How do I interpret output that produces gpg listing keys? Correct me where I'm wrong. There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the latter master (or primary) keys. In spite of them being called keys, they are actually keypairs.

Keyrings are files. gpg-1.4.18 by default creates two keyrings: public (pubring.gpg), and secret (secring.gpg). Public keys go to a public keyring, private to a secret one.

Let's take /etc/apt/trusted.gpg:

$ gpg /etc/apt/trusted.gpg
pub  4096R/68576280 2014-06-13 NodeSource <gpg@nodesource.com>
sub  4096R/AA01DA2C 2014-06-13
pub  4096R/86E50310 2016-10-05 Yarn Packaging <yarn@dan.cx>
sub  4096R/D50AF136 2016-10-05
sub  4096R/9D41F3C3 2016-10-05 [expires: 2017-10-05]
sub  4096R/FD2497F5 2016-10-30 [expires: 2019-01-01]
sub  4096R/B6FF4DE3 2017-09-10 [expires: 2019-01-01]
sub  4096R/88B63E1E 2019-01-02 [expires: 2020-02-02]
sub  4096R/69475BAA 2019-01-11 [expires: 2020-02-02]
pub  3072R/95BD4743 2019-03-18 DEB.SURY.ORG Automatic Signing Key <deb@sury.org>
sub  3072R/8059B8AC 2019-03-18 [expires: 2021-03-17]

Consider the Yarn Packaging key and its subkeys. First, all the keys listed are the public ones. And its public key has 6 public subkeys. Supposedly, the first subkey doesn't have expiry date specified.

Now if I do:

$ gpg -k --keyring /etc/apt/trusted.gpg
/etc/apt/trusted.gpg
--------------------
pub   4096R/68576280 2014-06-13
uid                  NodeSource <gpg@nodesource.com>
sub   4096R/AA01DA2C 2014-06-13

pub   4096R/86E50310 2016-10-05
uid                  Yarn Packaging <yarn@dan.cx>
sub   4096R/D50AF136 2016-10-05
sub   4096R/88B63E1E 2019-01-02 [expires: 2020-02-02]
sub   4096R/69475BAA 2019-01-11 [expires: 2020-02-02]

pub   3072R/95BD4743 2019-03-18 [expires: 2021-03-17]
uid                  DEB.SURY.ORG Automatic Signing Key <deb@sury.org>
sub   3072R/8059B8AC 2019-03-18 [expires: 2021-03-17]

I can see only Yarn Packaging's first and last two keys. (1) Why doesn't it show all the keys? There's also uid line that shows user id, which is basically a key name. And as I said, trusted.gpg contains only public keys.

But apt for one shows longer key ids. (2) Why is that?

  W: GPG error: https://dl.yarnpkg.com stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 23E7166788B63E1E

Let's take a look at a key I've generated for the purpose of this writing:

$ gpg -k
/root/.gnupg/pubring.gpg
------------------------
pub   2048R/454A8AB5 2019-03-25
uid                  Temporary Key (Comment to the Temporary Key) <temporary.key@gmail.com>
sub   2048R/763C1752 2019-03-25

$ gpg -K
/root/.gnupg/secring.gpg
------------------------
sec   2048R/454A8AB5 2019-03-25
uid                  Temporary Key (Comment to the Temporary Key) <temporary.key@gmail.com>
ssb   2048R/763C1752 2019-03-25

So I've got two keypairs, or 4 keys. One master (or primary) key (or keypair). And one subkey (or subkeypair). 2 (public) keys in public keyring, and 2 (private) in the secret one. (3) Why do I automatically get a subkey?

pub - public key
sub - subkey
sec - private (or secret) key
ssb - private (or secret) subkey
uid - user id

(4) Are there other ways to display information about keys?

There are public and private (or secret) keys. A public and a private key make up a keypair. Some keypairs are bound to the other ones. The former are called subkeys, the latter master (or primary) keys. In spite of them being called keys, they are actually keypairs.

Keys you generate (and own) are keypairs. Whey you distribute your keys to other people, or other people distribute their keys to you, only the publickey is distributed, and the owner retains the only copy of the privatekey. This is how public-key cryptography works.

Background: when PKC was first invented the terminology was rather ad-hoc. Cryptography in all of previous history depending on keeping the key -- the one, single, only key -- secret, but PKC invented a new kind of key that is not kept secret but rather can be and often should be made public.
Initially people called the other part, the part not made public, secret. As time went on it became clear that there is an important difference between the key in symmetric crypto that must (usually) be shared by two or more authorized parties but (always) kept secret from everyone else,
and the key in asymmetric crypto (PKC) that should never be shared at all, so we adopted the term 'private' to distinguish the latter. Because PGP was created before this terminology was settled, it often uses 'secret' where modern practice is 'private'.

  Keyrings are files. gpg-1.4.18 by default creates two keyrings: public (pubring.gpg), and secret (secring.gpg). Public keys go to a public keyring, private to a secret one.

Mostly true for GnuPG 1 and 2.0; 2.1 up changes secret-ring to a directory of separate files. GnuPG also stores trust settings related to the publickeys in a separate file named trustdb.gpg. There are other implementations of PGP besides GnuPG and they may use different files, or a database, or even turtle shells if they want, as long as they store the keys in some fashion usable for the operations they do.

  Let's take /etc/apt/trusted.gpg: ... Consider the Yarn Packaging key and its subkeys. First, all the keys listed are the public ones. And its public key has 6 public subkeys. Supposedly, the first subkey doesn't have expiry date specified

These keys belong to someone else, so you get only the public parts.

  Now if I do: $ gpg -k --keyring /etc/apt/trusted.gpg
  I can see only Yarn Packaging's first and last two keys. (1) Why doesn't it show all the keys?

By default it doesn't show expired subkeys -- crossdupe

  There's also uid line that shows user id, which is basically a key name. And as I said, trusted.gpg contains only public keys.

The userid is supposed to identify the owner of the key. That is not quite the same thing as identifying the key, but it is very closely related.

  But apt for one shows longer key ids. (2) Why is that?

Keys are actually identified in PGP, and GnuPG, by a fingerprint which is 20 bytes, and a long keyid, which is 8 bytes extracted from the fingerprint.
In olden times, it was thought that having to manually type, read, and compare the long keyid would be difficult for (some?) users,
so GnuPG by default used the short keyid which is the 4 byte (32 bit) low half of the long keyid.
Notice for the (long) keyid 23E7166788B63E1E in your error message the low half is 88B63E1E which is in the list you produced from /etc/apt/trusted.gpg -- and thus should be available.

In your gpg version you can add --keyid-format long to see the long keyids, and/or --with-fingerprint once or twice (or --fingerprint once or twice by itself)
to see the fingerprints, from which both keyids can be easily derived; see the man page. (You can put these, or other options, in your config file to use them automatically.)
Partial crossdupe

In recent years Moore's law has made it easy to fake 32-bit keyids so GnuPG 2.1 up shows fingerprint on masterkey (but not subkey by default).

  Let's take a look at a key I've generated ... So I've got two keypairs, or 4 keys. One master (or primary) key (or keypair). And one subkey (or subkeypair). 2 (public) keys in public keyring, and 2 (private) in the secret one. (3) Why do I automatically get a subkey?

The short answer is probably that you used gpg's default and that's the default, although gpg can create (and use) other arrangements. The long answer is more complicated and partly opinion-based.
First note each key/pair in PGP has 'usage' flags that control the operations it is used for, often displayed as single letters, and the gpg default is that the masterkey is only used for S=signing data and C=certifying (signing) keys, while the subkey is used for E=encrypting data.
Unfortunately before 2.1 (or maybe 2.2?) displaying the usage flags is inconvenient.
For DSA+ElGamal keys, which were more popular in the 1990s when the RSA patent was an issue for many people, this is a technical requirement: DSA can only sign (and certify) and EG can only encrypt (in gpg).
For RSA or ECC it is no longer a technical requirement but still the default.

There can also be operational advantages in at least some situations of having separate (sub)keys for encryption and signing,
and both of those separate from certifying (always the masterkey); gpg does only the former by default.
For some discussions on whether, when, and why you should have different subkeys for different usages or purposes, see:
What is a good general purpose GnuPG key setup?
Why do PGP master keys only have a single subkey, and tie certification with signing by default?
PGP - Why have separate encryption subkey
Purpose of secret-subkeys?
PGP/GPG: Do I need more encrypton subkeys?
Rationale for subkeys in OpenPGP?
GPG masterkey and subkey for encryption and signature and default keys
What exactly is a subkey?
https://superuser.com/questions/632375/why-does-gpg-pgp-by-default-use-different-keys-for-signing-encryption
https://superuser.com/questions/1113308/what-is-the-relationship-between-an-openpgp-key-and-its-subkey
and many other websites blogs etc all over the net, but Google gives me Stack results first because it knows I like them.

  (4) Are there other ways to display information about keys?

Lots, although most of them use something other than or at least added on top of GnuPG. A complete list would take me years to write, and Stack policy is mostly against lists anyway. If you have a particular need, ask about that.


How does the symmetric key get exchanged in SSL/TLS handshake? I've been reading a lot about SSL/TLS handshake between a client and a server and many articles on it are very contradictory.

Some say that the symmetric key that will be used to communicate between the two parties is transmitted from the client to the server (ofc, encrypted with the server's public key) and that's it.

Some say that a DH algo is being used and first the client sends a pre-master secret to help generate the shared key (why is the pre-master secret encrypted in the first place, an attacker won't gain any confidential info).

What's confusing is the overall flow of the generation on the shared symmetric key. a) Is DH being used at all (and if not, how is the symmetric key being generated, the client suggests it, sends it via RSA encryption and that's all?)

And b) If DH is being used, who starts first? There must be someone who first suggests the overall prime numbers to use for generating the secret, and then sends their computation (or is the overall algo determined up-front)?

