Virtualization as a layer of security for desktop computers? Given the amount of 3rd party plugins required to browse the web, I've been compelled to virtualize my online habits to gain an additional layer of security.

There is of course some obvious drawbacks:

1) Need to have a shared folder between the host and guest OS to move files back and forth.

2) Need to keep the guest OS updated with newest patches, as well as the host OS.

3) Need to separate online activities and patching in order to be able to revert to snapshot after each browsing session.

Will this mitigate the online threats, or will this just be a false sense of security?

It really depends.

To go through your points:

Depending on the host and guest operating systems, you may need additional security here. For example, I have a couple of Windows VMs from which I can remove any dodgy programs onto the samba share without too much fear that the linux host will be infected by the presence of these files. However, there is the possibility that a virus exploiting a vulnerability in the linux samba daemon could well exploit my host (I just accept that risk).

One solution to this is rather than using disk images, write the virtual machine disks directly to disk, i.e. to a partition. This means IO isn't virtualised, which is faster, and it means you can literally modify the filesystem direct from the host. Of course, your VM software must support this.

A third alternative is to mount the filesystem. qemu, for example, is capable of mounting qcow images and retrieve content that way.
Yes, absolutely. Very necessary. Must happen. You should do all you can to defend the guest from attack because it may well become compromised.

Another point to make here is that you have one additional defence - every so often, take a known clean snapshot of the system. Then, if you get an infection, roll the system back.  Of course, you must know you've been infected and not back up an infected system.
If you really want to revert the system after each browsing session, you will have a lot of extra work to do. You'll need to have sessions where you patch the baseline and do not browse, and browsing sessions which you roll back after to that baseline.

You're certainly not the first to practise this kind of setup. The security researcher Joanna Rutkowska did an interview with Tom's Hardware detailing her virtual machine setup and the concept of having different levels of virtual machines she cared about, with increasing security setups, and doing different browsing on different machines. It's a very interesting read; for me, it's a little on the paranoid side.

Now, to virtual machine security:

A compromised virtual machine has whatever access you give it to the local network. This could be nothing (safer) or it could be limited access to services on the host (SMB, SSH) or it could be all access. The point is, you are increasing the attack surface potentially, especially if you ignore point 2 in your question. If you're using NAT, be aware both your virtual machines share the same IP to the outside world, so it might appear like your host is doing things it shouldn't.
There is active research in red pill techniques, i.e. escaping the hypervisor. I am not qualified to say exactly how likely these are to be in the wild now, but I can tell you detecting being in a virtual machine is not that difficult and like anything else, the more prevalent the virtual machine becomes, the more appealing red pill code will be.
Some attacks are not prevented by virtual machines. Session hijacking, cross site scripting attacks. Anything that attacks the application layer of the web site or application you're using rather than trying to attack your host may be something you overlook.
The host can still be attacked through alternative mechanisms (flaws in any network related services or indeed the content you pull onto it "securely").

Is it secure? That question can only ever be answered in the context of what you want to protect. Personally, for me, I weighed up the value of the information I have to protect versus the effort of maintaining several or one virtual machine(s) and decided the maintenance burden was probably not worth it. My host is reasonably well protected as is and I think it adds additional complexity to my setup. I prefer to defend one point of entry, not two or three. However, assuming you are skilled at maintaining all your virtual machines and have a need for this level of security, I would say the separation from the host and the ease with which you can roll back machines make it an addition to your defences.


What is the next step of this file upload attack? Yesterday I discovered somebody had uploaded this PHP code to my server as a .jpg file via my asp.net MVC application's "Upload your profile picture" form.  I believe the attack was unsuccessful for a number of reasons (the images are given random filenames, then resized, and they're stored in a non-execute directory).  The file was leftover because I failed to clean up the temporary file if the resizing failed, which I've now fixed.

But it worries me that I don't understand what the next step of this attack would be...Say he'd successfully uploaded a .jpg file that had malicious PHP code in it to my Windows/IIS server, and he knew the file's URL.  Now what?  He would need to get IIS to interpret that .jpg file as PHP code rather than an image, right?  What might his plan have been to accomplish that?

The only thing I can think of is if it were an apache server and .php files were being filtered out but .htaccess files weren't, he maybe could have managed it.  Is there any equivalent approach that might have worked in IIS?

One possible path would be to try and get it to be included somehow.  A lot of add-on frameworks can run an arbitrary PHP code file.  If the attacker was able to find such an add-on framework, they could give it the path to the file and it would be executed as PHP regardless of the file extension.


Why do they use misspelled names in spams? I sometimes open my spam folder. Recently I discovered a spam, the sender name was somebody I know, but one letter in her name was changed from 'i' to 't'. Today I received a spam with this name again, but this time an 'a' was changed to 'q'. Why do spammers do this letter change?

Even my e-mail id in the spam appears misspelled: first an 'r' was changed to 'p', now an 'r' to 'k' and an 'i' to 'u'.

It's a very easy way for spammers to spoof an e-mail address without altering any header information: just create an e-mail account that looks similar to the naked eye at a glance.

Some e-mail security controls may also flag differences between the displayed name and the sender or, in the case of SPF checks, actually check the originating IP with the sender.

As an aside, there's also the theory that this sort of low-hanging fruit is deliberately done so that the only respondants to a social engineering attempt are those who are so gullible it, they will fall for whatever scam the advesary is attempting. They're effectively trying to maintain a high success rate for the time spent e-mailing users bacmk and forth: someone who misses small details like a Cyrillic rather than Latin letter may also believe that this Nigerian prince really does need their help in funneling money out of Lagos through their bank account.

It's quick, it's easy.


XSS prevention for RESTful services A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like:

<xs:pattern value="[0-9]{1}[0-9a-z/\\ -]{0,7}" />

Can this validation be considered as a reliable countermeasure against XSS, or do I need to implemend further security measures?

The content-type used by web services should indicate to the browser not to interpreter the response as executable JavaScript code.  For example,  a RESTful web service can use application/json or application/xml depending on the marshaling type used.  It is impossible for an attacker to obtain XSS with these content-types,  regardless of the contents of the body.

Something to watch out for is accidentally setting the content-type to text/html or omitting it entirely as this could lead to XSS in a web service.


Different Results When Testing TLS Using CDN77 I have enabled TLS1.3 on three servers that are behind another load balance server that has itself TLS1.3 enabled. I get different results if the domain name is written without www. All servers have active ssl certificates. Here are the test results when testing in cdn77 checker:

I get "Excellent" if www.waylisting.com is tested. However,
I get "Poor" in Firefox and "Moderate" in Google Chrome if waylisting.com is tested without www.

I have no errors regarding ssl when testing in gmetrics, pingdom, and so on.
What am I missing in my configuration

There is an inconsistent setup of the site. Currently a DNS lookup for the site returns 5 IP addresses and each DNS lookup returns these in a different order (i.e. DNS based load balancing), which means that multiple attempts to reach the site might actually reach different servers.

These servers seems to be configured differently. From the SSLLabs report:

 172.104.210.88       Grade B
 172.104.22.58        unreachable
 45.79.155.107        Grade A+
 172.104.16.205       Grade A+
 172.104.219.176      Grade A+

And SSLLabs also adds a big warning

  Warning: Inconsistent server configuration

The A+ grades are for servers which have TLS 1.3 enabled. The grade B is for a server with no TLS 1.3, incomplete certificate chain and broken HSTS policy.

So it looks like that you've properly configured some systems but not others. Given that both www.waylisting.com and waylisting.com return the same 5 IP addresses but likely in different order it might happen that the testing can see different results for both domains, depending on which of the servers they actually end up testing.


Double JWT submit method I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature.

The header & payload is stored in a separate cookie, not HttpOnly so its accessible by the client, and the signature is HttpOnly.

The implementation seems pretty straight forward, but I'm having an issue understanding how refresh works.

For example, since I'm using firebase, the users jwt token has an expiration of 1 hour. When that expires, we need to automatically refresh the token, but this means we are refreshing the whole token. The whole point of the signature token is to be session long.

How can we refresh just the payload & header part of the token, without it affecting the signature?

The strategy I am using is based on this article:
https://medium.com/lightrail/getting-token-authentication-right-in-a-stateless-single-page-application-57d0c6474e3

What you are trying to accomplish does not work based on the JWT specification. Let's focus on the relevant part (taken from JWT.io), the scope of the signature:

  To create the signature part you have to take the encoded header, the
  encoded payload, a secret, the algorithm specified in the header, and
  sign that.

You sign the header and the payload. According to RFC 7519, the payload contains the "exp" claim, which defines the expiration time.

This means, if you want to refresh the token, you have to change the expiration time. This changes a value that is signed. Therefore, the signature must also change, otherwise it doesn't validate the rest of the token.

Long story short, you cannot change the expiration time without changing the signature

EDIT:
Based on the source of this method, one crucial information was missing in the original question.

My answer above is still correct, if you implement JWT expiration with the "exp" claim. The linked method sets the "exp" to a full day (see chapter "Other Important JWT Payload Content"), thereby avoiding an actual token timeout. When the token (containing header and payload) gets refreshed, they do not change the content at all, but they only change the expiration date of the cookie. That way, the token stays the same and the signature stays valid.

So your issue is setting the "exp" claim to 1 hour instead of 1 day as suggested in the article.


Multiple SSL connections in a single HTTPS web request I set up Apache2 with SSL and tried to request the default Apache2 web page ("It works!") using https://[IP_ADDRESS].

The Chrome developer tool shows that only one HTTP connection is established, however, from Wireshark's captured packets, there are three separate TCP streams.

