Is there a way to prove that HTTPS is encrypting the communication with my site? I'm working for a business that deals with web application development, and I am the "Security Expert". I recently implemented HTTPS in an application with Let's Encrypt, and my boss is asking me to prove that HTTPS really encrypts the information.

How can I do that?

My boss is asking me to prove that HTTPS really encrypts the information. How can I do that?

On a basic level, you can use a packet inspector or simple port forwarding proxy. Perhaps Wireshark will inspect the packets easily enough.

You should quickly be able to find that the HTTP traffic is plain text, while the HTTPS is binary gibberish. (with the exception of the hostname)

However, this only proves that the connection is obfuscated. It does not prove encryption or security. Specifically it does nothing to show immunity to MiTM.

Fortunately, the browser does all this for you. If a modern browser tries to connect to an HTTPS web page, it will verify the following:

Strong enough hash algorithms for the certificates involved.
Strong enough encryption algorithms. (i.e. it is actually encrypted)
Certificate chain issued by trusted Certificate Authority(s) (i.e. CA who verifies domain ownership prior to issuing their certificates)
Non-expiry of the certificates.
Matching hash values means there will be no MiTM.

While your boss may like to see the wireshark gibberish comparing HTTP to HTTPS, a stronger test is to quite simply visit the HTTPS site with a modern browser.

Be sure the browser has not been pre-configured to ignore the warning. (i.e. test from multiple computers and smartphones)

If you plan to continue HTTPS permanently (which you should), a wise precaution would be to force redirect all HTTP visits to the HTTPS site, because you cannot guarantee that all visitors will include the https:// prefix when visiting your site.


Do certain SSL certificates / certificate authorities load faster than others? I've been trying to optimize my site's speed and noticed that many websites have low "Initial connection" and "SSL" times while mine are generally double of most sites that I've tested (over 110ms and 60ms, respectively). I optimized the delivery of the certificate as much as I could and it still takes the same amount of time.
So, my question is: could changing my CA make the certificate load faster?
I tried to research this but the only Google results I could find pertain to how fast the certificate authority issues the certificate, not how the certificate in question actually affects performance.

First, check not only the time needed for TLS but also time needed for initial connection. If the initial connection is already slower than for the other sites then the TLS handshake will be slower too - simply because the site is worse reachable from you in terms of round-trip latency.
If only TLS is slower than it is more likely that it might be caused by a bad key exchange method - which is independent of the certificate but dependent on the server configuration. RSA is the fastest key exchange but bad in terms of security. ECDHE is fast enough and recommend. But with a bad server configuration it might use DHE which is terribly slow. Also the speed of the key exchange depends on the performance of the CPU and the amount of resources available for computation: if the system is on its limits the key exchange can be significantly slower.
A major speed improvement in the TLS handshake comes also from session reuse, at least up to TLS 1.2. Thus the difference might also be caused by other sites doing session reuse and yours not.
There might be problems with TCP flow control if the certificate and chain is too large, i.e. if RSA 4096 is used (RSA 2048 is sufficient), many SAN are configured in the certificate, many intermediate certificates are sent and maybe needlessly the root CA certificate too. Optimal would be to use ECDSA certificates instead since they are smaller, but they might not be supported by all clients.
In case the client does a certificate revocation check using OCSP this might additionally slow down the handshake. Unless OCSP stapling is used by your server and supported by the client, the client needs to contact the OCSP responder of the CA to check if the certificate was revoked, which costs additional time.

EDIT after the target website is known:
A detailed timing shows that the TCP connection to the target website and the TLS handshake take about the same time. This is expected since the site is using TLS 1.3, i.e. TLS itself is already pretty optimized (apart from the useless inclusion of the root CA, i.e. "Contains anchor" in the report from SSLLabs).
Compared to servers like google.com the site is much slower though. This is because Google has data centers world wide and their location and routing is optimized to have a fast connection to the customer with small latency. A simple ping already shows the difference in round-trip time, which for the site in question are several factors larger than for google.com.
In other words: this is not a TLS or CA problem, but the target site simply has a worse network connection than the other sites the OP is comparing too.


Why shouldn't we roll our own? Why shouldn't we create our own security schemes?

I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.

With that in mind, I'm looking for a canonical answer, with the following properties:

Easy for a newbie to understand.
Clear and explicit in why rolling your own is a bad idea.
Provides strong examples.

Obligatory xkcd.

You can roll your own, but you probably will make a major security mistake if you are not an expert in security/cryptography or have had your scheme analyzed by multiple experts.  I'm more willing to bet on an open-source publicly known encryption scheme that's out there for all to see and analyze.  More eyes means more likely that the current version doesn't have major vulnerabilities, as opposed to something developed in-house by non-experts.

From Phil Zimmermann's (PGP creator) Introduction to Cryptography (Page 54):

  When I was in college in the early 70s, I devised what I believed was a brilliant
  encryption scheme. A simple pseudorandom number stream was added to the
  plaintext stream to create ciphertext. This would seemingly thwart any
  frequency analysis of the ciphertext, and would be uncrackable even to the
  most resourceful government intelligence agencies. I felt so smug about my
  achievement.

  Years later, I discovered this same scheme in several introductory
  cryptography texts and tutorial papers. How nice. Other cryptographers had
  thought of the same scheme. Unfortunately, the scheme was presented as a
  simple homework assignment on how to use elementary cryptanalytic
  techniques to trivially crack it. So much for my brilliant scheme.

  From this humbling experience I learned how easy it is to fall into a false sense
  of security when devising an encryption algorithm. Most people don’t realize
  how fiendishly difficult it is to devise an encryption algorithm that can
  withstand a prolonged and determined attack by a resourceful opponent.

(This question has more discussion of the above quote.)

If you are not convinced of "Don't Roll Your Own [Cryptography/Security]", then you probably are not an expert and there are many mistakes you likely will make.

Is your application robust against:

Timing Attacks.  E.g., to the nanoseconds do completely-bad keys and partially-bad keys take the same amount of time in the aggregate to fail?  Otherwise, this timing information can be exploited to find the correct key/password.
Trivial Brute Force Attacks; e.g., that can be done in within seconds to years (when you worry about it being broken within a few years).  Maybe your idea of security may be a 1 in a billion (1 000 000 000) chance of breaking in (what if someone with a bot net tries a few billion times?).  My idea is to aim for something like 1 in ~2128 ( 34 000 000 000 000 000 000 000 000 000 000 000), which is roughly ten million billion billion times more secure and completely outside the realm of guessing your way in.
Attacks on user accounts in parallel; e.g., you may hash passwords with the same (or worse no) 'salt' on all password hashes in the database like what happened with the  leaked LinkedIn hashes.
Attack any specific account trivially simply.  Maybe there was a unique random salt with each simply hashed (e.g., MD5/SHA1/SHA2) password, but as you can try billions of possible passwords on any hash each second, so using common password lists, dictionary attacks, etc. it may only take an attacker seconds to crack most accounts. Use strong cryptographic hashes like bcrypt or PBKDF2 to avoid or key-strengthen regular hashes by a suitable factor (typically 10(3-8)).
Attacks on guessable/weak "random" numbers.  Maybe you use microtime/MT-rand or too little information to seed the pseudo-random number like Debian OpenSSL did a few years back.
Attacks that bypass protections.  Maybe you did hashing/input validation client side in  web application and this was bypassed by the user altering the scripts.  Or you have local application that the client tries running in a virtual machine or disassembles to reverse engineer it/alter the memory/ or otherwise cheat somehow.
Other attacks, including (but not attempting to be a complete list) CSRF, XSS, SQL injection, network eavesdropping, replay attacks, Man in the Middle attacks, buffer overflows, etc.  Best protections very quickly summarized.

CSRF: require randomly generated CSRF tokens on POST actions; XSS: always validate/escape untrusted user-input before inputting into the database and displaying to user/browser.
SQLi: always use bound parameters and limit how many results get returned.
Eavesdropping: encrypt sensitive network traffic.
Replay: put unique one-time nonces in each transaction.
MitM: Web of Trust/Same as site last visited/Certificate issued by trusted CA.
Buffer overflows: safe programming language/libraries/executable space protection/etc).

You are only as strong as your weakest exploitable link.  Also just because you aren't rolling your own scheme, doesn't mean your scheme will be secure,  it's quite likely that the person who created what you rolled out was not an expert, or created an otherwise weak scheme.


How do I inject JavaScript into a JPG image and execute it when uploaded? I've recently joined a security project, and received a task to demonstrate the risk related to an end-user uploading an image containing embedded (malicious) JavaScript code.

I used EXIFeditor to inject JavaScript code in an image's imgdescription tag, then uploaded the image to the ASP.NET web server using the following C# code:

protected void Upload_File(object sender, EventArgs e)
{
    var postedFile = Upload_fu.PostedFile;
    string fileName=new FileInfo(postedFile.FileName).Name;
    string path = Server.MapPath("~/images/" + fileName);
    postedFile.SaveAs(path);
    Success_msg.Text = "successfully saved";
    img_sr.ImageUrl = "~/images/" + fileName;
}

Note: img_sr is a <asp:Image/> element, and Upload_fu is a <asp:UploadFile/> element.

The JavaScript code I've embedded int the image is a simple alert("Hello world"). However, the code isn't executed (I tried this with FireFox 21 and Internet Explorer 9).

What am I doing wrong?

Create a HTML page where you display the photo, and next to it you display the EXIF info. The EXIF javascript should probably be enclosed in HTML script tags. If you don't escape the EXIF info when you display it in the page, it should execute the javascript.


