Best password strength checker In XKCD #936: Short complex password, or long dictionary passphrase? Jeff claimed that password cracking with "dictionary words separated by spaces", or "a complete sentence with punctuation", or "leet-speak numb3r substitution" is "highly unlikely in practice".

However, there are certainly John-the-Ripper rulesets that perform l33t-speak substitutions and "pre/append punctuation or 1-4 digits (some are even included in the default set, and more are discussed e.g. at https://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf, which talks about cracking ~50K "corporate" passwords using such techniques; http://contest-2010.korelogic.com/rules.html has some of the specific JtR rules used), and I can't see any reason why an attacker wouldn't use them.

Jeff used rumkin.com in part to justify his claim that Tr0ub4dor&3 is in practice as secure as a 4-word-from-2K-wordlist passphrase. But rumkin.com doesn't seem to take into account l33t-speak substitutions in determining the entropy.

So my question is: Are there any password strength checkers which take account of the limited entropy added by l33t-speak and similar substitutions and concatentations?

Ideally the rating would closely correspond with the amount of time that an actual attacker (using "state of the art" techniques, not just character-by-character brute-forcing) would take to find the password. Those techniques would include l33t-speak transformations, common passwords, wordlists, etc.

Open-source non-web-based preferred, for obvious reasons. While a good password generation algorithm (by definition) is secure even when the attacker has seen other passwords produced by the same algorithm, the idea is to point naive users at this checker, and the whole point is that their passwords are unlikely to have been generated via a sound algorithm.

Extra points if it learns from passwords submitted to it... unless it then automatically breaks into the users' paypal accounts and uses the money to fund Skynet...

In theory, password strength checkers do not work. That's because the strength of a password does not depend upon the password value (which you give to the checker) but upon the password generation process (which you do not formalize often, let alone enter in the checker).

In practice, password strength checker use a set of rules which describe common password generation methods; they then tell you how long your password would resist if the attacker uses exactly the same rules. But the attacker does not use exactly the same rules. The attacker is after you; he knows you (if you are attacked only by people who do not know you, then you can consider yourself very lucky -- or very uninteresting). Therefore, the attacker will amend his password brute-force methods so as to target your psyche, your probable password generation methods.

Password strength checkers are good at telling you how robust your password is against incompetent attackers. This has some value, if only because there are so many incompetent wannabe hackers. But it would be a mistake to rely too much on such tools.


How does Autofill or Autocomplete work on a cellphone? I gave out my personal credit card info to a friend to order pizza online, should I be concerned? Are my personal info stored on his/her autofill phone?

Most of the legitimate keyboards on Android/iOS won't store credit card details for their "autofill" functionality. But if your friend has malicious intents and is somewhat tech-savvy, then you might have cause for concern. It is not difficult to get a keyboard(at least for Android), which can record keystrokes and then store them in a file, which can be later retrieved easily.

There are some other concerns as well, such as the portal where you entered your credit card information was secured or not, but I guess that'd be out of scope for this question.

Your safest bet would be to change your credit card password, which is used to make transactions. In case you neither have a password, nor the mandatory OTP facility for your credit card, it would be good to contact your bank and informing them that your credit card details have been compromised.


Is there any real value in hashing/salting passwords? I look after a system which holds a lot of "low grade" information, nothing financial but name/address/email etc. Someone has suggested that we up the security from the current in house password encryption algorithm to use ICO recommended hash/salting. I've done a bit of reading around and am struggling to see the benefit, my argument has gone back to the "experts" who are suggesting this but they wont (can't) answer my fairly simple question.

As far as I can tell, hashing/salting prevents the password being read and decrypted by a hacker, and it's excellent for this, no argument. But unless I'm missing something, in order to read the password value the hacker has to have access to the database so they can steal the password values?... if they have access to the database then they don't actually need the password(s) as they can just steal the data direct from the database i.e. the application access they gain from the passwords would give them nothing more than reading the database direct?...

What am I missing?

Users often use the same passwords on multiple sites. Your site might not have any financial data, but what if the same password is used for their bank, or for an online store?

You could argue that this isn't your problem, but it is a common issue, and is why whenever a breach happens, one of the immediate statements is "change your password, and change it on any other sites where you've used the same password".

If your site used something like Bcrypt (without flaws in the implementation - see Ashley Madison), the chances of an attacker being able to work out what passwords have been used is slimmer, and it increases the time for users to be able to change their passwords elsewhere. If you just store the password in your DB without any hashing, an attacker can wander off with the email addresses and passwords and start attacking another site immediately.

Email address and password pairs are often traded between attackers too, in the form of "combo lists", which means that even if the original attacker is only interested in your site, they might be able to get some benefit by selling the data to someone else.

Added in response to comment on question mentioning 2-way encrypted storage

The problem with a 2 way encryption approach is that the information to decrypt must be stored somewhere in the system. If an attacker gains access to your database, there is a good chance they have access to your encryption key too. A hash can't be reversed in this way - online tools for reversing hashes effectively look up the hash in a pre-computed list.

Even if they don't have the encryption key, they might be able to work out what the key was - they can use a known plaintext attack by entering a password to your system and seeing what the result is. It probably wouldn't be a quick process, but it could be worth doing if there were any high value targets in your data (celebrities, politicians...).

On the other hand, with a strong, salted, hash, the only way to find the original password with strong certainty is to hash every possible input, using the appropriate salt. With something like Bcrypt, this would take years, although weak passwords will still be found relatively quickly.


Is it possible to hack into secured wifi and download with bit torrent from my IP address? Is it possible to hack into secured wifi and download using BitTorrent from my IP address? I live in Denmark- if that makes any difference.

We changed to a new WIFI service provider a few years back (May 2015). My girlfriend recalls better than I do that the new WIFI came with its own password (security key, I'm looking into this with the company)

I don't know which kind of "protection" my WIFI was provided with, yet: WPA, WEP, or whatever, I'm looking into that too. At the moment I know next to nothing about any of this, I should add that for all, I know the security provided by the Danish internet company (Telenor) may be top notch.

However, it appears that someone has hacked into my WIFI using my IP address and downloaded numerous films, TV programs and other activity over a 2 year period without my knowledge. This has been confirmed by the internet provider, I am now being sued by a copyright management co. and need to deal with this in court.

I need to know if it is possible, first.  How so and is there anything-anything at all that you could provide me as credible proof that I could present to the court? I need anything that could at least provide reasonable doubt.  I feel like I am being railroaded here. I need help and I need it fast, preferably in somewhat simple layman's terms, as I am a techno-peasant and expect a judge will be too.

Yes, it is possible to hack to your WiFi, even if you use WPA2.

There are different ways how to do it:

The faster is WPS Pixie Dust Attack (within some seconds),
the next is Reaver (some hours, also need enabled WPS),
and the slowest is the off-line Dictionary attack (days or weeks, or even never).

All depends on your security settings on your router (Access Point) and the uniqueness of your password, and - of course - of the the possibilities and the level of your attacker.

And, yes, then the attacker presents himself (for outer world) with the same IP address as you, assigned to you by your Internet Service Provider (as anybody in your family).


additional network security benefits from double hop dmz? Core network --> Firewall Internal Zone --> Inner DMZ Firewall --> Outer Firewall --> Internet Based User

I can't think of any reason why "Inner DMZ firewall" would make this topology more secured from a network security perspective. Assume you take out the "Inner DMZ firewall" so you're left with Core network --> Firewall Internal Zone --> Outer Firewall --> Internet Based User.

For some reason having an additional firewall definitely sounds more safer. Thoughts?

That diagram appears incorrect. Typically you have it arranged slightly differently if you are using two layers of firewalls.

Core network-->Inner firewall-->DMZ-->Perimeter firewall-->Internet user

This lets you protect not only the servers in the DMZ from at least some attacks from outside, you also protect your core network from attack from a compromised device in the DMZ.

