PEM encoded rsa keys have different sizes I saved an rsa private key in a binary file (in PEM format), among other data. I knew its offset, but not its size. When I needed to load, I generated a temporary key, and used its size to load the saved one (I do not want to process text to extract the key).

I was a bit surprised, because for a modulus of 2048 I got two encoded key sizes: 1679 and 1675:

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAvsAqMhhCurk2ROslaeNDf5K4oedJiyqxAeIWhgWfYeLqxDQ7
U7A+r/HEoUjUQMia6dBLXVI+FyF0PhNJwIBAtlGu/ojSEppSA4los9u5Q4SNrpwZ
dSgIPIRWa1HSBoL464K9hIY5iXxku3jGeWgIHlKtaVeoSxhYv4lwAYL0QAKs24Bc
VC1JaLDVMldwf3CBqKiyoXhLIPGpW5PMPLKR0Tj44+4gm7vgQ/wOaavYp6DW2kaH
EZyu7T4viqpAdUk5dHi6HHTOzarhDP+1B8aL7scqZzTtzjbidyXVbm5vBjTSQqO5
865k9+p9znhVA5tS7Ha+zAKiGhRjXtRkRLxKdwIDAQABAoIBAA9h5cU2aaMvLm4u
XE0Gs7nE9jiwMyES50VUmyZhq7G0H+SEpcgg7V047PdorR0wUDXMw1caO8GXxA0B
dzAb55wMSEVkeTRg135LhXMDpBQKy3YqRm9JNCjVLzbmWT6HL1WmrGvUey1YJ7Nq
kO7XcdgoKK3XEM5Ff1qq1ap5igLjUGn3Ibna4faaVFvbw00/WYHqPUejmEn+xYV8
I8KrplZ2+0iE7nxrRQwdZWtyRgmjF81rJJPKw0BDiESXADkjdil9FPwMgCqJ8shZ
JhlslsYkD6JC/fS0u5w2h72dZY1chPqLex4CSUr3X3jGvUNkQt+l8jPs9p1zT7hP
jwPA6JECgYEA+s5Iz+rs5Y136VofAPSiGwrBuM1tvjpkV+tbUhlxJxem6JXypEYx
YFZ2fqwn9Timxfgsihjun1R1yn5wFjsylAB5lWgyNgt2uvTJrwsC3KpdEESGWlE/
c2yS7UJwWiZ3YcRP8tEwZre9VREdo7pObb+h3ZytoHMUNau18dJ5FBkCgYEAwrN7
R/euWvfutvCtHhE9xiAqu4qph9WYbx541zK8c5Vra+1JqnrBBPiXv6dxHnwlWV8g
CxH/PhjRSB+vyKn/bfHH5mfAYeAVwxIo04jdcc+vPETySITs9KN9KPnmYwSM1rJU
Fbo7X/0B+pHxVfj2kGlKyY2Jro84gToOckkwpQ8CgYEAqN/9ZwJoQKjg9N8ZwSr3
e/3iMu0f19a5efmfo8g9yHTEjhdpKfOZi6SsZN7GiPd8VBCm7NWc1uun5JD+J/n0
NHOdalyecoWFjJ0GsDZZ1vtfbnS1glryvmV9CQSTYiBEgjANJRJ15LQTaBP+QSBR
btR5yR6WSlMyaHEWMZ3mqQECgYEAk9kDFqVIKx/2j8i3TQu+owKuMHedQN67wDWd
gZyvaf3e8rffpqtMg1/aq9iUl5eiLPmFNaLW9eqWkXQuYexlYLGnIJlMh4ZIQDc7
9VYLAm+5G8UnTlZSMXssgb8yaaJ86FPGcjFXAQ75P7MvVh+V7BdoiSEHmhx7xfW2
HqbhX5UCgYA7UmzmedDd74yfzTbKv7xiTiTL5uQcra51iVFUNU+7Xv2ou11674ak
ymSyEfbLyNq0fZZSj538OVYLK7WG6YEED3nQ5bGvh8MfDHUcI2WgMzZloKUY7UWF
G0/AjGI55sEu+/nu9yPvhNEbq7nfa6LhBkLpB+RAgMhZ6dskdP4Eng==
-----END RSA PRIVATE KEY-----

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEApBxAjMLR4FOHPvgL2JiFoefQiArset5UTUV1VH+bes1saO4C
O0WZVXr8Ksj+Cnw4Secd8evy2frhEI3DCWizLn8/SVySmIX442H6nbgo0PokCEYo
a4ghI5dbc0QLXuyLL7VMRjwOVhpsd51Tx1pAJx0aHlQvmr2a3xaICI8F4hhTtI0r
IEoiaqWocJs9BjZd9gNqDK47UD9svjzLKc0jJ/yRCDsUGIvhYcYIzir6+NQTCU8Z
kvlmgO3WT8U3OdbnhhtuomjSjc/1TBOqbtRXLpQ+yLOJm6Op7XZb2h2iCuH9Hp9/
oy3DmpdXOYqtLYFUVyE26PwEPG5alw4QQbahJQIDAQABAoIBAQCA5JOqOqV+a/xQ
b59WOczTMe/tua6sfgx2ODSD7kmedNNNwonMJcjdg1+k9wHYGGJZYQV66ddubwXv
63eg3zPENDrvkp6s3qRxapXc5DRileRQ/1Fly6BDhPBVor7PijdzfBBxJWAZLl28
wLt5WqACWHAYHATbo0mNJ/QlzLdRMIoWFaJK71pn1pka1DZxzfk//uV+L6NCMAbP
e+PAArY/8bTQYOnlKHoPrjpmyDYtliOYDCr3OgZqS7dS69cz5jHNihHLJiKfOTNr
zyXFBAfPwWUqBsUagj5GCb3yeyalfY2y/9DBPvfY75+e6KtZcMtDXRzqV/hWswk5
ApWfqfqtAoGBANHdn4/AKTH4AIP+nNx2HTFsin7KnwjNbMFWbxrC/JjQqX90ugie
y1LzWiWgCXMo0tOuKsd6AWQEQQBAbxhCAjRZ6XfLVllmMXYVZQ2wwxNYwB49Vi9p
ZNsvGBKpcUbgzFkm2pRc8GkvjDz1iJxnKnVY0ATpjuK6CMhsDYkeyhXjAoGBAMgv
tMh1EFYJA2ewieCD+xlcAk8YZVc8b9JV2cdHtpAHCvMMbPm4S/ygwvZ1FadvVrX8
z6CRMVsRbmp4a5dDUkRQqAm5LUqZ59e2MHoYq5ueR145MXDZXhT5BoTZ1LC+r6nN
0Low1xP78sjTxSOb2aUvlSWG54y7+lVJkKf9cNtXAoGAPE4C27vMGp+5BjTTvkXy
fZFC+swehtkAt02u/3GoRAExs35HNtLqehuTe9xQ2taQPmN9x3Q3khXm17usMLxH
BeQQQmwbk/TZoaTkNNrmM1j9W7MkYNtYL+OId1RZSJSwI64WgStzqcYP9jRX3RmI
CdBLdh3nAR+UBoOGIDDIwSECgYAaBlmyVcWx6aoPqNvD3GSgf12terZyCOFgrtiJ
F8GcJ848mrjwHg2C4kN2VvJhug/DyQIVFcsc079PCCi0mYPwbavq17ATqr6BRKY4
uUxWBtWwYi8TRK7+ewFl9Au6jo+3u5IPIppTdsWxZhaS8ofw+aaiIk+n9CgvPkkY
DdLGMQKBgCQyM7Mg8xCgVQaQWAFJ8jHSrZfsk2+Xrj7oDW0JGa3Es3kXrWH/h/9/
VIP8/H1kzyuqDwuPN/1BzKfpIxzz2TGrK+KUAJsIN4j+Kh0yQDV/Pxw9sGx71Aid
m3AQwxAk8a10B1jbj/qPvxZjZZxqoILC4xIkWYrabFku2zot5yUx
-----END RSA PRIVATE KEY-----

Can I save an rsa key in a format, which always has the same size if the modulus is fixed?

The public key appears to always have a size of 451. Can I assume that this is constant?

If you look at the keys in an online tool like: https://lapo.it/asn1js/ , you'll find the RSA private key consists of 9 different fields, some of which are variably sized.

In particular, if you look at the key file format here: https://tls.mbed.org/kb/cryptography/asn1-key-structures-in-der-and-pem (PKCS#1) you'll see the definitions for the 9 fields.

First key is:

SEQUENCE (9 elem)
INTEGER 0                     -- version
INTEGER (2048 bit) 24080037…  -- modulus
INTEGER 65537                 -- e
INTEGER (2044 bit) 19418496…  -- d
INTEGER (1024 bit) 17612182…  -- p
INTEGER (1024 bit) 13672376…  -- q
INTEGER (1024 bit) 11858803…  -- d mod (p-1)
INTEGER (1024 bit) 10382218…  -- d mod (q-1)
INTEGER (1022 bit) 41657306…  -- (inverse of q) mod p

And the second key is:

SEQUENCE (9 elem)
INTEGER 0                     -- version
INTEGER (2048 bit) 20717013…  -- modulus
INTEGER 65537                 -- e
INTEGER (2048 bit) 16271218…  -- d
INTEGER (1024 bit) 14737271…  -- p
INTEGER (1024 bit) 14057563…  -- q
INTEGER (1022 bit) 42347422…  -- d mod (p-1)
INTEGER (1021 bit) 18275240…  -- d mod (q-1)
INTEGER (1022 bit) 25417766…  -- (inverse of q) mod p

So, as you can see, some of the components of the key are different sizes (upto 4 bits on the d field), and those will be encoded somewhat differently in the ASN1 and base64 format.

As to your questions:

I don't know of a way to generate exact size RSA key components; if you can I would just prefix the length of the string in the file format. Or alternatively search the file for the '----' bit. You may be able to generate the ASN file with additional leading 0's on fields to get everything to a fixed length. Or you could generate RSA keys until you get the size you want. /s

Public key, so long as you're using the default e=65537 (default everywhere, for everyone), it's probably safe to say size==451. Though I'd still length prefix any plain text in a binary file.