The first two TCP stream finish the SSL routine, however without any application data exchanged. The last TCP stream has application data exchanged. Even more curiously, those TCP connections establish concurrently, not one by one.

The question is: Why are three separate SSL connections needed here?

When you connect to an HTTPS Web site which uses a "problematic certificate" (e.g. one which is not issued by a recognized CA, an expired certificate, or a certificate which does not contain the server name as it appears in the URL), the browser asks for confirmation from the user. This can happen only after the server certificate has been retrieved, as part of a SSL handshake. This accounts for at least one initial connection with handshake.

Keeping a SSL connection open uses up some resources on the server; so servers auto-close connections after some inactivity, and browsers try not to keep connections open for too long. Displaying the warning about the invalid certificate implies waiting for the human user to come to a decision (to click or not to click, that is the question). This will take some time; humans are slow. Therefore, the browser will first close its initial SSL connection, the one it used to obtain the server certificate -- not HTTP has occurred yet, though, only the SSL handshake. When the human user finally decides to connect despite the scary warning, the browser will open a new connection, with a new SSL handshake, and in that one there will be some HTTP (as "application data").

As for the other connection (the "initial connection" is actually two connections made in parallel): Chrome is known to open speculative connections so as to speed up subsequent requests; in general, a Web page includes images which will have to be downloaded promptly. Chrome appears to be overzealous at times. The plausible scenario is then:

Chrome opens two connections with SSL handshakes.
Chrome notices that the certificate is flaky, and requires human intervention. It closes the two connections without doing any HTTP within the SSL tunnels.
When the user decides to open the page, Chrome opens a third connection, does a SSL handshake, and this time follows on with the HTTP dialog.


Is the following protocol a good method for encrypting a non-OS hdd? I find the following somewhat confusing, but it doesn't have many steps. Is this a solid method for encrypting a hdd with LUKS?

Here’s the process in few steps:

  Create a LUKS partition

cryptsetup luksFormat --hash=sha512 --key-size=512 --cipher=aes-xts-plain64 --verify-passphrase /dev/sda

  Note that obviously you can use different settings for the luksFormat command; above it’s what i usually use. After that you will be asked to enter a password for the encryption, it doesn’t matter if it’s not very secure now, because we will only use this device as random data generator.
  Open the encrypted device: the command below opens the luks device and maps it as "sda_crypt"

cryptsetup luksOpen /dev/sda sda_crypt

  Now we fill this device with 0s using dd and /dev/zero as source:

dd if=/dev/zero of=/dev/mapper/sda_crypt bs=1M

  All the underlying disk appears now to be filled with random data, minus the LUKS header that we are about to override (you can take a look using hexdump /dev/sda | less command). Usually the header takes few Megabytes, but to avoid calculations and be rude we will cover the first 10 Megabytes of the disk. We will use dd with /dev/urandom as random data source this time:

# first destroy the mapping
cryptsetup luksClose sda_crypt

# override the header
dd if=/dev/urandom of=/dev/sda bs=512 count=20480

  We have now the disk full of random data. Now for the serious stuff. Just repeat steps 1 and 2 but this time use a very secure passhrase, because it will be the key to unlock your disk
  Now we will use the device as phisical volume…

pvcreate /dev/mapper/sda_crypt

  Now create a volume group (I will name it vg00 ) that will contain the phisical device /dev/mapper/sda_crypt

vgcreate vg00 /dev/mapper/sda_crypt

  Create the logical volumes. I usually use 4: one for root, one for the swap partition, one for /home and the other for a data partition, but this is obviously up to you. The “+100%FREE” options on the last line modifies the command to use logical extents instead of size, and to use all of the free remaining ones for that logical volume.

lvcreate -n lv00_swap -L 4G vg00
lvcreate -n lv01_root -L 30G vg00
lvcreate -n lv02_home -L 10G vg00
lvcreate -n lv03_data -l +100%FREE vg00

  Now create the boot partition on a separate device, ideally an usb stick, and install GRUB on the MBR of this device. With this setup we both will have no clear partitions on our encrypted disk, and no chance to boot the system without the external device, which adds an extra layer of security.

It looks quite good for encrypting a computer disk where you will install your OS. Some comments:

You are filling the disk with random data by creating a temporary luks device, that you then fill with zeros. I would have used shred -n 1 /dev/sda to do the same, replacing your first 5 steps. I suspect shred may be slightly faster, would need to benchmark to be sure. Anyway, your approach would work, too.
You claim that "there's no chance to boot the system without the external device". I disagree, it would be possible to create an equivalent external device that is able to boot your system, as long as that the password is known. If you really want to force that only that usb device can be used for booting, I would include a key file in the usb device that is decrypted with a user-defined passphrase, then used as a LUKS key-file. That would require cloning that specific device, not only discovering your luks passwrod.
Booting from a separate media is better in that you can use a trusted boot device. On the other hand, this requires that you allow booting from external devices, which would make it easier to tamper with your machine (your disk is encrypted, but still). As a way to improve this, you could use a TPM to verify that you are booting what you really wanted to boot.
Another option would be to use a hardware security key instead of or in addition to your boot usb.
You don't mention it, but in the end, you would install the OS in the given partitions by pointing the installer to them as usual, letting it format those LVM groups.

Finally a few of warnings for anyone which wants to follow this:

This procedure will obviously remove any data that was previously on the device.
/dev/sda is the main disk of the computer. Most likely it is NOT the device you want to encrypt. topencrypt wants to use that one but you probably not.
Given that the above procedure wipes the main disk, it should be performed booting from another one (usually a live CD/usb).
Using an encrypted disk increases the risk of something going wrong and losing access to the data, making backups even more important to have.

Creating a LUKS partition for a non-OS external disk

The OP later mentioned that he is not interested in having OS data there at all, but only wanted an external hard disk that he would boot into his linux os.

This changes the procedure quite a bit, it becomes much easier as we won't need swap, lvm volumes for root and home, etc. A big filesystem on an encrypted container should this more simplistic need.

Note that in this case it is completely unlikely that /dev/sda is the hdd you connected. I will refer to it as /dev/sdX. You can find out the name assigned using lsblk, checking dmesg output, etc.

Creating an encrypted disk could be as simple as:

shred -n 1 /dev/sdX # Fill the disk with random data. This will take a while and destroy everything that was stored there
cryptsetup luksFormat /dev/sdX # Create luks container
cryptsetup luksOpen /dev/sdX external_disk # Open encrypted drive
mkfs /dev/mapper/external_disk  # Format the external disk

That's it.

Close the mapping with cryptsetup luksCLose external_disk and disconnect. If you know connect it again to your computer, your distro will probably automatically ask you for the encryption key to mount it, or will show it as a locked device that will ask the password you attempt to open it.

Should you need to mount it manually, you may do:

cryptsetup luksOpen /dev/sdX external_disk
mount /dev/mapper/external_disk /mnt # Mount on /mnt

Remember that the disk will have been formatted with an ext filesystem, in order to be able to write to the drive with your user account, you should change the permissions so that your user is able to write on it, for example: chown topencrypt /media/topencrypt/external_disk
(it would be the same whether it's encrypted or not).


SMIME email decryption using a private key - what am I doing wrong? I have an encrypted .eml file and a private key. I've looked it up a lot on the internet but couldn't find a way to decrypt the email using OpenSSL. I've tried this command:
smime -decrypt -in encrypted.eml -inkey privatekey.key -out decrypted.eml
and each time I get this error:

OpenSSL> smime -decrypt -in encrypted.eml -inkey privatekey.key -out decrypted.eml
No recipient certificate or key specified
smime: Use -help for summary.

I have also tried converting the private key to a .pem file but it still displays the same message. both files are in the same folder as the openssl.exe application is, before that I couldn't get it to work at all.

I clearly am doing something wrong, what is it exactly?

Try using openssl cms instead of openssl smime.  See https://www.misterpki.com/openssl-cms/ for a good example.


IIS IP Address Restriction - can I rely on it online? I've been told that I might have more luck posting here than on Stack Exchange, so here goes:

I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login page or anything, it's meant for use in a VPN environment. I'm trying to put it online without a VPN and am thinking of ways to add some sort of security to it. I need to restrict it to certain networks, its a business product, so I can probably get away with saying that you need to be on a private network (ie not public wifi) to use it. My idea is to use IP Address Restriction in IIS, and write an app that the users install and have it update the server with their current IP every few minutes, the server then blocks all except the ones recently updated.

How secure would this be? Is there a major flaw in this idea? Or is there perhaps a better way to do this in IIS?

edit:
To clarify - the software is not modifiable by me. It consists of a few web applications in IIS, that are WCF web services. Then the client computer has a program which connects to those. I am not able to edit the client program or the server, I'm merely hoping to either allow or deny the connection by injecting some sort of security measures onto IIS, or perhaps intercept the packets in conjunction with my own custom software that could be installed on the client PC to do the authentication.

Really does depend on your threat model, how valuable is the information and functionality offered by the web service? What type of attackers and specific attacks are you worried about?

IP address restriction is the most basic form of protection and really does not give you any security. It is trivial to bypass via a proxy for example. Also if you whitelist a corporate public address, you have no idea what machines behind that NAT are connecting. So if it is a basically a public service or you are using IP address restriction as a defense in depth mechanism to authentication then that is fine otherwise you are getting no security benefit and may as well not do it (for the trade-off in additional management and troubleshooting). Getting users to install anything with the troubleshooting and support this involves is generally a very bad idea.