In reality, you may have one firewall appliance acting as both inner and outer firewalls, as well as segregating sections of the DMZ from each other (eg by service, or by risk profile, or by platform), through multiple interfaces and/or VLANs, or you may use separate firewalls from different vendors in order to avoid a compromise of both through one exploit. This will all depend on your risk and threat profile.


How are symmetric cryptographic keys stored? If you have a symmetric key which is negotiated via SRP protocol between a mobile device (e.g. smartphone) and a server, what would be a safe way to persist this resulting key on each side?

On the client side you could use PBKDF2 or a similar key derivation function to generate a key to then use to encrypt/decrypt the symmetric key before using it. Would this be considered (acceptably) safe?

What possibilities are there on the server side? What procedure would be considered safe to store such a key in a database?

How does for example Amazon store their symmetric keys used for their query string authentication for S3? (For information: On S3 you can restrict access to stored objects so that only requests with a valid signature (created using HMAC) are granted access to the requested (restricted) object)

Secret keys (symmetric or asymmetric) are typically stored in an encrypted medium of some sort such as a keystore or encrypted database. Specific example of a keystore would be the JKS (Java Key Store), and a database would be SQLCipher. This encrypted medium is secured with a master password, which is needed in order to read/write to it. SQLCipher will first churn the password through with PBKDF2 in order to ensure it has enough entropy and computational cost.

The question of where that master password is stored will of course affect the security of your system. For the client side, expecting the user to remember it is the best option. For the server side, a Hardware Security Module (HSM) may be used to secure the keys like Amazon's Key Management Service.


How can html5 geolocalisation bypass my vpn? About two months ago I've decided to use a VPN all the time (it's launched at startup) for various reasons, privacy being the first one. But recently I realized that if you agree to share your location when an HTML5 geolocalization pops up in firefox, they can still get your localization pretty accurately (about 3 km away) when my VPN IP address locates me in another country.

Since I'm on a fixed computer without wifi how can they know my localization ?

I just checked this with my VPN in http://html5demos.com/geo

Although I VPN through Germany, it still shows my nearby location in London.

If you read https://www.mozilla.org/en-US/firefox/geolocation/ , you will see:

  If you consent, Firefox gathers information about nearby wireless
  access points and your computer’s IP address Then Firefox sends this
  information to the default geolocation service provider, Google
  Location Services, to get an estimate of your location.

As @Aria noted, Google Location Services uses their collection of WiFi AP to try to pin-point your location. I assume they have a global list of AP SSIDs through the Google Street View project as well as their Android devices.

edit:

FYI, here is the captured request that is being sent to Google. A full list of nearby APs. You might want to launch a proxy and check for yourself.

Also the fact that you are on a computer without WiFi doesn't mean that nearby APs aren't stored somewhere within your computer (Cache, Registry, Logged in Google/Firefox profiles, etc)


Root of Trust - The general Mechanism of how RoT Authenticates higher levels of software I've been reading many research articles about RoT - Root of Trust - for establishing a chained root of trust going up from BIOS to the Kernel.
However, most of the article go briefly on how RoT works for different brands.
A good article on RoT is RoT: The Foundation of Security by Lawrence Liu.
However, one of the biggest questions I have is the mechanism on how trust is established with the boot, os, and application i.e. how does the RoT ensure their authenticity.
For example, say I compromised the boot loader, how does the RoT mechanism detect it? Does it check the hash of the Boot loader's code, but what if there was a company update?
Please refer me to related articles.

Great question! The article you link, to me, uses a lot of words to say very little (ie I find that it is lacking specific detail). Instead I will base my answer on this page:

Secure Boot | Microsoft Docs

This article uses different terminology from the article you linked. I will use the Microsoft terminology. I believe that "Secure Boot" == "Root of Trust (RoT)", but I'm not 100% sure.
Disclaimer1: below is my understanding of this complex process, I am still a student in this area. Corrections are welcome.
Disclaimer2: I'm going to be a bit sloppy with my use of the word "firmware" and use it mean anything pre-operating system kernel in the boot sequence.
Secure Boot
Secure Boot is a small piece of firmware code. It is the first thing to boot up. It is provided with a local database of:

Signature public keys that are allowed to sign firmware for this device (ie approved software vendors), and
hashes of allowed firmware code (ie approved software binaries).

This may or may not be backed by a hardware TPM, if one is available on the given platform.
Protection and updates of the Secure Boot firmware itself
The Secure Boot code itself is not verified at runtime, however since it is the first code to run on system startup, the only way to update or modify it is to ask it to update itself, and it will check the code signature on any update package before updating its own code in firmware storage. So assuming you trust the original Secure Boot code shipped on your device, you can trust all updates to it.
Detection of compromised firmware
When firmware in the boot sequence tries to load another firmware module, it will first ask the Secure Boot module "Is this allowed to run?". The Secure Boot module will perform checks something like the following:

Is there a code signature on this binary?

If yes, is it produced by one of the signing public keys in the database?

If yes, is this binary valid under this signature?

If yes, succeed; binary is trusted
If no, fail; binary has been modified / tampered with.

If no, fail; binary is signed by an untrusted vendor.

If no, hash this binary and check if it is directly listed in the database?

If yes, succeed; binary is trusted.
If no, fail; binary is not trusted.

This means that Secure Boot will only allow other firmware to run if it was either produced by a trusted vendor, or is explicitly trusted in Secure Boot local database.


NONCE not supported in Asp.Net for CSP implementation Is NONCE supported in Asp.Net when implementing Content-Security-Policy header to protect from XSS ??

I read that NONCE was not supported in Asp.Net, however I read another simple article, that shows how it is done? Does anyone use nonce for csp headers, I was able to make my implementation work without-it by using unsafe-inline tags for the inline java-script that is in my enterprise web app, it is not feasible to move the inline JS to external files, so the unsafe-inline src was rec. by the client.

I am wondering how many people actually use nonce, or hash when implementing CSP. Also any general best practices on CSP would be appreciated.

CSP is client-side behavior, not server-side; it doesn't make sense to talk about it as something a server-side technology like ASP.NET "does" or "does not" support. At the end of the day, all you're doing is adding some text to your HTTP response headers and HTML bodies. ASP.NET can absolutely do that.
The complication occurs if ASP.NET adds scripts (or other CSP-restricted content) automatically. In that case, if you require nonces on all such content, you'd need to ensure the server adds them to its auto-generated content too. If it doesn't support doing so automatically, you'll need to modify its behavior to do so "manually". There are a few ways and places you might do this, although I can't think of a really obvious one (but then, I haven't done any serious ASP.NET development in the last decade).
If you've got a site that explains how to make ASP.NET handle CSP nonces correctly, why didn't you just try it to see if it works? If it doesn't, you could ask why, and what to do about it... but that's more of a StackOverflow question than a Security.SE question. How to use CSP in the abstract is a security question. How to make it work in a particular way on a particular web server is a programming question.


Should I be worried about SQL Injection for Internal Web Apps? I've been working a lot lately with writing report generating forms at work. The reports  sometimes require input provided by a drop-down list and sometimes require data to be entered by key.

My question is more about practice.
Is it common practice to implement SQL injection safeties in all cases? Or given that these are internal apps it's not worth the time and effort to worry about it? Reason behind this is that it is generally accepted that the intended users are using the system without malevolent intentions.

Or is this question too specific to be applied to such a broad case and one should seek answers from management?

Protections are in place to address risk - protections have a cost (time/effort to code, in your case) and those costs need to be compared to the benefits/costs of implementing them. If the cost of the realized risk is lower than the cost to implement protections, then it doesn't make sense to to implement protections.


Getting root with setuid and the s flag Ok, so I'm trying to wrap my head around what the s flag does in linux.