What factors make Android app code vulnerable to Cross-Site Request Forgery attacks? According to techtarget.com Cross-Site Request Forgery is:

  a method of attacking a
  Web site in which an intruder masquerades as a legitimate and trusted
  user. An XSRF attack can be used to modify firewall settings, post
  unauthorized data on a forum or conduct fraudulent financial
  transactions. A compromised user may never know that such an attack
  has occurred. If the user does find out about an attack, it may only
  be after the damage has been done and a remedy may be impossible.

An example of a Cross-Site Request Forgery bug within Android O.S

  App Name

  Wireless File Transfer Pro Android - CSRF Vulnerabilities

  Vulnerability Details

  Multiple cross site request forgery issues has been discovered in the
  Wireless File Transfer Pro 1.0.1 android mobile web-application. The
  mobile web-application is vulnerable to a combination of cross site
  request forgery and local command injection attacks.

  Security Risk

  The security risk of the cross site request forgery web vulnerability
  in the create and delete function is estimated as medium. (CVSS 2.3)

  References (Source)

  http://www.vulnerability-lab.com/get_content.php?id=1437

My Question

What makes an android application vulnerable to Cross-Site Request Forgery, as although I've seen and understand its use when used against regular websites. I don't understand what factors make Android application code vulnerable to Cross-Site Request Forgery attacks.

An Android client application should not be vulnerable to CSRF attacks (except for a browser application like Chrome, but it is not the application here that is vulnerable, it is the website being browsed).

This is because for an CSRF to succeed, the client needs to be able to send cookies to the vulnerable website. An Android application would only access web services for its own functionality. It should not be possible to view arbitrary websites from within the app in order to visit a malicious website that would trigger any CSRF vulnerability. If there was browsing functionality, the cookies stored for browsing would likely be different to the cookies the app uses to communicate with any API web service. If not, then see above ("it is not the application here that is vulnerable, it is the website being browsed").

In the case of "Wireless File Transfer Pro" it appears that this is not an Android client application, it is a server application running on Android. I'm taking a wild guess that this application allows you to access your phone's content via a web browser over the local network because the example exploit uses a private IP address:

<img src="http://192.168.1.2:8888/fileExplorer.html?action=deleteFile&fileName=test""width="0" height="0" border="0">

The report is saying that the Android hosted web application is vulnerable to CSRF in the same way that a public website would be vulnerable.


Dedicated domain for email registration With the recent surge in compromised user information on web services, I have the following solution in place for myself:

Registered a domain with an obscure domain name. (actually a bunch)
One email account with an obscure name
This email account is the catch-all for the domain
Now I register for online accounts with any "random_email_address@abscure_domain"
If the account / address is compromised, any attempt to access the emails linked to this email address is useless, since  it is not linked to an account.

Except the usual dependency on the hosting service provider's security, what are the risks to my solution? I am thinking about security and privacy risks.

(Please don't state the obvious inconveniences of dealing with a catch-all)

The key risks I am trying to mitigate:

Many online accounts --> one registered email address. If someone gets hold of that "one" email account via brute force attack or other means, they would have access to all other accounts via password resets.
Using the same email address everywhere enlarges the attack surface for spam / phishing / spear phishing.

The risks are similar to using one email address for various online accounts, minus the risk of having the email address floating around in public.

This means that a brute force (or other) attack from outside by people who need to use the email address is mitigated.

As long as nobody gets hold of the "catchall" email address, it is far more secure than using a publicly known email address. One should never send emails from this account, and it should have any auto replies or read receipts switched off.


Could Nmap scan switches/routers Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.

Yes, provided the devices are reachable on the network they can be scanned.

The accuracy of the results (e.g. fingerprinting) is dependant on the platform, software version, running services and configuration.

Example:

$ nmap -A -T4 10.1.1.1

Nmap scan report for 10.1.1.1
Host is up (0.020s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
23/tcp open  telnet  Cisco router
Service Info: OS: IOS; Device: router

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.21 seconds


Signed URL's as a security measure Would implementing signed URL's be an effective security measure to prevent URL tampering and poisoning on public facing resources accessed via a GET request.

e.g.
http://www.domain.com/:url_to_resource/:hash
http://cdn.domain.com/:url_to_resource.js?:hash

Hash in my case would correspond to my cache key for the resource.

Any feedback, improvements, or critiques would be greatly appreciated.

If it's being altered coming from the client, then we'd also need a mechanism for client certificates to have trust.  To avoid alterations on the connection coming from the server, SSL would already cover this and more.  Really, I fail to see what this would offer over the capabilities of SSL unless you are simply looking for a lighter weight way to protect links without having to use a full SSL connection.

This also seems like it would be very open to replay attacks unless some kind of IV was provided since if the server ever displayed a URL to an attacker, that URL could then be copied, with signature, to any future user.  This would be particularly devastating on a site that allowed links to be made by users, though perhaps those links could be left untrusted and unsigned.


Safest way to access data from an SQL server I am part of a group developing an iOS application. This app accesses a database to both retrieve and submit data. One of the group members said that he does not want to have any direct interaction with the database from the app, but for data to go through a .php on a website.

His reason for having an intermediary php page is that he does not want the database password in the code because someone could decompile the app and look at the password.

Friend's idea:
App -> website (.php) -> database -> website -> app
As opposed to:
App -> database -> app

Is this a legitimate concern? If so, is this group member's php solution effective?

Thanks a lot in advance!

Your question is very confused. I'll assume that English is not your first language and what you are really asking is "should a DBMS be exposed on the internet?"

  he does not want the database password in the code

That's just the start of your problems.

There are things you can do to make the problem less bad than what you are currently proposing, but they still leave a lot to be desired.

Use the credentials provided by the user to authenticate in the DBMS

i.e. the database password is the user's password. This restricts the use of the database to known users (as opposed to making it available to anyone on the internet) and removes the need to embed the database password in the client. But it doesn't solve any of the other problems.

restrict the accounts access to only run stored procedures

Done properly, this would prevent an attacker from reading stuff from the database they shouldn't have access to - e.g. they should only be able to see their orders and not orders from other people. It also allows you to implement your business logic on the serverside (you can't trust logic implemented on the client). You should never store data which has not been vetted for compliance. This also gives some scope for managing the user experience more effectively when things do not proceed along the happy path. However its really hard to implement application logic in procedural SQL.

restrict the access to specific IP addresses

Where only known IP addresses will be accessing a service, this is good practice - it cuts down on the noise, but its not foolproof. And your mention of an IOS app (I presume you are referring to iOS, Apple's mobile device operating system, not IOS, which is Cisco's network device operating system) suggests you won't be able to determine the client address in advance.

...but these are not nearly enough protection!!!

DBMSs are simply not designed to be exposed in a potentially hostile environment. And SQL, using the same channel for data and control, is particularly susceptible to abuse. Nobody has been able to fix these problems on a DBMS - and indeed, nobody is trying any more as the solution is to implement a proper control layer, serverside, on top of the DBMS.


AES encryption (in Java) of different JSON strings always produce same encrypted string as result. Why? I have a program written in Java which takes JSON string as argument, encrypts it using AES then encodes it using Base64.
JSON string is like:

{"a": "b"} or {"a": "n"} or {"a": "k"}

I.e related object would have one property a. Value part is randomly generated.

Program outputs for above JSON inputs looks like

UBNvKoRoGqk0PTQQL5K4Sw==
bKwlToSND3HkceDExEDXSw==
u/yKJq1FdoifBM+AnadC3A==

i.e. they are unique.

Same goes for {"a":"gn"} -- random string with length 2. Same for 3 and so on.

But starting from 7 program produces the same encoded string for different inputs. I mean following JSON strings taken as input:

{"a": "pzfovvs"}
{"a": "bqwuvck"}

produces same string as output:

Dwg0Xjkot8UBfn+vbcCfOS4KluXB6RCFQ932Y9ABtIg=

Same goes for length 8 and 9. Starting from 10 results became unique again.

What is the explanation of this strange phenomenon?

(I can post code if needed.)

Ok, here is the code:

import java.security.Key;
import java.security.NoSuchAlgorithmException;
import java.util.Base64;
import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;

public class JWTEncryptor {

private static String algorithm = "AES";
private static Key key;
private static KeyGenerator keyGenerator;
private static Cipher cipher;

public static String encrypt(String jwt) throws Exception {
    if (key == null || cipher == null) {
        setUp();
    }
    cipher.init(Cipher.ENCRYPT_MODE, key);
    return Base64.getEncoder().encodeToString(cipher.doFinal(jwt.getBytes("UTF-8")));
}

private static void setUp() {
    try {
        cipher = Cipher.getInstance(algorithm);
    } catch (Exception e1) {
        e1.printStackTrace();
    }
    if (keyGenerator != null) {
        key = keyGenerator.generateKey();
        return;
    }
    try {
        keyGenerator = KeyGenerator.getInstance(algorithm);
        key = keyGenerator.generateKey();
    } catch (NoSuchAlgorithmException e) {
        e.printStackTrace();
    }
}

public static String decrypt(String encryptedJWT) throws Exception {
    cipher.init(Cipher.DECRYPT_MODE, key);
    return new
   String(cipher.doFinal(Base64.getDecoder().decode(encryptedJWT)));
}

}

Since I can't comment.
I tried the code snippet you gave us, by adding this method:

public static void main(String[] args) throws Exception
{
    String[] plain = new String[] {
            "{\"a\": \"b\"}",
            "{\"a\": \"n\"}",
            "{\"a\": \"k\"}",
            "{\"a\": \"pzfovvs\"}",
            "{\"a\": \"bqwuvck\"}"
    };
    for (String s : plain) {
        String enc = encrypt(s);
        String dec = decrypt(enc);
        System.out.println(s + "\t" + enc + "\t" + dec);
    }
}

And the result is, that I can't reproduce the issue. The output is this:

{"a": "b"}  /P80Sou3+dGozWw7eVowRQ==    {"a": "b"}
{"a": "n"}  ht8KPm8KzZE9czjX2Jmu4w==    {"a": "n"}
{"a": "k"}  rFHzmbC3l6zjT4XP6Vhing==    {"a": "k"}
{"a": "pzfovvs"}    RhJi+SasO6tzvLf6yaDTgYhPWMFDIUVaS10zLek43/M=    {"a": "pzfovvs"}
{"a": "bqwuvck"}    S/H0I5qQKT9Fo5zitUzqKohPWMFDIUVaS10zLek43/M=    {"a": "bqwuvck"}

It also looks like the implementation is correct.