As you already noted, there are two ways to exchange symmetric session keys: through key encipherment or through key agreement (which is based on Diffie-Hellman algorithm). Both algorithms are not used at the same time. For example, Microsoft SChannel client reads bits from server certificate's KeyUsages extension (which is a bit string) and depending on what bit is set, the key exchange algorithm is used.

When key encipherment is used:

client and server exchange supported cipher suites and agree on a common cipher (which is supported by both parties).
client uses selected algorithm and parameters to generate symmetric key and encrypts it with server's public key (asymmetric encryption, RSA or ECC, for example).
server uses its private key to decrypt the key and this key is used to protect session. No DH is involved here.

In the case of Diffie-Hellman (key agreement), there is no much difference on who starts, because parties share common prime number p and generator number g and both parties MUST agree on these values. These numbers can be agreed on in public. So, the agreement initiator is just a protocol's message syntax matter.

After that the following process occurs (which is well-defined):

Clients sends its DH public key to server.
Server computes the secret session key by using the information contained in its private key and client's public key.
Server sends its DH public key to client.
Client computes the secret session key by using the information contained in its private key and server's public key.
Both parties now have the same session key, which can be used for encrypting and decrypting data. The steps necessary for this are shown in the following procedure.

Detailed DH key exchange algorithm is described in RFC2631.


How do mobile apps share details with each other to show customized ads My question is more towards how this is implemented. I mean do they expose apis to each other or store data at a common place to be accessed by others. Please excuse me if it seems too naive.

The apps do not share information. They use an ad network to display ads to users. Many apps will use the same networks, and those networks are also used by websites, so the network knows the user's behaviours on the apps and the websites that use them. That way the network shows relevant ads to users.
The apps and websites don't actually know what ads are being shown to users.


Can CloudFlare be DDoS-ed and issn't the actual DDoS mitigation limit, financial resources? CloudFlare (known for fighting DDoS-attacks) is explaining quite a lot about DDoS on their website cloudflare.com/ddos. In an article named The DDoS That Almost Broke the Internet they write about a DDoS attack of 300Gbps that they mitigated. Also the following is written on the CloudFlare page on Wikipedia:

  CloudFlare reported a new record for the largest ever recorded DDoS attack with independent media sites being targeted at 500 Gbit/s.

Since it's all about who has the most resources, CloudFlare has to be able to have more resources in order to "win" (read: mitigate the attack). I assume they can upscale their infrastructure flexibly and they pay for those resources from the collective money (earned by their payed contracts) to mitigate (big) attacks, like some kind of collective insurance. "All-for-one".

I'm wondering about the following unlikely and so theoretical scenario. What if CloudFlare has to deal with multiple DDoS attacks of 500Gbps at the same time or with multiple DDoS attacks of 1Tbps. In this example I used CloudFlare but I assume that the answer applies to other DDoS protection solutions also, right?

Also, isn't the only actual limit, financial resources? What if one or multiple DDoS attacks of 500Gpbs or more, continue for more than months. Will this bankrupt them?

I work for CloudFlare so maybe I can shed some light on how we do things.

Fundamentally, CloudFlare uses an Anycast network design; this means that network traffic has no control to where it is routed and it is automatically routed to the closest available host. Computers compromised by botnets are typically distributed throughout the world in different geographical regions. Because of using an Anycast network we increase the surface area of our network such that it is harder for a distributed attack to take us down. The traffic cannot merely overwhelm a single datacenter, in order to grow out this protection we now have 86 data centers around the world and we plan to add more.

We also operate an open peering policy where we are willing to directly interconnect with ISPs (PeeringDB). By removing the middle-men we are able to have the shortest path from the source of the attack to where we can filter the attack. Today, we have the single highest participation in Internet Exchanges globally, of any network. By having a direct path form attacker to destination we can prevent collateral congestion on our network.

Yes, we need a large network to come with attacks, we need big pipes so people can't congest them - to that end our network is 96% bigger than the largest DDoS attack ever recorded.

This is despite the fact we have seen a whopping increase in attacks. There are some interesting characteristics about these attacks; they predominantly happen on weekends (attackers busy with something else on the weekday?), they happen against largely benign websites indicating that anyone can become the target of an attack and also these attacks are massive in capacity.

Almost all of our Layer 3 attack handling is now autonomous, we use a range of strategies to protect against attacks. When attacks come to our Edge we have worked out strategies in order to ensure we are able to reduce the impact of such malicious traffic; we then seek only to pass on safe traffic to the origin.

In many ways CloudFlare has become the DDOS filtering method of last resort; for Business and Enterprise we have advanced protections against DDOS attacks backed by a full SLA, we offer this at a flat rate to ensure that DDOS attacks aren't successful in bankrupting their victims. For at risk public interest sites we have Project Galileo offering this technology for free to those public interest websites who need it.

Currently one of the largest risks to the internet lies in open DNS resolvers, which can be used for DNS amplification attacks by hijacking insecure DNS resolvers; I would highly recommend looking at the Open Resolver Project to learn more. Finally, an article from about 3 years ago on our blog goes into detail about how the DDOS attack against Spamhaus almost broke the internet.


How to verify SSL cerficate If restored session after session broken? For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How I verify my trusted cerficate on every new SSL session? Is it possible?

That should never happen.  User is requesting your site via https://example.com.  The user's browser will expect the server to provide a cert with hostname of example.com.  Hacker can not MITM that as hacker will not have the example.com private key to sign a message and authenticate as example.com.  User's browser will report an severe warning.  If hacker supplies a cert and signature for hostname hackercert.com the browser will warning the hostname is incorrect.  If hacker supplies no cert the browser will report server is not available.  If hacker suppliers proper cert and invalid signature browser will report there is a problem with the cert.

So the scenario you describe can't happen which is a good thing because if the hacker is MITM you can't do anything the hacker doesn't want you to do.  The hacker is between the client and you.  So even if there was a "reverify this cert because the other one is bad" command why would the hacker ever let the client see it?

So my guess is either you have a misunderstanding of TLS or I have a misunderstanding of your question.


Is there a security reason to disable a leavers account instead of deleting it? Well the title says it all really. Obviously if they return it's easy to enable but I'm talking specifically about leavers where there is no intention of returning.

Many places simply disable accounts rather than delete them. Is there a security reason for this? I'm not sure I see any risks with disabling the account rather than deleting it.

This depends on the context of course but in general, leaving an account helps with accountability, and like Matthew mentioned, with audit trails. Imagine the scenario where usernames are formed of the first letter of the first name, and the full last name, John Smith becomes "jsmith", but John decides to leave the company and soon after he is replaced by Jane Smith, her username would be "jsmith" as well. Preserving the previous user would stop an accidental impersonation from happening, which may also not be accidental in every situation.

Another situation may happen if the process of deleting a user removed everything linked to that user, recently Gitlab had a hard time partly because a staff user was flagged for removal and in the process a major database was taken down, in this case the decision of deleting a user was costly.

In general, if there is uncertainty on what would happen when deleting a user, the best option is to disable the user instead of deleting it. So yes, while there are security considerations, there are also operational concerns.


What rules should be enforced for users to create a strong password? I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best option for making users create strong, but still easy to remember passwords.

See this.

Important points:

You cannot test for password strength, on looking at the password alone. Password strength is a property of how the password is generated, which you cannot measure or even estimate more or less approximately by just looking at the password ("password meters" are a joke -- one of the best jokes: the kind which many people believe).
If you enforce strict rules on passwords, users will rebel and indulge in practices which degrade security (e.g. writing down the password on a stick-up note concealed under the keyboard, or reuse of passwords between sites).
You can help users by giving them a password generator which follows high entropy rules (this time you know how passwords are generated, so you can measure the entropy). The "correct horse" method would be a good idea.


VPN doubt about "encrypting" an IP address According to Kaspersky

Encryption of your IP address: The primary job of a VPN is to hide
your IP address from your ISP and other third parties. This allows you
to send and receive information online without the risk of anyone but
you and the VPN provider seeing it.

So, how is it possible that ISP knows where to return packets, then, if the IP headers in packets on lower layer of abstraction are encrypted? Obviously, the VPN server will know the origin IP, but when they want to return the information back, they would have to specify where they are sending it to and at one point, it's the ISP that is handing me the packets back. Their routers on the physical layer need to know the direction, so they would obviously need to know the IP if they want to return the packet back.
Did I miss understand this quote or am I I not seeing something right?

A VPN expert with English as a first language did not write those words. It's wrong and meaningless. But I do understand the gist of what the author meant to say. Your IP is hidden from your target and your traffic is hidden from your ISP.
According to the Wayback Machine, this new copy was added some time between Aug-Nov 2020. It looks like it was not properly reviewed... What's interesting is that all instances of this quote in other places start to appear in November 2020.


Node.js REST server running as root I am building a REST API server using Node.js and Express, that will allow you to turn any Linux server into a NAS. I have several fileExec which basically spawns a shell and executes a BASH command (Like pvs, pvcreate, lvs, vgs, etc). Most of these commands require root access to execute correctly. In order to do that I must run Node.js as a root user with sudo.

I know I could possibly have a non-root user run the server and have a separate function with sudo in it that runs that specific command. However I would have to place and manage the sudo password in my server application to have correct credentials. I don't know if that would be much better. Also it would add more complexity to my application...

So my question is, is there a better way to secure my server application?

I would recommend splitting your app into multiple components communicating through standardized REST APIs.

In this case you'd have a storage manager app which runs as a user with enough privileges to manage LVM volumes (or if impossible, then as root) and exposes its services through a REST API the main app (which is unprivileged) can consume. That little app should listen on an UNIX socket instead of a TCP one, for both performance and security reasons (an UNIX socket won't be able to be accessed from anywhere where as TCP could be if the firewall gets misconfigured and the app listens on any address).