I've got the following code:

#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <sys/types.h>
#include <stdio.h>

int main(int argc, char **argv, char **envp)
{
  gid_t gid;
  uid_t uid;
  gid = getegid();
  uid = geteuid();

  printf("gid %d\n",gid);
  printf("uid %d\n",uid);

  setresgid(gid, gid, gid);
  setresuid(uid, uid, uid);

  system("id");
}

and the s flag is set for user.

-rwsr-xr-x 1 root root 7358 2017-08-24 17:45 a.out

so to my understanding, since the s flag is set, the effective gid, and uid should be the user.

However when I run this file as another user I get the following.

nebula@nebula:/tmp$ ./a.out
gid 1000
uid 1000
uid=1000(nebula) gid=1000(nebula) groups=1000(nebula),4(adm),20(dialout),24(cdrom),46(plugdev),108(lpadmin),109(sambashare),110(admin)

I believe that this shows that the effective uid and gid were not set the way I would have thought.

Any help?? Thanks!

Filesystems can be mounted with setuid disabled. This is normally done on removable devices (because the administrator has no control over what the removable device contains) and on network filesystems (unless the filesystem is mounted from a trusted server). It is good practice to do it for all filesystems that aren't supposed to allow privilege escalation, such as a filesystem for temporary files.

Check the mount point where your setuid executable is located:

df /tmp

Chances are that on your machine, /tmp is a separate filesystem — you'll see /tmp in the “Mounted on” column. Check the mount options for /tmp; on Linux you can look them up in /proc/mounts:

grep /tmp /proc/mounts

If you see nosuid as one of the options in the fourth column, the filesystem is mounted with setuid and setgid disabled: ls still lists the bits and chmod still changes them, but they have no effect.

Do your experiments on another filesystem. /var/tmp is usually mounted on the same filesystem as / and that one needs setuid enabled for programs like (/usr)/bin/su and (/usr)/bin/sudo.

The setuid/setgid bits can also be disabled via a security framework such as SELinux. See this thread on ServerFault for how to investigate this.


URL Contains Sensitive Data - Alternative Besides Switching To Post? One of my company's clients recently produced an application security assessment report, noting a list of violations based on OWASP's top 10 list of web application security risks. One of the violations, based on OWASP's #3 risk, is that sensitive data is present in browser history. This can be both in the query strings (as in "myurl.com/somepage?userid=user123") or in the url segments themselves (as in "myurl.com/users/user123/edit").

The idea is that an adversary with access to the victim's system will be able to gain access to sensitive data just by viewing the browser history and seeing the data in the urls.

Question:

What are ways to solve this? For query string parameters, I know you can simply change the form method from GET to POST - are there any other ways to handle the query string parameters? What about handling data in the url segments?

It's difficult without a global overview to answer your question. If the only problem on your website was sensitive parameters are present in the URL: As you said, just pass the request as POST and not GET.

However : You need to check theses points :

Be sure communications are encrypted using TLS 1.2 or TLS 1.3
Your server must purpose only robust and non deprecated encryption algorithms. You can use this website to check it or this project if you need privacy.
Check for broken access control. You said that query string use the pattern userid=user123 : check that an attacker can't access to an illegitimate account changing the parameter of the request
Check for SQL injection. The pattern page=parameter (userid=user123) is often implemented on old web site and so more susceptible to be vulnerable. Be careful you can also inject in POST request and other ways

You need also check all TOP 10 OWASP recommendation but according to the information you gave, it's the first point I would check.

Conclusion

What are ways to solve this? Change GET method to POST
What about handling data in the url segments? I am not against the
idea of username appears in the URL. It's not a vulnerability if
access is controlled. Indeed if an attacker steal the computer it
could have access to the history and so the username. However It should
not have access to the password if security standards of storage
password are respected. Moreover, if an attacker steal a computer
which have not an encrypted hard drive, you will have more than the
username problem...

If you absolutely needs to solve this problem, you should encrypt
the user's computer hard drive of the application. In consequences,
if the computer is stolen (and turned off), data will not be available.


Does knowing the file type of an encrypted file make it easier to decrypt? If I encrypt, say, a .pdf file then does knowing that it's a .pdf make it easier to decrypt?
i.e. could the file's well-known structure act as a predictable part of the encrypted bytes?

For practical purposes, no.

Against good crypto, using modern ciphers and making no major mistakes such as a padding oracle or ECB mode or other weakness, it doesn't really help. It can theoretically act as a test for whether you brute-forced the key correctly - does the decrypted file contain the right magic number and data format? Good, you got the right key - but actually brute-forcing the key should be impossible for any modern widely-used cipher (even the weakest form of AES, with 128-bit keys, would take centuries for even a nation-state to brute-force, even assuming Moore's Law continues on course; using only modern hardware it would take many orders of magnitude longer).

Of course, people do make mistakes in crypto, and some ciphers that were once thought strong are now known to be vulnerable.

If you know that the file was encrypted in a particular way, and you know of a weakness in that method, then you can attempt to exploit that weakness. This might be made easier by knowing the file type, as some files are generated by software which nominally supports encryption but implements it very weakly, and knowing that the file is of that type will suggest you might be able to try such attacks (though it won't help you if the file was encrypted using some other tool that implements the crypto correctly).

The ECB (Electronic Code Book) block cipher mode of operation mentioned above encrypts every block (typically 16 bytes for modern ciphers; historically often only 8 bytes) using the same algorithm (for a given key), no matter where it is in the message. This means that if you break the message (or any number of messages, if they were all known to be encrypted using the same key) up into blocks and find two identical blocks, you'll know they're the same plain text. If you find such duplicates and know at least some of the plain text of one of them, because you know at least part of the data of the file (due to knowing its format, or for other reasons), you now know the plaintext for the same part of the other block. This can also be useful when you know the data format in general even if you don't know any specific bytes in it, especially if it's low-entropy data such as a simple image file; see the link above for a striking example of taking a bitmap image, encrypting it using ECB, and the ciphertext (if rendered as a bitmap) still largely revealing the content of the image.

There are other attacks that are less likely to be relevant here, but might be relevant in other situations. For example, if you can get the same data encrypted many times using the RC4 (sometimes called ARC4 or ARCFOUR) stream cipher, you can exploit biases in the "key stream" (the bits generated by the pseudorandom function that a stream cipher is) to slowly decrypt the data; this is why RC4 is no longer trusted for use in SSL/TLS (although for a given blob of data encrypted only once, this attack isn't viable). Padding oracle attacks allow you to decrypt a message (typically one encrypted using a block cipher such as AES in the CBC mode of operation) in linear time, provided there's an "oracle" that knows the decryption key and will, on command, decrypt any message and tell you if the padding (padding is necessary for block ciphers) is correct. Such an oracle is usually not available for a file at rest, but a padding oracle is the reason the that CBC mode can no longer be used in SSL, and led to the deprecation of the entire SSL protocol (TLS includes protections against padding oracle attacks).

Knowing the structure and some basic data about the file can also enable bit-flipping attacks (where you don't decrypt the data, but do change it in a predictable way that could further your causes against whoever legitimately uses the file). This is getting pretty far afield of your question, but it's sometimes relevant when you're attacking an encrypted file of which you have minimal but non-zero knowledge.


How to enforce confidentiality while keeping the authenticity? Below is an illustration of the digital signing process.

According to Wikipedia:

  A digital signature is an authentication mechanism that enables the
  creator of the message to attach a code that acts as a signature.

Suppose sender generates private key 1 and public key 1 to generate the signature.

I think sender basically sends the original Data + Certificate (which contains public key 1) + signature to the receiver.

Then the receiver can:

extract the public key 1 from the certificate
use the public key 1 to decrypt the message hash from the signature
Use the hash to verify the original Data.

But what if someone in the middle intercepts the message? He can do all the same as the receiver. Thus the original Data will be exposed. How is this prevented? Is it prevented by using another pair of keys to encrypt the original Data? If so, how is the public key given to the receiver without being intercepted?