Are we safe from infection of Bad Rabbit? I'm doing an assessment on the potential outspread of Bad Rabbit in our organization. Our staff do not have admin privileges on their host machines. We have also blocked the IOCs. Am I safe to say without admin privileges, the ransomware wouldn't be able to install the fake flash update/mimikatz?

Any other pointers we need to look out for, other than the ones for WannaCry, Petya, NotPetya?

First of all inform/warn employees from your organization - not to click on fake flash installation pop-up windows.

Here is an example:

On welivesecurity.com it is said:

  One of the distribution method of Bad Rabbit is via drive-by download.
  Some popular websites are compromised and have JavaScript injected in
  their HTML body or in one of their .js file.

That's from user perspective, now take technical advice:

keep your software/OS up-to-date
use strong passwords
block traffic on SMB protocol (tcp/445)
use AntiVirus software
monitor scheduled tasks and service creation

And as @Royce Williams said, you can create following files:

c:\windows\infpub.dat && c:\windows\cscc.dat

and remove ALL PERMISSIONS (inheritance).

You can also block access to following compromised sites from this list - https://pastebin.com/raw/n7ExrTsJ

More info about badrabbit follow here.


Is there any way of recover a locked drive using TPM? Just reading I learned about the TPM technology and how it works.

However, it make me wonder... if the motherboard crashes, is the data lost forever? Because you can't use the drive in other system due to the unique RSA key used by the TPM.

Many TPMs will allow a backup to be stored of the key either prior to loading it on to the TPM or via some kind of export.  As long as you have the key, you can reload it on a new TPM if the TPM fries.

I actually had this exact thing happen with an IBM ThinkPad with an early TPM where the TPM circuit fried and I had to replace the system board.  I was able to reload the key from a backup and get the system back up and running without significant issue.


Is code-signing with a non-ssl timestamp unsafe? Assuming your code-signing tool is secure (e.g., does not suffer from buffer overflow exploits and the like), is there any reason to be concerned if a time-stamping service is not running over SSL? Obviously, a MITM attack could do slightly annoying things (e.g., provide a bad certificate), but SSL doesn't protect you from such attacks, since a MITM can already cause an SSL timestamp to fail (by blocking the request).  Technically, a MITM could also provide a valid certificate under the MITM's control (allowing them to revoke it later).

Are there any realistic concerns when using a timestamping service over HTTP, rather than HTTPS?

Short answer: in general, no.

Long answer: the timestamp is a digitally signed data and it contains nothing that should be private on its own. It can't be reused and, as every other aspect of the system is properly conceived, cannot be counterfeit.

The critical element is that the timestamp comes from an authority that is trusted by both the initial signer and the final validator.

Now, there are edge cases where this timestamp element could lead to security issues if it is intercepted (for instance if the hash value contains in the timestamp can reveal important information about the data itself) but they almost all originate in other part of the system being broken (for instance, the use of a weak hash or the use of a hash in an insecure manner - like an anonymizer scheme).


Is it safe to use the free Cloudflare SSL certificate since it's shared with other domains? I have a free Cloudflare account where I manage my domain (ie: mydomain.com) and I use the free SSL certificate (mode Full SSL) in order to get SSL on a subdomain (blog.mydomain.com hosted with Github Pages).

The domain root is not secured by Cloudflare SSL but it has its own separate SSL certificate.

As you probably know the Cloudflare SSL certificate is shared between several domains (often adult sites) and it's a wildcard type. (so it contains *.mydomain.com, *.malicious.com, mydomain.com, malicious.com)

The web application is hosted on mydomain.com and app.mydomain.com is also secured with its own SSL certificate. Can these domains somehow be in danger because they share a certificate with malicious.com and malicious.com probably has access to the same SSL certificate shared with mydomain.com?

The web application hosted on mydomain.com or at app.mydomain.com (also secured with its own SSL certificate) can be somehow be in dangerous by the owner of malicious.com because he has access to the same SSL certificate shared by mydomain.com?

The owner of the malicious domain has no access to the private key certificate served by Cloudflare and neither do you. The certificates for the free accounts are owned by Cloudflare and only Cloudflare has access to the private key of the (shared) certificate.

It is also not a problem that you share the same certificate and/or IP address with a potentially malicious domain. The same origin inside the browsers only cares about domain names, not certificates or IP addresses and thus it is not possible to get access from the malicious domain to your domain. The usual CSRF, XSS... attacks of course still work, but these are not related to same certificate or not but to security problems of a specific web application.


Secure authentication: partial client-side key stretching... please review/criticize my idea I am trying to figure out what would be the 'perfect' authentication system for a website.

On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why MD5 is no longer recommended. The best solution for secure password storage, it seems, is making use of key stretching in combination with salting (i.e. using PBKDCF2, bcrypt or scrypt). For those who haven't heard of it, key stretching implies that a hashing algorithm will be computed through many iterations (not just once), causing each brute force attempt to take an unreasonable amount of time to compute.

Now, having users sign up, authenticate or change their password, and having the server use key stretching to store the password does ensure proper password protection -- but leaves the door open for DoS attacks. Mainly, a hacker could just flood it with authentication attempts with random passwords, and the server would choke on computing all those iterations for all those attempts.

I'm trying to get the best of both worlds -- secure password storage with key stretching, without the DoS door opened. Here's my idea, and I want to know if I'm overseeing anything, or if there's any problem in my logic... sometimes, when you're too close to the problem...

The idea is:

CLIENT-SIDE: Website user inputs username, password
CLIENT-SIDE: Website uses AJAX request to the server to retrieve the salt and number of iterations attached with the user's record (based on username match)
CLIENT-SIDE: Authentication Step 1. Website computes, on the client's computer with Javascript, all the hashing iterations MINUS ONE (I will explain why later). The computation is performed using a well-known algorithm, such as PBKDF2, bcrypt, or scrypt. Website sends the result to server.
SERVER-SIDE: Authentication Step 2. Server receives the username + hashed password (minus one iteration). Performs last iteration (with PBKDF2, bcrypt or scrypt) Compares with stored value to determine if combination is correct. Returns response to website.

Now, why all iterations minus one? If a hacker gets a copy of the database, and the server would expect a fully-hashed password to be provided, it would be equivalent to storing the passwords in plain text. Hacker would copy and paste the hash and use the authentication service. As such, we can't return it directly.

However, since we theoretically can't 'reverse' hashing, having the server only accept a n-1 iterated hash means the hacker can't guess what the previous iteration looked like, based on what we see in the database. Is that correct?

In the end, we have the majority of the work performed on the client-side (server only does one iteration), eliminating the DoS threat, but we also have passwords stored with full-on key-stretching with salt, a most secure practice.

Am I missing anything? Would this be an ideal way to implement an authentication system? Let me know! I'm just wondering if I'm missing anything here...

Client-side hashing works, conceptually. The problem, though, is that of power. In a Web context, client uses Javascript, and Javascript is feeble for computing intensive tasks. The client already uses a system which may have a relatively small CPU (it could be a cheap smartphone, for instance), but Javascript adds its own overhead, which is huge (because it is interpreted, hard to JIT, and lacks decent integer types). As a rough estimate, client-side hashing in Javascript will be 20 to 40 times slower than password hashing on a decent server.

Unfortunately, user's patience does not stretch; the user tolerates one or two seconds of delay, no more. So when you use client-side hashing, you have to use less iterations than when you use server-side hashing, which weakens the whole picture.

Or, said otherwise, as long as you handle the login process of no more than twenty users per second, server-side hashing will allow you to use more iterations than client-side hashing, and thus be better for security.

If the client uses a Java applet, then it is much more powerful; the "20x" factor becomes "3x". But Java applets have fallen out of fashion and won't work on tablets and smartphones. Mobile clients with a dedicated app may revive the concept of client-side password hashing.

As for the details, the best way is not to "remove one iteration" from the algorithm, but to add an extra hash: cryptographic algorithms are complex animals, and though password hashing function internally use "iterations", they don't necessarily use only iterations. For instance, you cannot easily remove "the last iteration" of bcrypt and get a partial result to be transmitted to the server. So, instead, do all iterations on the client, send the result R to the server, and the server stores both the salt, and h(R) for some hash function h (e.g. SHA-256).


Test website for SSL 2.0 I'm in the process of disabling SSLv2 on our IIS-based webserver and am wondering how I can test that SSLv2 is actually disabled?

The website is still in development so not visible outside our organization - which means presumably I can't use any of the public websites that would normally be recommended for this purpose (such as http://www.serversniff.net/content.php?do=ssl) since they wouldn't have access to the site.  We're completely a Windows setup so I can't use unix-based tools like openssl.   I have tried downloading and running SSLDigger, but the report that produced simply gave certificate details and listed the cyphers supported, without as far as I can see any mention of which SSL versions were supported.   So I'm now out of ideas :(

OpenSSL does support Windows. You can download it hehe.

This website has a tutorial that shows how to test for SSL 2.0 support (using OpenSSL).

The command is as follows:

openssl s_client -connect localhost:443 -ssl2

EDIT: I've just tried testing my server with this command, on Windows, and everything works fine!


Why submit a website to plaintext offenders? I've read this question and to quote from the accepted answer

  Besides that, by submitting the site to plaintext offenders, you will provide a third-party point of view, which might help your case.

But, isn't submitting a website to plaintext offenders putting yourself at more risk?
Someone with malicious intent could see the website you submitted to plaintext offenders and then go try to exploit the vulnerability, putting yourself (and anyone else using that site) at more of a risk.

Or am I just missing something?

To quote their FAQ:

  Aren’t you worried hackers will use your site to find targets?

  Yes, but less worried than having this information remain secret and relying on Security Through Obscurity.

To be more verbose: There are two possible outcomes from submitting a site there:

They fix it - This is more likely to happen when they get publicly shamed. The attack probability increases, too.

Also, hiding security problems away (leaving it secure only as long as it is kept secret) rather than fixing them is generally considered a security antipattern, as the NIST "Guide to General Server Security" states:

  "System security should not depend on the secrecy of the implementation or its components."