If it is a valuable web service the standard way to authenticate is:

Mutual authentication via certificates. http://msdn.microsoft.com/en-us/library/aa292114%28v=vs.71%29.aspx . This provides you strong authentication and no passwords to manage. A certificate cannot be brute-forced nor guessed and you provide assurance to the third parties that they are connecting to the genuine service. You can cut the certificate cost by using something like startssl.com but you do have to issue, support install, renew, revoke certificates
API key - the other most popular method is to provide an API key for each user of the web service. This is effectively a password and carries all the risks and benefits of a password. You need sufficient length, complexity, lockout/back-off to mitigate brute-force and guessing risks

I would be very careful about putting a web service designed for an internal corporate environment meant to be used over a VPN on the Internet. I would recommend getting it security tested from an application and infrastructure perspective before you do this. There is a high likelihood of cross site scripting, SQL injection and other common web application vulnerabilities especially if you are using REST web services.


Is it safe to use PBKDF2 for hashing? I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the White House Twitter page (in other words it will be public).

Would I be better off using a massive number of SHA-256 iterations (as a replacement for my 100,000 PBKDF2 iterations)? Are there any attacks that can reverse PBKD2?

This is the code I'm using:

        string salt = Utility.RandString(32);
        // convert to byte[] and store in both forms
        this.Salt = salt;
        this.BSalt = Utility.ToByteArray(salt);
        // generate the password hash
        Rfc2898DeriveBytes preHash = new Rfc2898DeriveBytes(this.Password,  this.BSalt, 100000);
        byte[] byteHash = preHash.GetBytes(32);
        this.Hash = Convert.ToBase64String(byteHash);

The short answer is that PBKDF2 is considered appropriate and secure for password hashing. It is not as good as could be wished for because it can be efficiently implemented with a GPU; see this answer for some discussion (and that one for more on the subject).

There are some arguable points, notably that PBKDF2 was designed to be a Key Derivation Function, which is not the same kind of animal as a hash function; but it turned out to be quite usable for password hashing as well, provided that you do not do anything stupid with it (meaning: be sure to keep at least 80 bits of output, and to use a high enough iteration count, ideally as high as you can tolerate on your hardware).

Don't try to make your own hash function; these things are surprisingly hard to get right, especially because it is nigh impossible to assess whether a given construction is secure or not. Use PBKDF2. If you really want SHA-256 (or SHA-512), then use PBKDF2 with SHA-256: PBKDF2 is a configurable construction, which is traditionally configured to use SHA-1, but works equally well with SHA-256 or SHA-512.


Honeywell WiFi thermostat security I recently purchased a Honeywell thermostat with a WiFi connection, and I haven't been able to get it connected to my network yet. According to a representative, the network name and password are required to be 13 or fewer alphanumeric characters. Before I go about changing all the passwords on the machines, I want to know:

1) Is this a common restriction for small hardware pieces like this? The rep sounded pretty confident in her information.

2) Will my home network be sufficiently secure under these restrictions?

A password of 13 alphanumeric characters CAN be robust enough to ensure security. There are 6213 such passwords, a number which is close to 277. If you choose such a password with full uniformity (i.e. you generate all 13 characters independently from each other, using a strong random source, i.e. /dev/urandom or some dice but not any biological brain), then you have 77 bits of entropy, and brute-forcing that is on the verge of the possible. That is, it could be done, but it would be expensive (cost in dollars would rise to the billions, not mere millions). In that sense, setting a 13-character password for your home WiFi should not impact your security too much, if you do it properly.

However...

A limitation to 13 characters screams of WEP. WPA and WPA2 can use any password length between 8 and 63 characters; a password length limited to 13 (a weird value in the absolute; developers prefer powers of 2) probably means that the thermostat will want to connect to your WiFi with WEP.

And that is bad news. WEP has a very poor design and can be easily broken through with software which is readily available for free, regardless of how random the password is. It is probable that even with the 13-character password, the thermostat won't connect until you configure your router to allow WEP, and that would punch a hole in your security. A big hole. Rather a four-lane tunnel, really.

It is relatively easy to check, though. Set a 13-character password but without enabling WEP, and see if the thermostat can work with that. But if you value your network security, do not enable WEP. Never.

(If you really must make this thermostat work and if that cannot be done without WEP, then you might consider buying an extra WiFi router, for the benefit of the thermostat alone. Then link that extra router to your network with a firewall in-between, blocking everything except that which is strictly necessary for the thermostat to do its work.)


Verification After Data Wipe A lot of data wipe algorithms have the final wiping pass with random characters. They discuss about verification after the wipe. An example of this is from this link:

https://www.datanumen.com/blogs/8-effective-algorithms-wipe-erase-data-permanently/

That brings up this question:

When you view the dump in the first few sectors, you see a lot of non-sensical characters but how do you know that it's truly random or may contain potential information? How does the verification process work? I don't see how you can verify when every byte is random, it has to be a consistent pattern where you can establish verification, right?

There's no reason that random data needs to be non-deterministic. You could easily use a stream cipher keyed with a random key and overwrite the block device with the keystream it outputs. It would then be trivial to verify that it was all written correctly by comparing the contents of the drive with the keystream generated by the cipher. Without access to the key (which vanishes when the program closes), it would not be possible to distinguish the drive contents from truly random data.


How is this website redirect working? Someone sent me a URL via WhatsApp (httpx://cadburys-prizes[.]com) that allegedly lets me claim a free box of chocolates. Obviously this is fake and I've seen similar websites before.

If I view the URL on my phone I end up at httpx://cadburys-prizes[dot]com/#forward where I'm prompted to answer some questions and then spam my WA contacts with further messages.

Viewing the source code for the page (by wget'ting it) , I can see a redirect to a bit.ly address. When I open the cadburys-prizes[.]com url on a (sanitized, virtual) desktop browser I get redirected to the bit.ly address which, judging from the URL, is a fake tech support site (the content is getting blocked by my network defences but I can imagine the scene).

What I don't understand is where the survey that shows on iPhone comes from? There is nothing I can see in the source of that page. Is it possible for an invisible proxy to be presenting a different index.html based on the user agent string? I did try to wget the page with mobile Safari UA but got the same result as without it.

There are various ways to fingerprint a client you're using. User-agent string is only a famous one. If you view the source code for cadburys-prizes[.]com, it uses meta refresh to redirect to httpx://bit[.]ly/2K1V332 after 2 seconds. It's possible that cadubrys-prizes may serve different content without using bit.ly. The bit.ly URL redirects to httpx://cash[.]trxmonetizer[.]com which seems to be doing the main job i.e. fingerprinting the client and presenting with whatever they feel like.

If it's doing everything on client, you can imitate any User-agent and inspect the response to dig deeper. However, it's also possible to do it on server-side for which they may or may not pass fingerprinting parameters in the request.


Is it Safe to Copy a Private Key Using SCP? Is it safe to copy a private key from one computer to another over SCP? Does this depend on whether you use the same key to authenticate the transfer?

SCP uses SSH for transport, and that's considered to be a robust protocol, about as safe as you can get. It does not matter whether the data which is encrypted is itself a copy of a private key involved in the establishment of the SSH tunnel; it would be a terrible weakness of the protocol if it did matter (and, in the case of SSH, the "keys" as seen by users are used only for signatures, at the start of the connection, but are unrelated to the symmetric keys used for actual data encryption).

However, using SCP to transfer a piece of secret data (e.g. a key) means that the secret data exists as a file on the source computer, and will be written as another file on the destination computer. Files leave traces on a physical medium (that's the point), so the secrecy of that transferred key is subordinate to your management of the two involved hard disks (on source and destination) throughout their life cycle. Don't simply discard old disks ! Have them shredded into small pieces if you cannot ensure their logical devastation when they reach their end of life (for instance, if a disk fails, then you cannot wipe out the contents by overwriting the whole disk area with zeros).

One may also state that the more a private key is copied, the less "private" it becomes.


For use with RC4 how do I combine a reused key and an initialization vector I am an a-level student writing an encryption program using an rc4 implementation I have written myself. I have the basic algorithm coded correctly (and I have checked that some ciphertext for a given key and plaintext matched another online rc4 implementation by a credible source). I have added a drop(n) method that discards n bytes of the keystream (768 by default).

I am aware of rc4's vulnerabilities and understand that it is a lot more effort to patch these flaws than to use a different method of encryption. But in the quest for understanding over security, how would I combine a reused key and a unique initialization vector in a secure way? How would I store the initialization vector for use when decrypting. Finally how strong is a key that is a created by the user?

how would I combine a reused key and a unique initialization vector in a secure way?

The standard method of combining the key and IV in RC4 to avoid vulnerabilities is to concatenate them and pass them through a cryptographic hash, and use that hash's digest as your RC4 key. This defeats the severe related key attacks that can allow recovery of the key by destroying the exploitable relations.

  How would I store the initialization vector for use when decrypting.

This entirely depends on the protocol. The IV can be either stored, or derived deterministically in a way that is guaranteed to be unique (such as from a session ID, packet number, or monotonic counter).

  Finally how strong is a key that is a created by the user?

If the key is composed of at least 16 completely random bytes, then it should be sufficiently secure that brute force attacks will not be an issue. Note that RC4 is still not a great cipher even if the key is very strong. Even when dropping the early keystream, there are still long-lived biases that can be exploited


PHP command injection create_function eval I was reading about the create_function, that will be DEPRECATED on PHP 7.2, that is prone to php command injection. I started to play with it and created an example.

The code below should return the lowercase version of each string in the array.

My question is, Why using 'array_walk_recursive' function seems to fix the code injection in this case?