This approach will also allow you to swap the low-level components with something else without modifying the main app.


Is HTML5 vibrate feature a security vulnerability? While surfing a news website on my mobile, I receive a virus infection alert warning that triggers my phone to vibrate incessantly. The alert looks like the following:

I didn't expect my phone to vibrate and the alert is able to tell me the model of my phone (first panel) and the OS system (second panel). Clicking the back button causes another warning to pop-up (third panel).

I almost wanted to follow the instructions on the second panel to install what looks like an anti-virus. But luckily, I was able to calm my nerves sufficiently to realize that this is a scare-ware served through an ad-server and that the anti-virus could be the actual virus.

Given that the HTML5 vibrate function is a new feature that people hardly encounter on websites. It would not be a surprise that there are people falling prey to this tactic.

Is HTML5 vibration feature a security vulnerability? Should mobile browsers enable such a feature on websites by default?

A popup was used to show the alert. Does this mean that the popup feature introduces vulnerabilities? Then by that line of reasoning JavaScript is the source of all problems. There are people who actually think that JS is an important vector for attacks and block it on untrusted websites with extensions like NoScript.

Many features can be misused, and is up to people creating the standards, browsers and even websites to judge what is bad and to change the standards or implement mitigations. Of course those people can be wrong and some feature can be unexpectedly used to attack users.

A nice example is the browser's console which is very often used to trick users into pasting JS code that attacks the user. This helped Facebook worms to propagate with great success. Facebook noticed this and introduced this message in the console:

This vibrate function might trick some users into thinking that it is actually the OS showing the alert, but I think the latest mobile browsers do a good job of showing the user that he is still inside the browser. In this case, the message from the browser is clear enough "The page at andro-apps.com says:"

If this becomes an important vector for attack, I'm sure the browser manufacturers will notice that and will make changes to reduce the impact.


Coding to detect DDOS I need to code a program in order to detect a DDOS attack. I'm not sure what's better:

1) use TCPDUMP in order to listen to the interface

2) code my own way to listen to the interface (using C language, for example).

May someone help me with some ideas of how to start my DDOS detector? I didn't find any text of how to do that?

I'm not interested in the language, but about the ideas of how to detect a DDOS.

EDIT

There's something I forgot to say: I have one server that receives all the traffic from the router (through mirroring). So, if the routers goes down, I can still send the notification to another server to notify there is a DDoS.

I'd try to go with established tools first, before writing my own networking interface monitoring code.

Chances are that if you're trying to protect a server, you'll be helpless against a sufficiently large DDoS anyway (someone further up the routing chain will have to take action to null-route attacks), so the main argument in favor of writing your own C code, efficient detection, isn't very strong).

(The above paragraph doesn't apply if you're trying to detect a DDoS flowing through specialized hardware, like large routers - in such a case, you'd be part of the effort to stop a DDoS before it reached it's target, and efficiency would be your prime concern - but I'd be disappointed if  high-capacity routers didn't already have such capabilities built-in)

Besides tcpdump, you could also use netstat (to get a quick idea about the number of connections or connections in a zombie state), iptables (both to log packets and then act on the log, and to drop suspicious packets immediately) and fail2ban (you can configure it to count, say, HTTP GET requests or SSH connection attempts etc, and then automatically ban the IPs in question, and of course also produce log messages that an additional DDoS detection script can the pick up and use to notify you).

One problem with basing detection code for a DDoS on the server that's being DDoSed is that if you're counting on the server to notify you of the attack over the network, you might get disappointed because the server might not have the CPU resources or the bandwith available to send out a notification any more. So you'd need to have a secondary means of communication, say a GSM modem over which to notify you (and that's assuming that the server still has the CPU resources available to run your notification code).

There's another, very easy and much more promising way to create a DDoS monitor: Set up a small script on another server that periodically tries to connect to your server. If it fails to connect, you can assume that either your server is down, the network between your server and your monitor is down, or that there is a DDoS in progress. Going this route, you don't even have to write any software at all; just subscribe to an online service that checks service uptimes. There's a lot of them available, some of them even for free.


Is it beneficial to run the browser from a different user account for personal devices? On Linux, when launching the browser does it help security if I don't run it from my main user (not root, but still has my personal information in it) as follows:

su  FirefoxUserName -c 'firefox'

Where each browser would have a user account and have his own /home directory and have no privileges.

I do however understand that my browsing history as well as downloads would still be on this different account so those would remain accessible.

Yes - beneficial, although it doesn't fix everything.

Being hacked through your browser is one of the most common ways you'll be hit. If the browser is running as a user that doesn't have access to your private files, your web cam and such, then the impact of a hack is much less.

There are still risks. If the hacker uses a local privilege escalation exploit, they can bypass the sandbox. Depending on how the sandbox is done, the hacker may get access to all you web traffic - and steal all your cookies. And this does nothing to protect you against phishing and other attacks.

In fact, this is such a good idea that many browsers do a similar thing anyway: the browser sandbox. Off the top of my head, Chrome does it on Windows and Linux, Firefox does it on Windows only. Some Linux distributions have an AppArmor profile for Firefox that achieves a similar result.

If you're keen, take a look at Qubes OS.


Is SSL over HIP (Host Identity Protocol) possible? In this relatively short Host Identity Protocol (HIP) overview Host Identity Protocol:
Identifier/Locator Split for Host Mobility and Multihoming it is stated

  Most Internet applications can run unmodified over HIP, although only HIP-aware new   applications   using   the   extended   socket interface  can  take  better  advantage  of  the  new  features  that  HIP provides.  As  HIP  secures  application  data  traffic  with  IPsec  that  is located logically “deep” within the networking stack, the challenge is to provide proper and understandable security indicators to the user to convince the user that the connection, for example, to a banking website, is secured. Such indicators can be developed as extensions to applications (for example, a security plug-in to the
  Firefox browser) or  within  a  hostwide  HIP  management  utility  that  controls  all
  applications.

the highlighted sentence left me somewhat puzzled as it indirectly states that currently working upper layer protocols such as TLS will not work over HIP. If it would work we would not need another solution, as we allready have server authentication that is highlighted in browsers. So will TLS work over HIP?

Up until now I thought HIP will introduce modifications in TCP (see first cited sentence) but above that everything should work fine as the layered ip stack architecture renders not directly connected layers transparent right?

Or is it that TLS will become a redundant security layer as HIP allready provides host authentication and transport encryption with IPSec, so that TLS over HIP should be avoided (it slows and does not provide additional security if HIP with additional certificate authentication is running ). Therefor we need a new way of highlighting (HIP) authenticated hosts? (or use the old one to not confuse the user)

Cisco says that HIP is an alternate to TLS:

  HIP provides a network layer alternative to using Secure Sockets
  Layer/Transport Layer Security (SSL/TLS) for application security,
  which has its benefits and drawbacks. HIP is a generic solution that
  should work for any transport protocol, whereas until recently TLS
  supported only TCP. HIP enables host mobility and multihoming, which
  is not supported by TLS. TLS runs on top of TCP, leaving it vulnerable
  to various TCP attacks; for example, using spoofed reset (RST) packets
  or DoS attacks with SYNs. Applications must be designed explicitly to
  use TLS, whereas HIP can provide security as an add-on to existing
  traditional applications. On the other hand, TLS does not have a
  problem with traversing traditional middle-boxes such as NATs and
  firewalls that need special attention for HIP. Both protocols share
  the characteristic of endorsing host identity. TLS relies on
  certificates issued by one of the known Certification Authorities,
  whereas HIP can use Domain Name System Security Extensions (DNSSEC)
  [18] or a PKI infrastructure.

As for whether it is possible to run TLS over HIPS, it doesn't seem possible. There is great conflict in the layers they interact on.


Can anyone explain how to use an X509 client certificate to securely authenticate a user? Bit of background.

Web Application that can generate Pub/Priv Keys and X.509 certificates.

How would I make use of the certificate in a web application, username and password login form to provide secure authentication?

This is for a part of a research project I'm doing so I'm not looking for 'better' methods of doing this, I'm just wondering how you'd go about this situation.

Many Thanks!

How would I make use of the certificate in a web application, username and password login form to provide secure authentication?

The point would be not to have such a form at all. You would use HTTPS. The server TLS configuration would require a client certificate (which is optional). In response to that option in the TLS connection setup, the client (web browser) would typically prompt the user to select an acceptable certificate from those he has available; you would of course have had to get the user his private key and matching certificate beforehand. The server would need the necessary CA certificates to verify the client's certificate. Once the TLS connection completes, the web server would make the authenticated client identifier available to the application in some form (e.g. environment variables with Apache mod_ssl); at least, the X.500 "distinguished name" which is the subject of the certificate.


How can I safely store a password in a .class file? I have some .java files containing some password variables, and these variables have values:

String password = "xyz";

Now after run, when I open the .class file, it contains those passwords. How can I store my password somewhere safe? I don't want to use DB for storing.

You cannot.

If the application has to know the password, there is no way to store it safely, unless you ask a user at run time for a master password. Because if the app can get it, an attacker could do the same either directly if it is stored in clear text or with reverse engeneering if it has been obfuscated.

The real question to ask is why an application should know a password? If is is interactive, it should ask it (or a master password used to decode an encrypted vault) to a user, and if it is not (a service or daemon), you should either rely on machine identification on a local controlled network, or accept that any person that has enough privileges to see the application files can know the password, and protect (including physical protection) the machine and account running the app.


Is a insecure VM in a secure host vulnerable to wannacry? Assume a reasonably secure windows host (latest windows updates/patches, up-to date enterprise antivirus).

How vulnerable is in this context a VM with a not up to date windows OS and an old and not up to date antivirus? 1)

What factors (if any) affects this? Internet access, VM guest settings, etc.