They do not fix it - Then it is at least documented publicly and externally.

To be more specific, thanks to Chris Cirefice who pointed out it the comments more explicitly what I had in mind:

  "documented publicly and externally" - with timestamps. So if a student loan company is hacked and the students' bank details are released due to lack of compliance with (U.S.) government policies, e.g. the Gramm-Leach-Bliley Act 1 2, the students could sue the company, and the timestamps of public release of failure to comply would be great evidence in court for recompense.


Is setting a firmware password on a Macbook enough to prevent cold boot attacks? I have a Macbook configured with a firmware password required to boot from any media other than the built-in NVMe drive. In theory, this means without my password you can't boot from removable media. Is this enough to prevent cold boot attacks or are there other ways to perform the attack. If so what attack methods still exist?

From wikipedia

  Alternatively, the memory modules are removed from the original system and quickly placed in a compatible machine under the attacker's control, which is then booted to access the memory.

This means that your computer is still vulnerable to cold boot attack.

Furthermore from wikipedia

  This is not the only attack that allows encryption keys to be read from memory - for example, a DMA attack allows physical memory to be accessed via a 1394 DMA channel.


Deciding whether to sign someones key How do i decide whether to sign someones PGP public key? I was looking at some contact pages and they have a request for people to sign their public key.
How serious of a commitment is it to sign someones public key?

You should really only sign someone's key if you actually know them, and you trust that the key is theirs.

When you sign it, you are saying that you checked them out, that you know it's their key.

You then figure out "would I trust this person to be as thorough as me in evaluating the identity of other people?"  You might have friends who are careful, or people who you are acquainted with and hold a position of responsibility so you think they might be trustworthy, or they might be a complete stranger, so you wouldn't trust them with a burned out match.  That's when you assign the level of trust.

A web page begging you to sign it could be someone trying to build a sock puppet, false identity, or even stealing someone else's identity.  Worse, they could be collecting the identities of people who are gullible enough to sign a random key with no validation process.


What reasons are there to not just send the API key as an HTTP header over HTTPS? I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult than I expected. Most web APIs I've used simply send some API key either in the URL or as an HTTP header.

I was under the impression that as long as you used HTTPS (or a similar form of encrypted communication), this would be plenty sufficient (and that was the gist I got from somewhat similar questions, like this one).

Yet, Microsoft seems to want me to use some very complicated Active Directory approach. What advantage does this have over a simple API key?

It's perfectly fine to send api keys as a header in the HTTPS request, since first SSL/TLS negotiation happens, and then the packet with the header is sent. The first packet to negotiate the SSL doesn't contain headers other than browser specific generic ones. This is secure and safe. AD however does have some power behind it, and in an all windows environment is actually a nifty tool to use.

As for specific advantages? See here for a good round up.

Some highlights:

Managing trusts: Access to multiple domains(forests too) from a single AD

Managing children: Changes to AD carry to all children of the AD

Managing users: Users in the AD are logged, kept track of, and kept secure across the AD, their domains, and anything else that is in the AD.


SMSC spoofing attack I attended a seminar on Telecom networks few day back and there I came to know how vulnerable our signalling network (SS7/ SIGTRAN) is.

The speaker discussed an attack in which a spoofed SMSC is connected to a legitimate network's SMSC and all the traffic routed to the legitimate one can be retrieved at fake SMSC. In this way, an attacker can exploit user details.

I wonder how can this attack take place without operator's knowledge and intervention? or even if its possible to conduct this attack or not?

It the absence of Signalling firewall(SS7,Diameter and GTP) in the receiving network, if an attacker uses a software that has the capability to send SS7 Map messages. The attacker can send Map messages that are expected from SMSC of external network towards the receiving network.
The attackers can send MAP messages with spoof CgPA such as ATI to get the subscribers locations, since there is not firewall, the Core CS network is not smart enought to detects these attrocities, unless you have a very smart telecom engineers that is monitoring the traffic 24/7 and are actively blocking traffic from operators that does not have certain traffic aggrement with them.


If I can disable antivirus tamper protection, couldn't a malicious worm do it as well? I was wondering how those client softwares protect themselves from worms / malwares etc.
Symantec protects their files from malicious users / admins with the tamper protection mechanism, but sometimes for troubleshooting it needs to be disabled.

This is how to stop the service:
https://support.symantec.com/en_US/article.TECH192023.html

But, if a user can do it, can't a malicious worm do it as well? Which causes the whole protection to be useless?

In order for malware to disable anti-malware protection, it typically needs to escalate its privileges to admin levels. And that's what the anti-malware tools prevent.

So sure, an admin level malware could do that, but in most cases that would be pointless, as it already has admin access and can do anything it wants.

In summary - no, anti-malware and antivirus are valuable in stopping many types of attacks.


Seeking security help as a non-technical manager A friend in the business sector recently asked me for advice on "IT security in a large charity". Being a developer not specialized in security, I could see his difficulty in finding someone qualified to hire to counsel him.

Struggling for answers, the only example I could advance was the following: if you're seriously asked to give out your password for an audit to be conducted (and this not being a "test", of course), you're probably dealing with someone who doesn't know what they're doing.

What are some helpful tips and pointers you could give a non-technical manager in choosing a competent / avoiding choosing (and hiring) an incompetent professional?

I am aware this question might be off-topic, but the purpose of this question is to give some general resources to non-technical decision makers to hire someone qualified.

a security professional knows that "secure" is a state that one will never reach to 100%. Its about reducing the attack surface on a daily basis. Security is a ongoing process and "secure" can be considered as a snapshot.


exploiting setuid and setgid bit I was reading material on secure coding and at many places it is mentioned not to use setuid and setgid bits for privilege escalation. These a vulnerable and can lead to security issues. Instead we should run a dedicated helper process which can do the job, like launchd on osx. SO my question is how is setuid and setgid insecure ? and how can it be exploited ?

It is not the bits themselves that are insecure, but if an attacker was able to exploit a flaw in a setuid/setgid binary it would result in code execution under elevated privileges. So by reducing the number or binaries (and lines of code) that run with elevated privileges you are reducing the attack surface.


Why Chrome blocks ajax locally? Could not find dup, so let me know if there is one

I am trying to create static one page website (to host it on neocities). I use jquery's load() function for that. It works fine in Firefox (and Edge) but not in Chrome.

Here is index.html:

<!DOCTYPE html>

    <meta charset="UTF-8">

and here is partial_page.html:

This is partial page

Error message by Chrome:

  Cross origin requests are only supported for protocol schemes: http, data, chrome, chrome-extension, https.

Screenshot (Chrome one the left, Firefox on the right):

Questions:

Does Chrome solve some kind of vulnerability by not allowing me to do what I am trying to do which would not have been possible to solve in any other way other then completely preventing me from doing what I am trying to do?
If somebody were to try to exploit vulnerability which Chrome is trying to fix by blocking my request, how would they go about it?
Does that mean that Firefox (and Edge) are (more) vulnerable to XSS or CORS (or something else)?

Does Chrome solve some kind of vulnerability by not allowing me to do what I am trying to do which would not have been possible to solve in any other way other then completely preventing me from doing what I am trying to do?

Yes, it does.

If web pages loaded from file:// were allowed to make requests to other pages under file://, they would be able to read any file on your computer, including sensitive files like SSH keys, browser cookies and saved passwords, and personal documents at known paths.

Changing this would mean that opening any HTML file on your computer -- including saved web pages, as well as HTML documents distributed as documentation or readme files -- could potentially exfiltrate sensitive data from your computer. Browser manufacturers have determined that this is an unacceptable risk.


What is the purpose of yubikey I've been doing some reading about YubiKey (for example What is a Yubi key and how does it work?) and found the information to be incomplete. It's my understanding, that when the user is prompted to answer a password, all they have to do is plug the YubiKey into a USB port and press its button and then it automatically types out a password into the active text field.

Point 1)
According to Linux Journal

  Each time you press the button on the device, it generates a one-time
  password and sends it to the host machine as if you had entered it on
  a keyboard.

So if it's a different password each time what good does that do?

Point 2)
Is it any more secure than using any USB key with a key file on it?

Point 3)
From Yubico it's not possible to backup the device so if you lose it or break it you're in trouble (in this sense a regular key file is much better).

Point 4)
I've read that it's not susceptible to malware copying the key, but I don't believe this. If it acts like a keyboard, what's stopping a keylogger from intercepting the keystrokes?

Point 5)
Yubikey is open source. Does it matter since it's primarily a hardware device?

Point 6)
If it does just enter a password, how is this different than just having another password written down or memorized?

A bit of background as to what Yubikey is first: Yubikey is a variation on a common type of device known as a One Time Password generator. Basically a mini-computer that generates an essentially unlimited stream of passwords, usually one per minute from a deterministic algorithm embedded in the device. The trick is that next password is predictable if you know a secret "seed" value and unguessable if you don't know it.

This way an authentication computer that knows the secret seed can confirm you have the Yubikey physically on hand because only the Yubikey and the authentication server1 can generate the once-off password required at a specific minute in time.

So:

Point one. As long as the authentication server knows what password the Yubikey should be generating, then having a different password every time makes it impossible for someone to spy over your shoulder and steal your password - as each password becomes useless a minute later. Essentially the key is something you have rather than something you know2.
Point two. For authentication - yes. For the reasons described above. For encryption - no. As you actually want to remember and reuse the key you encrypted the file with. In theory a 32GB USB key filled with truly random data could qualify as an all-purpose entropy source for authentication and encryption, but USBs are normally not that difficult to duplicate or manipulate.
Point 3. In theory if you know the secret key, you can duplicate the YubiKey but once a YubiKey is configured the idea is that you can't duplicate it as it must be something that only an authorised person possesses. Of course, since Yubikeys are intended for authentication instead of encryption, new ones (with new seeds) can reissued for a user who has lost their old one.
Point 4. As per overview, capturing the passwords is pointless as the maths behind the internal pseudorandom number generator make predicting future passwords extremely difficult - as in governments give you millions of dollars if you succeed, difficult.
Point 5. You want it to be open source. Most common cryptographic flaws are not in the mathematical algorithms but the overall implementation. You want to know that any security expert on the planet can pull up a copy of the system and examine it for flaws as need be.
Point 6. As per earlier discussion.