Legit use of the function

<?
$arr = ['HELLO'];

array_walk_recursive(
    $arr,
    create_function('&$value, $key', '$value = strtolower($value);')
);
print_r($arr);
?>

Array
(
    [0] => hello
)

Trying to Inject command but the PHP code is not evaluated. A string is returned

<?
$arr = ['PHPINFO();'];
array_walk_recursive(
    $arr,
    create_function('&$value, $key', '$value = strtolower($value);')
);
print_r($arr);
?>

Array (
    [0] => phpinfo();
)

Trying to put the phpinfo() inside create_function

(Note that phpinfo ran. The warning is from a php sandbox)

<?
$arr = ['anything'];
array_walk_recursive(
    $arr,
    create_function(
        '&$value, $key',
        'phpinfo(); $value = strtolower($value);'
    )
);
print_r($arr);
?>
*Warning:  phpinfo() has been disabled for security reasons in [...][...](32) : runtime-created function on line 1

Array
(
    [0] => anything
)*

Why using 'array_walk_recursive' function seems to fix the code injection in this case?

It's not array_walk_recursive that is fixing the issue. The problem is that there is no issue in the first place.

You can't use the create_function functions arguments for code injection, as those are treated as variable strings, and can't be used to break out of the current context.

The injected parameter would need to come from outside. For example:

<?php
$arr = ['a' => 'b', 'c' => 'D'];
$func = $_GET['x']; /// eg x=strtolower
array_walk_recursive(
    $arr,
    create_function('&$value, $key', '$value = ' . $func . '($value);')
);
print_r($arr);
?>

Now you could gain code execution:

x=strtolower($value);phpinfo();

Detailed explanation

<?php // I would suggest to copy-paste the below code to somewhere that supports syntax-highlighting, it helps in understanding the issue
$arr = ['a' => 'b', 'c' => 'D'];
$func = $_GET['x']; /// eg x=strtolower
array_walk_recursive( // apply the function created below to all array elements
    $arr,
    create_function(                      // creating a new function
        '&$value, $key',                  // arguments for the function
        '$value = ' . $func . '($value);' // the function itself.
            // function uses $func from outside this string context (this is the essential part).
            // $value is the value from the previous parameter. It is just a string here.
    )
);
print_r($arr);
?>

When this is called with x=strtolower($value);phpinfo();, the function that create_function creates from the given string is basically:

function (&$value, $key) {
    $value = strtolower($value);phpinfo();
}

And then this function is called for each array entry. We can see how this will lead to code execution.

If we compare that to the code from the OP, the function that is created would be:

function (&$value, $key) {
    $value = strtolower($value);
}

There is no code execution in this function, as no value from outside was used in the string that created the function.


When, exactly, should old password reset tokens be deleted? I'm trying to figure out best practices for working with password reset tokens.

Say a user initiates the password reset process and the are emailed the reset token and we store a hashed copy in the database. The token is time stamped in our DB and will be considered expired in, say, 24 hours.

Now consider two scenarios for what could happen next:

1) The user thinks he didn't get the email, tries to reset again. Should we allow him to generate another token? If we do, should we delete the old token immediately? (They all will be invalid from 24 hours after the issue datetime anyway...) I think it would minimize support calls if we allow a little flexibility as long as they're expiring anyway. Is there an attack type I'm not considering here?

2) The user received the email and clicks the reset link but doesn't complete the reset form. When should I delete the reset token? Only after a successful reset--the user can click the link again and again during the 24 hours and it only becomes invalid once he finally resets the password. Or should I delete the token as soon as he clicks the link for some security concern? (all of this occurs before expiration)

You should not reset the token when the user clicks on it, because the user might be disturbed in the process (e.g. his cat jumped on the keyboard -- mine does that on an all-too-regular basis).

(Two days ago I was using such a link -- not for password reset, but similar -- which was deactivated as soon as I clicked on it, and it turned out that the page behind it was not compatible with Chrome. So I had to request a new link, doing the whole process one more time, and I cursed them for that. When dealing with passwords, you want and need to make a cooperative ally of the user, and certainly not to make him angry.)

When the password is actually reset, all pending password reset links should be deactivated. It is simpler if you allow only one reset link at a time; if the user requests a password reset while the previous link is still valid, just send it again (possibly, reset the timeout counter). There is no need for supporting several simultaneously valid, distinct password reset links. One link at a time means an easier database design, and thus less scope for bugs.


Host Header Attack -> Password Reset Poisoning -> ASP.NET Web API 2 hosted as Azure App Services I'm currently testing a site where the host header is used for creating a recovery email link. However, when I try to manipulate the host header in Burp I get an HTTP 400 message saying I'm using an invalid hostname. I get this error even if I only try to tamper the host header for GET / or any other request.

My initial thought was that due to it being an App Service on Azure the host was not found and had no binding on the server and therefore it did not work. However, on the same App Service server, there is another application hosted that I was allowed to test against. When I added a host header that I know exists on that server I still get same HTTP 400 error.

What is Microsoft doing to prevent this?

Ping checking that the domains are on the same server:

Example request, edited host and target but both domains are on the same server.

Message is always the same:

HTTP/1.1 400 Bad Request
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 06 Oct 2017 07:28:25 GMT
Connection: close
Content-Length: 334

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii">

Bad Request - Invalid Hostname

HTTP Error 400. The request hostname is invalid.

I can add an X-Forwarded-Host: mydomain.com to the request and it will go through but not pick up the header as host.

https://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/

Gonna give it a shot and answer this myself. The code responsible for sending out the email looks like this:

await emailRepository.SendResetPasswordTokenAsync(Url.Action("ResetPassword", "Authentication", new { token.Token }, Request.Url.Scheme), model.Email, token.User.FullName);

The vulnerable part is this bit:

Url.Action("ResetPassword", "Authentication", new { token.Token }, Request.Url.Scheme)

I created an application on my machine and tried creating URLs with IIS Express and changed host and got the exact same error. I think this error occurs because there is no default binding and because the request is issued using HTTPS. If I change the request to use standard HTTP the host header is interpreted and in the request below I end up on domain2.

However I also tried it using my local IIS with binding to catch all on port 80. Using the same code as the vulnerable application I was able to manipulate the host:

Code:

public ActionResult Index()
{
    var host = Request.Headers["host"];

    ViewBag.Title = $"Host: {host} Url Created: {Url.Action("Index", "Home", "", Request.Url.Scheme)}";

    return View();
}


How do I automatically add a user login token to my csrf page? I'm testing my own system, and I was wondering if the csrf login token I created there could be obtained from the user session.

For example;

<input type="hidden" name="login&#95;token" value="token area" />

Can the "token area" value be filled automatically if the user is logged in?

I did not get a positive result when I entered "cookie" at value area.

<input type="hidden" name="login&#95;token" value="cookie" />

Can this information be automatically withdrawn from the system because the user is logged on? Is it possible to automatically fill this field(token area) according to the user session?

I would recommend to write a random generated csrf token into the session of the user during the login. So on a login other session variables like the username or login strings are set. At this position set a csrf token which is generated with bin2hex(random_bytes(128)).

On all pages with form fields use a hidden input field and echo the session variable. This could look like that:

<input type="hidden" name="csrftoken" value="<?php echo $_SESSION['csrftoken']; ?>" />

On validation check the submited csrf token with the session variable of the user.


How does "Let's Encrypt" provide authenticity? https://en.wikipedia.org/wiki/Let's_Encrypt

https://en.wikipedia.org/wiki/Information_security#Authenticity

AFAIK with "Let's Encrypt", we could create HTTPS websites with only one command.

Question: But what provides authenticity, if anybody could create a valid HTTPS cert to any domain? How does Let's Encrypt ensure that I am the domain owner, and not an attacker that wants to MITM the domain?

If you follow the links from the first Wikipedia link you provided, you'll find the spec for the ACME protocol that Let's Encrypt will use. And what it says is:

  Because there are many different ways to validate possession of
  different types of identifiers, the server will choose from an
  extensible set of challenges that are appropriate for the identifier
  being claimed. For example, if the client requests a domain name, the
  server might challenge the client to provision a record in the DNS
  under that name, or to provision a file on a web server reference by
  an A or AAAA record under that name.


Why a physical signature is even listing any security at all? I'm from germany where I have to "access" my money mostly by using a pin. (except for a credit card where I just had to put in the card at all (no signature was requested nor a PIN)

But this post: https://money.stackexchange.com/q/60824/32249

made me wonder why the banks prefer provide the service of using signature over PIN?

I never really was seeing the signature as an protection at all, more so as an confirmation of a transaction.

And I don't really get, how they can rely on this.
When I steal a card in the USA how would the signature step prevent me from making fraud of it?

What am I not seeing here?

I'm from germany where I have to "access" my money mostly by using a pin.

In germany both PIN and signature are heavily used if you use your card for paying. The reason is cost vs. risk: To get a signature is both faster and I think also cheaper for the vendor but the risk of cheating is higher. With PIN the risk is reduced but the costs are higher. Thus PIN is commonly required in high risk or high price environments where cheating causes more harm (like buying a computer or TV) while in lower risk or lower value environments (food store) a signature is often enough.


Can an infected machine have any security? Assuming that an attacker can view — but not change — the memory on your machine, can any amount of security be guaranteed?

Also, can privacy be guaranteed for messages in this scenario?

Let's consider the main tenets of security.

Confidentiality - Data cannot be read by anyone other than the intended recipient.
Integrity - Protection from unauthorized modification
Availability - Self explanatory, the capability to make data available
Non-repudiation - the quality which ensures that an    action cannot be denied.
Authentication - The quality that validates files, uers etc are authentic.

In the above five, only confidentiality is affected by an attacker with read only access. So the short answer is, yes, there is some amount of security left.

Privacy cannot be guaranteed as all the factors ensuring confidentiality is readily available for the attacker.


