to use.

Keep in mind that these are research tools.  Moreover, they focus only on a very specific set of vulnerabilities.  They are not a general-purpose static analysis tool, and are not substitute for a general-purpose security static analysis tool for Android (like Fortify); they are better thought of as a supplement for other tools available to you.

Some security static analysis vendors have support for analyzing Android applications, e.g., Fortify.  Expect these to be expensive.

See also the following questions on this site:

Any useful tools for Android source code review? (but beware that many of the tools listed there are merely generic Java code scanners and do not have any knowledge of Android APIs, so are likely to be of limited use for assessing the security of an Android application)
iOS/Android Pen-Test
Android API/development security pitfalls
Android/iOS application security testing checklist


Storing account credentials for spouse/loved one?

When I set up a similar thing, my solution was put a KeePass database on Dropbox. We both have access to the same Dropbox account, and both of us know the password to the database. It can safely be used to store shared account details, including passwords, account numbers and other details. It's free and entirely point-and-click, so it's really easy to learn.

What makes this approach even better is that everything is backed up on Dropbox, and even if Dropbox goes away (like MegaUpload did) you've still got the local copies in your Dropbox folders.


Hashcat bruteforce define digit range form and to

Let's start by bruteforcing between 90000000 and 99999999:

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx 9?d?d?d?d?d?d?d

Then let's bruteforce from 100000000 to 499999999:

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx -1 1234 ?1?d?d?d?d?d?d?d?d

Finally, let's try 500000000:

./hashcat64.bin --hash-type 2500 --attack-mode 3 ~/Desktop/wifi.hccapx 500000000


First of all, the device is not a PRNG. All cryptographic functions remain securely within the chip on the card. The device is little more than a user interface. Because it's air-gapped from your browser, it can't be "hacked" by a web page or malware infected computer. And because it's your from your bank, you can trust that it's not a PIN-skimmer keypad. These are very good security attributes that make these devices powerful tools against fraud.

You enter the PIN in the device, which then sends the PIN to your card, and the card verifies it according to the ISO/IEC 7816-4 spec. The card returns only the results of the PIN verification attempt to the reader, which it then displays to you as either an 8 digit authorization code, or as an invalid PIN error. Three consecutive failed PIN verification attempts result in a card that must be reset at an ATM authorized by your bank.

As you noted, this is a tragic weakness in the protocol, but for a completely different reason than cryptography. A mugger can strike you in a private place, and demand your card and your PIN, and he can use your PINSentry on the spot to prove you're not lying. It used to be a mugger would have to drag you to the bank to verify your PIN and risk the security cameras, but now they can do it in the convenience of a dark alley. At least three murders have been committed by robbers gathering PINs.

To be more secure for the user, the device should continue merrily on its way regardless of the validity of your PIN, because the bank should be validating the PIN later on. The problem is this was all designed and decided when many small merchants were still authorizing cards offline. With almost 100% ubiquity of the Internet across the populated areas of our planet, I see little reason to continue accepting offline payments.

As far as PIN security on the chip, that's a lot stronger than the typical mugger. The chip is engineered so that it's very difficult to access the memory on it. It's not like a flash drive or old-school payphone chip, where it's simply a storage device. It's a cryptographic processor, with algorithms and keys and certificates loaded into the silicon only after verifying the signatures on the data. You can't issue a command like "set counter memory location 1234 = 0". Instead, the command to reset the PIN is part of an HMAC protocol, with cryptographic authentication that must be generated by the bank, and the MAC is verified on the chip before it will actually reset the PIN counter.

The chips are reasonably well-protected against tampering, considering they have to cost only a few pennies each. Focused ion beam microscopes have been used to read bits from the cards in the laboratory. Timing attacks have been reduced by improving the designs of the encryption algorithms. As far as I know, differential power analysis attacks can still work, but some chip designs can even withstand those.


What is the worse that could happen if a government wanted to interfere with a CA?

For the government to gain effective control over SSL certificates used within its borders, it would first have to establish much stricter control over Internet traffic than most governments currently have.  The Great Firewall of China comes to mind here.  It's not impossible, but relatively few governments are currently doing it.  The reason I say this is necessary, is because no single government can have control over all the CAs in the world.  So, they would have to first implement measures that would allow them to restrict SSL access to only websites that use CAs that are under their control.