1. Depending on configuration, as there are many other ways to use the Yubikey design.
2. Although I believe YubiKey is an open standard, so you could memorise the secret seed yourself if you really wanted to for some reason.


How to securely sanitize data tapes, and audit the results? I work at an electronics recycling facility and we were just presented with an offer from a client that would like to buy our used data tapes. Our problem is that we have never sanitized data tapes as we have only shredded them in the past. I need to know if data tapes have the same properties as traditional rotating magnetic media where a DOD 3-Pass wipe is sufficient to sanitize the device or if there is any hidden dangers that we must be aware of.

The only way we can move forward with the deal our client has proposed is if we can 100%, without a doubt, know that the data is unrecoverable. On top of that we must have a method to verify that the data has been successfully sanitized, and there is no remnant previous user data.

Typically we would use a hex checking program for checking our hard drives after they have been sanitized, but I'm not sure if that will reliably work for data tapes. If anyone has any experience with sanitizing data tapes (other than degassing, or shredding) please let me know how the task was completed.

Regarding the reuse of recycled tape; the business may appear sound but the technical parts are not. Even apart from the issue of securely wiping data, it is hard to determine if tapes were properly stored before they were sent to you for recycling. Magnetic tape is susceptible to mold damage if stored in high humidity conditions.

Unless it is used for forensic(skim data using non-traditional method) or other research purpose, the next viable step of recycling magnetic tape material is to create counterfeit/ after market product or even "refurbished as new".

Use of research or forensic techniques to recover data means that data not recoverable by normal methods doesn't mean the data can't be recovered at all. Any method that claims safe wiping of data by today's forensic standard may also be insufficient for future forensic methodologies.

If your facility signs any sort of strict data destruction agreement with a client, reuse of the client's tapes should be avoided at all costs. Your business would risk major legal liability if someone could prove your data destruction destruction facility didn't destroy the tapes.


Security monitoring in the cloud? I am working for a company which works with PHI, HIPAA, PCI and other highest sensitivity data. Their current security architecture uses hardware network monitoring tools to monitor the network connections between servers to detect security incidents and other abnormal traffic. They are looking to migrate their applications to the various cloud providers and are wondering how to do something similar there. Are there ways to guarantee network links are exclusively used only by specified hosts or components in the cloud? How would we monitor these connections, or can we only monitor requests coming in to our servers or applications? Is it just a case of trusting the provider's security claims and blaming them if there is a breach? Or can we maintain responsibility and control and should we? What are some other cloud specific security challenges that we might not be considering and how do we mitigate those? Thank you for any good info or references.

Are there ways to guarantee network links are exclusively used only by specified hosts or components in the cloud?

This depends on your cloud provider. Most cloud providers will allow this if for instance you want  them to build a full private cloud for them. If you are looking for this option to provide security in terms of availability by offering connectivity from multiple data centers, then yes you could ask them. But do note this comes with a price tag.

How would we monitor these connections, or can we only monitor requests coming in to our servers or applications?

You could opt to procure IDS/IPS or WAF systems (virtual or physical) to monitor these lines. Note that in the end you are working with a cloud provider to save cost on maintenance or provide scalability, so most likely the cloud provider will have access to it

Is it just a case of trusting the provider's security claims and blaming them if there is a breach?

Probably they have their ass covered with regard to such demands and they will put blame on you.

What are some other cloud specific security challenges that we might not be considering and how do we mitigate those?

The most issues I see in the real world is with regard to hosting information in certain countries. For instance banking information from Switzerland and Luxembourg can only be hosted in those respective countries and no where else. The one fabulous thing about cloud computing is that you can have geographical failover, which means distributing your data across countries. So if you have requirements in place that require you to not distribute information to certain countries (e.g. in Europe many companies do not want to have their information sent to datacenters in the US) than you need to make those clear as well to your hosting provider.

Finally I would like to add these comments:

First you need to understand why you want to move things to the cloud. Is this for more flexible computing, less hardware maintenance, reduced costs for operating a data center, etc... or is it because someone saw that the "cloud" (did you know cloud can be replaced with just "somewhere on the internet") is cool and decided to move everything there because he heard other people were doing it.

If you do require flexible computing and scalability it might make more sense to build your own cloud infrastructure so you have full control of your environment.

Many people believe cloud computing is about automagically getting cost reduction by not having to host your own hardware, but it's at its core not different from using a managed hosting provider.

Cloud computing at its core is about scalability, flexibility and availability. If you require these properties it makes sense to move your applications into a cloud environment, if you don't then you need to reconsider.


Does certutil -delkey actually delete the certificate and private key? I am trying to delete a certificate and it's private key using certutil -csp "Microsoft Enhanced Cryptographic Provider v1.0" -delkey "the key container". This gave me a command completed successfully message. I then check what is in the store again with certutil -store,
this still lists the certificate.  When i then try to delete again, it gives me KeySet does not exists.
Can someone explain what the -delkey option and why it still appears in the output?

certutil is one of the less-well-documented commands I know of. However, both by considering the existence of the -delstore command ("Delete certificate from store") and considering what a key container is probably doing, my best guess is that the command deleted the private key storage (and, presumably, any private keys it contained) but did not delete the corresponding certificate(s).
Does the certificate in question have an associated private key known to the system? You can find this at the bottom of the text output, somewhat indirectly - it'll say "Cannot find the certificate and private key for decryption" or similar if not - or you can use the certmgr.msc graphical tool to view installed certificates and ones with a private key will display this on their icon, plus have the text "You have a private key that corresponds to this certificate" in the General tab of the certificate info window. If it didn't now, did it have one before?


How and when do I use HMAC? I was reading HMAC on wikipedia and I was confused about a few points.

Where do I use HMAC?
Why is the key part of the hash?
Even if someone successfully used a "length-extension attack", how would that be useful to the attacker?

A message authentication code (MAC) is produced from a message and a secret key by a MAC algorithm. An important property of a MAC is that it is impossible¹ to produce the MAC of a message and a secret key without knowing the secret key. A MAC of the same message produced by a different key looks unrelated. Even knowing the MAC of other messages does not help in computing the MAC of a new message.

An HMAC is a MAC which is based on a hash function. The basic idea is to concatenate the key and the message, and hash them together. Since it is impossible, given a cryptographic hash, to find out what it is the hash of, knowing the hash (or even a collection of such hashes) does not make it possible to find the key. The basic idea doesn't quite work out, in part because of length extension attacks, so the actual HMAC construction is a little more complicated. For more information, browse the hmac tag on Cryptography Stack Exchange, especially Why is H(k||x) not a secure MAC construction?, Is H(k||length||x) a secure MAC construction? and HMAC vs MAC functions. There are other ways to define a MAC, for example MAC algorithms based on block ciphers such as CMAC.

A MAC authenticates a message. If Alice sees a message and a MAC and knows the associated secret key, she can verify that the MAC was produced by a principal that knows the key by doing the MAC computation herself. Therefore, if a message comes with a correct MAC attached, it means this message was seen by a holder of the secret key at some point. A MAC is a signature based on a secret key, providing similar assurances to a signature scheme based on public-key cryptography such as RSA-based schemes where the signature must have been produced by a principal in possession of the private key.

For example, suppose Alice keeps her secret key to herself and only ever uses it to compute MACs of messages that she stores on a cloud server or other unreliable storage media. If she later reads back a message and sees a correct MAC attached to it, she knows that this is one of the messages that she stored in the past.

An HMAC by itself does not provide message integrity. It can be one of the components in a protocol that provides integrity. For example, suppose that Alice stores successive versions of multiple files on an unreliable media, together with their MACs. (Again we assume that only Alice knows the secret key.) If she reads back a file with a correct MAC, she knows that what she read back is some previous version of some file she stored. An attacker in control of the storage media could still return older versions of the file, or a different file. One possible way to provide storage integrity in this scenario would be to include the file name and a version number as part of the data whose MAC is computed; Alice would need to remember the latest version number of each file so as to verify that she is not given stale data. Another way to ensure integrity would be for Alice to remember the MAC of each file (but then a hash would do just as well in this particular scenario).

¹  “Impossible” as in requiring far more computing power than realistically possible.


How dangerous is a virus introduced to a malicious website in chrome? I am using Google's Chrome browser under Linux (Ubuntu) 64 bit for web browsing.

If I a virus uses for example a leak in the flash player, the virus will get the privileges of the user who started the browser, in my case a normal non-admin user.

Each tab in chrome is separated in a different process and I know that applications are directly prevented from modifying each other's memory addresses because they can't see it. So if I have two tabs open. In one tab there is my twitter login page, in the other tab there is the malicious website with the flash malware. If the tab (process) with the flash player gets infected by the virus, is the virus separated from the tab (process) where my twitter login is? This would mean that the virus can only sneak passwords etc. in the tab (process) where the virus exists. If I will use my Twitter password in the other tab, the password is only in the memory of this tab and cannot be seen by the infected tab (process) right?
Another point is the sandbox of google chrome. If the virus uses a leak in the flash player to control the process where this tab is executed, what can this virus do? I think a successful usage of a plugin leak will bring the virus only in the sandbox and what can it do inside this sandbox? Can it read my personal data from my home folder, or sneaking passwords I use in the browser?

First you have to understand what a sandbox is. It is not like a virtual machine where the things running inside can do whatever they want. The Chrome sandbox controls access to the outside by providing a limited set of APIs with stricted parameters. Some Chrome sandboxed processes are not allowed to write to disk or display anything to screen.   What exactly they can do is controlled by an explicit policy.

Escaping a sandbox means doing things that are not specifically allowed by the sandbox.

Read more about Chrome's sandbox from the Chromium homepage and The Security Architecture of the Chromium Browser

You said:

  This would mean that the virus can only sneak passwords etc. in the
  tab (process) where the virus exists.