I used the jdk-13 to test this. So either the Java Version you are using is bugged, or for some reason you don't write the correct String to your encrypt method and instead are always supplying the same String. Eitherway the snippet you have sent works correctly.

Greetings


Attacking admin and non-admin User accounts on the same PC Imagine the following scenario;
A hacker want to attack a remote PC and take control of it using RAT. This PC has three user accounts.
- A (administrator account.
- B (non- administrator  account)
- C (administrator account)
The attacker sends malicious (RAT included!) emails to both  user A and user B to infect the PC.
My question is what happens if user A who has an administrator account installs the malicious application?does his action get the other two accounts infected as well and lets the hacker take control of all user accounts?or only his account is compromised?

Whenever you detect that an attacker's code has been executed, it is best to act with the assumption that all data on the system is potentially compromised. This is especially true if a privileged user was compromised, as even if they require affirmative action to don their privileges (sudo, etc), they will at some point do so. At that moment the attack code can fully compromise the system.

Even if the infected user has no privileges, a number of local vulnerabilities may exist (unknown to the administrator) that could grant the code increased privileges without any privileged user ever logging in.

It is a problem of 'unknown unknowns', and with local access the attack surface is simply much larger.

It's worth considering that local network communications can be generated, sniffed, and spoofed by the attack code so you can't merely assume that information and accounts on other machines are secure.


How to stop people from spamming the account creation url on my website let's say I have a website with an account creation form. How can I stop people from writing a program that automatically submits the form thousands of times, which would fill up my database with junk and cause my system to come to a standstill?

I don't think you can do anything clever with cookies or "session variables", as these can be automatically obtained.

I am guessing that you need rate limiting:(https://en.wikipedia.org/wiki/Rate_limiting)?
Is this it?

Most of the techniques which will help you are anti-automation tools. The following may be a helpful resource in this regard:

http://projects.webappsec.org/w/page/13246938/Insufficient%20Anti-automation

This is the reason many websites deploy tools like re-Captcha and that may even be one of the easiest quick-fixes to your problem but it's not foolproof. There are even anti-anti-automation tools just to get around defenses like re-Captcha.

Another tool you will definitely want to look at is Fail2Ban but you will need to enable the specific configuration to protect your website. This is easy to do but by default, it only protects SSH. In many cases, Fail2Ban by itself will take care of your problem.

If you have a more persistent attacker you may need to look into what is unique about their attack technique and either stop it by writing a custom IDS rule for something like Snort or by using a tool like mod_security. Sometimes rate limiting tricks in IPTables works too if you are either on Linux or can place a Linux box in front of your website. There are a lot of ways to solve these but you may need to dig deeper into how their attacks work. Another low-tech way to handle this is by changing your "submit form" url semi-frequently via a cron job, this isn't the easiest solution but it can be very effective. There are many other techniques as well including things like using GEO-IP locations to block the source of the attacks but the key is looking for anti-automation tools which work with the stack you are currently using. Finally, search if the tools or frameworks you currently use have anti-automation tools built-in, some times these ship with things like web-frameworks but need to be enabled/configured by the user of these tools.

One problem you need to be aware of is the attackers likely already know your current public IP address so simply adding a cloud-based WAF solution, like CloudFlare, may not be a practical or useful option to quickly stop active attacks especially if you have other sites linking to your current website via IP (this shouldn't be the case but it happens). Likewise, you will have to make firewall changes to enforce that ONLY connections from CloudFlare can access your application otherwise it will have no effect at all on attacks directly to your current public IP address. This is still a useful security control for future attacks but may create other short-term problems if not implemented correctly and these won't protect from all types of attacks either. It should be noted that there are a number of WAF-bypass techniques which will allow attackers to continue to submit form requests even with one of these in place.

More information about these problems can also be found here:

OWASP Automated Threats to Web Applications

Finally, in case the attacker changes to brute force in response to your implementation of anti-automation tools you may want to go ahead and read the following too:

OWASP Blocking Brute Force Attacks

Hopefully, this helps.


Creditcard store first six digits PCI reference I need to store masked PAN with first six digits and last four digits along with the card expiry month and year. Is it safe to do it according to the PCI rules?

Regarding four digits has been previously discussed in the following post.

Minimum Requirements For Storing Last Four Digits

It mentions that storing first six digits and last four digits is ok with PCI compliance. Is there a official PCI documentation with this information?

I referred to pci_dss_v2 and pci_fs_data_storage, but could not find an answer.

  3.3 Mask PAN when displayed (the first
  six and last four digits are the maximum
  number of digits to be displayed).

The rule most are referring is the 3.3 requirement. But this only applies if I am displaying the PAN, but it does not mention anything about storing first six + mask + last 4 digits.
Appreciate any help...

Considering your questions indicate you are already processing card holder data, either by transfering PANs or storing (partial) PANs, you fall in the category of SAQ-D. So this means you should be already undergoing PCI audits (provided you have over 300k transactions annually), so best is to check with your QSA and see what they say.


Is this method of managing storageless session management secure? I have a web application in which users can log in. Due to technical constraints, the application is not allowed to store any session information on the disk.

To identify requests from the same user without storing sessions to disk, I have devised the following scheme:

The application has a long, randomly generated server side secret S, created at the time of installation. There is an user with an username u and a password p.

In order to log in, the user presents (u, p) to the web application for authentication at time t. If the authentication is successful, it sends out a cookie c in the response, containing Encrypt(u || t, S). Encrypt in this case is AES-256 in CBC mode of operation.

Later, when a request containing c arrives, the application decrypts the contents of c with S to obtain u and t. Obviously, if u is not a valid user, the request is rejected. Also, the request is rejected if the difference between the current time and t is greater than x. Rejecting the request involves asking the client to delete c and redirecting the user to the login page.

If the user sends a request at time t + y, such at k <= y <= x, the application refreshes c by updating it to Encrypt(u || t + y, S). k is chosen to be some suitable value, such as x/3.

Logging out simply involves asking the browser to delete c.

Is this method of authentication secure?

First off as always why are you trying to roll your own? As pointed out in the comments something like JWT performs the same job.

A brief look suggests this should work. Although i'd suggest making it more transparent. You could instead for the cookie value use -

username:[Username]&tokengeneratedat:[GenerationTime]&Sig:[Signature]

This makes development, debugging and user inspection far simpler since the underlying details are in plain-text.  This approach is also more flexible seeing as you can do things like cycle keys - just use the Generation Time to identify which key to use.

I would suggest verifying the user exists in the table at the very least on token refresh / ideally every request to support instant access revoke.


Continuous SQL injection testing We have a set of internal Python/Django web applications that are pretty well tested functionality-wise, but from time to time we do discover vulnerabilities and, specifically, places where SQL and other types of injections may happen. Currently, this is a very manual process requiring the knowledge of the system (white box).

But, is there a way to do an automated SQL injection test of all of our API endpoints of the applications under test?

I guess some of the things I don't understand now is: should we actually write the logic of these tests and examples for  them and use, say, Python unittest framework, or is there a way to specify endpoints and possible parameters and let some security testing framework generate the malformed inputs to probe for SQL injections (sqlmap?) (the question is in a sense about whether it would be Example-based testing or Property-based testing)

You could script up example based testing pretty easily. With a sample request, sqlmap can do the rest. The only thing it doesnt do by default I believe is path paramters, but that as well could be incorporated into your script. The issue with this is that it will exponentially increase the amount of time it takes for unit tests to run and is generally not done this way because of that. Its up to you and your developers to determine if time added is acceptable. In my experience, it generally isn’t. You could also build somethig out that launches sql map in a separate thread, for example, when something is deployed to stage, and alert security if something is found. This way it wouldnt block your build. Example based testing would be the answer to your question though.


Is it possible to make a crypto wallet software secure without forcing users to encrypt keys with a strong password? I'm creating a mobile software crypto wallet. I'm not an expert, but to my understanding, no software crypto wallet is 100% secure, as it can be reverse engineered so that the private keys are exposed. A possible solution is to encrypt the keys with a very strong phrase, so that, even if an attacker reverses the code and checks the encryption algorithm, they still wouldn't know the passphrase and brute-forcing would not be a viable option (assuming they didn't keylog the user typing the phrase). But, forcing the user to type a long password every time the software needs to decrypt the private key to sign a transaction is bad for UX, and storing the password locally would still expose it, no matter how many layers of encryption are around it.

So, is there any creative way to build it so it can't be reverse engineered when private keys are stored locally and without forcing users to have very long passwords?

If not, then is it correct to assume that no local software wallets are secure and the ability to gain access to the private keys is just a matter of skill of the attacker?

So, is there any creative way to build it so it can't be reverse engineered when private keys are stored locally and without forcing users to have very long passwords?