That being said, what might a government do if they could gain coercive control over a CA?  The primary risk would be traffic sniffing.  If the government could get the CA to issue them valid certificates for high-profile websites, then they could (via border proxy or other means) set up a man-in-the-middle attack to read whatever data private citizens are exchanging with that site.

Could they get the CA to revoke site certificates?  Perhaps they could, but the key here is that certificate trust is at the user's option.  Even in the case of expired or revoked certificates, users generally still have the option to let their browser or other programs trust the certificate and conduct business as usual.  Then, we eventually work our way back to Problem 1 - controlling what sites the users can access outright.


Does the HTTPS protocol consume a lot of CPU time?

I believe the website "Is TLS Fast Yet" https://istlsfastyet.com can answer your question. Here's a quote from the top of the page:

  "On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10 KB of memory per connection and less than 2% of network overhead. Many people believe that SSL/TLS takes a lot of CPU time and we hope the preceding numbers will help to dispel that." -- Adam Langley, Google


SQL injection in find_by Active Record RoR 4

https://stackoverflow.com/questions/22162350/sql-injection-and-activerecord answers this issue fine.

Do not use raw strings in ActiveRecord, use hashes.

View http://rails-sqli.org for a complete review of the concerned methods.


RAM memory data remanence and double boot, risky?

There is a Linux version of Skype however, I wouldn't recommend running it on bare metal. Have you considered running a virtual machine on your main Linux system (either Windows or Linux) and running Skype inside that? This way the software inside the virtual machine cannot access the ram of the host.

  I assume that in such a case the RAM is still absolutely readable and hence the key for decrypting and accessing the encrypted linux is still somewhere in the RAM?

This is a possibility. You may be interested in tresor which stores the encryption key inside a CPU register instead of in RAM.
http://linuxaria.com/howto/protect-linux-from-cold-boot-attacks-with-tresor?lang=en


Selecting a secure PIN for building access

PINs are usually accompanied by some other authentication factor, like biometrics or a physical token. So, the PIN is not a lone factor in authentication.

But you appear to describe a situation where people can gain access to a secured building by punching in a code. Let me rephrase that: by using static, difficult-to-change sequence of numbers that can be easily copied and shared, the public gains access to the inside of your building.

The control against that threat is to make it very difficult to record and guess or use the physical appearance of the pin pad to deduce the code. That means making the PINs long and putting physical controls in place to make recording more difficult and to place layers of additional authentication protection on the inside of the building.

Because you are asking about the rejection process, my suggestion would be to use a random number generator instead of people choosing their own, and make it long. This bypasses people choosing PIN pad patterns or other pattern-based PINs which can be easy to guess or observe.


Get IP of web server located at sub directory level

This is not possible, unless the (or every) site behind the proxy leaks its IP address somehow, usually in headers when sent special requests (it is surprisingly common but far from ubiquitous) - exchange autodiscover springs to mind. The application running on the server would have to be vulnerable to this.

There are leaks of information for example how many sites are behind load balancers using IP ID information disclosures, but not the address

Or the load balancers/proxies can disclose this information in some cases due to the cookies they use for connection tracking.

I'm not aware of any built in tools or the like. And has been commented - the chances are these will be behind a DMZ on a LAN on private address ranges, though again, not necessarily.


As you have given a list of information you would like to protect from your ISP, I will try to give you some hints:

browsing history:

Your browser is normally not provided by your ISP, so if you consistently apply security patches, it should not be able to access it from your browser - I would not be as sure as what Chrome reveals to Google. But all your network traffic passes through its routers so they can log every plain HTTP request, and at least the IP destination and size of your HTTPS request and their responses.

=> if you want to hide the HTTPS sites that your browse, you should considere using a VPN or TOR: the ISP will only know that you use a VPN. This part is IMHO fully relevant regarding the new US congress vote. Simply you have to trust the VPN owner to not collect and sell back your data... (read: do not trust a free VPN to respect your privacy)
DNS requests:

you normally use the DNS from your provider so they can log all of them. Even if you try to use a third party DNS server (but anyway that one will log your requests) the DNS request will pass in clear text through the ISP router, so it can also log them.