"Sneaking passwords" means that the exploit has access to memory and can execute code. That means it can do anything on the system. Read more about the concept of sandbox.

In the context of sandboxes, the closest thing you talk about is a partial sandbox escape where an exploit (the generalization of what you call a virus) for example, can read arbitrary memory of the process it is running under. This is still a vulnerability and it can be combined with other vulnerabilities to realize a full sandbox escape. Google will pay you money for a partial exploit.

  $60,000 - “Full Chrome exploit”: Chrome / Win7 local OS user account
  persistence using only bugs in Chrome itself.

  $40,000 - “Partial Chrome exploit”: Chrome / Win7 local OS user
  account persistence using at least one bug in Chrome itself, plus
  other bugs. For example, a WebKit bug combined with a Windows sandbox
  bug.

  $20,000 - “Consolation reward, Flash / Windows / other”: Chrome / Win7
  local OS user account persistence that does not use bugs in Chrome.

Flash is not completely sandboxed in Chrome, so some exploits can be contained by the sandbox while others not. The contained ones will not be allowed by the sandbox to access your sensitive data. The other ones will run free on your system.


Computer virus names and their aliases At this VirusTotal report we have detected a set of viruses with different names.

Every antivirus system provides its own virus names. Is it possible in some way to get a common virus name based on these aliases? Is there any online database that can provide such kind of service or something like that?

The quick answer is "no".

Each anti-virus vendor examines the malware samples they find, determines a detectable "signature" for each, and creates a name for the malware.  Malware names are often derived by the examiner who is looking at the unique text strings contained within the malware.  Every few days they send an update to their paying clients with the new signatures and labels.

The anti-virus vendors don't often cooperate with each other because they're in competition.  If my WowAV!! product detects 1,000,000 viruses, that's a reason I can market to people why they should buy my product over the competition, YawnAV, which only detects 900,000 viruses.  So they don't share names, they don't share signatures, they don't share analysis.


What are Encryption/Decryption Key Management Best Praticies I am developing a web based application that will be employed by numerous third party organisations
in numerous countries around the world.

The browser based client will feed sensitive data into a shared back end database.

All organisations in all countries will Read/Write data into the same database.

I wish to encrypt the data entered within the browser so that its safe while in transit
to the back end database. e.g. client side encryption.

I also wish to encrypt the data while at rest in my database.

This application will be developed using Java, Javascript (REACT.js), and Scala.

The backend database will be MongoDB.

I cannot find a good Key Management example/description e.g. how a key is properly generated,
distributed, stored, replaced, deleted, and recovered during its life time.

I have the following choices/decisions to make:-

Flavour of encryption, e.g TripleDES, RSA, Blowfish, Twofish, AES etc..
Key(s) Symmetric/Asymmetric and its/thier length
How should I securely distribute the keys to my clients.
How to keep my keys safe on my back end servers.

If keys should have a lifecycle of generated, distributed, stored, replaced, deleted.
How do I decrypt data that was encrypted with Key0 when I am now using Key1, or Key2?

How should I store my multiple keys for my multiple clients to enable me to encrypt/decrypt
each clients data.

That is a very, very broad question. You should split it up into several questions. As it is, it would fill an article.

General Encryption

For data at rest, use symmetric encryption. Asymmetric is way too slow anyways (most so-called asymmetric encryption is actually hybrid).

Use AES. Because it's the standard, it has the most eyes that looked at it, you will never have to explain why you picked AES and not something else, and the performance etc. advances of some others are unlikely to come up in your application in a meaningful way.

Also, MongoDB supports AES out-of-the-box.

Keys

Your DB keys are the crucial ones. Keep them securely locked away and keep a few backup copies stored securely (i.e. encrypted). Key generation is its own topic, but probably MongoDB handles that for you already, check it.

TLS

For communication, use TLS, aka HTTPS. It's the standard, all browsers support it and all webservers support it.

Certificates

If you want to use client-side certificates, as your question about key distribution indicates, read up on PKI. That's too much of a topic to put into a textarea field on SE. :-)

That should get you started in the right direction. For more details, I advise you ask more questions with a more narrow focus.


Webservices exploitation / axis/services/AdminService?Method=AdminService I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services.

I have a sandbox (can't post live URLs...)

I'm trying some stuff to try to exploit axis/services/AdminService?wsdl

I am looking for a good tool to do this or an article to read to get some extra knowledge about pentesting web-services.

This looks like .NET WCF / WSDL service, you can access it with Visual Studio  but also any other WSDL client would work, but with this one you can actually access all objects, so you can properly hack it. It is created and debugged the same way:

http://www.youtube.com/watch?v=rrdpjrGojO8

Basically in this kind of service, you need to have SSL (HTTPS), Session (which is supported, but you need to make authentication) and Transactions (also supported).

It should not expose any objects or classes by default (in the XML you got with ?wsdl), but only login (authentication). You can wrap it in high level single object and encapsulate other methods to it, so it doesn't expose much, like getCommand().

It can also require certificate on the client side and firewall protection.

For hacking such services, there are not many useful tools, because it depends on how you code it, so you can get any WSDP / SOAP client and check it out yourself.


Need a time consuming symmetric encryption I have a database with millions of entries, each entry encrypted with a (different) password. Normally, only one entry is needed at a time. If somebody steals the database, I want to make it hard for them to get the data, even if they know the passwords, by making it very time consuming to extract all the information. Such as: If decrypting of one entry takes 10 seconds, decrypting of 50 million records takes years.

What approach would you suggest?

You can basically choose decryption time by jacking up the key length - have a look at http://www.javamex.com/tutorials/cryptography/rsa_key_length.shtml.

The only thing is though that encrypting with the longer key also takes significant time (though, exponentially less than decryption); so you're probably going to hit an upper bound where you're not willing to spend a month encrypting millions of rows.

Symmetric encryption tends to be fast, much faster than asymmetric, and tends toward algorithms where decryption and encryption times are very similar (since you're basically doing the exact same math backward). In a case where you can choose and you want slow, go with something like RSA.


Is my pseudo "password manager" solution secure? My solution to store passwords is just using this free program, SafePad, and then writing in a document all my passwords, plain text; for example a line might be

  Facebook.com - user: johnsmith - password: prettyball00ns

The document is then encrypted with two passwords. I have various backups of this document spread in a few different places (so losing it is completely unrealistic). I have also saved the code and the .exe of SafePad in all those different places, just in case.

Now, I know I am vulnerable to things like keyloggers (that could record me typing my master passwords), but so are the other types of password managers I think... I am writing here to know: is my approach bad? Could I do better? If yes, how?

I can see a couple issues:

1. You are still vulnerable to phishing.

Using a proper password manager will protect you from a site using homoglyphs to look like the official site. For example, fаcebook.com and facebook.com. They look identical, but on the former, the a is not the Latin a, but the Cyrillic version. You cannot visually identify the forgery.

2. You cannot easily generate TOTP tokens

You can save the shared key on your password file, copy the key and use another program or script to calculate the token for you. But would you? Probably not.

3. Backing up by hand is a hassle

You can forget to backup after a critical password change and get locked out, or at least have to reset the password. You may end up with different sets of files, and have to remember which one is the most recent. You have to be disciplined to replicate every change among your multiple locations.

4. Browser integration and user interface

This is more a usability issue. With a proper password manager, you get a dialog box to save any new login on its database, and to change the stored password when you change it on the site, you can audit your passwords to see the age of each one, you can auto-generate strong passwords without being bitten by the lack of randomness every human suffers from, and so on.

There's a saying don't create your own crypto, unless you are a cryptographer. I would say don't invent your own password manager unless you are a security savvy, expert programmer. There's lots of password managers around, just choose one and be happy. And safe.


The reason of using XOR operation in cryptographic algorithms I notice that some cryptographic algorithms involve using XOR operation with the key (Even AES uses XOR to derive the round keys). My question is why specifically XOR? How about OR or NAND or some other logic operation. I believe there is a reason behind choosing XOR instead of other logical operation but I really do not know it.

Thank you

XOR is an operation that can always be reversed, all information is retained.  It is as simple as that.  Using AND and OR may result into information loss because you cannot tell if certain bits were either 1 or 0 in the operands.

Playing a little with the python repl, we will use 19 (10011) and 5 (101) since these numbers make for good examples.

Using OR you lose the information about which of the operands had a certain bit on:

>>> bin(19|5)
'0b10111'

Isn't that 19?  Yep, that's 19.  The resulting number cannot tell us that it has been ORed with 5.

Using AND is the same:

>>> bin(19&5)
'0b1'

That's 1.  There is not way for us to recover neither number (19 or 5) easily, we lost information again.

XOR is good for cryptographical tools because you do not lose information when XORing:

>>> bin(19^5)
'0b10110'

That's 22.  Apparently that does not tell us much, but see this:

>>> bin(22^5)
'0b10011'
>>> bin(22^19)
'0b101'

You can recover either number by XORing the 22 with the other number.  That's a very primitive conception of a secret key.  Assuming that you and someone else can have a huge list of very big and random numbers (both of you have the same numbers), you can simply XOR messages and then securely exchange between yourselves.  As long as you guys use a different number every time you communicate that is a secure algorithm.  The algorithm is called an one-time pad.


Encrypt with private and decrypt with public Above picture is captured from iOS Security overview at page 25. The path encrypt with public and decrypt with private makes sense. But the other path, encrypt with private and decrypt with public to recreate plain text is something i am not able to understand. If it is just for integrity check, then that should be fine since we will be only worried about tampering. But if the secrecy of the text should be maintained, shouldn't this pose a problem when decrypt with public key?

Can someone help me understand how this path is still secured?

This is the path used when proving the encrypted data hasn't been tempered with, commonly known as a digital signature[1].

The part the diagram leaves out is that the commonly accepted technique for digital signatures is to use a hash function, like SHA-256, to represent the data, then sign the hash.  It reduces the amount of data being transmitted and reduces the amount of data available to an attacker to reverse engineer the private key.