No. This fails Kerckhoffs's principle - you must assume that an attacker can know everything about your system, and therefore only a secret entered by the user can offer any security.

  If not, then is it correct to assume that no local software wallets are secure and the ability to gain access to the private keys is just a matter of skill of the attacker?

Local software wallets that have a passphrase are potentially secure. Local software wallets that do not have a passphrase are not secure, even if they use something like the Windows Data Protection API (DPAPI), because an attacker who gains code execution on the system under the same context as the user (e.g. by the user running malware) can just called the DPAPI functions and decrypt the wallet.

  I'm creating a mobile software crypto wallet. I'm not an expert

Please do not use this for anything but fun. You should not store any funds in there that you do not intend to be stolen. Implementing secure cryptographic storage of data is a non-trivial task, and doing so in the context of a mobile app introduces additional security challenges (e.g. insecure intents/segues).

On a personal note, I think anyone who stores significant amounts of uninsured funds in a digital wallet on a general purpose computing device (PC, laptop, phone, etc.) for the purposes of opening and using that wallet on that device, regardless of whether it is password protected or not, is utterly insane. It's a gamble that the app you're using is legitimate and not backdoored, that it was engineered correctly (cryptocurrency people are hilariously bad at secure development in my experience - see the BitFi debacle for just one example), that the other software on that device is secure, that the OS itself is secure, that the device has full-disk encryption and that the FDE can't be violated in any way, that the device's hardware architecture is hardened against evil maid attacks (e.g. using an IOMMU... properly), that the device is doing proper chain-of-trust boot verification to prevent bootloader modification, and that the preboot environment (e.g. UEFI) is correctly signed and verified. If any of that fails - and it is absolutely bound to at some point - then your entire set of funds is at significant risk. Single-purpose devices with verifiable software are the way to go, but so far I haven't seen any that have a good security posture and reasonable attitude towards security research.


What should I set the TTL for my DNS to? I've heard before that one should set TTL for the domains of recovery emails to as high value as possible. The threat model here is that an attacker uses social engineering tactics to gain access to the DNS hosting account to the maliciously change the records to their own servers. In this case, you have longer to remedy the problem

I am also considering a second threat model: if the attacker gains control of the email server and I cannot easily gain back access for whatever reason, I am unable to quickly change the TTL to point to a different server.

Is either of these concerns valid? I know some DNS caches seem to simply ignore TTL, and it is also unreliable since some caches may happen to query for an update just after the hack even if the TTL is set for multiple days.

What should I set my TTL to for the most secure DNS?

What should I set my TTL to for the most secure DNS?

As you already state in your question: a high TTL conflicts with a possible insecure mail server and a low TTL conflicts with a possible insecure DNS server.  Since the security of DNS and mail server depends in the actual setup there can be no general "most secure" TTL setting. Instead you have to evaluate the specific risks of your setup to find out the most secure value for your setup.


Is there any safe OpenBSD desktop screenlocker? Linux screen lockers don't seem so very secure, at least not in the past [1, 2, 3]. But is there any very secure OpenBSD screen locker?

(Or perhaps OpenBSD uses the same desktop related source code as Linux and therefore would have similar problems?)

Ideally, I'd like to be able to leave my laptop unattended, and know that after a few minutes, it'll screen lock itself, so it gets as safe as if the laptop had been powered off and full disk encrypted (all disks including swap). Is this possible with OpenBSD and screen lockers? Or would I have to configure the laptop to actually power itself off?

1: https://news.ycombinator.com/item?id=3484859
2: http://www.h-online.com/open/news/item/GNOME-screen-lock-ineffective-in-openSUSE-Linux-Update-928794.html
3: https://blog.martin-graesslin.com/blog/2015/01/why-screen-lockers-on-x11-cannot-be-secure/
Related question, for Linux: What is the most secure way to lock a Linux Distros Desktop?

Altough OpenBSD made some enhancement to improve the security of X11 the problem is the underlying architecture of the X11 system which has no real (i.e. secure) concept of screen locking. This means screen locking is mainly realized by a process which grabs input and has a full screen window and if this process exits (normally or by crashing) the screen is unlocked. The article from Martin Grasslin you already mention describes the problems very clearly and these problem are no different on OpenBSD.

But, if the screen locking process tries to stay simple (like not trying to integrate with fancy desktop environments, show pretty animations...) or at least crash proof and if X11 itself has no real bugs apart from the design problem then screen locking usually works well enough. This is no different between Linux and OpenBSD.


password requirements vs password storage options Could the following password requirements be enforced, without keeping a plaintext/encrypted copy of the current password?

The ######## password requirements are as follows:
    * Passwords must be updated every 90 days.
    * Users may not re-use the previous eight passwords.
    * Passwords must be 8 to 16 characters in length.
    * Passwords must contain at least:
            - One alphabetic character
            - One numeric character
            - One of the following special characters: @, #, $
    * Passwords must contain a non-numeric in the first and last positions.
    * Passwords may not contain two consecutive identical characters.
    * When changing a password, the new password must not contain more than
      three consecutive characters from the previous password.
    * Passwords may not contain a dictionary word or proper noun.
    * Passwords may not be the same as, or contain, the user ID.
    * Passwords are case sensitive.  When you create a password using a mix
      of uppercase and lowercase letters, it must always be entered that way.

The condition "When changing a password, the new password must not contain more than three consecutive characters from the previous password." is the one that I am curious about.

If the 'change password' form asks for the current (old) as well as the new password (as it should), it doesn't have to keep a plaintext copy around.

It can check that the old password is correct by comparing the hashed versions, and then do the check against the requirement you mentioned and only if it passes, update the password in the database.

(Update - changed "encrypted" to "hashed" to avoid distracting discussion on whether encryption is by definition reversible)


Can my ISP see MAC address of devices which are behind router? My ISP gave me a special portal which contains my data usage. It also showed the usage by device MAC address. These devices are behind my router, but I thought that the mac address would not cross the router!

The router is not provided by my ISP, and I believe that the portal is on the internet and not just served from the router.

So how is my ISP tracking the MAC addresses of all devices connected to the router?

Do your network segments look like this?

                                                             _    ____
                  +-------------+       +------------+      / \__/    \
Internal LAN------+ Your Router +-------+ ISP Router +-----+ Internet /
                  +-------------+       +------------+      \________/

If so, your inner router must be misconfigured. You're right, MAC addresses are not passing a correctly set up router because ethernet is not routable.

So it doesn't matter whether that portal sits on the ISP's router or somewhere in the internet; in both cases, it shouldn't have access to your internal MAC addresses unless you somehow actively provide them.

If your ISP's Router (located at your home) provided WiFi to your internal clients, then obviously that would explain where it got their MAC addresses. Or if your router acted as a bridge (and especially if the ISP's router then offered DHCP to your internal LAN), that might explain it. Or if you installed a special app on each of your devices that sent the device mac to your ISP, that would also explain it. I think that in all other cases, your router is configured wrong; it's passing information it shouldn't.

If you're not sure whether your router is acting as a bridge, tell us the network addresses of your internal lan and the lan segment between your router and the ISP's router.


Why is Elliptic Curve Cryptography not used much outside of government? It seems that Elliptic Curve Cryptography, being required by the US government, is not being used outside of the government. Why is this? And why does the government support it's use for government?

Is it just because ECC is new and people haven't migrated over. Or is ECC the same as RSA DSA etc...

There are a lot of reasons why ECC is not used more widely, among which are:

ECC is newer than RSA and Diffie-Hellman (by about a dozen years).
ECC mathematics are a bit harder to grasp than RSA/DH maths. Most people should not implement cryptographic algorithms anyway (safe cryptographic implementation is hard; it is much better to rely on existing libraries), but developers really prefer to use algorithms that they could theoretically implement themselves (they want to feel that they understand what is going on).
ECC has been covered by some patents. Since patent law is a difficult subject which is typically not well known by people who specialized on cryptography (because it is another specialization), the generic attitude is that of cautious distrust.
RSA was there first, and is firmly entrenched. If you want wide usage of ECC, kill RSA first.

You do not tell which government mandates use of elliptic cryptography, so I guess you are talking about the US government. At one point, the US government paid a hefty sum to Certicom (something like 25 millions of dollars) for the right to use the techniques covered by the patents held by Certicom. It is no wonder that they want to use them, then.


How long does it take to compute hashes using the MD5 hash algorithm? 1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds?

2) Will salted and unsalted versions of md5 hash algorithms take approximately the same amount of time to compute?

1) If one iteration of MD5 takes x seconds, is it safe to assume that n iterations of MD5 takes n * x seconds?

Yes, except that multiple iterations can sometimes be parallelized. So while it takes the same computing time, it may take less wall clock time because more computers can be put to the task.

The key derivation function PBKDF2 relies on this slowdown. It does several iterations of a hash in order to make the whole function slow.

  2) Will salted and unsalted versions of md5 hash algorithms take approximately the same amount of time to compute?

Yes. A typical way to add a salt is to concatenate it to the password, so hashing it will take just a little bit longer to add the extra bytes to the hash.

In case of a password hashing function, you want it to be slow in order to slow down brute force attacks. So a password hashing function such as PBKDF2, bcrypt, scrypt or Argon2 should be used to create a function that takes tens of milliseconds. These slow functions are often made up of fast functions such as SHA1.


Email and telephone identification - gmail I was advised to post this as a new question, so linking from my previous question (Tracing senders) and the exchanges there, I have been doing some further work this morning and I have one further question. When examining the email on gmail (using the 'original email' link) where can you find information about the mobile telephone that was used to send the email?
Thanks again,
Andrew.