=> You could try to connect to  a third party DNS server through IPSEC - and trust the DNS owner to not collect your data... Alternatively or in addition, you could setup a local DNS cache (common in Unix/Linux system) to limit the number of DNS requests and make their statistical usage harder
geo localization:

of course your ISP knows where you are! As you have a contract with him he generally knows your address and your banking coordinates. Only some pre-paid mobile plans allow to by-pass this. As far as I am concerned, I would not worry too much about that point
communication data:

the rule is simple: all unencrypted data can be logged by your ISP. It include plain HTTP requests and their responses, as long as SMTP, POP or IMAP unless you use them over SSL. I will not speak too much of other (older) protocol like NNTP, Telnet, or FTP which are now seldom used and SSH/SFTP is fully encrypted.

=> here your should prefere HTTPS over HTTP, and only use mail protocols over SSL. For the mail part, you should also know that the mail provider has full access to all your unencrypted mails either sent or received. For example if you use Gmail, Google knows everything of your mailbox.

TL/DR: Some simple rules can allow a minimal protection of you privacy:

use a mail provider that you can expect not to sell too much or your data - neither Gmail nor your provider since the US Congress vote
always use SSL version for TCP protocols like SMTP, POP or IMAP
prefere HTTPS over HTTP

Some additional rules allows for better privacy at a cost of more complex configuration:

setup a local DNS cache to limit the number or DNS requests
use a VPN or TOR for browsing - and choose a VPN provider that you can expect not to sell too much of your data
use encrypted mail if the recipient as given you his public key


Deep international spy forensics: what hw really needs to be destroyed?

You grind the whole laptop and incinerate the remains.

But as you mention focusing on the laptop is merely symbolic.

Any and all data could have been transferred off the laptop prior to destruction. Indeed unless the newspaper is willing lose unrelated information from the laptop, some of information would have been backed up beforehand anyway.

Destroying data in an open network is almost futile. The laptop connects to the corporate intranet, which connects to the internet, which connects to any third party. The assumption that the newspaper confined some of the information on the laptop is entirely unverifiable.

The solution of document watermarking doesn't work here - since the watermarks, if they existed, would simply point to whoever published the files from a secure watermark-generating server (i.e. Edward Snowden). Watermarks couldn't trace whoever propagates the material between various unsecured networks afterward, as no new watermarks are added.

However, the same mass surveillance revealed by the whistle-blower could be used to trace what the newspaper chose to propagate; providing that Edward only propagated to The Guardian and that the newspaper chose propagate only through non-anonymous networks.


How can I check the integrity of a Bitcoin tarball with GPG?

Updated for the latest version: 0.15.1

You need to verify the signing key's fingerprint, before you import it:

cat laanwj-releases.asc | gpg --with-fingerprint --with-colons - | sed -ne 's|^fpr:::::::::\([0-9A-F]\+\):$|\1|p'

It should say:

01EA5486DE18A882D4C2684590C8019E36C2E964

Do not continue, if it does not match!
The signing key needs to be imported:

gpg --import laanwj-releases.asc 2>&1 | grep 36C2E964

It should say:

gpg: key 36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" imported

Now, we check the hash sum containing file's signature:

gpg --verify SHA256SUMS.asc

It should say:

gpg: Signature made Sat 11 Nov 2017 02:52:22 PM CET using RSA key ID 36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>"

And finally what we needed - to check that the hash sum of the file matches:

sha256sum --check --ignore-missing SHA256SUMS.asc 2>&1 | grep OK

It should say:

bitcoin-0.15.1-x86_64-linux-gnu.tar.gz: OK

In case it does not output anything, something's wrong and you may verify this by running it without | grep OK on the end.


What should I do when I need to store passwords for usage in 3rd party software?

After reading your question, but before reading the Jon Galloway post, my initial reaction was to use DPAPI. So I was encouraged when I finally took a look at Jon's post.

Here is why. As Snox says, encrypting the password with a master key makes sense. That is exactly what DPAPI does. But, the master key for DPAPI changes between users and machines. So you don't have to figure out your own way to do this. DPAPI has presumably been studied by cryptographers, so it should be fairly secure.

That said, DPAPI is no silver bullet. It only offers a tradeoff. So it is important to understand the risks involved. First, someone logged in as the same user can decrypt DPAPI blobs by simply calling the right function on the blob. You can lower this threat by using the optional entropy parameter. I'd highly recommend this. That value could be hard-coded into the application or read from a registry key, etc. Hard-coding it into the application might be the way to go as the attacker would have to reverse engineer the app to get the value back (not hard, but definitely raises the bar). Attackers with access to your filesystem can also decrypt DPAPI blobs (assuming they know the optional entropy) using DPAPIck. This also requires knowing the user's password.