Difference between hardening guides (CIS, NSA, DISA) I'm researching OS hardening and it seems there are a variety of recommended configuration guides.  I realize the different configuration providers supply different offerings per Operating System, but let's assume (for convenience) we're talking about Linux.  Consider the following :

CIS Benchmarks
NSA Security Configuration Guides
DISA STIGs

Is there any obvious differences between these that might compel someone to choose one over the others?

Update: 2014-11-19

Some additional context, per answer submissions that asked for additional detail:

I don't have a requirement to harden against a given benchmark or guideline, I'm simply trying to understand the current best practices used in industry & government.  However, I do plan to turn my findings into a research paper for class.
I will not be audited, except by those that read my paper.
My professor and a couple of students may be familiar with the auditing process, but I hope to make my paper approachable for everyone.  I'd like to write about how to use a tool to automatically scan a system per some guidelines or vulnerability database.  I'm fairly new to this area, but I'm researching OpenSCAP and OpenVAS.  OpenSCAP seems more approachable than OpenVAS, and appears to be written to test against NIST standards.  I'm not sure which NIST are tested by OpenSCAP, but I'll add NIST the NIST guidelines to my list of guides to consider.
Tate Hansen suggested using Nessus for scanning, however I'd like to stick strictly to Open Source applications to suite my needs for this research.
A sub-question, it looks like the NIST standards guide for hardening is SP 800-123 and SCAP is simply a format (XML?) for tools to perform and communicate analysis of a system.  Is that correct?

In general, DISA STIGs are more stringent than CIS Benchmarks. Keep in mind that with STIGs, what exact configurations are required depends on the classification of the system based on Mission Assurance Category (I-III) and Confidentiality Level (Public-Classified), giving you nine different possible combinations of configuration requirements. CIS usually have a level one and two categories.

OpenVAS will probably suit your needs for baseline/benchmark assessment. Nessus will also work and is free for non-commercial use up to sixteen IP addresses.
For commercial use, it's still quite affordable.

I have yet to find a comprehensive cross-walk for these different standards.
The best attempt I have seen thus far is here (a Web Archive copy): http://www.dir.texas.gov/sitecollectiondocuments/security/texas%20cybersecurity%20framework/dir_control_crosswalk.xls. This spreadsheet, however, is a controls comparison, not baseline/benchmarks that I think you are really interested in.

Regarding NIST requirements, yes 800-123 is the baseline document that requires systems to implement the controls found in 800-53A. These requirements differ from benchmarks in that NIST requirements tell you a control that must be implemented, but not exactly how it must be implemented. The Benchmarks are usually very specific in that you must set setting X to value Y.

Hope this helps.


How can I demonstrate SSL/TLS to 10 year olds? I'm a software engineer with a particular skew on information security and DRM; I have a good understanding of the implementation (and some of the maths).

My son's school are doing about information security and staying safe online at the moment. One of the topics they will cover is http vs. https and his teacher has asked if I can come in and help facilitate. I'd like to find a really simple way of demonstrating key-pair encryption using something like a tin can telephone to demonstrate how easy it is for Eve to listen in on Bob and Alice by just attaching a third tin can to the string, followed by a (very rudimentary) tls handshake over tin can telephone to then send an encrypted message. Ideally they'd encrypt the message in a suitably lo-fi way (pen and paper, calculator).

How might I go about it?

A lesson or activity on the topic 'HTTP vs HTTPS" for 10 years old is not a lesson about cryptography. It's about privacy and staying "safe" on the web.

The EFF has a good educational material about HTTPS and Tor that you can use as inspiration (Tor is out of scope, but the part about HTTPS is relevant). The point is to explain the threats and how using HTTPS mitigates them.

As a demo, you can set up a wifi network and a laptop with Firesheep or another tool that visually displays HTTP interceptions:

You can ask the kids to use their smartphones to browse websites in HTTP and compare with websites in HTTPS.

If you want to go into the details, you can tell that TLS guaranties the confidentiality, authenticity and integrity of the data coming from and to the websites. Explain those 3 words.

If you start talking about encryption keys or maths, you are going to far. But you may try to convince the teachers to do a second talk about the history of cryptography and cryptanalysis (it's usually a good way to introduce the topic).


Claims based vs Permission based authorization So I understand roles vs permissions.  I also understand roles vs claims.  In both cases claims and permissions are granular, usually per feature or business operation such as AddPerson permission.  I've been learning about claims based authorization and the examples that show how it's "better" and it's usually comparing it against role based authorization.  Obviously it is better because that's the wrong way to use roles as you should be using permissions as a mapping between operations and roles.

What is the distinction between claims based and permission based authorization?  (note permissions are different from roles, so this is not a duplicate of the Role vs Claim question)

In both it seems you have granular permissions/claims.  So far the concrete examples I've seen of claims are really close to what I would conceptualize as permissions.  An example I see with claims is the Add/Person claim, and certainly I would have similar with a permission as a AddPerson permission.  I find usually I have a business layer with single entry points for things like this and every feature/entry point requires a permission.  In both cases the rational for permissions/claims is that over time a particular identity or role might change in terms of what things it is allowed to do.  And if you've hardcoded checks for that role within your application, you have to make code changes to accommodate, but if you've used claims/permissions then it is simply an administrative matter of changing what the role is associated with.  So both seem to carry the same benefits.

I ask this question not to sound like I'm challenging the idea of claims.  Instead I know I will probably have a better concept of claims if I understood more clearly what makes them stand apart from permissions.

A claim is somewhat more arbitrary than a permission. A claim is 'blue eyes' whereas 'AddPerson' is a permission. It is an assertion from the identity provider that a given characteristic (or more accurately, an attribute) about the identity is true.

You can determine permission based on claim or characteristic because 'all blue-eyed individuals can do xyz' whereas a permission is explicitly calling out what you can and cannot do. With a permission you cannot (easily) determine a characteristic by, say, 'anyone who can do xyz has blue eyes'.

With that being said, a permission is a claim. It just happens that the identity provider is asserting the identity has the characteristic of having permission to do whatever.

In short: a claim is an arbitrary attribute about the identity, whereas a permission is an asserted right to do something.


Does my vpn subscription get compromised if I get hacked? I am thinking about subscribing to a vpn service and I want to know that if my computer gets hacked and the hacker sees my vpn subscription details, could he use them later?

If I do a fresh os install and change vpn password will everything be ok?

For example with an email if someone finds your password all you have to do is change it.

Or if I am using vpn on two devices and one gets compromised, can I still use the  vpn on the other device safely? Can the person with access to the compromised device find the ip the vpn has given my other device?

If the hacker sees your VPN subscription details (username and password) he might have all the information you have. Unless access to the VPN is protected by an additional factor the hacker does not have or know, the hacker can then use you VPN credentials too.

Such additional factors might by physical or software based multi-factor authentication. It might also be that you get an email (where the attacker has no access to) if a new device was added and that you explicitly need to enable the device. If a VPN provider offers or requires the use of additional factors though is specific for the VPN provider.

  Can the person with access to the compromised device find the ip the vpn has given my other device?

It might be that the VPN provider offers such details for anybody who knows the correct credentials. If this is the case again depends on the specific VPN provider.

  If I do a fresh os install and change vpn password will everything be ok?

A fresh OS install will likely get rid of the attacker from your specific system. It will not make it impossible for the attacker to use the already stolen credentials though. A password change might be sufficient but it might be that the attacker has added himself as recovery contact to the account. Or the attacker was the one who changed the password first and also the contact email and locked you out this way from your own account.


blacklisted URLs: what to trust? This website blacklists URLs: http://hosts-file.net/?s=54.244&view=history&direct=1 Its last database update has been today. When I check the last 5 URLs it published Firefox tells me they are unsafe. But When I check those URLs on http://wepawet.cs.ucsb.edu/ it says they are benign. And when I run those URLs on my computer (i take a risk) by unchecking the boxes of Firefox that prevent from blacklisted websites nothing happens: which result to trust ?

@trustme lpmxp625.com is a malware link so lets first start by finding out how i came to that conclusion.

If we do a Google search for that link* (The star indicates a link listed below) we find the first 100 results coming back as people asking how to remove lpmxp625 from their PCs which brings up red flags in my mind. Now we go to VirusTotal.com lets run a scan on the link**. After scanning the link 4 out of 50 antivirus engines comes back as saying its malicious with BitDefender leading the way. BitDefender has 98% detection from most tests***. We will continue on doing more tests with Sucuri which is a website scanner but it comes back with even more bad news for that domain****. We can scan with more scanners and tools but they all come back with bad news.

I personally use hosts-file.net for blocking malware/ad blocking i find it to be highly reliable for blocking malware and ads. I also use other lists as well. Most of these list are composed by volunteers who actively try to find malware so that other users don't get infected.

https://encrypted.google.com/search?num=100&site=&source=hp&q=lpmxp625.com&oq=lpmxp625.com&gs_l=hp.3...2108.12684.0.13417.6.6.0.0.0.0.121.396.5j1.6.0....0...1c.1j2.51.hp..6.0.0.0.G1fjtGRXyNg

https://www.virustotal.com/en/url/a8c9a4ae305969b7305b85d378eaf45dc147d9b43a12e88c5fe76d2b7cf56d76/analysis/

https://encrypted.google.com/search?num=100&q=bitdefender+wins&oq=bitdefender+wins&gs_l=serp.3...19756.34772.0.35011.14.10.4.0.0.0.73.642.10.10.0....0...1c.1.51.serp..1.13.603.1zCnWd1mqWA

http://sitecheck.sucuri.net/results/lpmxp625.com

Hope that helps.