I think it is dangerous to send the public key along with the message. But even if you don't send the public key along with the message, the man in the middle can still intercept the public key and keep it for later use.

So, how to keep both confidentiality and authenticity in a public channel, and with all communications happening only on that channel?

Is it prevented by using another pair of keys to encrypt the original Data?

Yes, you can use one set of keys for signing and one set of keys for encryption.

  How is this prevented? Is it prevented by using another pair of keys to encrypt the original Data? If so, how is the public key given to the receiver without being intercepted?

The problem of key distribution is fundamental. In practice this problem is solved by using a trusted third party called a Certificate Authority (CA).

The CA is implicitly trusted (because the manufacturer installed its root certificate in your computer) and the CA can sign a web server's (e.g., google.com) certificate to prove that the certificate belongs to the web server.

You can then verify the CA signature on the certificate. This gets rid of the MITM attack because the MITM can not obtain a signed certificate from the CA saying that the MITM is, e.g., google.com.


How to be taken seriously when doing responsible disclosure? Last week while reading an article on a website the URL ending in .php?id=1 it just asked to be tested for SQLi. When I confirmed that it was vulnerable I also found out that there was no user input filtering and a simple  "<script>alert(1)</script> was possible.

When looking for a contact email to report the vulnerability I only found addresses for specific departments, like finance@badwebsite.com.

Since I did not want to just send the vulnerability report randomly I called the company, explaining that I found a problem in their website and that it would be a good idea to get it fixed. I explained that I would like to get in touch with someone from IT or someone who has any relation to the people that maintain the website.

The person on the phone got quite aggressive, told me to take a hike (used a bit less friendly language) and told me I had nothing to do with their IT department of website.

How can I convince people about the importance of a vulnerability and the disclosure when they are not familiar with IT? Especially when no email contact is possible?

FYI, I believe I was very polite and calm on the phone.

The ground rule is, if a website does not have a responsible disclosure policy any security team looking after their public resources is an indication that they neither care about the security of their resources nor they are going to consider any report from a random person yet. If I find some major issues in certain major company's website, I would report it through right communication channel and remind them couple of times and that should be it.

  The person on the phone got quite aggressive, told me to take a hike
  (used a bit less friendly language) and told me I had nothing to do
  with their IT department of website.

You are a nobody and he is right. I guess he's not aware of things like bug bounty, independent security researcher. So it is hardly likely he's going to honor anything coming out of you.
There have been numerous cases where the website owners got pissed and created problems for the researchers. The wise thing to do here is just let go and look for somewhere else where your efforts are appreciated. They have no written policy or procedure which can defend you if they were to ask you why you generated such malicious traffic on our website.

  How can I convince people about the importance of a vulnerability and
  the disclosure when they are not familiar with IT? Especially when no
  email contact is possible?

The convincing in this case is to be done to the respective person and here you have no contact. You can't randomly go explaining the bits of weakness of their website to the guy who picks up the phone or sending the report via social media channel like Facebook. This would not be responsible disclosure.

The right thing to do is ask for their security team's contact information on their official contact email without explaining the issue. If you do get an official response then act accordingly otherwise they don't care and so should't you. You can send two or three polite weekly reminders and that's it.


HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication? We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use to anyone. However, we will need to authenticate users and do what we can to ensure the integrity of the data passed to the service.

Therefore, we've looked at using HMAC with the key being a 256 bit key derived from the users password entered on the client using PBKDF2. While I'm happy thus far with our implementation, I'm not sure how PBKDF2 with even 1000 iterations will perform on a iPhone/Android client. Also, as I mentioned earlier, it is unlikely anyone would want to compromise our service and while reading questions such as this one that mention things like "threat model and risk profile", I wonder if I am overdoing things.

The thing is, a third party has been commissioned to develop the client application, and their initial design doc provides some basic thinking of their idea of security and it is much more around something like;

MD5(shared secret + user password + request uri + timestamp + json serialised post data (if any))

Irrespective of whether we choose MD5, SHA1, or SHA256 is there any advantage to choosing HMAC/PBKDF2 over their suggested method (assuming roughly the same inputs to generate the hash)? Basically, am I overcomplicating this for a service that is likely to see a very small amount of traffic? At this stage, it is likely that all traffic will be over SSL also.

Recommended approach. I recommend that you use SSL and authenticate the client using their password.  Then you won't need any fancy MAC, hash, PBKDF2, etc.

Details.  You asked how to authenticate the user.  Here is a simple approach.  Use SSL sitewide.  When the user logs in (entering their password in via a web client), then set a session cookie that remembers the user for the rest of their session.  (Make sure to use SSL throughout, and to set the secure flag on all cookies.)  If you want, you can set a persistent secure cookie once the user authenticates, so they will never need to enter their password again on this browser.

If you want to access the web service from a dedicated mobile client, the same approach works fine.  The web server can send a secure persistent cookie which the app can store permanently in its app-local storage, and can use that cookie to authenticate the client.

Alternatives. If for some reason the above is not possible, there are some fallback alternatives, but I think they are less preferable and more likely to have security problems.  Here's one plausible fallback method:

On the first launch of your mobile client app, it prompts the user for their password, connects to the server over SSL, and sends the password over SSL.  The server responds with a random 128-bit authentication key (chosen by the server using a crypto-strength PRNG).
The client app stores this auth key permanently in app-local storage.  The server remembers the association between this auth key and the user's account permanently.
All future requests from the client app are authenticated using this auth key, as follows: you append a parameter to the end of the URL that holds the HMAC (under the auth key assigned to this client) of the rest of the URL, any POST data, and any other state that the server will taken into account.

As long as all requests are idempotent (e.g., for non-idempotent actions, you make sure to include a unique identifier somewhere in the URL parameters or in the POST data, and the server does replay detection), this should work OK to protect the authenticity and integrity of requests from the client to the server.

However, it has some security limitations.  It does not protect confidentiality.  It also does not protect other request headers, response data, and all sorts of other stuff.  For this reason, it is not as secure as just using SSL.  For instance, a site built using this approach likely will not be secure against man-in-the-middle attacks, due to the amount of other stuff that isn't protected by a HMAC, and thus won't be safe to use on an open Wifi network.  For this reason, I suggest you just use SSL across the board and simplify your life, rather than trying to invent your own cryptographic request authentication format.

Security against password guessing. You'll note that none of my proposed approaches involve generating the cryptographic key as a function of the user's password.  Users typically choose passwords.  You should expect this will be especially true on mobile platforms, where entering passwords is a pain. For that reason, cryptographic keys derived from passwords will generally provide weak security and can often be broken by dictionary search.  For instance, an eavesdropper who captures any one request will be able to mount a brute-force password search attack to recover the password and thus the crypto key, if the crypto key is derived from the password.

While PBKDF2 is an attempt to mitigate this as best as possible, the fundamental vulnerability remains.  For this reason, I believe it is better to avoid using cryptographic keys that are derived from passwords, whereever possible.  My solutions above are more robust in the face of weak user passwords, because they do not involve sending a password or anything derived as a function of the password in the clear over any connection.

The third-party design. You mention you hired a third party to come up with a design, and they proposed using something like MD5(secrets + data + more data).  This is a bad idea.  Don't do it.  It has multiple cryptographic flaws.  First, MD5(secret + data) is a poor message authentication code; it is susceptible to message extension attacks.  Second, combining different kinds of data by concatenation is a bad idea and one of the top-ten most common crypto mistakes; both Amazon and Flickr had high-profile security flaws due to this.  Instead, I recommend that you use a proper message authentication code (like HMAC), and that you use proper methods for concatenating the data fields that you want to authenticate, e.g., by including length fields.


Are foreign keys linking to a table with PHI considered PHI under HIPAA? Table 1 has PHI and it's encrypted. Table 2 doesn't have PHI, isn't encrypted and has a foreign key to Table 1.