Also, as a nit, the encrypted data would not be the same in the two paths as shown in the diagram.  So it's good not to take simplifications too literally.

[1] http://en.wikipedia.org/wiki/Public-key_cryptography#Inverse_Public_Key_Encryption


Relay Attacks on Bluetooth LE Is it possible to perform a relay station attack on Bluetooth LE? For example if I installed an August smart lock or similar on my front door (which uses BLE to communicate with my phone to decide whether or not to unlock the door based on RSSI), would someone be able to perform this attack and get into my house even if I was hundreds of meters away from my house? Or even inside my house?

If it is possible, are there any techniques I could use in a similar application that would make it more difficult/impossible?

There is an interesting paper which talks about securing IoT devices such as smart locks - http://www.eecs.berkeley.edu/Pubs/TechRpts/2016/EECS-2016-11.pdf

It has a section on relay attacks, which can be summarised more or less as:

Systems can under some circumstances use the GPS location of the mobile as a countermeasure for relay attacks, but:

this depends on the system knowing about GPS locations, etc and
apparently GPS location can be spoofed anyway

Otherwise they say there's nothing you can do to mitigate bluetooth LE relay attacks without requiring hardware changes or similar kinds of low level things.


XSS - Setting Values and Attributes w/ jQuery I was looking at the answer here and got curious if a function I use may be susceptible to XSS. Mostly because of this statement:

Some HTML attributes are inherently dangerous. This includes href,
since you can do something like javascript:alert("XSS");. Since you
make sure the value will always start with http you should be fine,
though. Other examples of dangerous attributes are style and JS event
handlers.

In my function you will see that the form action url and the input value are both set using jQuery.
$("#test").on("click", function(){
    let id = $(this).data("id");
    let url = 'test.php';

    let form = $('<form method="POST">').attr({"action":url, "target":"_blank"});
    let input = $('<input type="text" name="id">').val(id);

    $('#page').append(form.append(input));

    form.submit();
});

I am setting the input value to the value of a data attribute and setting my form action url. Is this susceptible to XSS?
Edit:
To explain some on where id is coming from, it is coming from a row that has data-id as one of its attributes. When a user clicks on this row, the function is triggered. This id could be altered by using the Inspect tool in browser.

You definitely don't have to worry about setting the action on your form.
This is because it isn't being set from user input.  The issue isn't setting it, but setting it based on user input and therefore potentially setting it to a dangerous value.  If you control what it is set to then an attacker can't inject anything, and therefore there is no avenue for XSS.
Also, I'm not sure if the form action has the same potential issues as a link href does.  I've never tried setting something like <form action="javascript:alert(1)"> but I'm 95% sure that it won't work.
The way you set the input value is fine too
It is unclear if the value you are setting the input to is controllable by a user (and therefore an XSS vector).  It depends on where the id data in this comes from, and whether or not it comes from a user.  However it shouldn't matter.  You can still set values safely, even when they contain user input, by using the proper JavaScript methods.  As a slightly different example this is perfectly safe:
element.text = [USER_INPUT];

While this is not:
element.innerHTML = [USER_INPUT];

In the case of the former, you are explicitly telling Javascript that you want to take some data and set it as the "text" for element.  As a result the browser will treat your content as plain text - never JavaScript.  The latter tells the browser that you want to take the input and treat it as HTML.  Since HTML can contain JavaScript, this would be an XSS vector.
In your case you are using the val method in jQuery.  Whether or not this is safe from XSS depends on the underlying method jQuery uses to set the input value.  I haven't looked in a while, but I'm 95% sure that jQuery just sets the input.val property.  Doing this is safe, and can't trigger any JavaScript, so you're fine even if id contains user input.


Handling secrets and environmental variables in Docker-k8s-skaffold dev environment Basically, trying to wrap my brain around how I should be handling secrets using Docker, k8s, and Skaffold in a dev environment. I'm pretty new to this tech, so don't fully understand all of it.

Just not sure if I should be using a .env, or config.json, that isn't committed to the repo, or if there is a better way with using Docker.

Ideally, I could just refer to process.env.API_KEY in my code, regardless of environment, and it would just work and grab the correct environmental variables. If it is in production in AWS, it would just grab the keys from Key Management Services. In production, it would just grab them from where ever.

Did come across this, which seems to apply to Docker Swarm so may not be relevant:

https://docs.docker.com/engine/swarm/secrets/

So what is the best practice using Docker, k8s, Skaffold for handling environmental variables and secrets in developement?

Generally best practice in this kind of setup is to make use of some kind of secrets management tool. The theory is that you want secrets to be injected into containers at runtime and restrict who has access to them as much as possible.

For Kubernetes, you can use the in-built secrets resource type. There's some good documentation on it here.

One thing to watch for is that you need to enable an additional option to ensure the secrets are encrypted at rest. There's documentation on how to do this here.

If you want something more flexible, or with additional features, there are a wide array of third party secrets management tools available. Hashicorp Vault is one of the more used options here.


Is SSL key generation client-side, server-side, or both? Who generates the session keys for a SSL symmetric encryption? Is it the client for both client and server where client generates part of it while the server generates the other part?

In SSL protocol handshake both sides generate the same encryption key which is then used for the session. It is done following this procedure, in general:

Client & server generate each a random value and send to each other
Server sends the public key to the client
The client generates a value called "pre-master secret" using both random values, and encrypts it using server's key, then sends it to the server
Now both client and server have each other's random values and "pre-master secret", so basing on this information they can both generate the same session key and start using it in encrypting the following messages.

See detailed protocol description for more in-depth explanation.


Does use of OpenID Connect for login imply Google can impersonate my users? I am looking at integrating Google OpenID Connect (OAuth 2.0 for Login) as a login option for a web application.

https://developers.google.com/accounts/docs/OpenIDConnect

My question: Does use of OpenID Connect (and similar schemes) imply that Google could impersonate my users, log on to my website, and access all their data there?

My guess is that the answer might be different for the "server flow" versus "implicit flow" (see Google link), with the latter involving javascript in the browser.  But depending on underlying implementation on Google's side, I'm not sure about either.

I don't believe Google has any interest in committing criminal acts of unauthorized network access, but on the other hand, a vulnerability is a vulnerability and I want to understand the real relationship of the systems.

The verification is not directly performed by you, so in principle yes, Google could fake the identity of any of its users upon authentication.

What happens during the authentication is that your service contact Google OpenID provider and asks: "who is this user?". Google answer will be along the lines of "this user is foo.bar@gmail.com and I have verified it". It's a matter of trust. You have to trust the authentication provider to perform that verification.


SSL Protocol Support If I connect to a server using a specific SSL protocol version, but no cipher-suites are offered under that protocol, would that protocol still be considered supported?

For example, connecting to a server using SSLv2: the server accepts my SSLv2 client-hello, but in the response there are no supported cipher-suites.
SSLv2 is insecure and should never be supported, but if the protocol is enabled and no cipher-suites are available, is that still considered supported?

A protocol version is considered supported if you can successfully finish the TLS handshake with this protocol version. Since a successful handshake includes a key exchange which requires a cipher it does not count as successful if no common cipher can be found.


How do I encrypt a private key before sending it to another person? I have a private key for SSL certificate that I need to send to another person to install it in their server. How do I encrypt it before sending? I use PuTTY. Can I simply load the raw key in PuTTY and then go to Conversions > Export OpenSSH key and provide a passphrase? Is that how I encrypt it?

Is there another way to do this with linux command?

This is the wrong approach. Rather than attempting to encrypt private key, let the user of the key generate their own private key and give you the CSR, this massively simplifies key management.


how to circumvent ASLR without pointer leaks is there way to circumvent ASLR without pointer leaks, I mean i read many exploit development course Syllabus and many of them talk about bypass ASLR without pointer leaks, Does anyone can explain to me how it is.

i read
How "leaking pointers" to bypass DEP/ASLR works
How do ASLR and DEP work?

There are ways, but they depend on the context of exploitation. No one size fits all I'm afraid. Some example techniques of bypassing ASLR;
- Partial address overwrite
- Brute force
- Using non-ASLR libraries.
- Non-PIE binaries
- Forcing a non-ASLR library to trigger
- Heap spraying

I'm sure there are more techniques I missed. But life is a lot easier if you can get a memory leak.


Hiding remote database credentials in application If I'm building an application that connects to a remote database, where should I hide the credentials?

I've seen many suggest that you go through a web-application and use POST and GET requests to communicate with the database through the web-app. Now the website should then have some sort of password. Where do I hide these credentials in my application?

You don't try to hide them. Anyone with access to the application and sufficient incentive will be able to find the credentials.

So what do you do instead? It all depends on what you're trying to restrict. If it's an app for anyone to download and use then you may not need any credentials. A step up from that would be to generate and store a security token after the enduser enters any required data (ie. registers). Or you can have the end user enter credentials that have been assigned to them (eg. a user name and password). The point is that each user/device gets a unique identifier that can be revoked if needed and if found by the user doesn't give them access to anything beyond what they already have access to through the app.

The reason using POST and GET are suggested is less about the authentication process and more about limiting and controlling what it is that the app can do. With a REST (or similar) interface you can program various validations of the data coming from the app and you can do it on a piece of hardware (the server) where you have full control. Using an interface like that also means you don't have to open up full access to the database as you would only program the functions your application actually needs.


Is it possible to become infected with virus, trojan or malware by browsing the infected sites or running installation .exe? I am quite paranoid and I am always afraid that when i accidentally open some infected sites it would run scripts that automatically download malwares, viruses and trojans into my pc and run by themselves without prompting the download window.   Do browsers report every download or is it possible to circumvent it in some way that initiates downloads? And is it possible to have malwares, trojans or viruses that could infect your pc without having you download something -- but instead through text-based or web-script based means of transmission? How safe are popular browsers such as google chrome, firefox etc.. and in comparison, very outdated ones such as windows IE. Does the type of internet protocol (http, https matter in this regard?