I think you might refer to this passage in my answer to your question, rather than the comment you linked to:

  Much more plausible would be to ask the email provider for data on previous or subsequent usage of the account. If it gets accessed over the mobile network and the provider has logs of its NAT, the phone may be tracked.

There are several steps here that are to be taken, none has anything to do with email headers. Given, sometimes information is leaked through email headers; yet, let's assume they use a webmailing service with fake information. No information is leaked about the sender then.

Yet, as described in my previous answer:

If

the Email-Provider can give information on IP addresses previously or subsequently accessing this account and
the mobile network provider that those IP addresses belong to has traffic logs and logs of its NATs,

there might be a possibility that the actual user of the email address can be tracked.

Still, both points are big ifs and pretty unlikely to happen,

For the first case, because the user might never again use and never previously used that account and there are few legal ways to track that information.

For the second case, because the data neccessary for that is huge and again, legal reasons.


why is thepiratebay.se listed as deceptive site in Chrome and other browsers Why is thepiratebay.se listed as deceptive site in Chrome and other browsers? My Norton says nothing about fishing or malware.

There is no doubt that some organisations doesn't like thepiratebay but is there real security threat or just politically motivated site block?

I don't ask this to discus piracy I am more concerned for possible false alarm if thepiratebay is enlisted as security threat without exact security reason.

With such praxis we can't rely on security alerts in browsers anymore because we will become unsure is it real security threat or result of campaign of some organisations with enough money to put someone on security block list.

edit:

I agree with you totally @baconface sir. Can you say everything you said for this site also:
http://www.opensubtitles.org/en/subtitles/6617311/rizzoli-isles-hide-and-seek-nl ? This is well known subtitle download site. It isn't enlisted as threat. Yet of course, but we shall see... all those argumentation works only on one site.

Internet is full of such examples and simply, user have to be careful, Internet isn't environment adapted to least intelligent person in the network.

Respecting all yours, no doubt, valid argumentation, google should enlisted as threat much more sites which is not in case, so threshold or trigger to be enlisted as threat apparently is something else.

“Attackers on thepiratebay.se may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards).” well that should answer your question.
These types of warnings typically occur when an ad network is compromised and starts serving malicious ads. Because sites often use multiple advertising networks, some specific to certain regions, not all users are always affected. In short, at least one of The Pirate Bay’s pages is serving up malware, according to Google.


Is it OK to use the same password for a Linux login and the SSH private key? I want to remotely log in to my Linux server with SSH. Public/private key authentication is more secure than password authentication, so I have disabled password-based authentication for SSH on my Linux server.

Now I still need to provide a passphrase to unlock my SSH private key. To save me having to memorize yet another password, can I use the same one on the SSH private key and on the Linux server login?

In my case, the client is Windows 7 on a TrueCrypt volume. Please indicate whether this is important to your answer.

Summary: using the same password for different things is a generally bad idea. However, in this case, where the two uses of the password control access to the same asset, it's not too bad.

So if someone can eavesdrop when you unlock your ssh key (for example by looking over your shoulder, or if they've managed to install a keylogger), they'll know your password on your server. If the only way to log in on that server is to have physical access or through ssh (which has passwords disabled), then having your password compromised doesn't matter.

That is, assuming that your password is only a login password. In fact, it is pretty common that your password doubles as an authentication token to become root through sudo. If that's the case, then an attacker who obtains your ssh key file's password as well as the key file can immediately escalate his access to the root account. If you're the only administrator on the server, it doesn't matter much, because the attacker can inject malware into your account that will let him piggyback on the next time you become root. If there are other administrators (or other ways for you to access the root account, such as a remote administration panel), this removes an opportunity for your colleagues to disable your compromised account.

Conversely, if someone can find out your password on your server, they can unlock your ssh key file. That's not a concern if you only use that ssh key file (or more generally that password) to access that one server. But if you use the same ssh key for other servers, then the attacker can gain access to these other servers given your key file and that server's password. This only represents a gain if you aren't using that same password on the other servers.

All in all, using the same password won't make much difference in typical situations other than a multiple-administrator server where you can sudo to root.

  Public/private key authentication is more secure than password authentication

That's a bit simplistic. Public key authentication uses two factors (the key file and the password to the key file); this is good in that it takes more work for the attacker to compromise both factors. However, you also need to take the risk of a compromise into account. For example, for an ssh key, an active attack on the client will reveal both factors. If the attacker obtains a copy of the key file, he can try to brute force the password offline, so password protection on a key file requires a strong password, stronger than a password that can only be brute-forced through online attacks (though note that an online-only password can be brute-forced offline in some circumstances, for example if the attacker gets hold of a system backup).

Using a password for ssh is not wrong per se, if you can guarantee that it's unguessable. Typical users are bad at choosing unguessable passwords, that aren't a simple variation on their birthday or their girlfriend's name. If you have a good password (randomly generated with an amount of entropy that you can evaluate and that satisfies you), it's ok to enable password authentication if you don't type your password in a place where it'll be eavesdropped.

So if your login password is only a login password, you might combine an ssh public key for convenience and resistance to shoulder surfing, with a strong password that you don't remember keep in a safe and can use in private in emergencies (such as the loss of your client machine and difficulty to access its backups quickly). If your login password doubles as a sudo password, you will need to remember it.

If you only ever keep the key file on an encrypted volume (that only you can access), you don't need to encrypt the key at all. Remember to encrypt backups too.


Knowledge Base about Windows Defender I am trying to find more information on the alerts that come up from Windows Defender and include one of the following:

Remediation Status: What is it?, what are all the different types? and what each of them means?
Action Status: What is it?, what are all the different types? and what each of them means?

From your description, it appears to not just be a Defender source, but an SCCM source of knowledge you need.
https://docs.microsoft.com/en-us/sccm/protect/deploy-use/monitor-endpoint-protection

Malware Alert Levels Use the following table to identify the different Endpoint Protection alert levels that might be displayed in
reports, or in the Configuration Manager console.
Alert level
Failed Endpoint Protection failed to remediate
the malware. Check your logs for details of the error.
Note: For a list of Configuration Manager and Endpoint Protection log
files, see the "Endpoint Protection" section in the Log files in
System Center Configuration Manager topic.
Removed   Endpoint Protection successfully removed the malware.
Quarantined   Endpoint Protection
moved the malware to a secure location and prevented it from running
until you remove it or allow it to run.
Cleaned   The malware was
cleaned from the infected file.
Allowed    An administrative user
selected to allow the software that contains the malware to run.
No Action Endpoint Protection took no action on the malware. This might
occur if the computer is restarted after malware is detected and the
malware is no longer detected; for instance, if a mapped network drive
on which malware is detected is not reconnected when the computer
restarts.
Blocked   Endpoint Protection blocked the malware from
running. This might occur if a process on the computer is found to
contain malware.


How are keys negotiated in wpa-eap? Question about PEAP-MSCHAPV2 on RADIUS.

After MSCHAPV2 success keys are extracted from TLS context. Then it sent to AP.

Client failed to connect WiFi (or eapol, etc) with my handmade RADIUS Access-Accept.

Can you explain full keys negotiation?

Radius source code implementations based on state machines, so code is difficult to understand.

I find missed step. After Success-Response (from client) on phase2 I need to write empty message. I.e. TLS-ASK packet needed before phase1 Success (from server).

Now it works with linux, android (wpa_supplicant). Not works with iOS...


Preventing Server-Side Request Forgeries in Java The application lets users specify a URL for their profile picture. It fetches the data from the URL and saves it on the server. However, the app is vulnerable to server-side request forgery (SSRF) - you can specify URLs like file:///etc/passwd and also access local HTTP services like http://localhost:8080/.

What's the best way to fix this? Some ideas I had:

Restrict the URL protocol to HTTP and HTTPS.
DNS lookup the host name and check it's not a local address.
Disable redirects.

This seems a good start - although there's a TOCTOU issue with the DNS lookup (may be ok in practice, as local DNS will cache).

An alternative idea I had was to place a proxy in a restricted network segment, where it can only see the Internet, and send requests through that.

I did research this online, but there's not much information. This article is pretty good.

This is the code I'm currently using:

if(!url.getProtocol().startsWith("http"))
    throw new Exception();
InetAddress inetAddress = InetAddress.getByName(url.getHost());
if(inetAddress.isAnyLocalAddress() || inetAddress.isLoopbackAddress() || inetAddress.isLinkLocalAddress())
    throw new Exception();
HttpURLConnection conn = (HttpURLConnection)(url.openConnection());
conn.setInstanceFollowRedirects(false);
conn.connect();
IOUtils.copy(conn.getInputStream(), out);

It enforces HTTP or HTTPS, forbids local addresses, and disables redirects. However, it still has the TOCTOU (time of check, time of use) flaw.


TOTP - Larger Timesteps I'm in the process of implementing TOTP based on RFC6238.
The RFC's recommend time step is 30 seconds.
However, for addressing a resynchronization problem that we have,

if I use a larger time step, 15 mins

or if my verifier verify the code in 30 time slots (15 previous, the current and 29 future),
is there any vulnerability apart from the larger time window for brute-forcing?

The RFC document doesn't seem to explicitly mention why the 30 sec is their recommendation.