1) Let's say you have a an old VM you need to work on, for which an update would have a significant cost, or not be possible (legacy applications support, or simply the VM scope is to test an application in that specific environment).

Apparently my question is not clear enough. So let me rephrase it like this: You have a system A that is safe from wannacry (i.e. it is patched and it cannot get infected, has up to date antivirus). You have a system B, which, on it's own is not safe from wannacry (i.e. not patched, it can get infected, old antivirus definitions). If you run system B as a VM inside system A, can B still get infected, or does the fact that it runs as a VM inside a secure system blocks the attack vector? Can the A's antivirus prevent wannacry from entering B?

TL;DR - Treat a VM as if it were a physical machine just like any other.

The presence of security patches on a host will not prevent the client VM from being vulnerable.

WannaCry has 2 infection routes -

  Arrival through social engineering emails designed to trick users to run the malware and activate the worm-spreading functionality with the SMB exploit
  Infection through SMB exploit when an unpatched computer is addressable from other infected machines

  Source: https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/

So in other words, the VM is vulnerable IF another machine in your environment gets hit by WannaCry and the VM has any SMB services enabled (and most do even if it's only the "admin" file shares like \\machine\c$).


With SAP_ALL access rights, can someone run an executable on the SAP Netweaver ABAP server? Given a demo system for a fair which is based on SAP Netweaver ABAP. Our application has a bug which cannot be fixed easily, at least not in time for the fair. The workaround is to give the users of the demo SAP_ALL access rights.

SAP_ALL is a bad idea, I know. Please, let's not discuss that part. I did already and it will just be that way.

We do not care about the data in the system. It's an IDES demo system and we have a program that can delete the data (our application data) and reset it into the delivery or demo state. So it's not a big deal if someone manipulates data.

As a tester of that system, I have application knowlegde but not enough SAP administration knowledge. I wonder whether it would be possible to somehow transfer an executable to that server (via transaction CG3Z maybe) or create one on the server and later run it.

IMHO this would be an undiscussed attack surface and if it's possible, it would give me a new argument to talk to people again.

Maybe it's relevant: our application needs ICM (Internet Communication Manager) and HTTP, so a port will be open.

Yes, SAP_ALL gives you all you need to get a shell as <SID>ADM on the box. First, you can run report RSBDCOS0 which gives you OS code execution right away. Second, you can make use of the sapxpg mechanism which also executes OS programs. As SAP_ALL user, you can also change the config so that RCE is possible over the network.

Both mechanisms allow you to add another SAP_ALL user for later use by directly inserting 2 lines into USR02 using a DB client which escapes all SAP-internal logging.


Evil Twin Access Point Secured-Unsecured A very similar question was asked here but it didn't get any reply, so I'm going to ask a new question with some more insights.

The problem of the most common Evil Twin Attack is that the fake AP is unsecured and I've noticed that even with a deauth attack to the actual AP, the client won't connect automatically to the fake AP because of the different 802.1x configuration. The only way would be that the client connects of his own will.

I'm using hostapd to create the fake AP.
So, how could I accept the request of authentication even if the passphrase of the client does not match the one set in the configuration file of the fake AP (hostapd.conf)?

Because the PSK generated from the fake AP would be different from the one generated by the client.

I've already answered on how to clone AP (merge with the original on a wireless network list) in here I think.

If you're evil twin is an Open Network (waiting for the user to mistakenly selecting it manually from the network list), you would have to keep sending deauth frames until the reconnection time times-out.

If you want to automatically accept the request of authentication (which will be passed to the RADIUS-AAA server) from the client you need to have exactly the same settings on the AP.

Higher signal strength (There is a parameter that says which AP is better to connect "roaming aggressiveness")
Same ESSID (The name of the network the probe requests look for or the beacon the AP emits)
Encryption algorithm (WPA2, judging by the tag on your question)
The Cipher (CCMP)

Which roughly translates to this on the hostapd.conf (These are SOME parameters)

auth_server_addr=192.168.0.1         // RADIUS SERVER (Enterprise / 802.1x)
auth_server_port=1234                // RADIUS SERVER (Enterprise / 802.1x)
auth_server_shared_secret=verySecret // RADIUS SERVER (Enterprise / 802.1x)
wpa_key_mgmt=WPA-EAP                 // RADIUS SERVER (Enterprise / 802.1x)
ieee8021x=1                          // RADIUS SERVER (Enterprise / 802.1x)
wpa=2                                // Encryption Algorithm (WPA2)
wpa_pairwise=CCMP                    // Cipher (CCMP)
ssid=evilTwin                        // ESSID
rsn_preauth=1

Here's the link where I took this example from (for further knowledge too).

Now, this obviously will fail at some point because you need the RADIUS server, you're talking about 802.1x, so you also need to configure the eapol-config file (If you're using freeRADIUS) which changes everything when you choose one of the 22 supported EAP methods (EAP-PEAP, EAP-TTLS, EAP-TLS, EAP-MD5, EAP-FAST, etc.)

  Because the PSK generated from the fake AP would be different from the one generated by the client.

The key used for data encryption is called PMK, and it's dervived from the TLS Masster Secret in EAP-TLS, here you can find some more infor specifically for EAP-TLS

I hope this answers your question because it's still missing what you want to achieve and everything about the RADIUS server.


I'm being followed on the web. Explanations for mysterious behavior Am I being stalked?

I was recently doing some basic Python development scripting.

Python has a nice feature where it can run a simple HTTP server that serves the contents of the local directory, on port 8000 by default, but selectable to any other port.

I went to serve the contents of my working directory using this feature. Note that it prints out a log with IP/Hostname of every request in real time.

(Note I'm masking my IP with 1.2.3.4)

Serving HTTP on 0.0.0.0 port 8000 ...
1.2.3.4 - - [02/May/2013 17:20:57] "GET / HTTP/1.1" 200 -
1.2.3.4 - - [02/May/2013 17:20:57] code 404, message File not found
1.2.3.4 - - [02/May/2013 17:20:57] "GET /favicon.ico HTTP/1.1" 404 -
1.2.3.4 - - [02/May/2013 17:21:01] code 404, message File not found
1.2.3.4 - - [02/May/2013 17:21:01] "GET /mobile HTTP/1.1" 404 -

Ok. This looks fine, getting all 404 errors at this point. 1.2.3.4 is me.

But then look:

1.2.3.4 - - [02/May/2013 17:21:08] "GET /mobile.html HTTP/1.1" 200 -
ec2-54-242-63-60.compute-1.amazonaws.com - - [02/May/2013 17:21:40] "GET /mobile.html HTTP/1.1" 200 -
usloft3354.dedicatedpanel.com - - [02/May/2013 17:22:13] "GET /mobile.html HTTP/1.1" 200 -

Look at the last two lines! Once I get my first 200 Response (OK), I'm being followed!

Note that there are of course no links to this page anywhere on the Internet, so web crawlers couldn't find it.

Let's just assume for a second it's a port crawler scanning port 8000 (very plausible). Then how does it know exactly to request the page /mobile.html (nothing else)??

So I run the python web server again, this time removing /mobile.html and making a new page /test.html:

Serving HTTP on 0.0.0.0 port 8000 ...
1.2.3.4 - - [02/May/2013 17:34:05] "GET /test.html HTTP/1.1" 200 -
ec2-54-242-63-60.compute-1.amazonaws.com - - [02/May/2013 17:34:06] "GET /test.html HTTP/1.1" 200 -
usloft3101.dedicatedpanel.com - - [02/May/2013 17:34:06] "GET /test.html HTTP/1.1" 200 -

Whatever's happening, this much is clear: My web browsing is being recorded and shadowed.

To hammer in the point, I try serving the server on port 8001 with a new page (/test2.html):

Serving HTTP on 0.0.0.0 port 8001 ...
1.2.3.4 - - [02/May/2013 17:36:40] "GET /test2.html HTTP/1.1" 200 -
ec2-107-20-20-213.compute-1.amazonaws.com - - [02/May/2013 17:36:41] "GET /test2.html HTTP/1.1" 200 -

Again, the mysterious shadower knows exactly the page to request (and NOTHING else).

Hypotheses

I really have no idea how to explain this. It is important to note that I am browsing through a VPN located in Canada, while both me and the sites I'm vising are located in the United States. I have a suspicion that since this is crossing national boundaries, the traffic is flowing through a pipe tapped by [insert-three-letter-government-agency]. Laws regarding domestic censorship within the US are tough, but I doubt any of that applies to international traffic.

If not some agency, might it be my VPN provider snooping on my stuff while being proxied?

Also, could it be ISPs snooping on my traffic, since traffic originating from this IP is often used for torrents (I'm not torrenting, I'm using this VPN for anonymity while browsing). If so, is this unethical/illegal on their part?

Any thoughts/feedback/experience greatly appreciated, thank you!

I agree with TildalWave and Tracy Reed. This is almost certainly a caching proxy or an indexer of some sort being run either by your VPN provider, their upstream connectivity provider, or the server hosting provider.

It's not NSA/TLA "snooping" for the following reasons:

The NSA would just sniff the packets over the wire
The NSA would force your VPN provider to span them a feed from the outbound side of their gear
The NSA would tap into the packets by compromising your computer
The NSA would not use such an amateurish, easily detectable method of snooping

For all those reasons, I'd say there is no determined adversary spying on you. The other explanations are much more plausible.


How to defend against web server security scanners? I'm developing/hosting an Asp.Net IIS Website on AWS. I have added StackExchange.Exceptional, and in the first days, I get exceptions about attempts to access pages like:

/CFIDE/administrator/

and

/muieblackcat/

I discovered the first is a scan to try access some cold fusion admin page, and the second is scanning for PHP vunerabilities...

I was calm because I'm using MS stack, but then I know that there are scanners for IIS/ASP.Net Servers.