Parameters for PBKDF2 for password hashing

Your starting point

PBKDF2-HMAC-SHA-256
number of iterations desired        = 1024
length of the salt in bytes         = 16
length of the derived key in bytes  = 4096

Algorithm
Ok - PBKDF2-HMAC-SHA-256 is a solid choice, though if you're running on any modern 64-bit CPU, I would strongly recommend PBKDF2-HMAC-SHA-512 instead, because SHA-512 requires 64-bit operations that reduce the margin of a GPU based attacker's advantage, since modern GPU's don't do 64-bit as well.

Salt
16 bytes of salt is fine, as long as it is cryptographically random and is unique per password.  Normal recommendations are in the 12-24 byte range, with 16 considered quite solid.

Output and Iterations
4096 bytes of output is ACTIVELY BAD!  SHA-256 has a native output size of 32 bytes.  PBKDF2/RFC2898 states that in this case, you'll first run 1024 iterations to get the first (leftmost) 32 bytes, then another 1024 iterations for the next 32 bytes, and so on for 128 times in total to get the full 4096 bytes of output you requested.
So, you did 131072 iterations total, and got 4096 bytes of output.  The attacker is going to do 1024 iterations total, and compare their 32 bytes of output to the first (leftmost) 32 bytes of your output - if those are the same, they guessed correctly!  You just gave every attacker a 128:1 advantage!
Instead, if you're happy with the speed, you should do 131072 iterations with 32 bytes of output - you will spend the SAME amount of time you are now (so it's free!), and your attackers will need to spend 128 times more time than they do now!

NOTE: If you move to PBKDF2-HMAC-SHA-512, you can use up to 64 bytes of output, and each iteration will take slightly longer.

Never get more output for password hashing than the native output of your hash function, i.e. 20 bytes for SHA-1, 32 for SHA-256, 64 for SHA-512.  You can optionally store less, but it doesn't save you any computations.  I would recommend storing at least 28 bytes of output (224 bits, which is twice 112 bits, the nominal security of 3DES).
Note that output length values are pure binary output - BEFORE you BASE64 or hexify them, if you do (personally, I'd store the raw binary - it uses less space, and requires one less conversion).


What is the best practice to secure an unattended Raspberry Pi?

I Have a few suggestions but no definitive best go to solution since it really depends on your specific use case.

First off look into BerryBoot, it offers full disk encryption out of the box.

A second alternative is to use any of the TrueCrypt like applications such as VeraCrypt It offers a bunch of options to either perform full disk encryption or make sure that specific vulnerable files are safely encrypted.

A third option, similar to the second is encrypting directories on the disk

If you are more technically inclined and would like to manually perform certain taks it is also possible to use LUKS/dm-crypt yourself.

You will have to keep certain things in mind though: The computational power of the Pi is limited so any form of encryption on the devices will cause a performance hit.

Secondly you will have the problem that you will need to manually enter the key each time the device wants to perform an operation, since storing it in a physical form on the device makes it vulnerable to anyone with physical access.


There are several organisations that maintain vulnerability databases.  NIST's NVD is probably the most notable IMO

http://nvd.nist.gov/

CVEs are software flaws - Common Vulnerability Enumeration, but there are also other prefixes used, like CCE for Common Configuration Enumerations - which are misconfiguration based issues like easily guessed default passwords, and ports exposed by default etc.


There are equations for when the password is chosen randomly and uniformly from a given set; namely, if the set has size N then the entropy is N (to express it in bits, take the base-2 logarithm of N).

For instance, if the password is a sequence of exactly 8 lowercase letters, such that all sequences of 8 lowercase characters could have been chosen and no sequence was to be chosen with higher probability than any other, then entropy is N = 268 = 208827064576, i.e. about 37.6 bits (because this value is close to 237.6).

Such a nice formula works only as long as uniform randomness occurs, and, let's face it, uniform randomness cannot occur in the average human brain. For human-chosen passwords, we can only do estimates based on surveys (have a look at that for some pointers).