This is a XY problem since your real issue is the time synchronization issue. Why did you end up with that?
I would say, the problem is not only bruteforce (you additionally detect TOTP bruteforcing, right?), but also reuse. You want a small enough value to prevent repeats. Watching you log in would allow me to do that during the next 15 minutes, although it could be argued that 30 seconds might have been enough. You probably don't want to make it even smaller than those 30 seconds, since you need some time for people to manually retype them, plus all the time synchronization issues that might arise.
I would favor the second option, but what confuses me is how you need both past and future timeslots (note: 15 + 1 + 29 = 45, not 30). The RFC already mentions, and it is recommended that you do, adapt the calculation to each device drift. This should (a) allow you to avoid many of these errors and (b) if you know that 1 minute ago, the user provided the code for "2 minutes ago" (as seen from the server clock), you only check codes after that, i.e. you shouldn't allow a code from 5 minutes ago since they showed their clock is already ahead of that.
And obviously, it is paramount that all your verifier servers have their timedate correctly kept synchronized (NTP). :)


Can an SSH session be taken from memory? I'm aware that SSH keys can be taken from a client's memory. However, in the case of SSH that requires a second factor like Duo/Yubikey stealing the key would not be enough. Could an attacker with full access (RAT, with elevated privilege) steal an existing open ssh session from memory?

And if not, why not?

(if needed for this example lets say the client is running the latest MacOS and the server is running the latest version of Ubuntu, etc.)

The attacker gets the session keys and other state information from memory, but those keys are good only for that single TCP connection.  For a new TCP connection, the server will generate new nonces and all the anti-replay features of SSH kick in.

So the attacker needs to hijack the TCP connection, which the server identifies by client IP address, client TCP port, and sequence number information.  The attacks can be classified by how far from the original client the seized TCP connection is picked up:

In the ssh process itself.  If the attacker has superuser rights where ssh is running, he can either replace the ssh binary with his own compromised copy that the innocent user runs, or change its behavior via code injection (for example, injections don't modify the binary on disk, so digital signatures don't detect the tampering).
In a second process on the same machine.  It's easy to continue the TCP connection from here because packets sent by the server are already being routed here.

a. All the TCP connection-related information is kept by the OS sockets layer, and while the details of moving a TCP socket between processes are OS-specific, sockets don't have process affinity in any POSIX OS, because they can be used from multiple processes at once if inherited during spawn or fork.

b. By bypassing the sockets layer used by applications, and capturing/modifying/injecting packets at the network stack or driver -- for example using iptables or libpcap.
In another machine positioned for MITM attacks.  The only thing that's absolutely necessary besides getting a copy of the session keys and state itself is to continue using the same IP address so the server thinks the same TCP connection is ongoing. That's the same thing necessary for man-in-the-middle, either sitting really on the path, or at least compromising a router on the path to send packets transmitted from the SSH server to the attacker.


How does WiFi NIC monitoring mode work, if at all? I always wondered, when connected to WIFI network, does my NIC receives packets directly from other computers (not ones that passed through the router) and ignores them (similarly to what happens when packet with wrong MAC reaches my NIC) or it doesnt even notice them ?

In monitor mode prespective, does the monitor mode, when I turn it on, tells the NIC to stop ignoring packets or does it change somehow completely the way that the NIC is receiving its data from the air ?

Your NIC will receive any 802.11 wireless communications that is within range.  Packets that are not addressed to a particular device will be ignored- unless the NIC is in Monitor or Promiscuous mode.

From Wireshark documentation (https://wiki.wireshark.org/CaptureSetup/WLAN):

  A 802.11 LAN uses a "broadcast medium", much like (the mostly obsolete shared) Ethernet. Compared to Ethernet, the 802.11 network is even "broader", as the transmitted packets are not limited by the cable medium. That's one of the reasons why the 802.11 network adapters have two additional mechanisms to ignore unwanted packets at the receiving side: channels and SSID's.

Therefore the NIC is purposely designed to ignore any packets that aren't addressed to that specific device.  This is necessary due to the 'broadcasting' nature of a wireless AP.

Unless a wireless AP could 'beam' a signal directly to a particular NIC antenna, then that may be a way to avoid having to ignore packets.  Although, this would be unlikely considering that it is common to have high density areas with many Wifi networks overlapping and the difficulty/cost in beaming a signal directly to a potentially moving target.


Is there an easy way to know if a regex is "evil" I was reading this article (about ReDos). The examples they give are pretty simple but I'm sure such regex can hide everywhere. If there is any way to test if a regex is evil without spending a lot of time trying to find the NFA used by the regex engine, I would be very happy to know it.

Thank you very much.

The answer is that you don't know. This is the classic halting problem.

Basically you should not allow users to set their own regexs wherever possible. If you do allow them to set their own regex, then you could mitigate it in other ways such as only allowing them to set regexs when it affect their own service, or by setting execution timeouts. You could possibly flag long running regexs so you are aware if any of your users are attempting a ReDos.


SSL certification stats Why is

https://w3techs.com/technologies/history_overview/ssl_certificate

saying Let’s Encrypt has 0.1% when

https://letsencrypt.org/stats/

says 32 million Fully-Qualified Let's Encrypt Domains Active?

32 million = 0.1%

32 000 million SSL certs? = 100%

The question is which of the two stat website is lying?

There isn't 32 000 000 000 HTTPS certs imho.

UPDATE: Maybe: "The Let's Encrypt roots were cross-signed by IdenTrust, who are number 2 in that table. "

from another forum:

  TLDR: Look at the IdenTrust numbers if you want to know the real Let's
  Encrypt numbers.

  Not many people use Let's Encrypt's own root for their validation
  chain when they use Let's Encrypt certificates. The Let's Encrypt root
  is not propagated widely enough across clients.

  We (Let's Encrypt) have a cross-signature from IdenTrust, that's what
  most people use because it's widely trusted. IdenTrust issuance is
  otherwise very small, so you can effectively consider the IdenTrust
  numbers in charts like this to be a proxy for Let's Encrypt.

  -Josh from Let's Encrypt


Brute forcing domain accounts without hashes Recently I noticed that on windows 7 domains it is possible to run cmd through .bat file command as a non admin user, therefore giving access to all domain admin user names. My question is how much danger the domain is in, if not all admin users have passwords over 6 characters long and whether it is possible for attacker to brute force those user names without having password hashes at all?

The main thing is to have policy on all users to lock accounts after few failed logons. This way no account can be brute forced quickly. This should include local accounts as well.

Another thing is to have strong passwords so you can't guess them with little attempts. E.g. by trying only 2-3-4 times after each user logon.

If the accounts are not locked it's possible to use various protocols to brute force them, like SMB and sometimes LDAP.


Quantum-secure alternatives in SSL Are there any quantum computing-secure open key exchange algorithms already implemented in SSL/TLS which I could use on my web server? As far as I know all the available-options like RSA, DH, elliptic curves etc are insecure to quantum computer brute-force.

If (I assume) the answer is NO, are there any activities by major industry players to allow QC-secure algorithms in the near future?

No, because all of them may be potentially broken by Shor’s algorithm. Such attacks may require trillions of operations on millions of physical qubits, but defending against them may still be a good practice.

In such case, symmetric cryptography may be used to solve the problem. Even though Grover’s algorithm affects the wide range of them (such as popular AES and SHA), some algorithms are still secure (GMAC59 and Poly1305) which both are MAC functions.
The field is very new and quantum cryptography field is in active research now.

Google did some research on the field with New Hope project.

Also, PQCRYPTO project has published some general recommendations.


Why would a scammer ask for creation of a new email account? I recently received the following email:

  Good day my dear friend,
  I am contacting you to help get the deposit (£8.5 million pounds), my late
  client Engineer Alexander left in his Bank before his sudden death with
  his wife and their only daughter to avoid confiscation.
  For more information about this transaction to continue with me on our
  E-mail: [scammer's email redacted] or you can provide your private E-mail
  address, so that I can write to you with details.
  I find it very difficult to send this items to you because of your
  differences domain / IP. I suggest you create a yahoo.com, Hotmail.com or
  gmail.com and reply me through it easily our correspondence. With kind regards and best wishes, Barrister Dr.Simon peter Esq....

  [Message clipped] View entire message

Sadly, I can't help out Barrister Dr. Simon Peter Esq as I tend to get a terrible rash in the presence of large sums of money. However, this part of the email caught my eye:

  I find it very difficult to send this items to you because of your
  differences domain / IP. I suggest you create a yahoo.com, Hotmail.com or
  gmail.com and reply me through it easily our correspondence.

This seems to match up as I got this email in a zoho.eu inbox using a custom domain.

Why would they ask for creation of a new account on a popular mail site?

Well, where did you receive this e-mail? If it was a corporate/business domain, then they're probably trying to set up a side channel so they can lure you outside the "protection"/oversight of your infosec team.


Should I use random usernames for a MySQL database? I have a script that accesses a MySQL database - clearly a strong, random password and a username unique to the script with no more privileges than it needs are all sensible norms here.

However, is there any tangible and worthwhile security benefit to creating a completely random 16 character username?

I'm aware that other questions cover username policies in general, but this is specifically about a single-use MySQL username that's only ever called from a script - thus it doesn't need to be memorised by anyone.

There's no benefit to going to lengths obfuscating username as long the database does not return a descriptive login error, for instance "username or password incorrect". There will already be many possible usernames, and no way for an attacker to know whether they are using a valid one. Having a descriptive username is often operationally helpful in a larger organization, username 7Uy$kk020G1g doesn't give an admin much to go on. If you're managing the whole thing then that's not a problem.

If the database returns a descriptive login message, for instance "username does not exist", then it's a different story as you don't want to make it easy for an attacker to guess the username. Randomizing the username seems like overkill to me, but there's no harm in it as long as it's documented.


Is there a privacy concern if I'm using shared IP from VPN? I'm running my own VPN with couple of my friends where we share the same static IP. If I'm visiting some particular websites and ads are generated based on my browsing behavior, is it possible that the second user from the same shared IP will be able to see same ads as me (generated according to my browsing behavior)?