Also for malwares and adwares, do they infect your computer with undesirable elements immediately when you run the installation .exe files, or does it require for them to finish installation? Generally is it possible to check what kind of changes a program makes beforehand or afterwards, and is it possible to block the changes it wants to make midway if you have found out its a malware or adware during installation or with the process running already. I think windows by default would notify you if a program wants to make changes to your pc but usually i disable that since the default behaviour of that windows function is too annoying...is there an alternative solution that could detect changes made to computer and halt them only when you request for it, or that the program is included in some kind of online blacklist?

I suggest you check out https://en.wikipedia.org/wiki/Drive-by_download.  It is possible to exploit vulnerabilities (some known some unknown) in browsers or (more often) browser plugins to download (and sometimes execute) files without your knowledge (unless you know where to look). More often the adversary will try to get you to click on something masquerading as legitimate (as this is easier for him).

As for browser safety modern browsers use a number of tricks like sand-boxing to separate malicious code on the websites you visit from affecting you but nothing is foolproof.  Please don't use an old IE or any out of date browser or plugin (patch regularly).

Best thing you can do for yourself besides patching is don't go to dodgy websites and don't click random links you have no reason to trust.  If you have to go to a site that is suspicious do so in a clean virtual environment that has no sensitive data inside it.


Restrict compilation to certain machines I am a software developer in a big company. I just realised that I could technically clone the repository of my employers git repository. The infrastructure is in docker images.

So technically this is all I need to recreate the web server on my local laptop or another Server. Of course, I wouldn't do this. I don't think my employer should have so much trust in me or us employees. So my questions are:

Is there a way to restrict the code compilation to certain company computers?
How do other companies handle this issue?

For 1) the answer is sort of no. There are tools used to restrict code to a particular machine in various fields, by physical tokens, licence keys etc, but none are foolproof (DRM, or Digital Rights Management doesn't work) so the important bits are all in your question 2)

Various mechanisms should be in place:

Theft is typically a criminal offence, so employees know that if they steal code they could end up in prison. This works rather well as a deterrent, however as it is not preventative, most companies will also have
Data Loss Prevention tools, that will monitor for and alert on unapproved exfiltration of data
Access controls on the repo such that only those people who require access will have it, and then only the minimum required for their role
Searches for their code across Websites, online repos, or criminal trading sites

And various other tools depending on requirements.


MongoDB Nosql injection in python code Here is the code snippet for accessing to MongoDB.

client = MongoClient()
db = client.test_database
collection = db.test

# Get data from fields
condition = form.getvalue('name')
if condition:
    where = {"$where": "this.name == '"+condition+"'" }
else:
    where = ""

I was told this code is vulnerable to NoSQL injection since condition variable is not properly sanitized. But I could not figure out how the injection works with python. Can anyone give me an example like what input may cause the issues or some references to related injection attack? By the way, I also did some research by myself, but only found the injection based on Javascript and tried not working in this case. Thanks.

The $where operator in MongoDB is a feature which is best avoided. Its performance is abysmal, and not just because it doesn't benefit from indexes. Almost every common use-case can be solved much more efficiently with a common find-query or aggregation, especially one as trivial as this. But this is security stackexchange, not stackoverflow, so let's focus on the security implications.

The $where statement passes a javascript code snippet to the database which the database will then execute once for each document in the collection. Thankfully this script has no access to the db object and other dangerous shell functions and it works on copies of the documents, so the attacker can at least not change the database content like with many SQL injections. But it is for example vulnerable to attacks where the attacker wants to return other results than intended.

Let's make up an example. Let's say we have a blog. Our blog has lots of articles which can be read public, but we also have some private articles which are for our internal use and not supposed to be published. So we have a field hidden in our documents which can be true or false depending on whether or not our visitors are supposed to see the article. Our MongoDB query to get a list of all articles in a certain category for displaying it to the website visitor looks like this:

db.articles.find({"$where": "this.hidden == false && this.category == '"+category+"'" });

That should make sure nobody looks at our hidden articles. Or does it? When the user controls the category-variable, they can set it to this string:

'; return '' == '

The resulting Javascript snippet which gets send to the database is this:

this.hidden == false && this.category == ''; return '' == ''

When you have a javascript snippet with multiple commands separated by ;, they will be executed as a function and a return statement is needed to determine which value will be passed back to the caller. This function will always return true. That means the user will also see all articles in our collection, including those which are supposed to be hidden.


What is the impact of "urgent Firefox update" malware? Yesterday I was setting up my new windows laptop and while browsing on Firefox I got a webpage saying "urgent Firefox update is available" and I accidentally executed it.
I immediately realised that it was a malware and immediately uninstalled Firefox. I had my Facebook and Gmail logged in on Firefox and have since changed their passwords.

Is there anything else that I should be concerned about?

It is a brand new laptop so I don't have any personal data on it. So that is not a worry.

On a side note, when I installed Firefox back, I was already logged into FB and Gmail. I am not sure if it is because of the malware.

If it is a brand new laptop I would just reinstall the OS.

The malware that you executed will not be fixed by removing Firefox. If your computer had more time invested in it, it may of been worth while trying various malware/virus detection/removal products. But as it is brand new just reinstall the operating system.

As for what effect it could have, did it prompt to "make changes to your computer"? If yes and you clicked yes, then the malware could do almost anything, from installing new software, to modifying the operating system, to installing device drivers.

The most common thing for malware to do is to install something that autostarts and contacts another computer and requests instructions. These instructions are normally either to be part of a botnet, being part of a DDoS attack, sending spam emails, clicking on ads on webpages. Or installing crypto-locker which would encrypt all your files on your computer and demand money to decrypt. There are lots of other things this could do, these are just some examples.


How can the authenticity of releases on GitHub and GitLab be ensured? Can their hashsums change? To help ensure authenticity of packages some projects on GitHub and on GitLab add hashsums to the descriptions of the release on the Releases page.
Sometimes, at least here, the hashsum are made part of the release's filename. Sometimes, at least here, a script generates a file with hashsums that's uploaded to the releases.
However, many projects don't add these hashsums to their releases. They aren't automatically added and not always posted in a findable way somewhere else on the Web.
I proposed adding hashsums to the Releases page of Kodi but was told that the hashes (of files in the Releases of a GitHub project) can change in the case of GitHub. Is that really true? Doesn't this diminish the authenticability of builds/files distributed this way?
I think ensuring authenticity of builds requires at least:

them to be reproducible (reproducible-builds)
a mechanism to verify that one has the reproducible software and not something else
a mechanism to allow developers to authorize, sign and audit the software/changes to it
a mechanism to ensure that the reproducible software is installed - and remains unaltered - and not something else.

I thought that a very easy-to-implement and convenient step towards this for projects distributed via GitHub or GitLab would be simply adding hashsums (e.g. simply the SHA256 hashsum of the tarball or .deb file). What would a more complete mechanism look like? And more importantly: can hashsums of GitHub releases really change? Why and wouldn't this mean that the authenticity of releases there can't be ensured? How come some projects add them to release's description in that case?

GitHub dynamically generates a tar.gz file when a user downloads a source release for a git tag. The hashes for those files are not stable, as they are dependent on the versions of git, tar, and gzip involved. These hashes have changed in the past, which has affected various package repository/build systems.
Source: https://github.com/libgit2/libgit2/issues/4343#issuecomment-328631745
Another issue listing issues from projects bitten by this before: https://github.com/spack/spack/issues/5411
The best way to get verifiable source dumps from GitHub is to clone the repository and check out the commit hash associated with the tag. The next best thing is to have the project generate its own tar.gz files and upload them as release artifacts, but that's a lot of extra work for little return (I'd only recommend it if the project gets a large amount of download traffic).


Tweaks related to javascript execution in browser Suppose, a filter validates the url, but not the protocol. In that case I can XSS that field with the following payload

javascript://%0D%0Aalert(document.domain);//validurl.com

You can paste above payload in chrome URL bar to see that it executes.

[In above payload // comments out code and %0A takes the code outside of comment.] Here we have added stuffs between protocol and URL to execute xss.

The problem:
I am trying to insert an arbitary letter,followed by(//),followed by colon(:)  ahead of protocol (instead of between the protocol and URL as shown in example above) , something like:

a://%0Ajavascript:alert(document.domain);

But the above payload won't execute in chrome. Is there any workarounds for this?

According to my test, I have found that the payload is valid but is not executing in Chrome. That is because of Chrome's browser based XSS protection. You need to turn it off so it will execute in Chrome. In Google Chrome, some XSS attacks are prevented using this protection. For disabling Google Chrome's XSS protection open it using the flag below:

  googlechrome.exe --disable-xss-auditor

This will disable the XSS auditor of Chrome and the payload will work well.


Verify Quad9 is working Disclaimer: I am a complete neophyte.

I set 9.9.9.9, Quad9, as my DNS in my router's configuration.

How do I verify Quad9 is working and that I am benefiting from its features, especially encrypted DNS and DNSSEC?
Do I need to use a client on each computer/device, or does configuring my router make it work for the entire network?
If using encrypted DNS and HTTPS (only), am I protected from snooping, including by my ISP?
Is it bad to use encrypted DNS with Tor as mentioned here: https://www.privacytools.io/providers/vpn/#info ("However you shouldn't use encrypted DNS with Tor.")?

How do I verify Quad9 is working and that I am benefiting from its
  features, especially encrypted DNS and DNSSEC?

Did you specifically install, enable, and configure those features? Also, what protocol for encrypted DNS did you set up (DNS over TLS, DNS over HTTPS)? Pointing your router's DNS setting at a different server doesn't automatically activate new protocols and features.

  Do I need to use a client on each computer/device, or does configuring
  my router make it work for the entire network?

That depends, are all of your devices pulling DNS settings from DHCP, and is the advertised address that of the router itself? It will depend on the individual device. If you cannot change settings on a particular device, you could add firewall rules on the router to force all DNS traffic to use the router's DNS forwarder.

  If using encrypted DNS and HTTPS (only), am I protected from snooping,
  including by my ISP?

Assuming you are only using those protocols, the ISP can still see the IP addresses you are connecting to, which can sometimes be enough to determine the website. Also, the TLS SNI header (unless using the encrypted SNI extension to TLS) can reveal the hostname of the website in plaintext (e.g. example.com).