What measures/tools that I can do/use to defend against that kind of scanner in ASP.Net/IIS stack?

The truth is, any server with a public IP address connected to the internet will be scanned all the time. There are so many automated tools and scanners out there just looking for the low hanging, outdated, easily vulnerable servers.

You are looking for how to secure it, and that is a really important first step. You can not stop the scans. However, that does not make you vulnerable.

Things you can do:

Change the HTTP Server headers

This doesnt make you more secure, but you can remove identifying information that makes scanners less effective.

Set up a firewall and block non-essential services

Windows comes with a firewall. Use it to block all inbound traffic that is not port 80 and 443. This will make scans get less results and reduce your attack surface. If you need to RDP in, open up port 3389 to your own subnet, or a few select IP addresses, but certainly not to the whole internet.

Install something that will protect your server from common exploitable attacks, such as XSS, and SQL Injection.

You can't block all attacks 100%, but you can install something like ModSecurity that will inspect the data submitted and block/log known attacks.

Start logging to a remote server

Your server might get compromised. Thats just reality. Have a plan for how you find out what happened, and a plan to restore the server if you need to.


Why isn't an Expect-CT violation report sent when I use a certificate generated with Burp Suite? I wanted to test the Expect-CT security header. So I searched for sites and found that LinkedIn uses the Expect-CT header:

Expect-CT: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"

I configured my Chrome with Burp Suite so that it would use a certificate issued by PortSwigger Burp Suite, which is not logged in public CT logs. I then accessed linkedin.com.

Since the Expect-CT header was served the browser should query CT logs, and since the certificate isn't recorded in CT logs it should generate a report to the report-URI. But I didn't observe any violation report being sent there.

Is it because PortSwigger Burp Suite CA is configured to always trust in system?

Certificate Transparency (CT) does not apply to non-public root Certificate Authorities. CT only validates that certificates issues by trusted public CAs were issued legitimately.

Your Burp Suite certificate is configured on your system as a trusted root certificate and no CT policy will therefore be applied to it.

The Mozilla MDN page on Expect-CT also explicitly states this behaviour:

  Root CAs manually added to the trust store override and suppress Expect-CT reports/enforcement.


Does Android have sufficient app sandboxing? In a previous question in InfoSec, I asked about how to determine the safety of a sideloaded Android app that requires root permissions.

Now I would like to ask a related, but different question: Is it important to check the safety of an Android app that does not require root permissions and will not have data access?

If data access is disabled for the app (via a firewall with root permissions), does it even matter if the app is "bad" in some way?  You can use AppOps or XPrivacy to prevent access to the contacts and calendar and the ability to make/receive phone calls or SMS/MMS.  So what harm can an app that does not have data access (and has its permissions restricted by AppOps or XPrivacy) actually do?

Another way of asking this question is: Does Android KitKat and later have sufficient default sandboxing to prevent malware from doing any harm (assuming you can block data access to/from the app via a firewall and use something like AppOps/XPrivacy to block permissions to contacts, calendar, phone calls, and SMS/MMS)?

Each version of Android is incrementally stronger on this front than the previous, and Lolipop certainly pushes application sandboxing a step further than Kitkat, particularly with respect to inter-app isolation.

Third-party "firewall" apps on Android are probably a bit over-hyped, and the level of protection they can offer without rooting is in my opinion a bit questionable. Android does offer some level of device control via the Device Administration API, but it's largly policy stuff, not fine-grain control over app internals.

If your device is rooted, then all bets are pretty much off, and you're on your own. Sandboxing can no longer reasonably be enforced, and it's up to you to manually control execution. Good luck.

For non-rooted devices, app permissions are controlled by the permission set granted at installation. And that permission set is enforced. If an app is malicious and you granted it permission to send SMS messages, then it will be able to maliciously send SMS messages. If it wasn't granted that permission, then it cannot do so.

AppOps allowed these permissions to be updated at runtime, but according to a developer wasn't meant to be a supported feature for general users. The reason is that it breaks stuff. And a feature that breaks everything is, sorta by definition, not supported.

This isn't the end of the story, though. The permissions model is something that the Android team is reportedly paying lots of attention to. They need a solution that (A) doesn't break all the apps, (b) gives the user meaningful control, and (c) is usable by customers with the technical skill set of a gerbil. This isn't nearly as numbingly simple as it sounds, but expect continued attention and progress on this front in the future.


Web Certificate invalidation - You might be connecting to a website that is pretending to be [Site name] Recently while trying to log-in to Facebook this notification starts to appear:

At first I ignored it (by pressing Continue), but it started to popup every time I navigate through the website!

I thought it might be a fake certification applied by the ISP so I changed my account password and started to choose Cancel every time it pop's up, I expected that the page wont load! but nothing happened and on the contrary the web page continued to load normally?

Can anyone explain what happening and clear the whole idea to me?

Message shown again and here is the Show Certificate details:

Check out Dan Kaminsky's blog post on mysterious Facebook certificates. The response from Facebook:

  We’re safe.
  Turns out we just ordered new (smaller) certs from Verisign and deployed them to a few test LBs on Monday night. We’re currently serving a mixture of digicert and verisign certificates.
  One of our test LBs with the new cert: a.b.c.d:443

But then have a read of @JeffFerland's blog post inspired by this week's discovery of a spoofed google.com certificate.

So it can happen, and unless you are au fait with certs and the trust assumptions, you should check any time you get an odd warning.


XSS - Using firebug to inject Scripts Recently I did a bit of digging around XSS and found that to prevent XSS the best way is to encode user input/output. Being a newbie in this field I am unable to get my head around this and have a couple of questions:

If on the server side we use a REGEX to strip of slashes (/,\) and script opening/closing symbols (<,>) can we prevent XSS?
I also came across an article wherein checkboxes and radio buttons were also being attacked by injecting an onMouseHover = <script> .. </script>. Since this would not send any data back to server, how does this pose a threat?
Using firebug we can inject scripts almost everywhere. What exactly should we take care of? If user form inputs are properly validated are we good?

If on the server side we use a REGEX...

You should use a whitelist, not a blacklist. Use a regex to match only letters, numbers, and a couple symbols. It's easier and safer than trying to solve every single way the attackers could inject scripts.

  Since this would not send any data back to server, how does this pose a threat?

A script CAN send data to the server. Imagine the following snippet:

Nothing

You point the mouse to the B tag, and all your cookies are sent away.

  Using firebug we can inject scripts almost everywhere.

Firebug is a debugger, running in the client side, operated by the client. Anything done within Firebug does not count as an attack, because is a user-initiated action. If you convince the client to open Firebug and execute any procedure, you probably could ask him to download an executable, put it on the antivirus whitelist and run it with administrator privileges.


Terminology question - authentication through encryption I came across a number of somewhat similar solutions, which are based on the knowledge factor related to a symmetric key in particular:

If a party was able to generate correct message authentication code, be it in form of HMAC...
If a party was able to encrypt a piece of plaintext which decrypts to a message of expected structure...

... it means they are in posession of a symmetric key K, which in turn implies that this must be the party XYZ, unless the key has been compromised.
What is the common name for such authentication schemes?

The generic term is proof of possession.
It's most commonly used for a private key, where a prover needs to convince a verifier that the prover knows a certain private key. The most natural way to do this is for the verifier to send a challenge to the prover, and the prover signs this challenge with the private key. The verifier uses the public key to verify the signature. Only a party who knows the private key can produce a valid signature. The challenge should be unique, because otherwise an adversary who intercepted a response could replay the signed message without knowing the private key. It's also possible to generate a proof of possession by having the verifier send a challenge encrypted with the public key and the prover decrypt it and send it back.
From RFC 2797 — Certificate Management Messages over CMS:

"POP" is an acronym for "Proof of Possession".  POP refers to a value that can be used to prove that the private key corresponding to a public key is in the possession and can be used by an end-entity.

More generally, the term can be used with symmetric keys as well. For example JWT defines a proof of possession protocol for both asymmetric and symmetric keys.


Transmitting Credit Card Information I want to know how secure it is to transmit Credit Card details as plain text to the payment gateway from my website using HTTPS. We are not storing any details in our database but I read that transmitting plain text to payment gateway is not PCI Compliant. Also once we transmit the details to the Gateway they return a Token which we use for recurring payments so just want to make sure that if we are secure or not.

If you are transmitting the credit card details to your payment gateway via HTTPS, you are not transmitting in plain text, you are using SSL/TLS cryptography.

Once you don't store the details in your systems willingly (using databases, etc.), your only concern would be your system's logs, because they can store this informations without your knowledge, so make sure that no log is storing the credit card details.

We can have another issue that an attacker can use to steal your client's credit card details before he sends it to your server, this issue is called Cross Site Scripting (XSS), be aware.

Edit:

Be careful!

I am not saying that you don't need to pay attention in tons of other possible vulnerabilities.

I am just saying that if an attacker gain access to your servers, he will not be able to steal old credit card details if you follow the above rules.


How to check that an e-mail service provides encryption between the mail servers? How can I technically verify* that the e-mail I'm sending from Gmail to Yahoo is encrypted all the way from Gmail's servers to Yahoo's servers? I know that it's advised to have encryption between the mail service provider and the client's desktop, e.g. using IMAPS or SMTPS, and when using a web interface, HTTPS. But if an e-mail is sent from e.g. the web interface, then that e-mail could be sent in "plain text" format through the mail relay servers until it reaches its destination mail service provider.

* besides reading the corresponding FAQs

You can look at the raw email headers and see if they have pertinent information in there.

I've just looked at a few that came via Google and noticed Received: from XXXXXXXXXXXXX(XXXXXXXXXXXX. [x.x.x.x]) by mx.google.com with ESMTPS id xxxxxxxxxxxxx.73.2014.06.24.07.31.28 for version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128.  That suggest to me that Google received it via encrypted SMTP.