What must be remembered is that entropy qualifies the password generation process, not the password itself. By definition, "password meter" applications and Web sites do not see the process, only the result, and uniformly return poor results (e.g. they will tell you that "BillClinton" is a good password). When the process is an in-brain one, anything goes.

(I generate my passwords with a computer, not with my head, and I encourage people to do the same.)


How to make sure that the cryptographic hardware accelerator is being used in am335x?

There is a TI wiki page for the Crypto hardware on the AM335x here. On that page there is a tutorial on how to compare the performance of the hardware accelerator versus the pure software implementation.

  After the modules are installed, OpenSSL commands may be executed which take advantage of the hardware accelerators through the OCF-Linux driver.  The following example demonstrates the OpenSSL built-in speed test to demonstrate performance.  The addition of the parameter -engine cryptodev tells OpenSSL to use the OCF-Linux driver if it exists.

Running time -v openssl speed -evp aes-128-cbc -engine cryptodev and time -v openssl speed -evp aes-128-cbc should produce very different results if the hardware accelerator is enabled and working correctly. You may also need to remove the crypto driver as that page suggests to see the difference. If you run those tests and see no appreciable difference in performance, that probably means the hardware isn't working, and you should make sure you properly configured the kernel (that information is also in the provided link).


XSS Vectors that work with no closing brackets?

That depends on the rest of the page. If it contains a closing bracket, you can likely use that to close whatever tag you have opened.

An example would be:

<img src=no onerror=alert(1) foo=       // the input

example
                      // the rest of the page

Which would be executed by at least Chrome and Firefox.


What are the concerns, or drawbacks, regarding Intel's SGX when it comes to privacy?

Intel SGX does not really replace homomorphic encryption. It is designed to protect from compromise of one of the communicating computers by verifying, that the other computer runs the correct, unmodified software and that any data the SW saves can be only read by the unmodified software. You have to trust Intel to achieve this. This can be used to for example make sure, that self-destructing messages are really deleted by the other party in communication. Signal wants to use it to confirm they don't keep user metadata and contact list.

On the other hand, to protect the data, you can still add your own encryption as an inner layer, whether in transport or at rest.

As for privacy and trust in Intel, this is a moot point considering the Intel Managment Engine is effectively a backdoor into your computer black box with full access to your computer, that can not be fully removed or disabled.


Location Obfusication and Email/remote login

The short answer is yes, there are a variety of ways to achieve this, if I'm understanding your question correctly.

A basic example would be that a user could set-up Team viewer on their home PC, then connect to it from anywhere in the world.  they could then use VNC into the office over the Team Viewer connection and appear (from an IP address perspective) to be coming from home.


What is the threat model for AWS EBS volumes encryption?

tl;dr Auditors

Many data security audits require data to be encrypted at rest. Often the threat model is an old hard drive ending up on eBay or picked out of the dump. If the data is unencrypted on these drives and they are not properly handled/destroyed there could definitely be data loss. There is also the classic "truck backing up into the datacenter" threat vector where people make off with whole servers but no decryption keys.


A proposal for effortless two-factor authentication

No, it won't work. Because of one key factor: probability.

If you throw probability into any system, there's no guarantee that the other side is real, or not. Like you cannot say with certainty that a dice is fair or not by throwing it a few times. You can say that probably the dice is fair after lots of throws. You only have a probability, as you already stated.

Look at the server. It receives a key 0 0 0 0 0 0 0 0. It should not have decayed so fast, right? But every bit have a probability for decaying, not a fixed rate, so it's entirely possible that every single one decayed at the same time. Why not? So how can the server tell that the device was compromised?

If you are willing to go for the probability instead of certainty, you can train a model with all requests for the user: duration, time of the day, type of purchase (in case of a credit card), and block when a sizable change occurs. Credit cards already do that, and that usually works well.

A fixed device key is better than a randomly mutating one. Storing a device key on the Secure Enclave on iPhones or the equivalent on Androids makes the key very difficult to steal (think State-level difficulty). When the application is first installed and the user authenticates itself, generate a token server-side and store it safely on the device. It will be used to generate TOTP tokens and add it with the next authentications automatically, without user intervention.

It basically have the same upsides from your idea: no user interaction needed, it does not fingerprint the phone or invade privacy. Other than that, it is not probabilistic, and identify the true account holder. An attacker would have to steal the device, as extracting the keys from the Secure Processor is very difficult, and maybe cost more than any financial gain it would bring.