What IMEI(s) does an ISP get in case I use a mobile hotspot to connect my laptop to the web? I found out today that ISPs get the IMEI code of any device connected to
them.

See a (very old) reference here: http://news.bbc.co.uk/2/hi/technology/4738219.stm

I was hence wondering: in case I connect to the web through a mobile
hotspot with a prepay SIM card, which IMEI(s) does the ISP gets?

Say the setup is: Laptop - mobile phone - internet

Does the ISP get only the mobile phone IMEI, the laptop IMEI or both?

The phone company will receive the IMEI of the mobile phone, which is the device connecting to them. You might have one, zero or dozens of laptops behind that phone. Not to mention, laptops don't have IMEI codes (the equivalent would be the MAC of the Wifi card)


Is it safe to run online, multi-person game as administrator on Windows 10? The newly released computer game Genshin Impact must be run as administrator on Windows 10. Millions of people have downloaded this game. It runs on multiple platforms, however I assume that a signification proportion of the downloads are being run on Windows 10 as administrator. There is almost no reference to the requirement to run as administrator on the Genshin Impact web site or other discussion boards. I therefore conclude that very few people care about the requirement to run as administrator. I therefore ask, what are the real risks of running an online, multi-person game as administrator on Windows 10?
Update
There are a couple of good answers here already. They describe why what could happen if you run as administrator. They don’t address probably of such bad things happening. Since millions of people are doing this I’m interested to know if the risks are something which should prevent people from doing this or are just the possibly but unlikely.

From the perspective of IT security there is no "being safe" or "being secure" 1.  There is only being more or less secure and the idea of being sufficiently secure by having most relevant risks mitigated. Deciding if a specific software is sufficiently secure would require a deep evaluation not only of the specific software but also of the environment where the software is run in, i.e. what impact problems can have. Such a deep evaluation is out of the scope of this site.
But what can be said is that running a software as administrator provides additional and powerful attack vectors compared to running as an unprivileged user. The impact of these new attack vectors can be small and the risks acceptable if the system does not contain any sensitive data and is not used for sensitive activity like online banking. Given the right environment it can be very dangerous though, for example when being inside the network of a nuclear power station.
It can also be said that already running a potential malicious or buggy software as a non-privileged user poses considerable risks. Many malicious actions like extorting the user by encrypted the users files (ransomware), spying on the user or impersonating the user do not actually require administrative privileges in the first place.

1 In the context of IT security the term security is typically used to describe harm against IT systems, compromise of information etc. Safety instead is used to describe more direct harm against humans, like when hacking a car and disabling the brakes.


What is the meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC from ETSI TS 102 231 V3.1.2 From Technical Spec

http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC
a Root Certification Authority from which a certification path can be
established down to a Certification Authority issuing Qualified
Certificates. Only to be used as an extension, if the servicetype is
http://uri.etsi.org/TrstSvc/Svctype/CA/QC

But what is the purpose of having this URI associated to a TSPService with ServiceTypeIdentifier http://uri.etsi.org/TrstSvc/Svctype/CA/QC?
Does it mean that if I have a prospective certificate path like this one:
 - A (root ca)
   - B (intermediate)
     - C (end user)

Where A is the only one registered in the TSL as a TSPService without the http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC URI associated, I can't construct a valid certification path for B and C?

I just found the answer from COMMISSION DECISION 2009/767/EC

The meaning of http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC additionalServiceInformation extension is stated directly in that document.

  As a general default principle, for a listed CSP in the Trusted List
  there must be one service entry per single X.509v3 certificate for a
  CA/QC type certification service, i.e. a Certification Authority
  (directly) issuing QCs. In some carefully envisaged circumstances and
  carefully managed conditions, a Member State Supervisory
  Body/Accreditation Body may decide to use the X.509v3 certificate of a
  Root or Upper level CA (i.e. a Certification Authority not directly
  issuing end-entity QCs but certifying a hierarchy of CAs down to CAs
  issuing QCs to end-entities) as the Sdi of a single entry in the list
  of services from a listed CSP. The consequences (advantages and
  disadvantages) of using such X.509v3 Root CA or Upper CA as Sdi values
  of TL services entries must be carefully considered and endorsed by
  Member States. Moreover, when using this authorized exception to the
  default principle, Member State must provide the necessary
  documentation to facilitate certification path building and
  verification.

So the meaning and purpose of that extension is to clearly indicate (As a warning?) that the way the X.509v3 certificate is being associated to the TSP service is not under the default principle of including the direct CA for end user accredited Qualified certificates.

This would mean that in the original example without including the http://uri.etsi.org/TrstSvc/eSigDir-1999-93-EC-TrustedList/SvcInfoExt/RootCA-QC additionalServiceInformation in the TSP, constructing a certification path including B and C certificates wouldn't be appropiately supported by that TSL.


What kind of local information are desktop applications capable to retrieve (and use) from my computer? I've already seen on Windows what kind of information the Steam application is sending online: time, place and device of the connection, time passed playing the games, payments, mail, numbers, etc. All this data looks related to the use of that precise application.

However, what is preventing any desktop app from sending any arbitrary file stored in my computer to an online server? From my newbie point of view, once you installed an application, there could be a script which just reads all my files and sends them to the servers.

What prevents my apps from reading all the logs locally stored in my PC?

Any application inherits the permissions of the user who runs it or gets the permissions assigned to it. So, if you install it as a user who has access to your files or the logs, then it has that access.

That's why you need to segregate your data and permissions. Windows system logs are usually only readable by a user with admin rights. And this is why granting a user local admin rights is such a bad idea.


Precedent for an in-house cardholder information server? My organization is undertaking a project to attempt to reduce the amount of our infrastructure covered under PCI scope.  Specifically, we're looking to exclude our web merchandising software from PCI scope.

Of course, to make that happen, we'll have to ensure that the application servers never get cardholder information and that the application servers never "connect to" anything in the CDE.

We've talked to our QSA about it and he's mentioned that a lot of organizations do just that.  But dispite much Googling, I can find little further evidence of this, let alone anything about best practices when undertaking such a project.

Is this (even remotely) a suitable way to go about approaching the problem?  What should I know when going into a project like this?  And, who else has written on the topic and what would I Google for to find more information?

Thanks in advance.

I don't have any specific resources to point to because, for better or worse, the PCI council typically defers to QSAs rather than attempting to cover each scenario that an organization my encounter.

Your QSA is responsible for determining exactly what you need to do in order to properly segment you other applications that you wish to keep out of scope. The segmentation usually requires placing system on different subnets with a firewall in between. The extent to which the data flows between the subnets needs to be restricted between the two networks is a good discussion to have with your QSA.

As a QSA, I don't agree with your statement that your application servers "can't connect to anything in the CDE". My interpretation is that traffic should be severely limited and have a strong business need. The DSS uses a flat network as an example of no segmentation--where there there is no access control between two networks whatsoever. On the other hand, it uses the example of "routers with strong access control lists" as an example of network segmentation.

While inbound traffic will most likely require some input from you QSA, outbound traffic is a little more flexible. If you can structure your network such that connections are initiated from inside of the CDE and out through the firewall, you will have much better security in place and a much easier time justifying the traffic.

Just my thoughts.


Are email systems like Countermail safe? I am aware of some of the main competitors in this space, including: Lavabit, Countermail, Fastmail, Proton.  But, I don't have enough knowledge to differentiate them.  Along the same line, I don't think I truly understand what Lavabit does.  It seems like it is more of a sophisticated third party encryption system than a true user friendly email system.

Although I am somewhat concerned about privacy, my main concern is security.  I don't want to be tracked by google ad text as I am when I use my current gmail.  And, I feel like that renders me vulnerable not only to ads, pop ups, videos but also outright spamware, bugs, etc.  I recently suffered a related attack.  And, I want to reduce my risk along those lines.

Although I am somewhat concerned about privacy, my main concern is security. I don't want to be tracked by google ad text as I am when I use my current gmail. And, I feel like that renders me vulnerable not only to ads, pop ups, videos but also outright spamware, bugs, etc. I recently suffered a related attack. And, I want to reduce my risk along those lines.

Use gmail. If the ads are unacceptable, use an ad-blocker, or a imap client such as Thunderbird.

When it comes to security, few can beat google. They have huge resources, and they can infer connections between happenings tat someone with a smaller service can't. They offer the advanced protection programme, which makes phishing attacks next to impossible, and standard password recovery attacks very much more difficult.

They monitor your habits, and blocks logins from unknown location. They alert you on the phone if they see a new login. And so on and so on.

From a security perspective, this is good. It makes it hard for an attacker to gain access, even more so without your knowledge.

So my suggestion? Stay with gmail if security is your focus. Consider using a mail client such as Thunderbird if the ads in the interface bugs you. If you want encryption, there's many possibilities, including browser extensions if you prefer to use the web-mail interface.

Regarding popups, I have never seen an popup in gmail that was unsolicited. I've never seen spamware or videoes either. I've found bugs, but all software has bugs. And google tends to be pretty good at patching bugs, especially if they affect security.


Can I develop SSH-based tools within United States? It is well known that development of open-source cryptographic tools is very problematic within the United States:  all open-source ssh-based software was specifically developed outside of the US of A due to the USA export restrictions.

http://www.employees.org/~satch/ssh/faq/ssh-faq-1.html#ss1.10.2

Whilst located in the United States, what if I wanted to re-use some MIT-licensed ssh code, like from OpenSSH, Dropbear or PuTTY, and write some functionality on top of it, and publish results as open-source under a similar licence as that under which I've acquired the original code?