Well, it depends, ads are mostly not based on IP but more on cookies and logged in accounts. As an example, if you are logged in to your Google account and you are visiting some website that provides ads from Google and at the same time, one from your friends is doing the same thing you two will see different ads (this relies on your browsing history (i.e. targeted ads)). But if you are somehow anonymous on these websites you are visiting and also your friend is the same you will be seeing ads related to your IP (Time of year, area, etc.).


What is the difference between DH and DHE? I have been reading Bulletproof SSL and TLS

Diffie Hellman is a key exchange mechanism, in which each of server and client share secret i.e. gx and gy respectively with each other where g is generator of some group. They calculate secret S = (gy)x and (gx)y respectively. Note that an attacker in the middle cannot get the value of S from gx and gy, since discrete logarithm is a hard problem. But, an active attacker can masquerade and fool both server and client.

Now in RSA_DH, the value which server sends to client i.e. gx is fixed and stored in certificate. So, the "ServerKeyExchange" message is not sent. Now, client sends its gy value in "ClientKeyExchange" message and this is encrypted with RSA public key cryptography algorithm whose certificate server has already sent in "Certificate" message.

In RSA_DHE, the "ServerKeyExchange" message takes place where server sends gx to the client.

Now my question is what is the difference between the two? Since the premaster secret is calculated from the value (gx)y, Therefore, even in RSA_DH, if the client sends different gy values in each session, then (gx)y value will be different. (I think even if he doesn't still my argument holds) Therefore it will achieve forward secrecy as in RSA_DHE. And the poor attacker won't be able to get premaster secret even after getting the value of gy by compromising the server private key. So, in both cases he won't be able to calculate premaster secret. So why Ephemeral one (RSA_DHE) is said to achieve forward secrecy and other one not?

Diffie-Hellman is an asymmetric algorithm, with a public key and a private key.

In a "DH_RSA" cipher suite, the server's "permanent" key pair is a DH key pair. The public key is in the server's certificate. That certificate, like any certificate, has been signed by a CA, and that CA uses a RSA key pair (that's what the 'RSA' means in "DH_RSA").

In a "DHE_RSA" cipher suite, the server's permanent key pair has type RSA; the RSA public key is in the server's certificate (the cipher suite says nothing about the type of key used by the issuing CA, but it is usually RSA as well). When a client connects, the server generates a transient DH key pair and sends the public key to the client as a ServerKeyExchange message; the server signs that message with its permanent RSA private key.

Forward secrecy is a property defined relatively to ulterior theft of server secrets. "DHE_RSA" cipher suites provide forward secrecy because the actual key exchange secret (the DH private key) is transient, thus not saved by the server -- if the server does not save that key on its disk, then it should be immune to ulterior theft. Conversely, "DH_RSA" implies that the DH private key is stored somewhere on the server's hard disk, and if that key is stolen, then past recorded session can be decrypted.

One must note that some servers will keep they DH key pairs around for some time, usually in RAM; they don't make a new DH key pair for each client. This behaviour has some performance benefits but slightly weakens the forward secrecy, by definition. This really depends on the model you use to define "ulterior theft": are you talking about retrieving an old hard disk in a dumpster, or a malware that inspect RAM contents?


Sql Injection - Possible exploitations on a real case This is a snippet of a PHP script:

$useragent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL;

$query = "SELECT `id` FROM `browser` WHERE name = '".$useragent."' LIMIT 0,1;";
$result = @mysql_query($query);

//  The browser is visiting the page for the first time
if (!$row = @mysql_fetch_assoc($result)) {
    echo "<!-- new browser -->";

    $query = "INSERT INTO `browser`
                (`id` ,`name`)
              VALUES
                (NULL ,'".$useragent."');";

    $result = @mysql_query($query);
}
//  The browser has already visited the page
else {
    echo "<!-- taken -->";
}

Now, it seems obvious to me that there is a SQL Injection on the $useragent parameter, but I can't able to exploit it, even with SQLMap.

If anyone could help, I would really thankful.

Best regards.

Sorry to all, I have just solved my problem. Next time I will be more self-confident.

I would like that someone deletes this message if it is possible. Otherwise, just forget it.

Sorry again.


Is Opal-based full disk encryption fully working for Linux? I'd like to know   to manage the password purely via the BIOS and not need to run any utility e.g. sedutil.

First, if your BIOS can handle an Opal SED, then, yes it will work for Linux. Check your BIOS to see if it supports Opal.

Second, SED's protect against someone stealing your computer when it is powered off. In a sleep state, the SED is still drawing power and therefore exposed. So if an attacker steals your computer and wakes it from the sleep state, they potentially have access to all your data.

Third, tools like sedutil make SED's independent of the BIOS. They are no more intrusive than BIOS solutions in that they ask for a password at boot time and then get get out of the way. The only drawback is that they take more effort to install than a pure BIOS solution.

At this time, sedutil will work with any BIOS that does not cut power to the SED during a reboot.


Will using Teamviewer reveal my IP? I will be accessing a computer in a different state via Teamviewer. The sites I work on have very high security measures in place. Is there any way possible that my actual IP address can be revealed in addition to that of the computer I'll be dialing into?

The IP you connect from will be available to the computer you access.  The sites you access in a web browser from that computer will only see a connection from that computer, and will not be able to determine the IP you used to connect from on Teamviewer.  If you run any applications outside the web browser, it would be possible for them to detect the incoming connection, but only if they are specifically looking for it.


authorization vs federation vs entitlement I am vague among the three following terms: authorization, federation, entitlement (as stated by the OpenAM product: OpenAM provides open source Authentication, Authorization, Entitlement and Federation software). I cannot differentiate which one is about what.

Could anyone please point me a simple definition about these terms?

Authorization is the access policy stating to which protected objects or services a client has access.

Authentication is the proof of identity that the client provides to validate his authorization.

Federation (usually identity federation) is to make one central online identity valid over several different services. Google Accounts and Facebook Connect are identity federation systems.

Entitlement could be anything IMO. The closest I get is that when you are authorized access to a service or object, you are entitled as authorized to that service or object.

This way, to get access to your Security.StackExchange account, you may authenticate with your Google Accounts ID and find that you've (earlier) authorized StackExchange to use your Google ID credentials at that service. Also, when authenticated, you find that your Google Accounts user is authorized to access StackExchange, and you are approved access.

A classic misconception is that authorization is the same as access approval, although authorization is established in the registration phase (happens only one time), but access approval is done each time, based on the authenticated user's authorization, looked up in the access policy.


Test for OWASP Using Components with Known Vulnerabilities? I'm trying to think how I would test an application for OWASP "Using Components with Known Vulnerabilities".

If my understanding is correct, this deals a lot with out of date libraries/modules, but if one is pentesting an application (externally) how could they identify this type of information?

Whilst it is sometimes possible to identify this issue whilst doing an external black-box web application review, for example by identifying outdated JavaScript libraries using retire.js, or identifying outdated web server software from banner version numbers, in general the best way to check for this is to carry out a credentialed review of the systems involved in the application to confirm the versions of software in use and check for any known issues.

With a blackbox scan you're either relying on identifying the in-use version via strings in the file (or some other heuristic) or exploiting the vulnerabilities in question.

With a whitebox review it can be easier to do, as with software which is packaged, you can more easily check the installed versions.


Protecting MYSQL with Fail2Ban? I have a bunch Raspberry Pis collecting data from behind client firewalls. I want to start sending this data to MYSQL server. Because the Raspberry Pis do not have static IP addresses, I obviously feel vulnerable opening up my database to the public. For SSH we have Fail2Ban, but for MYSQL I have found no documentation or recommended equivalent. Is it possible or even desirable to set up Fail2Ban for MYSQL in this context?

My alternatives seem to be a mix of using a VPN, wildcard IP addresses, and port knocking. I'm not too fond of having potentially insecure RPis connecting to my server via SSH if I can help it. I imagine the best approach is strict IP banning.

Use ssh to forward a port securely to the machine running MySQL, using a key for authentication. To make this work, you need to not use per-IP authentication, as thge IPs are changing.  Attacks on ssh will then trigger your fail2ban system, while authenticated connections won't.


Working on sensitive data on the cloud In my current project for an NGO, I have to set up a system that allows members of the organisation to perform basic analysis on highly sensitive data.

The data (reports, or form submissions) is currently stored on secure UNHCR servers through KoBo (a tool for collecting data on the field). For performing analysis, for now, I have a Google Apps Script that fetches the relevant data, strips it of the sensitive bits behind the scenes, and pastes it in a Google Sheets spreadsheet. The problem with this approach is that, obviously, the fetch necessarily parses the whole of the data, so Google has access to it.

I have thought of this solution:

Alternative 1

Protocol

Manually download the data from UNHCR on my computer
Remove the sensitive bits via a script on Excel
Paste the data on the Google Sheets spreadsheet
Remove the data from the computer

Limits

No real-time fetch of the data, but having someone do this once per day does solve the problem of privacy

However, I have two features that I'd also like to implement. After the data collectors send in their reports, some of them may need to be contacted for follow-ups or sent a more in depth form, and I'd like that to be done through a script. Also, the UNHCR servers have a certain size limit for the media that are sent in alongside the reports, so I want to create some database where the media that are above this size limit are indexed against the relevant reports and stored.