  Is it bad to use encrypted DNS with Tor as mentioned
  here: https://www.privacytools.io/providers/vpn/#info ("However you
  shouldn't use encrypted DNS with Tor.")?

The link you provided already contains some reasoning behind this, although most users are just using the Tor Browser and DNS isn't even used on the user's end (the Tor network will make DNS requests on your behalf when you make connection requests to Tor's proxy). So this would only matter in certain circumstances; I would say that page is slightly misleading.


How safe is dm-crypt/LUKS? Would TPM make me more secure in this case? I’ve been looking to purchase a new laptop and I need to have security in mind. I’ve specifically been looking for laptops with discrete or integrated TPM because it’s been my understanding that TPM would improve disk encryption security, but after doing some more research I’ve heard a lot of sources saying that it doesn’t really make a difference and some go so far as to suggest TPM has unpatched vulnerabilities and may even be backdoored by intelligence agencies such as the NSA.
For someone such as myself who is becoming more active in activism and investigative journalism, should I bother with TPM? And how safe is dm-crypt/LUKS? I currently use Linux Mint which I believe uses LUKS by default for disk encryption and I’m wondering how vulnerable it is to attackers with physical access to my laptop.
(P.S I’ve heard of Qubes but at the moment I’m unable to use it. In my case I’ll be using Linux Mint + AppArmor and sometimes Whonix when appropriate.)

"should I bother with TPM?"

Yes. Could help you against low-level adversaries and maybe even against the NSA in case it is not backdoored.

"And how safe is dm-crypt/LUKS?"

Safer than no dm-crypt/LUKS.

"and I’m wondering how vulnerable it is to attackers with physical
access to my laptop."

Very. Depending on your setup and the attacker it would be possible to install a camera somewhere to watch you typing in your password, install a hardware keylogger, modify other parts of your system like /boot, bootloader, BIOS/UEFI, disk firmware, ...
TPM + Secure Boot could help you with some of those.


SAML for transporting authorization information I'm thinking of using SAML for sending authentication and authorization information to system. I plan to send roles and other information as authentication attributes in the assertion.

Does this sound like good idea or do I have to look into using XACML?

As Guido points out in his comment, it largely depends on the target system. If the target system has clearly defined APIs / interfaces you can protect, then XACML would make more sense (XACML has an architecture whereby a policy enforcement point intercepts a flow and sends off an authorization request to a policy decision point).

If, on the other hand, the target system doesn't have APIs (e.g. it's mainly a web UI / portal), and if the target system has a rich role-based / claims-based authorization model within it, then you should aim for attribute statements inside your SAML assertion which can be used as assertions / claims in the target system.

The benefit to SAML over XACML in this scenario is that it's probably less disruptive. The benefit of XACML over SAML is that it's more fine-grained and can take care of context (time of day, device...)

You can still use XACML on the IdP side when the SAML token gets issued to provision claims inside the SAML token.

So, what is it you want to protect? Do you control the target system?


Swatch installation's issue to detect intrusion I have installed snort and I want to use the swatch tool to send me an email when it detects something going wrong. I am using OSX and I followed the installation guide: http://www.snort.org/assets/188/Building_Snort_for_Mac_OS_X.pdf

In the .swatchrc file, I added these lines:

watchfor /Priority\: 1/i
mail addresses=USERNAME\@DOMAIN,subject=[SNORT] Priority 1 Alert

I put swatch as a daemon:

sudo swatch --daemon -c /etc/swatch/.swatchrc -t /var/log/snort/alert

and finally wrote a plist file in order to launch swatch at boot time. The problem is tht I don't receive anything when I connect to my os with an ssh connection from an other device. Could someone help ?

(Here's the plist file

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://
www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>Label</key>
        <string>net.sourceforge.swatch</string>
        <key>KeepAlive</key>
        <false/>
        <key>RunAtLoad</key>
        <true/>
        <key>ProgramArguments</key>
        <array>
                <string>/usr/local/bin/swatch</string>
                <string>--daemon</string>
                <string>-c</string>
                <string>/etc/swatch/.swatchrc</string>
                <string>-t</string>
                <string>/var/log/snort/alert</string>
Page 16 of 17        </array>
        <key>ServiceDescription</key>
        <string>Swatch 3.2.3</string>
</dict>
</plist>)

By default, swatch uses sendmail. Check to make sure sendmail can successfully send messages from a bash prompt. The second step to debugging this issue would be to actually read your /var/log/snort/alert file to see if any helpful information exists there. The solution to this issue is very likely a need to configure sendmail properly. There is the chance that it could be sitting in your queue, but not delivered, according to this user's case.


Recommended practice for laptop encryption: nested encryption? Until now I have used a laptop that has a single folder encrypted (using filevault2)
containing my passwords and bank stuffs.

I am getting a new laptop that encourages full-disk encryption. This would be attractive,
but I want to be able to hand my laptop to a colleague or student for half an hour while
we're working on a shared project, and not need to even to worry about password security.

Conceivably this could be done by having an encrypted folder nested inside the whole-disk encryption
(two layers of encryption).

Is this a bad idea?
The encrypted folder (bank details, etc.) is not heavily used.

Nested encryption is usable as an access-control, but doesn't help against all the other problems you get with sharing identities/systems which is something you may want to consider as well.

Handing an unlocked laptop over to someone else is pretty much always a bad idea, if only for attribution. Don’t share accounts, including computer accounts. Pretty much all modern systems allow for easy multi-user computing with fast user switching. If you both need to work on the same file, Apple, Microsoft and Google support this using iWork, Office and Docs.

Computers and user accounts are personal items. Treat them like your underwear: you should be the only user.

To elaborate on the 'handing over an unlocked system' part, this basically means that you are no longer in control of what happens from that point onward. Even without malice in mind, this is not something you should accept. Because the system is 'yours' and your account is 'you', this means that everything that happens on that system is attributed to you. At the same time, many external systems might still assume that if it is your system accessing or doing something, it must mean it is 'you' doing the thing or accessing the stuff. It cannot differentiate who is at the controls, only what requests are made and served.

A scenario:

You hand over your unlocked system to someone else and need to do something somewhere else where you no longer have the machine and its user in sight. At that point, the (non-malicious) user might be doing the intended thing, like looking up some data or filling in some forms. A popup might appear, or a site might be visited which after interaction or sometimes even without interaction persistent malware is introduced to the system. The user might not know this, or might not care, or forget about it or even assume this is intended as your system might be setup in a way that is different from what this user is used to. You return and after the user is finished, you get to work on your machine. The persistent malware now tracks all activity and some NDA'ed information gets leaked. This information just happens to be watermarked with your identity, and turns up somewhere. Now you're on the hook for leaking information that should not be publicised and they can prove it is yours because of the watermarking. Now it is up to you to prove that it was stolen/extracted/leaked and not something you intended to have happen.

While this often can be resolved, it will still take a lot of time, resources and attention which could have been spent on other things of your choosing.

Instead of having anything like this happen, you could also just setup the system in a way that prevents this from happening in the first place, but still retain the possibility to work together on the same data or applications. This can be done in a number of ways, for example:

Work on separate accounts, share data as needed
Work on systems that are intended for collaboration
Use the OS-provided guest account and share data using the guest-accessible storage methods (i.e. the read-only Public and write-only Drop Box directories on macOS)

Many of the security-related issues translate into possible wastes of resources/time in case something does go wrong, and not immediately loss of resources/life/access. Preventing something from happening by using a suitable method of collaboration is the key in most cases. While this answer is rather large and possibly contains duplicate information from other Q&A posts, I hope this describes enough reasons to look for better ways to achieve your goal.


Whitelisting DOM elements to defeat XSS As we know, developers are responsible for correctly escaping/validating data provided by the user before rendering or storing them. However, we must agree that it's relatively easy to forget a single input among hundreds, and finally get your web-app exploited by a XSS. Or haven't you met someone that got his/her site exploited by XSS?

Even Twitter and Orkut recently suffered from XSS. And I'm not here to blame anyone.

Suppose your browser supported whitelisting DOM elements. These whitelisted elements are the only elements allowed to execute JavaScript. You quickly realise that sounds insane because it's impossible to keep your preferred website working properly if you have such a generic whitelist. And you're correct!

But now suppose that HTML and JavaScript engines supported a syntax to allow you to whitelist elements of your own website. For example:

This doesn't solve the problem of rendering

    click me

example 1

example 2

This should NOT allow execution of:

alert('inner') -> we allow div.outer, but none of its child elements;
alert('example 1') -> we allow #list, but none of its child elements;
alert('a') -> we allow a.test, not a.navigate;

JavaScript is a client-side language.

In my professional opinion trusting ANY client-side implementation for added security is a waste of time, and the implementation would be a gross waste of resources.

Your time, and money would be better utilized implementing proper input cleansing and validation on the server-side environment.


Storing US employer identification number (EIN / FEIN) in a database What are considerations for storing a United States Employer Identification Number (EIN / FEIN) in a database?
Is this considered sensitive information along the lines of an SSN?
Are there legal concerns as well?

The EIN is publicly available information, so it is not generally as sensitive as a SSN.
Nevertheless, you may need to secure it for other reasons depending on your circumstances. e.g. could a competitor use it to figure out your customer list?
As ever, get your legal advice from a lawyer licensed in the relevant jurisdiction, not from some schmuck like me on the Internet.


GET over HTTPS vs POST over HTTPS How safe is a hybrid mobile application developed using a GET Web service over HTTPS?

What are the pros and cons of using it and how safe is POST over HTTPS?

In HTTPS, the TLS channel is established before and HTTP data is transfered so, from that point of view, there is no difference between GET and POST requests (or any other HTTP verb, for that matter).

A few things might impact system security, though:

GET requests usually are logged in full while POST requests usually are not. This means that, potentially, you might get more information leaked through GET than POSTS (this logging can happen in the client - through history - on a proxy server or on the web server itself).
GET requests are more constrained by size than POSTs. This makes it (slightly) more difficult to use them as a way to attack the web application.