I am not a math person, so my ssh contributions will most likely consist of deep-level-integration parts only: for example, creating various kinds of ssh-based file transfer clients.

Am I opening the door for being potentially prosecuted in a criminal case for US export violations?

Most strong-crypto export restrictions have been lifted, but not all. You can't sell to "rogue states" or terrorist organizations for example.

Wikipedia: Export of cryptography in the United States

As always, though, consult a lawyer, not the Internet, with respect to legal advice.


Activating a user on a website -- why include anything other than an activation code? Quite often in order to active my account on a website I'll receive an email with this:

https://web_site.com/access?uid=1234&secret=456789&login=0123456789&mid=aabbcccdd

Why user id, login, mid or other addition parameters? Why not only a secret activation code?

for example, stackoverflow:

https://stackoverflow.com/users/signup-finish?email=my_email.com&name=my_name123&token=fdsafdsfdsfds&authCode=fdsafdsfdsfds

Seems to be a poor practice. All they need is a unique activation code that maps to your new account.

Some of them (e.g. secret=) can be treated as ephemeral and hence don't increase the risk by much, but in general limiting the exposure to any information / internal structure is always a good idea (despite all arguments against security by obscurity) - especially when used along with other security measures. There is also the additional risk of additional potential injection points with every additional parameter.

All considered, it is not a practice that I'd recommend.


How much access to the file system does the recent Drupal vulnerability give? A friends drupal site was hacked. What is strange is that the root directory of the installation at the hosting company (let us call it rootdir) was copied (or renamed) rootdir_hacked and the directory rootdir was left one file index.html saying the site is under update.

What I do not understand is how can the hacker create/copy a directory to somewhere outside the rootdir. Shouldn't the security settings of the hosting company prevent this without access via ftp?

The vulnerability allows remote code execution, meaning that you can perform arbitrary actions (like performing file system operations) with the privileges of the web server process on the remote host. You can imagine the attacker actually sitting in front of the compromised computer and typing commands in the console.

Here's how Remote Code Execution is achieved: https://www.sektioneins.de/en/blog/14-11-03-drupal-sql-injection-vulnerability-PoC.html


Ping response contain subnet ip One of my friends site got hacked recently. Now while pinging the site ping zyz.com the response is like

  From 10.x.0.1 icmp_seq=79 Packet filtered

From what I have heard, 10.x.0.1 looks like a LAN gateway address.

Could someone please help by telling me why is the response having subnet detail in it? Any help would do, Google-ing dint help much!

IP addresses starting with 10.* are reserved for local area networks. You seem to be on a LAN which does not allow you to ping any host outside of it. 10.x.0.1 seems to be a border-router which filters your pings.


Good reason to continue using fraudulent certificate? A relative of mine used a favorites link to login to yahoo. The favorite link is

https://de.mg40.mail.yahoo.com/neo/launch?

However, this link uses a fraudulent certificate. Visiting the Yahoo website was now (maybe 2 weeks ago) reported as insecure (you can try above link). However, when redirected from the main yahoo.de website to a different server, Yahoo already uses a newer certificate which is not fraudulent.

What is a good reason to keep a fraudulent certificate and not replace it by a renewed one?

The certificate is not necessarily fraudulent (though it does expire on the 28th of March) as much as it is that the name being used to access the resource doesn't match what is on the certificate.

It's common for companies to have aliases or CNAMES for services/hosts. The problem is that unless you generate a UCG or SANS cert to handle all the names then you can run into the situation that you are experiencing.

With all that being said, it is very bad practice for a company not to accommodate for this when modifying their infrastructure as the Common Name on a certificate is the defining security characteristic of an SSL certificate.


What to do after you get a CVE? I recently reported a security vulnerability and it was patched. The patch (and associated issue) are both out in the open in a Github repo (aka public). I contacted cve-assign@mitre.org to get a CVE Identifier issued for the vulnerability. I have been issued a CVE Identifier.

Do I need to do anything else (e.g. supply Proof of Concept code etc), or am I done?

Given you have referenced Github, I will assume this related to some type of As an open source project, a note to oss-sec is a good idea. This will bring it to the attention of most upstream distributors.

You do not need to subscribe to post to oss-sec, but you should note carefully the etiquette/content guidelines in the link above. A rummage through the archives should point you in the right direction, this one is a recent posting (from the list maintainer) the form of which you could usefully copy:
 http://seclists.org/oss-sec/2015/q3/61

The NIST National Vulnerability Database is driven by CVE data and should be updated in the near future, they don't suggest how long it might take though. The NVD FAQ also has some useful details, including contact procedures for missing or incorrect entries. I'd suggest giving it at least two weeks (based on empirical evidence) after you post to oss-sec before following up though, the CVE people tend to be busy.


Is server hardening with grsecurity really necessary on the CentOS 6.3 environment? I consider myself to be reasonably good with IT, however I am relatively fresh at server and system administration. I am a web developer for my company and I have been charged with setting up and migrating to a new VPS to get away from the shared hosting my company has been on for ages.

In this process, I have spent almost a week now hardening the server (security became an issue, which is why we're moving in the first place) and have gone over and above to harden the server. I've installed and configured ConfigServer Firewall, hardened SSH, only private keys, all the good stuff. But I found a program called grsecurity that looks promising, but I guess I'm just curious as to whether or not it's overkill?

Are there things that grsecurity offers that I really need? Or is it something that I can do without? I read something about how it prevents buffer overflows and other things, however I am just curious as to whether this is worthwhile, as I don't want to add so many moving parts to the security of this server that I end up falling on my face.

I appreciate any feedback you can give me, or links to tutorials/information that you may have!

For what it's worth, the server environment is as follows:

Linode VPS 2048
CentOS 6.3
PHP 5.4.5
ConfigServer Firewall

Again, I appreciate whatever feedback you can offer me! I trust this community implicitly, and I know you guys know what you're talking about!

grsecurity (a.k.a. grsec) isn't really a program - it's a hardening suite for Linux.

It includes the following:

A fully comprehensive Role-Based Access Security (RBAC) system.
grsec-hardened kernel patches.
Enhanced PaX implementation.
chroot restrictions (misc features to prevent malware from escaping a chroot jail)
General system security improvements.

These features are designed to prevent shellcode from being successful on the system. The restrictions in chroot and other system features help prevent untrusted processes (e.g. httpd) from performing tasks they shouldn't.

Here's a few examples of practical improvements:

Prevention of ptrace and other IPC mechanisms between processes that shouldn't be talking to each other.
Forensics capabilities via /proc/[pid]/ipaddr
httpd can be placed in chroot jail with highly restrictive permissions (no kill, no pid/sid set, sysctl writes, etc. outside of chroot)
Full fine-grained auditing of processes, users, groups and other entities.
Ability to completely hide kernel-mode processes from user-mode.

The most difficult and powerful part of configuring grsec is the RBAC system. It relies on you to properly and fully configure the privileges and abilities of certain processes. By default, this is a fairly restrictive set. This can often crash and kill certain processes, often with no obvious reason. However, if you tune it correctly, it's an incredible security measure.

It's great for high security scenarios, and I highly suggest installing grsec with RBAC disabled first to give it a go. Set up a proper chroot for your services (httpd at least, preferably SQL / mail daemons too) so that the entire system won't get pwned due to a vulnerability in a single daemon.

There's way too much to cover in a single answer, so I suggest you read through the grsec wikibook.

As to whether you need it - it depends. It's complex to configure (includes a kernel recompile from source, plus a lot of auto-training and manual config editing) and will take a significant amount of time to fully set up, but the result is that you gain a huge amount of resistance against remote code execution vulnerabilities in service daemons and the kernel itself. Figure out how much time you want to dedicate to protecting yourself from such attacks, and go from there.


Share root access without sharing password I am looking for a way to share admin privileges on some hosts without providing the admin password.
From his link, I was thinking of using a primary host from which every user can sudo -u user to have access to the specific SSH key and connect to the other computers without any password.
The SSH keys have strong passphrases and are loaded in the memory by an admin.

If userA needs root access to lan1 computers, we just add him to the sudoers file as : userA ALL= /bin/su - lan1 where lan1 is another user containing an SSH key accepted by all hosts on lan1.
Then, userA can have access to the specific SSH key at user lan1 and do sudo su - lan1 ssh root@[computer_in_lan1] without knowing any root password.

Problem is that I need to enable root SSH login for lan1 and this is a bad thing. I am wondering : root login would require an SSH key so guessing anything would be impossible, what is the risk except tons of bots logs ?

Now, are there any solutions for sharing a root access without having to share the password ?

I recommend that you do not permit direct login as root via ssh on any system. As mentioned in gowenfawr's comment above, it is better to have personal accounts for everyone who will be administering the system on all of the nodes, and give them access to sudo to root locally. They would not need a root password on any node for this; they would use their own password or other credentials.

This can be automated with distributed authentication tools such as LDAP and RADIUS, or with a client-server tool in which the client runs locally on each node, gathers the information from a central authorization system, and creates and maintains the individual user accounts on the systems.

Failing that, you may want to set up a dedicated (non-individual) account on each node whose purpose is to run a specific set of commands as root via sudo control, and have a means for the public keys of all the administrators on the central "jump server" distributed to the authorized_keys for this account on all nodes.

The key (pun intended) is to protect against misuse or interception of the private keys of the administrators on the central node by not allowing unrestricted access to the root account remotely, and instead relying on local privilege escalation (sudo).


portscan using nmap fails to return open dhcp-port I've just stumbled upon something pretty weird, at least for me at this moment.
When i've finished setting up my openBSD 5.5 server, along with the isc-dhcp43-server port. I tried to see if i could find this service by doing a nmap-scan from a client.
But somehow the command listed below fails to find the open port (67), although the service is actually and providing ip-addresses.