I'd like to recommend the strongest security. If there's a requirement in HIPAA, it's not optional and must be done. If it's part of a standards body like ISO/IEC 27001 then it will need to be done for compliance to that standard. If it's a best a practice, it would be ideal but difficult to persuade for a best practice vs the performance impact.

1) Does HIPAA have any requirements for the foreign key to Table 1 in Table 2?
2) Is there a standard like ISO/IEC 27001 that has a requirement for the foreign key to Table 1 in Table 2?
3) Is there a best practice or anything similar that covers the foreign key to Table 1 in Table 2?

To answer your question according to the points:

1) In a pure sense, no.  PHI means identifiable patient information (e.g. a name, an address, a social security number, etc) combined with clinical data (e.g. a diagnosis, CPT code, test result etc).   A foreign key in and of itself is not PHI.

2) Not that I am aware of for HIPAA -- HIPAA is more of general guidelines than clear, distinct standards.

3) Yes!  If it makes you worried that the release of any particular data might cause problems for your company, your customers, or especially trigger HIPAA breach notifications: encrypt it!  With HIPAA, it's always best to err on the side of encryption.  If properly encrypted data is compromised, this does not trigger reporting requirements; which can be a life saver for a company -- especially a small one.


Does the strength of password matter in bcrypt? Even if I choose 1 character for my password or 32 characters with numbers, letters, uppercase symbols etc. the bcrypted password will still be 60 characters length password. So does the password strength matter when using bcrypt?

The "strength" of a password is exactly how much it is unknown to the attacker. It always matters. That strength equates to the number of tries (on average) that the attacker will have to perform in order to guess it.

What bcrypt does is that it makes each try more expensive. With its configurable number of iteration, set sufficiently high, bcrypt can make it so that the attacker cannot try more than one password per second on his machine. This is much better (for you) than a billion tries per second, with a less suitable hash function: it makes cracking your password a billion times harder. However, if your password consists of only one character, the attacker will still find it in less than a minute.

So while bcrypt makes weak passwords more tolerable, it cannot save your skin absolutely.

(Output length of bcrypt is irrelevant for this. It is normal that hash functions have a fixed output size; in fact, if the output size depended on the input size then it would be a weakness, since it would leak information on the password.)


DOCSIS modem only authenticated by MAC? Is a DOCSIS modem only authenticated by the CMTS by a MAC address or are there any other AAA techniques? In that case, how do I prevent other customers from spoofing my modem's MAC address?

Cable Modem Initialization Wallchart published by Cisco in 2005:

MAC address spoofing is possible, but a) requires knowledge of existing, valid, not used MAC address b) tools - not that widely available for cable modems as for ethernet routers.

Certificate based authentication and encryption is available (Baseline Privacy Inteface Plus - DOCSIS 1.1 and DOCSIS 2.0, Security in DOCSIS 3.0) - see http://bit.ly/1iJMbNM for some more details.


Any downside to using basic authentication over HTTPS in addition to native authentication? Can basic authentication over HTTPS do any harm on a personal one-user server if used in addition to native authentication provided by individual web applications?

Using Basic Authentication over HTTPS is considered to be secure as the main issue with Basic Authentication is that the credentials are sent over clear text.

However, there are some common practices that make using Basic Authentication a bad idea. The following are some examples:

Usually no request limiting is put in place - This can allow brute force attacks
Same password for the whole lifetime - usually the password will be static and will stay the same during the entire application lifetime
If a user forgets his password, how does he reset it?

If an application is using correct configurations and is used over SSL, it is theoretically secure and all that is left is to solve the application design issues.


Hashcat custom mask - brute force 12 length passwords with 1 capital letter, 1 number and 10 lowercase letters I need to use brute force to crack the password. I know about the password that it has exactly 1 capital letter (A-Z), exacly 1 number (1-9) and exacly 10 lowercase letters (from a to z). I have Python script that generates this type of passwords, but I don't know how to turn it into a hashcat mask.

Python code:

import random

random.seed(None)

lowers = 'qwertyuiopasdfghjklzxcvbnm'
uppers = 'QWERTYUIOPASDFGHJKLZXCVBNM'
number = '0123456789'

length = 12

while True:
  uprspot = random.randint(0, length-1)
  numspot = uprspot

  while uprspot == numspot:
    numspot = random.randint(0, length-1)

  strgen = ""

  for i in range (0, length):

    if i == uprspot:
      strgen += random.choice(uppers)

    elif i == numspot:
      strgen += random.choice(number)

    else:
      strgen += random.choice(lowers)

  print(strgen)

You can't do that with a single hashcat mask, but you can make multiple masks. You need to use a multiset permutation for this. There are 132 possibilities, so need to generate a .hcmask file with 132 lines like this (in Python with sympy):

from sympy.utilities.iterables import multiset_permutations
import os

contents = os.linesep.join(list(map(lambda b: "".join(b), list(multiset_permutations(['?d', '?u', '?l', '?l', '?l', '?l', '?l', '?l', '?l', '?l', '?l', '?l'])))))

file = open("scan.hcmask", "w")
file.write(contents)
file.close()

Then use the .hcmask file in hashcat

This would require 26¹¹ · 10 · 132 ≈ 2⁶² hash computations, which would require about one to two years to crack assuming 70 GH/s.


Accept a https connection with invalid certificate and validate the certificate before. Is it possible? I will integrate with a new application on the next weeks. But something that was told to me by the partner team was very strange.

The partner ask us to pass one .CSR file with our company information: name, address, etc. After that they signed this file and send back to us. Until here, ok.

But after that, they said something like this:

  [...] we will setup our system to restrict the requests for the certificate. If someone try to make a request without the certificate, our system will accept the connection without the certificate or with a incorrect certificate, but the system will answer with a error for the sent requests.

As far as I know, if the certificate is invalid the https connection protocol will not accept the connection, no matter what. What I'm missing here?

What your partner said is somewhat legit and ok from security perspective.

TLS is established between client HTTPS library and TLS server, not server app! Server app delegates TLS stuff to TLS server (Apache, IIS, dozens of them). Partner is planning to ignore certificate errors at TLS level (between client and web server). Instead, they apply certificate validation logic in web application. They simply check certificate details for every connection and if certificate fails, they will respond to client with error using client-server data protocol (SOAP, Web API Result, HTTP code, etc.).

In other words, there are two levels where certificate validation occurs: on TLS server and inside web application. They bypass all errors on first level and will handle them on app level.


Locking server ‘root’ to IP whitelist, But prevent my lockout To protect my Debian servers, I'd liked to lock access of username ‘root’ to only IP addresses(or ranges) listed in a ‘whitelist’ file.  But getting locked out of my server is even worse than getting hacked. And as I travel a lot, I must have a couple good ways add or change the IP addresses in that whitelist file.

1:  Is the ssh sshd_config file the best way to limit the IP addresses?
And if I create a new user, example named ‘AltRootUser’ and give him full root permissions, but NOT limited to any IP, then I could login as him to edit the  sshd_config file?

2:  As a second way of updating the allowed IP addresses, I'm thinking of some secret webforn, where I enter a special password, and a new IP address.   Then I could write a script that would take that IP address and add it to the whitelist.   Is this doable or are there already any such scripts or tips on doing this?

This sounds like an XY problem to me. The real question should be on how to better protect your root account from malicious remote logins and not how to limit access to the root account to only specific IP addresses. While this could be useful in a defense in depth strategy the ways you propose to deal with dynamic IP addresses likely add even more attack surface instead.

I recommend to abandon your specific ideas and instead use other ways to protect your root account from unwanted remote access. Note that the following ways can also be used together for increased protection and that there are additional ways possible for even better protection:

Don't use passwords but always use key based authentication. This makes brute forcing accounts practically impossible.
Don't allow remote login as root in the first place but login as a normal "jump" user (preferable key based not password based) and then sudo to root or create a tunnel to localhost which you then can use for key based SSH login as root.
Use some form of port knocking or SPA (single packet authorization) to temporarily allow access to the SSH service from a specific IP address. This kind of matches your idea but it affects the whole SSH daemon instead only root access and it also uses established implementations instead of some self-made stuff.