Alternative 2

Protocol

Set up a private server with a provider who is based in a EU country with strict data privacy laws
Have the server fetch the data from UNHCR
Send out emails to the data collectors, for example to ask them if they have any large media they'd want to attach to their report and the instructions to do so (these emails don't have to be encrypted or anything)
Store the reports (stripped of the sensitive bits) in an unencrypted CSV
Have my Google Apps Script fetch the CSV and paste it in the spreadsheet as is
If I have large media for previous reports, I make report-media files on my computer, encrypt the lot, and upload them to the server, where they'll be stored within a database

Limits

Find a provider who fulfills the criteria
The fees and the complexity that this alternative brings are acceptable

I realize that another alternative is using Alternative 1, manually sending emails to the data collectors, and storing encrypted report-media files anywhere in the cloud (since they're encrypted), but I'd like the whole process to be as automated and centralized as possible, so: how do I make the alternative 2 work? Where can I find a good cloud hosting provider?

Which of these alternatives would be better all depends on your threat model. If you do not know what this is, please research it, or get someone to help you on that. (Or start asking questions here about it!)

I say this because I do not understand why you are so worried about Google (potentially) accessing that sensitive data, while you just assume by setting up a server in some place with strict data privacy laws all will be fine. If Google is an identified threat (by your model), why are you sharing your (redacted) results via Google Sheets in the first place, and (try to) use some Google Apps script to achieve that? Can't you just use some other (local) tool to obfuscate or strip that sensitive data?

What also boggles my mind is, if this data is so sensitive to your organization, why are you allowed full access to it in the relative insecure manner of either downloading it to your own computer, or to some other server (somewhere else in the world, where you probably can not physically guard it)?

From your story it appears that UNHCR gives you access to that servers' data, so the chances are your organization have accepted some agreement with the UN on using and handling that data. Talk to your organizations' legal counsel and see what is possible and what not.


Am I exposed to WebRTC leaks if my IP resulting from WebRTC is the IP of my VPN server with the last digit augmented by one? I am connecting to the website of ExpressVPN that checks for WebRTC IP leaks.
My IP as resulting from that website is the same IP of the VPN server I am connected to but with the last digit augmented by 1.
That is, if IP address of my VPN server is
A.B.C.D (e.g. 1.2.3.4)
the IP as detected from that website is
A.B.C.(D+1) (e.g. 1.2.3.5)
What does this result mean?
Why is the last digit augmented by one?
Am I exposed to WebRTC leaks?
EDIT: More information:
Actually A.B.C.D is the IP address I have on my openvpn configuration files.
That is, inside the openvpn configuration file there is written
remote A.B.C.D 443
But when I connect to say https://whatismyipaddress.com/ I see A.B.C.(D+1)

As your own IP address is not visible, your private IP addresses are not leaking.
The reason you might see a different IP address in the network of your VPN provider is because of the way your VPN provider's network is set up.
You might want to disable WebRTC in your browser to be on the safe side.


Can we prevent a man-in-the-middle attack with symmetric-key cryptography? Suppose that Alice signs the message M = "I love security" and then encrypts it with
Bob's public key before sending it to Bob. As well known, Bob can decrypt this to
obtain the signed message and then encrypt the signed message with, say, Charlie's
public key and forward the resulting ciphertext to Charlie. Could Alice prevent this
"attack" by using symmetric key cryptography?

Is your issue that Bob leaked the data to Charlie? There isn't anything you can really do about this. If Bob can read the data, he can always share it with someone else. If symmetric key cryptography was used, Bob could just send the key itself to Charlie as well as the encrypted message. Better yet, he can still just the decrypted message. There is no way to prevent Bob from doing things if he's the intended recipient of the data.


Can SPF be bypassed by using a shared email server? As I understand it, SPF works by listing permitted SMTP server domains in the TXT DNS record of the domain you own.

So if I own example.com and wish to permit a 3rd-party SMTP server at smtpexample.com to send emails on behalf of my domain, I add smtpexample.com to the SPF record, in the TXT field of my server's DNS entry.

Because DNS is publicly viewable, anyone can see my SPF entry and deduce that I am using smtpexample.com for sending email.

If smtpexample.com were a shared hosting provider, couldn't I sign up for an account with them and send emails purporting to be from admin@example.com?

So are the emails are considered legitimate, because they come from the SMTP server which is listed in example.com's SPF record?

SPF is designed to protect against someone using their own server to send e-mail with your from address. For instance, spammers might use a botnet of compromised PCs or devices to connect directly to the target SMTP server, making a blacklist of sending servers very hard to implement; because SPF is a whitelist, the recipient can detect that this is a spoofed message and mark it as spam.

As you say, it does not protect against other users using the same server as you. Essentially, any server you whitelist in the SPF record should be one that you trust not to allow other users to spoof your identity. For instance, if you whitelist GMail's outgoing servers, you are trusting Google to only route messages through those servers which were created by someone logged into your account.

Theoretically, you could use DKIM to share an untrusted server without this risk - if you keep the only copy of the private key somewhere other than the shared server, nobody will be able to spoof your mail. In practice, however, DKIM signatures are commonly added by the same service as is running the shared SMTP server - so, for instance, you could set up DKIM for mail you're sending through GMail, and would still be trusting Google not to let other users sign their mail with the same key.


Allow apache to write to users' .ssh dir's I know the title is just baiting the "your setup is insecure", but allow me to explain.

I'm working on an application which aims to allow clients to rsync over SSH to our server. We need a web application from which we can create/rotate SSH keys for our users. This application will return a private SSH key to the user for their future use and will store the public key user's authorized_keys file.

Upon registration, we'll need to automatically create the user and initial .ssh directory and keys.

We're on CentOS 5 now, but we're flexible if there's sufficient reason to migrate. This server will be running only this web application in Apache (as apache:apache) and no data other than the synchronized user data will be stored on the system.

I've been thinking about the following solution, but have been running into trouble:

Grant sudo useradd privileges to the apache user to allow them to create new users
Call sudo useradd from the PHP script in the web application with a umask of 000 on the newly created home directory.
chgrp the new home directory to apache so that apache will be able to create a new .ssh directory and write the keys.*
chmod the new home directory to 770 so that only the user and apache have access.*
mkdir .ssh in the new home directory and ssh-keygen to create the new key, storing the public key in authorized_keys and passing the private key back to the calling client.

The problems I'm encountering are with the *d points -- it seems that, even with chmod 777 I'm not able to chgrp or chmod the directory, as it's been created with the owner and group belonging to the new user.

I've looked at changing the user's default group to something that would allow apache to write to it, but I can't find a way to do that without having to grant apache usermod sudo privileges, which seems like a really bad idea.

Any thoughts would be appreciated!

I'd probably suggest having cron fire a script that does nothing but edit those files with whatever is queued in the database to do.

Allow that part of the script to act entirely outside of the realm of the apache user and be able to lock down the account to only do that task.

That's just off the top of my head though as a simpler solution.


Is an email domain name considered PII? For example, can you reference a customer by their domain in an email?
Each customer in a system can be associated with a domain, and some domains are associated with a single customer.

Schroeder awnsered this better.
But basically a domain is only considered PII if it’s possible to derive a person from it.
Thereby making it a PII.
Doing this is a really bad idea since the DNS system requires that anyone can cache the data by design.
This means anyone can make copies of the data.
In regards to mail servers. It’s actually really rare that a mail server domain refers to a person, it usually refers to a company.
Also is the email address itself allready PII, so considering just the domain part of it is kinda redundant.


Firefox can import the .p12 format, but that contains a private key? Isn't this a security risk? Everywhere I go, people tell me the private keys need to be kept away, possibly even locked into a safe. Then how come Firefox and other keystores expect you to give them a private key?
Firefox is a client, it shouldn't need this right?

The private key is need by Firefox for client authentication, i.e. when the client demonstrates to the server ownership of a certificate. By definition, this requires knowledge of the private key on the client side. This does not happen often, because most Web servers authenticate clients with passwords, not with certificates.

Of course, Firefox has no need of the private key corresponding to a server certificate, and in practice won't have access to that private key.

Generally speaking, the less a private key travel, the happier we are. However, when it becomes necessary, for some reason, to transport a private key and its accompanying certificate, then we prefer to do it with some extra security to maintain confidentiality; this often uses the PKCS#12 format, also known as "PFX" or ".p12". Such a file is an archive which can contain just about anything, but in particular certificates and private keys, and (that's the point) it includes password-based encryption: parts of the archive contents (e.g. the private key) can be encrypted with a key derived from the password chosen to lock the archive.


Should I trust Grive2? I am trying to run Google Drive on LUbuntu 64 bit, but since there isn't an official version yet, I was thinking to follow this tutorial.
Since it's not an official software from Google, I am concerned about them seeing, copying, sharing, etc. my data. Should I trust them by following that tutorial and syncing my files using this software?

I would not trust the application. The client secret bl4ufi89h-9MkFlypcI7R785 is embedded directly into the application. If you allow this application to be trusted by your Google account, then any permissions you give the app will be inherently granted to anyone who decides to maliciously make use of the client secret together with the client ID. Furthermore, the client secret leak breaks a layer of protection designed to ensure the legitimacy of the communicating server.

Click here to view the main source code file containing the client secret.


Privacy laws' right-to-amend (and right-to-delete) requests and archived data/backups Under HIPAA and some privacy laws (in US, EU and other countries), the user has the right to amend (under some laws even delete) his/her data. What is the right way to handle a request to amend/delete regarding archived data or backups? That data may not be in use today but it may be accessed in the future.

I can only speak for the UK; here the end consumer (or the subject of the data) has a right to enforce that an organisation (a data processor) keeps up to date information about the subject.  The act does not make any special provision for backups etc

if old data is accessed from time to time then it is the responsibility of the organisation (data processor) to ensure that the data is matched against the most recent data before utilising it.

Why would you sometimes access old data (except during a disaster)?