However, I believe that the messages that email servers place in the headers do not follow any mandatory standard and therefore it could be delivered via an encrypted SMTP connection even when the headers don't state that.  I suppose it's unlikely (but not impossible) that any service provider would claim that they received it via encrypted SMTP when they haven't, so it's a safe bet that if all your hops are encrypted then you're OK (but not guaranteed).


Heap canaries, to protect function pointers in heap objects I'm wondering if anyone has previously proposed, evaluated, or deployed the following measure to harden systems against heap-based buffer overruns: basically, stack canaries, but applied before function pointers in objects stored in the heap rather than before return addresses stored in the stack.

Consider a struct like

struct whatever {
    int blah;
    char buf[256];
    void (*fp)(); // a function pointer
}

Notice that if there is an overrun that writes past the end of the buf field, it will be possible to overwrite the function pointer field fp.

A compiler could plausibly defend against this by introducing a canary -- a secret random value -- stored between the buffer and the function pointer.  Basically, the compiler would transform the layout of the structure to

struct whatever {
    int blah;
    char buf[256];
    unsigned int canary; // inserted by compiler; not exposed to source code
    void (*fp)(); // a function pointer
}

For instance, the compiler could arrange to write the canary field with a global secret value any time the program writes to fp, and could check that the value of the canary remains unchanged any time the program reads from fp.

This is basically the analog of stack canaries, but where now we focus on protecting function pointers in the heap instead of return addresses in the stack.  It seems like a natural idea.

Has anyone proposed this before?  Has anyone prototyped it or evaluated the performance cost of doing something like this?  Are there any non-obvious barriers to deployment (beyond the fact that it requires changes to compilers, just like stack canaries do)?

Research I've done: I'm aware of the idea of inserting guard pages between objects in the heap, but that's different (it protects against heap overflows that go beyond the bounds of a single object, whereas I'm talking about something to protect against heap overflows that stay within the region of a single heap object).  I'm familiar with Cruiser and ContraPolice, which places canaries between objects in the heap, but that too focuses on cross-object overflows rather than intra-object overflows.  I'm also familiar with use of stack canaries or pointer encryption for protecting malloc's metadata, but again, that doesn't protect against intra-object overflows and is intended to protect malloc's metadata rather than function pointers.

Canaries within an object run into one practical problem: it changes the in-memory layout of these objects.  This layout needs to be consistent when passed between, say, the program and libraries.  If you passed a pointer of type struct whatever * from a program compiled with this instrumentation, to a library compiled without this instrumentation (but with the same declaration of struct whatever), then things would break, because some of the fields would be at a different offset.  As a result, using internal canaries for anything other than theoretical research would break compatibility with almost all existing code and libraries.


OIDC - what is the point of two separate tokens - access and id? I struggle to understand why don't we just have a single token that serves both purposes - authorisation and authentication?

In some sense, the access token does more than just authorisation. It also provides user id (in the sub claim) and after verification, the API (audience of the token) knows both - who you are and what you are allowed to do.

ID token, on the other hand, is meant for the client, but in case of a SPA, I don't really see any point in it at all. A SPA retrieves both tokens, ditches ID token and uses the access token to communicate with an API.

Some questions: - Is it purely because of historical reasons, that we are stuck with two separate tokens? - When do I really need the ID token? What does a SPA do with it?

The following link helped me to understand how what could happen if we use OAuth2's access token for authentication, which is called pseudo-authentication:
https://security.stackexchange.com/a/51903/182475

How I understand it, id token in OIDC serves just as a proof to the client application that resource owner authenticated at the Authentication server, and access token is used to tell the requesting Client application which resources the user (Resource owner) has on it (Client) and Authentication server perhaps (user info endpoint). Then client could ask the user (Resource owner) to give it access to other resources, at other Clients, and that access could be provided to the requesting Client in form of another access token or at the same time when the authentication is happening.
I think it would be helpful for you to look at my own recent question, where I provide my own questions regarding how does OIDC work and ask for validation:
Authorization on OAuth2 application that is both Client and Resource Server

And regarding ID token for an SPA, I don't see the point as well. Since SPA is just like the user (Resource Owner) himself, it is like user asked for proof of the authentication which he did himself. I think it is there just to make workflows uniform.


Store hash password and encrypted data with this password in db? I'm currently developping a django application.

I need to store user data. This data must be unavailable to any other user or admin

I've created a dedicated user account system (no using dj auth). (Maybe I could modified it, but this is not the subject here..)

User password is hashed with passlib.

User data is encrypted using AES and user password (not hashed :p) as secret key.

I'm wondering :

Is it safe to keep hashed password and encrypted data, when encryption used this password as secret key ?
What can I do with AES IV used to crypt user data ? Generate it when I create the user and keep it in user table, next to hashed password ?

When hashing the password with passlib make sure to use  passlib.hash.pbkdf2_sha512. You can read more on it here.

Yes this is safe, in fact you actually need to do this to verify the password before trying to decrypt the data.
The point of the IV is that even when the same key and plaintext is re-used, a different ciphertext will be produced. You can look at it a bit like a salt for a password. You just need to make sure it's unique and that when re-encrypting data (if data was modified) you generate a new IV.

Depending on the size of the data you can create a long, complex decryption key which is itself encrypted with AES using the user's password. This is often done as the user might decide to change his password. This would result in having to re-encrypt all data with the new password. Hence you use a decryption key which is itself encrypted with the user's password. In the event a user would decide to change his password, all you would need to do is re-encrypt the key. Now if you are just storing a bit of text this might be overkill, however, should you be storing large amounts of data (megabytes) then you could opt for this strategy.


Suscpicious registry entry In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and  HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) and UseCount (3). I do not have an antivirus on this machine because it's slow and am wondering if there is reason to be concerned?

If I were to take a guess, I'd say that it had to do with some sort of software (possibly from Microsoft, but just as likely not) that you had installed a trial version of. The registry contents don't appear to be malicious; an install date and usage count isn't particularly insidious. If you're to be concerned, I'd think it would be for some other reason than this.

You're bound to find LOTS of registry entries you can't immediately place off-hand. That's sort of the nature of the registry.


How do I recognize or prevent using a malicious WiFi network? Suppose I unknowingly connect to a malicious WiFi-network. I want to visit my bank's website. When entering its domain name (or clicking my bookmark), my laptop does a DNS request. My requests covertly gets resolved through some rigged DNS server which was fed to me by the WiFi. So my browser and I think we're connecting to my bank's website but in reality I'm visiting a spoof site.

How do I detect this, and how do I prevent this? VPN? Making sure I only visit https/SSL sites (which would be typically the case with banking) and checking my browser's green padlock and not ignoring any certificate warnings? DNSSEC (how)? Not using public WiFi networks at all?

Not using public WiFi networks is of course the best solution =)

In case of public WiFi, you can use VPN to connect to your protected network to be sure, that no one is able to intercept your traffic. Your VPN should encrypt all traffic as well and your VPN client should check if the VPN server, you are connecting to, is not a rouge one. You can use openVPN for this purpose.


How dangerous is it to open my DNS server to the world? I'm using pihole as my DNS on the LAN but I'm trying to use it as my "global" DNS server wherever I am on the planet.

One solution is to use a VPN on my LAN and pihole being set as the default DNS for that VPN gateway. It's fine but it may not be possible to mount a VPN tunnel every time for some reasons.

So I was thinking about opening port 53 on my home router and redirect the traffic to the pihole server.

Apart from being unintentionally DDOS if the DNS server is found and being used but botnets etc., what is the risk of doing that? I guess some people scanning the web may eventually find that DNS server and use it for some (bad) reasons, but in the end is my LAN at risk?

Apart from being unintentionally DDOS if the DNS server is found and
  being used but botnets etc., what is the risk of doing that? I guess
  some people scanning the web may eventually find that DNS server and
  use it for some (bad) reasons, but in the end is my LAN at risk?

Any open port increases the attack surface, in theory. Your LAN could be at risk if a serious vulnerability is found in whatever DNS software you use.

The biggest risk is that your DNS server becomes an unwitting participant in DNS amplification attacks. Your home connection could also be flooded with bad traffic and become unavailable due to saturation.

To minimize abuse you could also set up rate limiting (RRL). Here is for example how it is implemented in Bind.

What I usually do for a private DNS service is to configure the resolver (eg Unbound) so that it only listens to a local interface (tun0), that is used by OpenVPN. So it is only visible to VPN clients and not open to the whole Internet.

So the best solution is to use a VPN. You've said this is not convenient in all situations, then something you could do is set up port knocking. This is security by obscurity but seems sufficient to me in this scenario. Here is an example  that explains the concept. But since you have a router this will require opening a few ports (those required by the knocking sequence you'll define).

Now correct me if I'm wrong, but I had a look at the doc for Pihole and I have the impression that the built-in DNS 'server' is dnsmasq, so it is only a forwarder that sends requests to upstream servers like Google or OpenDNS. Then this is not a real resolver like Bind or Unbound and the benefit is not so obvious.

However they explain how to use Pi-hole with Unbound: Setting up Pi-hole as a recursive DNS server solution


Why is the Wikileaks site still accessible? How come it hasn't been hacked? Let me get started by saying I think Wikileaks is great, and that their work is invaluable. Background/context for this question: The recent Wikileaks data dump on the CIA. I've visited the site several times over the past few days and have read over it, and the site has been up every time.

Now obviously the CIA doesn't want this information out in the public domain. Additionally, certain governments would be unhappy with this information being out there. In light of this, how is it that the Wikileaks site is still up?

With the hacking capabilities of the CIA having been revealed, how has the site stayed up? Are they not trying to hack it? Why haven't other foreign powers hacked or DDoS attacked it in the past when it's posted information they didn't want public? Surely Wikileaks' security isn't THAT impervious. Or are they just not being attacked?