How to make a certificate encrypted flash drive? I was wondering if it possible to encrypt a flash drive (or any other external medium) using certificates instead of a password.
The idea is to have a number of encrypted pendrives that can be used on PCs that have the appropriate certificate but nowhere else.

Any ideas how that could be implemented?

as Jeff said, depends on what kind of "certificate" you mean. if you just want to allow USB sticks on certain machines, then Win7's BitLocker To-Go as well as Truecrypt (using key files) allows for this sort of thing.


Are there any flaws in two step (RSA + AES) key exchange and secure channel setup? To setup a secure channel with server I use the following setup in my application:

1.Generate a random AES key and random IV

2.Encrypt AES Key, IV and client credentials with RSA public key

3.Send to Server

4.Server decrypts using private RSA key

5.Server verifies credentials

6.Server replies with [(OK or FAIL) + random salt]  encrypted with AES key

7.Client verifies response

8.Communication channel is designated as authentic and session as valid

9.All further business communication go via same AES key until session end (Disconnection)

Additional details:

1.Public and private RSA keys are hard-coded and constant for application's lifetime i.e. no procurement of public key from external source happens

2.All constant known plain-texts like OK FAIL etc are sent with salt

I beleive this setup should pretty much be fool proof unless someone has access to client or server operations (or breaks RSA)

Are there any potential loop-holes in this setup that I failed to realise or overlooked?

Your concept looks mostly good, but I see two flaws in it:

Not cryptographic authentication: I would suggest that in step 2, instead of sending the credentials you just send a user identifier and derive a MAC key for the user's secret which you use to authenticate the remaining data. This would reduce the possibility of someone tampering with the data and furthermore improve the security by not having to send any secrets.
No forward secrecy: If this is an actual problem depends on your scenario but since you stated that the RSA private key is hard coded in your software, I assume it could be one (especially since your current plan is to send some secret credentials in step 2 always encrypted with the same key). Instead of sending an AES key in step 2, you could send half a Diffie-Hellman key exchange message and return the servers key exchange message in step 6 along with the encrypted response.

Not really a problem but still noteworthy: I do not see a point in creating the IV on the clientside and transfering it encrypted. An IV is not a secret thing, it could just as well be created on the server and sent along with the message in step 6 in cleartext.


Sniffing, Snooping, Spoofing Could somebody please explain to me the differences between the following attacks?

sniffing
snooping
spoofing

My professors used them all in his documents, but I'm not sure, if those are 3 different attacks or just synonyms.

Sniffing and snooping should be synonyms. They refer to listening to a conversation. For example, if you login to a website that uses no encryption, your username and password can be sniffed off the network by someone who can capture the network traffic between you and the web site.

Spoofing refers to actively introducing network traffic pretending to be someone else. For example, spoofing is sending a command to computer A pretending to be computer B. It is typically used in a scenario where you generate network packets that say they originated by computer B while they really originated by computer C. Spoofing in an email context means sending an email pretending to be someone else.


Is it possible to make a video that is provably non-manipulated? Suppose a student takes an exam at home. Since home-exams are prone to cheating, the student wants to be able to prove that he/she did not cheat. So the student puts cameras in the room, which videotape the room during the entire exam. Now, if the student is blamed for cheating (e.g. because his/her exam is similar to another exam), then he can show the video and prove that he did, indeed, write the exam by his own, did not leave the room during the exam, did not use unallowed materials, etc.
The only problem is that video can be edited. Theoretically, the student can exit the room, talk with a friend about the exam, then get back into the room, and after the fact, use a video editing software to erase the relevant part.
Is there a way to take a video and simultaneously sign it digitally, so that it will be possible to verify later that the video was not edited? (Is there maybe a software that does this?)

Trusted Timestamping
I think, if you continue down this line of thinking, you will end up with something very similar to Trusted Timestamping Servers.
The core idea of trusted timestamping is that you submit a file to the server and it signs an attestation saying that it saw the file with hash aabbcc112233 at time X. This is typically used for both proving the initial publication time (and who published it), as well as proving that the file has not been modified since.
You need the trusted 3rd party because if the end-user creating the video is the same person signing it, then there's nothing stopping them from re-signing it after they edit it.

Why not just save the video stream on the server?
That said, I don't think you really need any fancy crypto here; the simplest solution is probably best. Have the student live-stream their cameras to an exam-monitoring website. The website logs the video stream in its database as it comes in, and it can detect and alert if the live stream had any breaks or disruptions long enough for manual editing to potentially have taken place.

Create a blockchain of the video stream
Update addressing comments.
Ah, you have the extra privacy requirement that students do not want their video stored on 3rd party servers (that should have been in the question!).
In that case, what makes this problem hard is that you can't wait until the end of the exam and publish a single hash for the entire video because that gives the student too much time to edit a middle section of the video. The solution that comes to mind would be some kind of hash-block-chaining (not "The Blockchain (Bitcoin)" but "a blockchain"). Either the sender or receiver breaks the video stream into, for example, 10 s "blocks", hash each block as they are produced/recieved, and stream the hash for each block along with the video in real-time. You do "block-chaining" by including in each block the hash of the previous block. In math notation:
h_0 = hash(videoblock_0)
h_1 = hash(videoblock_1 || h_0)
...
h_n = hash(videoblock_n || h_n-1)

This preserves privacy because the server only needs to store the hashes and not the video itself. This is streaming-friendly because you are producing hashes throughout the stream and each hash covers the entire stream up to that point. This is efficient because the server only needs to store the most recent hash (h_n), and that is enough to later verify if a provided video was tampered with at any point in the stream (though to detect where it was tampered you would need to save every block hash).


Deny access to IIS Server from IP local range I have a local IIS 10 Server, this server runs a critical application.

I want to deny access for this server from IP local network and allow only 2 or 3 IP-addresses. Additionally I want to log any attempt to access this server.

How do I can do this ? It is a way to add a .conf file like apache for example? Or use a firewall?

In IIS Manager, (if the sub-feature has been installed) there is a node for IP Address and Domain Restrictions which will allow you to determine which IP addresses you want to allow and/or deny either for a specific website or for all websites on the server.

If you don't see this node, it is because the sub-feature has not been installed.  In that case, from the Server Manager Dashboard window choose Add Roles and Features and navigate to the Server Roles node, and then to the Web Server role.  Under the Web Server role node there is a Security sub-node, and from there, check the box for the IP and Domain Restrictions item and save.  You should now be able to create IP allow and deny rules in IIS Manager for your website or the server.


What are the point of these gibberish comments? On this site there are comments such as:

ÃÊÁ ¹67 Èìåíè Âîðîõîáîâà â Ìîñêâå (Ãîðîäñêîé äåïàðòàìåíò çäðàâîîõðàíåíèÿ) ïî ïðàâó íà -ñåãîäíÿøíèé äåíü ñ÷èòàåòñÿ êðóïíåéøèì âðà÷åáíûì çàâåäåíèåì ãîðîäà Ìîñêâû. Ïîìîùü â äèàãíîñòèêå, ëå÷åíèè (ïëàíîâîì ëèáî àâàðèéíîì) îêàçûâàåòñÿ àáñîëþòíî âñåì áåç èñêëþ÷åí

They are obviously spam, but what for? The other posts about gibberish comments have been either Bayesian poisoning, which this obviously isn't because there aren't actual words, or seeing how you format certain things in a post, which again this is pretty clear it is not.

So what is the point of this spam? What are the bots trying to accomplish?