Am i missing something here?

  sudo nmap -Pn -p1-1024  [ip-address]

EDIT:
I've also tried to scan the server using the -sU parameter, but even then it returns that the host is down. So i think it's safe to imply that finding a dhcp server does require to send out a dhcp-request packet, and that just port scanning doesn't suffice.

  sudo nmap -Pn -sU -p1-1024 [ip-address]

Upon digging a bit deeper, i read that nmap should be able to send a dhcp-discover packet.http://nmap.org/nsedoc/scripts/dhcp-discover.html

  sudo nmap -Pn -sU -p1-1024 --script=dhcp-discover [ip-address] -vv

But on my system this returns the following error.
Unknown datalink type 138.
I will investigate this further tomorrow!

You're performing a SYN scan (the default when run as root) which only scans for TCP services.  DHCP, on the other hand, is a UDP service, so will only be found with a UDP scan (-sU).  Even then, it might not be found, as it is up to each application to respond to UDP packets, if it does not, then there will also be no response.  This will lead to nmap giving the response "open|filtered", which means basically "the packet was not rejected".  Alternatively, if an ICMP port unreachable message is received in response, nmap will mark the port "closed".  Only if a response from the application is received (which most DHCP servers will not give to a UDP scan) will you get "open".  See the NMAP documentation for details on port scanning techniques.


Is there a way to create time based OTP with public/private key I have a situation where I need time based OTP.

But most of the examples and cases I have seen, uses same key to create and check otp.

But I need something different. I want to create OTP using a public key, so that it can only be checked/decrypted using private key only.

Is there any method like this?

In case you are talking about a One Time Password there is a simple reason, why TOTP-Algorithms are using a symmetric key on the client/device and the server side.

If you take a look at HOTP-TOTP (RFC6238), it is derived fro HOTP-OTP (RFC4226), the event based OTP algorithm.
This was specified in 2005. The first smartphone arived in 2007.

So what? The OTP algorithms are designed to work with hardware devices. These hardware devices have a display, so that the user can punch in the one time password. During the generation of the one time password the RFC defines a truncation method, so that the user is actually able to punch in a limited set of characters.
The output of HMAC-SHA1 is 20 bytes hexcode. Noone wants to enter this as a one time password.

To be able to do assymmetric cryptography you can not use any truncation function. Otherwise the public key would not be able to verify the signature. The private key would not be able to decrypt the message.
The data to transfer with assymmetric keys would be much larger - 1024 bit, 2048 bit... Again, the user would have to enter manually a very long one time password.

Well, if the client transmits this data electonically you would not have to truncate it. But then we are again not talking about one time passwords but about publy key crypto or client certificate based authentication.

So in the end it is all about human readability and truncation.


Is SHA1 better than MD5 only because it generates a hash of 160 bits? It is well known that SHA1 is recommended more than MD5 for hashing since MD5 is practically broken as lot of collisions have been found.
With the birthday attack, it is possible to get a collision in MD5 with 264 complexity and with 280 complexity in SHA1

It is known that there are algorithms that are able to crack both of these in far lesser time than it takes for a birthday attack.

My question is: is MD5 considered insecure only for this reason that it is easy to produce collisions? Because looking at both, producing collisions in SHA1 is not that difficult either. So what makes SHA1 better?

Update 02/2017 - https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html

Producing SHA-1 collisions is not that easy. It seems reasonable that the attack with has been described on SHA-1 really works with an average cost of 261, much faster than the generic birthday attack (which is in 280), but still quite difficult (doable, but expensive).

That being said, we do not really know what makes hash functions resistant (see for instance this answer for a detailed discussion). With a lot of hand-waving, I could claim that SHA-1 is more robust than MD5 because it has more rounds and because the derivation of the 80 message words in SHA-1 is much more "mixing" than that of MD5 (in particular the 1-bit rotation, which, by the way, is the only difference between SHA-0 and SHA-1, and SHA-0 collisions have been produced).

For more of the same, look at SHA-256, which is much more "massive" (many more operations than SHA-1, yet with a similar structure), and currently unbroken. It is as if there was a minimal amount of operations for a hash function to be secure, for a given structure (but there I am moving my hands at stupendous speed, so don't believe that I said anything really scientific or profound).


Can someone know who created a cpp file? I know that one can see the modification, access, and creation date of a file on Windows. And that the creation date, as well as other dates, can be modified at will. I just wonder if it is possible to forensically determine who created a file?
For example, is it possible to find out which DESKTOP_NAME created a .txt or a .cpp file even if it was transferred from other PCs?

No. Plain text files only include the plain text, and no further metadata. Only the file system records metadata about the file, and as you've seen, it can be easily forged.
However, further analysis of the file system or related systems may yield useful information. For example, if the file is stored on a network drive, it may be possible to look at log files, e.g. if Windows' “auditing” feature was enabled for the shared folder. It may also be possible for a forensic analysis to view old versions of file metadata when a journaling file system such as NTFS is used.
But all of these approaches only relate to metadata on one file system. Only file contents (not metadata) are copied when a file is copied from another file system, e.g. when a file is copied from a thumb drive.


ECC Public Key length differs from bit representation A 256 Bit ECC key-pair (256 Bit is supposed to be the length of the public key) generated with OpenSSL using this command from the manual:

openssl ecparam -name secp256k1 -genkey -noout -out key.pem

and the corresponding public key with:

openssl ec -in key.pem -out public.pem -pubout

The public.pem file contains a base64 encoded string, for example:

-----BEGIN PUBLIC KEY-----
MFYwEAYHKoZIzj0CAQYFK4EEAAoDQgAEdPzYnkmkF8oy+R+FcByIbyPBE2l6HHOJ
mfZWtAaFZyIx9WPSzZTdyjmWlFqLvwaFlHu9OX9e7Snslfw7nneDIw==
-----END PUBLIC KEY-----

The public key consists of a point(x and y coordinate) and the curve used.

When decoded, each coordinate is a 256 bit-long number and the key itself is by no means 256 Bit long. Is this correct?

I'm aiming for the shortest possible public key length while preserving secuirty in my application and i don't understand why a suggested "256 bit public key" is more then double the size in reality.

An elliptic curve is defined over a finite field of size q for some integer q. Each curve element is a point and has two coordinates X and Y, which are curve elements.

The "size" of the curve, which is the important parameter for its cryptographic strength, is close to q. It can be shown that the total curve size n is such that |n - (q + 1)| ≤ 2*sqrt(q) (that's Hasse's theorem). So if you want a "256-bit curve" you will need a 256-bit field.

However, a public key is a curve point, represented by two coordinates. So you end up with two 256-bit values, hence the public key size. Moreover, standard public key formats also include some parameters which specify that the public key is of the "elliptic curve" type, and reference the actual curve from which the point is part. We still call it a "256-bit public key" because that number relates to the cryptographic strength of the key, not to the actual encoded size.

If we dig a bit further, we may note that all curve points must, by definition, fulfil the curve equation, usually Y2 = X3 + aX + b for two constants a and b (these constants actually define the curve). It follows that, if you know X, then you can compute Y2 by using the curve equation. Since we are working in a field, an element has at most two square roots in that field, so from Y2 you can get Y and -Y. This allows point compression: a representation of a point (X,Y) as only X, plus one bit of Y (which is enough to distinguish between Y and -Y). With point compression, a 256-bit EC public key fits in 257 bits (assuming that the information about the used curve is transmitted through some other way).

Unfortunately, point compression, while nifty, appears to have been patented at some point, so a lot of existing implementations don't support it, even though it would be "standard" (it is described in ANS X9.62-2005). From the "RFC" point of view, support of point compression is optional. Therefore, using it incurs a risk of loss of interoperability.

(I don't know if OpenSSL supports point compression. It should be tested.)


Are there any studies on the security of preventing password re-use in a single system? Some system, when you change your password, they don't let you re-use previous passwords. For example, you use password 1, then change it to password 2, and then when you try to go back to password 1, it blocks you.

Do we have any studies about whether this practice increases, decreases or does nothing to security?

I can think of arguments in either direction and none are conclusive without measuring. When I try to search for any studies on this matter, I only find articles about the danger to re-use passwords across systems, which is not what this is about.

I'm not aware of any scientific studies that focus specifically on the security impacts of password history controls.

However, it doesn't seem like we need a study to be fairly confident that reusing old passwords decreases security.  An old password may not have been exposed during its use, but if it was exposed then reusing it provides an opportunity for an attacker to abuse it.  So in some, likely small, percent of cases the choice not to maintain a blacklist of previous passwords is a detriment to security.  In the cases where passwords remained unexposed it has a neutral impact on security.

Now if you expand the scope to include user behaviors that might be influenced by password history controls I could understand hypothesizing how this might negatively affect security.  Maybe some user has tried to rotate between two very securely constructed passwords but when foiled by this control just decided to use a simple password and increment the number at the end after every change.  You could argue that while rotating between two passwords is bad, using a simpler password that changes predictably is worse.

One problem is that the password history control is very often implemented in conjunction with scheduled password expiration, so password history can be difficult to study in isolation.  You'd be left waiting to observe passwords changing organically.  A user would have to decide to change their own password for some reason, or the app owners would have to force users to change passwords due to a security event.  Then over time you could analyze whether being unable to use 'n' number of previous passwords had an observable influence on user new password choices.

This obstacle may be the main reason that researchers have chosen to focus more on the effects of password expiration controls or cross-site password reuse rather than password history.  But I suspect it is also because most of us don't predict that there will be greater negative effects compared to the positive effects.