Why haven't other foreign powers hacked or DDoS attacked it in the past when it posted information they didn't want public?

Attacking the Wikileaks website to withhold information is ineffective. The site's availability is just not crucial for making the leaks public.

Instead of only hosting the documents centralized on their web servers, Wikileaks follows a different publication approach. Take the latest Vault 7 leak as an example: The documents were first released as an encrypted torrent file, and the key was only made public one day later. Without revealing what the content actually was, Wikileaks made it less likely that someone would interfere with the publication. Furthermore, that made it possible to download the documents without incriminating yourself - because at the time of the release, you wouldn't know that posessing contents of the file might be illegal. Also note that despite being declared the "largest ever publication of confidential documents on the CIA" (8,761 documents), the torrent is just over 500 MB in size that can be quickly shared across the Internet. And even with an ongoing DDoS attack, it would just be a matter of mailing USB sticks to selected journalists. After all, most people read about the leaks in the news rather than searching the archive.

That said, there were indeed lots of DDoS attacks against Wikileaks in the past years. That's why during the attacks around 2010, volunteers have set up hundreds of mirror sites. But today's attacks are more likely a botnet power demonstration rather than a targeted operation to suppress releases.


Do Apple and Samsung collect user's biometric data? Since Apple uses fingerprints to download apps from the App Store, I'm wondering if they are collecting our biometric data.

If so, I want to know if they hash that data? One day, if the US government asks Apple to give all users' fingerprint data, will they give it to them? Is it possible if the data is hashed?

Short answer: No, yes, no, probably not, no.

According to Apple:

  Fingerprint data is used only by the Secure Enclave to verify that your fingerprint matches the enrolled fingerprint data. The Secure Enclave is walled off from the rest of the chip and the rest of iOS. Therefore, iOS and other apps never access your fingerprint data, it's never stored on Apple servers, and it's never backed up to iCloud or anywhere else.

Your fingerprint model is locked with a key pertaining only to your device, and the data is never sent off the phone. If it were to get off the phone (from an attacker, government agency, or whatever else reason), the fingerprint is a model not your actual fingerprint.

No, Apple is not collecting biometric data and no the fingerprint model is not able to be reverse engineered.


Database breach protection I'm developing an API which requires an API key to use. These keys are assigned to users. To figure out which user the key belongs to, I have to store some information in that key. But I don't want it to be seen by "others". So I want to encrypt that value.

I was first thinking about making an encryption key for each user, but then I figured if the database has been breached, they have the key for each user.
So instead, I thought I should make a server-side encryption key. But I realised, if they breached the database, they probably don't care much about that encryption key anymore.

And then I started asking myself the question: What can I do to protect the data stored in a database, even if it has been breached?

For example, does it make sense to encrypt the values inside the database? I would assume not due to the time needed to decrypt everything again which would make for a bad user experience. So what options do I have?

Firstly please take a look at the suggested answer How to encypt sensitive data in database of a web app? (as per the helpful comment by @mentallurg

From a defence in depth approach, it absolutely makes sense to encrypt values on the database, as well it is worth taking measures to limit and contain breaches, such as ensuring your application is resilient to SQL injection, its DB connection is done with an unprivileged account (ideally multiple depending on the role and task) that can access only a subset of data on the database. Then the database server should be segregated from the remaining network. The database service should be running under unprivileged user permissions and have system command execution disabled.

As to how you should manage encryption and keys, there's several good solutions (as per the recommended question/answer), but be very very careful, as there's many times more bad/ineffective/insecure solutions.


Monitoring sender and/or receiver identity of a Whatsapp message? I know that Whatsapp is using end-to-end encryption, but is the sender and/or reciever identity also encrypted in a different layer?
If so, is there any way to monitor the party IDs of a conversation by a long-term sniffing?

WhatsApp's end to end encryption is based on the Signal protocol developed by Open Whisper Systems. An overview of the implementation of the protocol in WhatsApp can be found in this white paper.
According to the double ratchet algorithm documentation which is used by Signal:

The Double Ratchet algorithm is used by two parties to exchange encrypted messages based on a shared secret key. Typically the parties will use some key agreement protocol (such as X3DH 1) to agree on the shared secret key. Following this, the parties will use the Double Ratchet to send and receive encrypted messages.
The parties derive new keys for every Double Ratchet message so that earlier keys cannot be calculated from later ones. The parties also send Diffie-Hellman public values attached to their messages. The results of Diffie-Hellman calculations are mixed into the derived keys so that later keys cannot be calculated from earlier ones. These properties gives some protection to earlier or later encrypted messages in case of a compromise of a party's keys.

It provides forward secrecy. It is a complex algorithm which has been studied by cryptographers and is being constantly improved.
As far anonymity of the users, it does require a phone number to work so I guess you are as anonymous as your phone number.


URI redirect with only query parameters Is it possible to perform a URI redirect to a different domain if you only have raw write access to query parameters?

In pseudo-code, creation of the URI looks like this:

URI = "/example/path?" +
"thing1=" + rawFormValueFrom("#thing1") +
"&thing2=" + rawFormValueFrom("#thing2")

I have two particular suspicions that I have to confirm:

URI-delimiting characters

Would putting a an un-encoded space, tab, line feed, carriage return, vertical tab, comma, semicolon, or some other character make the browser navigate to the second URI if one were provided? In other words, were the value of #thing2 https://security.stackexchange.com (notice the leading space), would your typical browser navigate me to the second URI in the string?

Backspacing

Would it be possible to supply raw backspace characters to a form input to make it erase parts of the URI behind it? In other words, if the value of #thing1 were <backspace><backspace>3=actually2, would the URI become /example/path?thing3=actually2&thing2=... ?

No. you cannot trick the browser into redirecting.

You can write a web page that reads query params and redirects the user.

But this is a stack overflow questions those are stack overflow answers.

If you do trick a browser into following a redirect like you describe, you should report it to the browser's security team to fix it.


Key authentication with ssl Can i authenticate myself in SSL with a key, just like in SSH?

SSL/TLS supports authentication of the client with an asymmetric key pair. Since this is SSL, it takes the form of a client certificate. The server requests a certificate during the initial handshake, indicating which root CA the server will use to validate that certificate; the client then sends a certificate to the server. This of course requires the client to actually have a certificate to send.

Usual clients (browsers) and servers support this feature. What the server does with the certificate is entirely up to it. In a Microsoft Active Directory + IIS world, the client certificate, once validated, is mapped to an account through one of several mechanisms (either the certificate itself is already attached to the account in the AD server, or the account name is found as a "User Principal Name" in the client certificate).

@Rook talks about TLS with SRP, which is something completely different: with SRP, client and certificate authenticate each other with a shared secret (a password). There is no certificate anymore, not in the client and neither in the server. This has no equivalent in SSH (there was a patch to SSH for that, but it is not much maintained; it does not map well to account names and authentication as they are usually managed in operating systems). Usual SSL clients and server do not support SRP (but this may come in the future).


Chip-and-PIN PIN sentry, what it actualy does when signing? When I use internet banking with my bank I use something called PIN sentry, i.e. this:

(wikimedia commons image)

To use it I insert my chip-an-pin card (chip side in) and press one of the three top buttons: IDENTIFY, RESPOND or SIGN.  The sentry asks me for the PIN and produces an 8 digit code which I then use inside internet banking.

The sentry itself does not contain any keys that are to my account (and EMV already uses public key cryptography anyway) since I can use the PIN sentry of someone else.  But I wonder what it actually does to generate those digits.

My guess

At first I thought it performed an offline authorization for 1 unit of currency, an authorization that would simply never be cleared.  Then the sentry will print the first digits of the HMAC.  But this guess has two problems:

At some point the card will want to go online and refuse to perform an offline authorization.  I tested this (by using the sentry several times in sequence and the card never rejected it).
EMV has UN (unpredictable number, i.e. random number, at 9F37) which is generated by the card and send as part of a transaction.   As far as I am aware the UN is used in the HMAC calculation, therefore an issuer checking HMAC needs the UN.  But, if the issuer receives only the digits from HMAC he cannot verify it.

So yeah, I'm out of ideas how this thing can work.  But I have yet one more question on this device and PCI-DSS.  The summary of the question is therefore:

Question

The PIN sentry generates an 8 digit numeric code, that's relatively easy to bruteforce.  How can this be PCI compliant?
It is unlikely that the PIN sentry makes a transaction for one unit of currency.  How therefore it can use the chip to validate the PIN and produce an output that can be checked by the issuer?

There's a sub-specification to EMV known as the Chip Authentication Program (for MasterCard) or Dynamic Passcode Authentication (for Visa).

I'd never run into this before, but according to Wikipedia, your "one unit of currency" guess is pretty close.  The device starts by generating a cancellation message for a (fake) $0 transaction, then uses a mask stored on the card (Issuer Authentication Indicator) to select certain bits from the ARQC response, which get turned into the number displayed.

As for brute forcing the code, that's on the bank: Since the device is only used when interacting with your bank, the bank is immediately aware of any incorrect code attempts and can lock your account if it detects too many.  Similarly, the device uses the card's standard PIN counter, so if you get your PIN wrong too many times the card will lock itself until it can do an online transaction.


Reset password - should I prevent abusing it? My assumption is that resetting password is only a security issue if an attacker gained access to the user's email.

But I was wondering, what if someone simply abuses it (e.g. sends a "reset password" request every 5 second to an ex girlfriend/boyfriend email or a hated boss etc)

Is there a common practice to have some sort of count / time limit for password reset requests? (e.g. user can't ask to reset password more than x times in a period y)
Or is it considered a non issue as people don't really do that often? (or at least as often as people order pizza to someone else's address I assume)

*This is my first question here, I hope it follows the FAQ, please comment if its not

Yes, it is very likely that the same "excessive attempts" detection that is applied to login attempts is also applied to "password reset requests".