These are almost certainly incorrectly encoded foreign characters.  From some queries on "words" like âñåì and çàâåäåíèåì (chosen at ~random from the text), I'm guessing it's supposed to have been Cyrillic.  For example, this Russian book on Amazon has a similarly garbled description.

I do not know of a way of mapping those things back to Cyrillic in order to read (or translate) it.

It may also be comment spam, in which case perhaps the spamming software is the source of the bug rather than the site (I see Blogspot, WordPress, and Amazon in the search results; you'd figure they wouldn't all share this bug!).


How to mitigate evil twin WIFI social engineering attack? I just come across this article: Capturing WPA Passwords by Targeting Users with a Fluxion Attack.

Although WIFI Evil Twin attack and WIFI de-authentication attacks is known for a long time, a mature ease of use WIFI toolkit such as Luxion will escalate the frequency of such attack.

Besides luck(If I am not using a mainstream router inside the attack list ) or disconnect the WIFI, I still can't think a better way to mitigate the risk for such well-crafted/well-though attack

For a typical user(imagine our non-tech savvy parent), is there a way to mitigate such attack?

As with any social engineering attack, one of the best ways to mitigate it is through training and communication. Explain the problems to users and nurture in them an attitude of cautious skepticism towards ANY unannounced changes in the way your systems operate.

The ideal default user behavior should be, "Hmmm, that login page looks different. I don't remember a notification that said this was changing. I am going to ask support/management about this before using it."

This is an idealistic description; reality will always be harder and require layers of security controls.


Implementing Secure Remote Password with Remote Desktop Application I had read the Secure Remote Password Protocol paper written by Tom Wu. This protocol is resistant to dictionary attacks. I have also go through some papers regarding to VNC attacks due to weak password and DES encryption. Will this protocol improved the security concern for authentication protocol of remote desktop application.

RDP is a protocol with a rather long history, and multiple layers. Recent versions can mix with SSL/TLS in two ways (which can be used concurrently):

Since RDP v5.2, the protocol can embed a TLS session (the TLS records are transported as so many messages by the RDP transport layer); the TLS session protects the connection.
Since RDP v6.0, the whole protocol can be embedded within a TLS session opened from the client to a specific gateway (called Terminal Services Gateway).

Both TLS usages can conceptually use SRP, since there is a standard for that. However, this will not happen until you get an RDP client and an RDP server who agree on using SRP with their TLS tunnels. I am not aware of any existing RDP implementation (either client or server) which currently does that. You could launch an opensource project on the subject, building on FreeRDP (for the RDP protocol) and GnuTLS (for the TLS+SRP part). This is not a five-minute task, though...

Another possibility is to establish a kind of SRP-powered VPN and tunnel the RDP protocol through that. The SSH protocol can help; it includes features for port forwarding through the SSH tunnel, and at least one SSH implementation supports SRP. This kind of tunnelling will be clunkier, but easier to assemble than patching RDP implementations (in particular if you want to use close-source RDP client and servers, which is usually the whole point of RDP: to use Microsoft's client and/or server).


FIDO: what is the benefit of the challenge parameter? In the enrollment stage an attacker could intercept the message and answer with a signature based on the correct challenge.
I know that normally you include a symmetric secret in such a challenge, but here there is only a random value which will be signed. I do not see the advantage of using this scheme. I think you can just do the authentication without this challenge. You can prevent replay attacks with it.
So did I overlook anything? Is there a good explanation why FIDO does it the way it is specified?

The challenge-response model is primarily designed to help prevent against replay attacks, in which an attacker sniffs an authentication packet and then replays it within their own session to gain unauthorised access.

As you noted, a server-controlled random token (called a "server nonce" in most protocols) which must be signed in order to authenticate makes it almost infinitely unlikely that an attacker would be able to replay an authentication packet to gain access.

However, one additional benefit is that the scheme forms a kind of zero-knowledge password proof, in which knowledge of a secret can be proven to the server, without ever actually transferring the actual secret over the network. This means that a network eavesdropper must break the challenge-response scheme (e.g. by bruteforce attack) in order to discover the secret.

Thomas Pornin provided an excellent summary of both server nonces and client nonces in another question, which summarises it much more clearly than I could hope to.


How to properly handle security certificates in asp.net (ws-federation) So I'm setting up single-signon authentication for the organization I work for.

Our IT guy has setup an ADFS server, which is where we're getting our logon credentials from. He's using an in-house security certificate that wasn't originally created for this task. Now upon setup, I was getting an error "The remote certificate is invalid according to the validation procedure". So I've added the certificate to my dev machine as trusted root, and that exception went away. Good.

Now upon logon, we're getting a 'IDX10201: None of the the SecurityTokenHandlers could read the 'securityToken'' error. And then a list of 3rd party certificate handlers (w3.org, godaddy).

Now a lot of the solutions I've found online just say to set yourself up as a token handler, but that doesn't seem to be the ideal, nor the more secure solution.

So, I have a few questions. Will getting a 3rd party certificate resolve the token handler issue? The certificate we're using was issued to a specific server, not my dev machine, is that an issue as well? SSL is a brand new world to me, so explain it to me like I'm in 1st year.

EDIT:

So upon running openssl x509 -in <certificate file> -text, I'm getting an error:

11568:error:0906D06C:PEM routines:PEM_read_bio:no start line: crypto\pem\pem_lib.c:691:Expecting: TRUSTED CERTIFICATE

The IT guy told me yesterday that he's using a "wildcard certificate", but I can get more information if needed.

Turns out that Asp.Net doesn't support encrypted tokens out of the box. DarksideCookie made a great guide on how to set it up manually.

http://chris.59north.com/post/Manually-configuring-OWIN-WS-Federation-middleware-and-accepting-encrypted-tokens


How to add subject alternative name when converting PEM certificate to DER format? Is it possible to add a subject alternative name when converting PEM certificate to DER format.

openssl x509 -outform der -in Certificate.pem -out Certificate.der -extensions SAN -subject-alternative-name 'alternative name'

If possible, so how to make this operation with openssl?

No, of course not, this would change the certificate and invalidate the signature. You're asking the exact same thing as "I have a certificate for a domain I own, chedy.com, and I want to add google.com to the Subject Alt Names list, what is the openssl command for that?".

The difference between DER and PEM is just a base64 encoding.

You need to generate a new certificate with the SAN you want.


Most secure response for a server to return to a user scanning for exploits I have ASP.NET servers hosted in IIS, regularly i see bots attempting to scan my server searching for outdated versions of phpMyAdmin, mysql etc.

Currently these requests all return 404 because that's the legitimate response as /phpMyAdmin-2.5.1/index.php certainly doesn't exist.

Is there something better that should be done?

My best thoughts, is there anyway to tell IIS to completely abandon a client connection without informing the client so basically it looks like the server just doesn't exist or is completely offline for those addresses?

The problem is that you may have vulnerabilities in your system. Scans are unavoidable.

Scan your own site and make sure you are immune to such low hanging fruit. Pay an application penetration tester to make sure you are immune from more threatening attacks. Use a web application firewall like mod_security to filter attacks before they hit your web application.


xss bypass for javascript elements filtered as [removed] If we write test ">script>alert(1)/script>, application is filtering the JavaScript with test">[removed]alert(1)[removed].

And payloads like onmouseover,onmouseout are skipping.

In this case what kind of JavaScript bypass can be used for performing XSS.

I think you can try with the following options:

<script>

Also you can use another HTML tags:

Click me

I recommend you the following link, you could find useful samples.

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

I hope this information helps you.

Good luck.


SOC 2 audit for small business (6 employees) with no IT department One of our clients is demanding that we complete a SOC 2 Type II audit. There is no way we will meet the standard, and, considering we only handle publicly available data, it is ridiculous that they are asking for one. We're talking about 6-8 Excel files per year that represent a very small but critical part of our business. Unfortunately, we have no choice but to comply.