Many systems also involve a captcha step, that makes spamming the reset attempts more difficult. The example below is the outlook.com password reset page:

I think this is a fairly inefficient attack - thanks to rate-limiting, it can't reliably target an individual, and even if it could, the emails could be trivially blocked with an email client rule.


Split an application into user and admin parts for security reasons? I'm currently developing an application which needs to have the ability to manage users. If a hacker would have access to the administrative section, he would have access to sensitive information and/or could delete user accounts etc.

So I had the idea to split the application into two applications, one hosted on a public server for the users and the other one hosted on a private server, only accessible from inside a specific network.

I'm fairly new to application security, so could someone please tell me if this is a good idea or, and if not, why?

Yes, it's a good idea: if you application allows it, it will make it possible to apply the principle of least privilege to a deployment, for instance by making sure the administrative interface can only be reached  from "secure" networks.

It can be further improved by applying the same principle all over the stack: using the OS and database security systems to make sure different elements of the application only have access to the part of the data they really need.

The main risk is over-engineering the whole thing: splitting the application means defining mechanism for the different parts to communicate together (APIs). This is often an overlooked aspect of application security that can increase the attack surface of a potential attacker.


Is using cat -v an appropriate way to sanitize untrusted text? It is well known that a terminal tends to trust things which are printed to it through stdout/stderr, making outputting attacker-controlled data to the terminal a risky action. Is using cat -v an effective way to sanitize untrusted data that will be output to the terminal? My threat model assumes that my terminal emulator, terminal multiplexer, or Linux VT subsystem may be vulnerable to arbitrary code execution if made to print malicious data. Attacker-controlled data can come from foreign sources, such as from a website, or from a lesser user, for example when viewing a file as root which is owned and writable by a lesser, potentially compromised user.
Some example uses:
cat -v /home/lesseruser/evil.txt
curl -I example.com | cat -v
curl -s example.com/evil.txt | cat -v
telnet 198.51.100.98 23 | cat -v

From section 3.1 of the coreutils GNU Info page:
-v
--show-nonprinting
    Display control characters except for LFD and TAB using ^ notation
    and precede characters that have the high bit set with M-.

From the source code for src/cat.c, in coreutils version 8.28:
if (show_nonprinting)
  {
    while (true)
      {
        if (ch >= 32)
          {
            if (ch < 127)
              *bpout++ = ch;
            else if (ch == 127)
              {
                *bpout++ = '^';
                *bpout++ = '?';
              }
            else
              {
                *bpout++ = 'M';
                *bpout++ = '-';
                if (ch >= 128 + 32)
                  {
                    if (ch < 128 + 127)
                      *bpout++ = ch - 128;
                    else
                      {
                        *bpout++ = '^';
                        *bpout++ = '?';
                      }
                  }
                else
                  {
                    *bpout++ = '^';
                    *bpout++ = ch - 128 + 64;
                  }
              }
          }
        else if (ch == '\t' && !show_tabs)
          *bpout++ = '\t';
        else if (ch == '\n')
          {
            newlines = -1;
            break;
          }
        else
          {
            *bpout++ = '^';
            *bpout++ = ch + 64;
          }

        ch = *bpin++;
      }
  }

Is using cat -v to sanitize untrusted input before printing useful for my threat model?

It seems like a reasonable belt-and-suspenders security measure, though you'll probably get better answers over at unix.stackexchange.com. That said, with my tinfoil (and highly-imaginative) hat on,

There could be a vulnerability in cat you're not aware of (either in the code you cited (presumably ch is an unsigned 8-bit type but what if it isn't and ch is negative?) or in some other section, for example where it loads the file).
Your version of cat could be compromised to include a vulnerability.
There could be a vulnerability in the filesystem, or the other tools or the shell's pipeline, that is exposed by loading the file.
There could be a vulnerability in your shell when passing the filename to cat (perhaps the filename is crafted to expose the bug).
You (because you forgot, or because you were tricked; or the user of whatever script/tool you are providing) could be using a non-ASCII charset that includes control characters in the {32..126} space.
There could still be a vulnerability in the shell when printing the output (I'm imagining some really weird bug like 2^n consecutive tab characters overflows something).
There could be a vulnerability in one of the shared libraries or interpreter that your, or a future, version of cat loads.
There could be a vulnerability in the method you use to invoke cat (for example if you write a shell script that examines the file first).
The file could contain wrong information, written in a convincing way so you believe it.


Svchost without name 50%cpu using and can't access to "Service tab" I have recently downloaded a trash software (even if normally I do not), and just after done an update of windows 10. After this when I was booting my computer my ventirad (I guess) was running faster and faster (like an exponential).
So I  watched tasks by pressing (CTRL+Alt + Escape) and saw a  empty task running a lot of CPU.
When I went to detail it shown me a /Windows/SysWow64 and it was pointing to Svchost...

As far as it was using 50% of my CPU I knew that there was a problem because it's not supposed to use that much.

So I restarted in safe mode to run an analysis with in this order Avast, spybot, cccleaner,  and they didn't find anything and can't run at all.

I tried to restore an old save point  of windows, and in the middle of the process it failed.

Then I have downloaded Process explorer and saw that things :

I wanted to go to Service tab but first I received an access refused
then I wanted to suspend it, and it refuses.
Then I tried to force to kill it with a Taskkill 6492 /F
Did not work...

Please I have lost my resources and don't know what to do.

(I don't have windows 10 usb bootable, and  don't find my key (it was a windows 7 key official, then I upgraded to 10 long time ago)

Do you have any solution ?

It looks like it is a crypto miner virus. Once it was happened to me. I realized it when I have listened my network using Wireshark. svchost was commanded to communicate with a pool server of Monero coin. I found the only solution by restoring my C drive. Apologize, I can not come up with a nice solution. I had to write this as comment not as answer, but my reputation is not sufficient for commenting, and I would like warn you about the miner virus from my experience;

It is a malware infects in svchost.exe, so it is not possible to kill it since Windows recognizes it as a system process.
Usually its encoders work very well so that virustotal or any anti-malwares can not detect anything.
Do not try to log-in to interface of your router while you have this malware, since it is going to steal your router credentials and change your proxy or dns settings.
Do not make any online shopping with your bank or credit cards on this infected pc.
It is not only a miner virus. It is a strong Trojan which has many capabilities such as disabling Windows Defender, breaking Windows Updates. ( That's the reason why your restoring is failing ), listening your keyboard strokes, might be getting screenshots as well.

Windows 10 has a feature to return to a fresh re-install without removing your personal files. Restore Windows 10 to Factory Settings.  This will definitely save you from the dangerous trojan.


Shortening PayPal url I am currently sending very long PayPal url's to customers which sometimes leads to a line-break and makes it unclickable, whenever the customer can't receive HTML emails.

I am thinking of using a 3rd party application like bit.ly to shorten the paypal url and then send it to the customer. However, I am not sure if this leads to any security risk if I shorten the url instead of sending the full url.

The PayPal url contains the following information:

My account email
Item name, price, currency and quantity
Shipping Address of Customer

I think this is an information leak to the url shortening service, which is a third party. You would give away your own busines data (who buys what), and also your customers' private data (the fact that they bought those items).

Depending on how the shortening service works, doing this on plain http would be even worse (sharing the above stuff with pretty much anybody), but bit.ly I think works over https at least. But still it doesn't change the fact that you share this data with bit.ly.

Another aspect of it is that you may not even be legally allowed to do that unless you warn your users of what happens to their data (that it will be given to a third party, not just processed by you). Privacy regulations in for example the EU are very strict.


Are PGP/GnuPG trust information transferred to key servers? When signing a key X in the PGP Web of Trust model, I assign the key full validity. Other people who have my key in their key ring can regard X as valid as far as they fully trust me (owner trust).

This mechanism only works if people know which key I have signed. Can I assume that such signing information is stored on key servers? Does this mean that I have to resend my key to a key server after having signed someone's key?

I am a little bit confused, because in "What is the exact meaning of this gpg output regarding trust?" the first answer contains the statement that

  ... trust is a kind of signature on other keys, it does not get distributed when uploading keys to key servers.

I would not understand how the PGP trust model works if this was true.

This mechanism only works if people know which key I have signed. Can I assume that such signing information is stored on key servers?

Yes, certifications are stored on key servers.

  Does this mean that I have to resend my key to a key server after having signed someone's key?

You have to upload a key, but not yours, instead upload the certified key (or ship it to the owner, who can decide whether to upload it or not).

You have to differentiate between different kinds of trust.

Certifications (Signatory Trust)

OpenPGP expects trust in identity to be public, thus certifications being shared. "I believe that Alice is really who she claims to be" is a statement based on facts that can be shared without further implications (maybe apart from network analysis and clustering being possible).

Owner Trust

On the other, you have to decide whom to trust. Certifications issued are only valid, if a key itself is valid (so you can build a trust path to the other user) and you put trust in the certifications of all the users in-between (or partial trust on different paths). "There's Trust and Then There's Trust and Then There's Trust (a nice article on trust in OpenPGP) called this "trust to vouch".

Sharing this kind of trust might have heavy implications. You don't trust in the capabilities to correctly certify others of your boss, wife/husband? They might get this very wrong. It also reveals social connections at a much deeper level, as you have to know the other person to some extend, while you can safely certify a completely stranger's identity by verifying his identity card/passport.


Determining a reasonable session timeout limit What's a resonable session timeout limit and how can you determine it?

I think it's very related to the task being performed in the session.

How to determine it: verify what the session / program / software would be used to. Measure how long it takes to a regular user perform such activity. The more measures you have, the better. Calculate the average time and standard deviation. Make the timeout limit be average + 2 std dev, and I think that almost every user will be able to use the session before a timeout occurs.