I am looking for some guidance on how to bring our systems up to standard. I handle our internal IT via google search, most of our services are cloud-based, and we contract for support as needed on our internal server.

We need someone to manage the changes and documentation of our systems for the auditors. The company we contract with for IT support wants no part of this. We can't hire a full-time IT person, but we could hire a contract employee to carry us through this process.

Would it be better to hire an individual on a contract basis, or to contract with an IT company? Where would I even find a company to handle this sort of thing? Any help is greatly appreciated.

When I kick off a SOC2 audit I screen at least three vendors based on he following criteria:

Duration of audit
Do they provide a pre-assessment checklist/self assessment
Duration from end of audit until report delivery
Cost
Sample work product


What are the minimum parameters for Argon2? Argon2 is the winner of the Password Hashing competition, and currently recommended by OWASP for secure storage of passwords.
One crucial step of Argon2 is determining the parameters used by the function. The current IETF draft titled "The memory-hard Argon2 password hash and proof-of-work function" has a chapter named "Parameter Choice", which provides a step-by-step guide to finding the right parameters.

Select the type y. If you do not know the difference between them or consider side-channel attacks as a viable threat, choose Argon2id.

This step seems pretty straight-forward. The advice to use Argon2id as default unless you know that some other mode is better for your use case.

Figure out the maximum number h of threads that can be initiated by each call to Argon2.

This step is the first confusing one. How does one "figure out" how many threads should be used? If only one thread is used, is it unsafe?

Figure out the maximum amount m of memory that each call can afford.

This step seems more straight-forward again. However, if a server has 128 GB RAM and expects ~1024 concurrent logins at peak times, then ~ 128 MB is the maximum. This does not answer however, what if there would be 10 times as many users? What if 1 MB was the maximum? What if 16 KB was maximum? Which point is "too little" memory?

Figure out the maximum amount x of time (in seconds) that each call can afford.

This seems straightforward, higher numbers mean more cracking resistance at the cost of login speed.

Select the salt length. 128 bits is sufficient for all applications, but can be reduced to 64 bits in the case of space constraints.

This is very helpful, as it provides a default value that is considered sane.

Select the tag length. 128 bits is sufficient for most applications, including key derivation.  If longer keys are needed, select longer tags.

Just like step 5, this is helpful as it provides a sane default.

If side-channel attacks are a viable threat, or if you're uncertain, enable the memory wiping option in the library call.

Helpful information, as it explains the threat it tries to mitigate.

Run the scheme of type y, memory m and h lanes and threads, using different number of passes t. Figure out the maximum t, such that the running time does not exceed x. If it exceeds x even for t = 1, reduce m accordingly.

This step is by far the most confusing. The idea is obviously to benchmark the system, to find "good" values for m, h and t, but it does not provide any priority to those parameters. Is low memory, but high parallelism and many iterations good? What about high memory and parallelism, but few iterations?

To summarize:

What are the minimum values for parallelism and memory usage to be considered "secure"?
What priority do memory usage, parallelism and iterations have?
What happens if one parameter is too low, but the other two comparatively high, so as to still get an execution speed of about 1 second?

The Argon2 spec gives very detailed information.

How does one "figure out" how many threads should be used? If only one thread is used, is it unsafe?

The  maximum number of threads you want is the number of hardware threads on your system. A 4 physical core Intel CPU Hyper-Threading to give it 8 logical cores should be be running Argon2 with 8 threads. If you use only one thread, then you will not be making optimal use of your hardware. This isn't inherently unsafe, but it does mean that the KDF will take longer to get the same amount of work done. If you have a system with a lot of hardware threads, you might just want to benchmark it.

This does not answer however, what if there would be 10 times as many users? What if 1 MB was the maximum? What if 16 KB was maximum? Which point is "too little" memory?

There's no effective lower limit beyond the limits imposed by the specification. You can bring it as low as you want, but remember that a smaller amount of memory means an attacker will be able to more easily utilize high-speed specialized processors like ASICs. The more memory you use, the more expensive it is to attack. You want to use the maximum possible. If you are forced to use very little memory due to resource constraints, there's nothing you can do about it.

This step is by far the most confusing. The idea is obviously to benchmark the system, to find "good" values for m, h and t, but it does not provide any priority to those parameters. Is low memory, but high parallelism and many iterations good? What about high memory and parallelism, but few iterations?

Parallelism is actually used to fill memory more quickly. The more hardware threads you use, the faster the memory can be filled and operated on. As for memory and iteration usage, that represents a tradeoff. With all memory-hard algorithms, an attacker can utilize a time-memory tradeoff (TMTO) attack where they can get away with using less memory than you used, but at the expense of greatly increased computation requirements. The more iterations you use, the more computations an attacker will need to perform to reduce the amount of memory they need to use. The exact optimal values depend entirely on the economics of the attack itself (e.g. it's possible to get around 16 GiB of ultra-high speed and low-latency memory using TSVs on sapphire substrate, but is that more or less expensive for a given attacker than adding more computation units to perform a TMTO attack?).
Related answers on our sister site, Cryptography (and the argon2 tag), which help explain more:

Questions about the argon2 options

What is the recommended number of iterations for Argon2?

Is it better to maximize memory usage or number of passes with Argon2i 1.3?


How many authentication factors are there? The three classes that we all know and love:

Something you know.
Something you have.
Something you are.

I've also seen references to "somewhere you are".  Is this really a fourth factor? How many factors are there?

At some point some of the factors might start to resemble others such as the blurring of the "something you have" as described in this sec.SO question.

“Somewhere you are” seems to be a very reasonable authentication factor in 2012.  A few weeks ago my Android’s Google Maps app prompted me to turn on my Wi-Fi to better locate me.  My GPS was on and had a good location but Google was going the extra mile (or better stated – extra meters) by triangulating local Wi-Fi signals (Street View collected that for a reason).

So if Google wants to authenticate me based on my location compared to my typical routine they probably will have a valid factor for 90% of my trekking around this planet.

My gasoline pump asks for my Zip Code to process my credit card.  My Zip Code is the same as that of the querying pump so it seems potential exists in that use case too.  I know that typically the Zip Code question is "Something you know" but think about the actual location and likelihood it is me especially considering we are collocated in the same Zip Code and I have been there many times before.

Other factors will probably similarly be added with the changes in technology and virtual presence.  “Something you do” might be one for example.  My typing rhythm and keyboarding differs from many (e.g. lots of backspaces).

I am sure there will be some opportunities for factors in 10 years that we cannot conceive of today just as my Google Maps Android tracking was unconceivable to me 10 years ago.


How to extract session key from trace file? I have wireshark dump of SSL session from client side. I have no control on server side. Should I be able to decrypt SSL session, get the session key, pre-master key?

Regards

If you only have a packet capture from a TLS session, then you will not be able to decrypt the traffic. A packet capture is the result of a passive attack where an attacker is just looking at the network traffic. If this would be sufficient to decrypt traffic, it would make TLS rather useless.

In modern configurations, the client and server will use a Diffie-Hellman key exchange to establish a shared secret (the TLS premaster secret). Each side generates a private value and computes the corresponding public value. The public value is sent over the network, and each side uses their own private value to establish the same shared secret. As the private value is never sent over the network, an attacker cannot calculate this secret.

Now, if you actually control the client (or server), then you could read keys from memory or modify the program such that it saves the (pre)master secret. With Firefox and Chrome, you can set environment variable SSLKEYLOGFILE to a file path and have all master secrets written to it. This file can then be loaded into Wireshark in order to decrypt the TLS traffic of your client.


Which browsers don't support Forward Secrecy and ECDHE The question is which browsers are known not to support Forward Secrecy and the  Diffie-Hellman (DHE) or Elliptic Curve cryptography (ECDHE) ciphers?  We have clients who are demanding we support forward secrecy for them to continue to use our products.  We need to determine if it may have an affect on other clients which may not be on latest browsers.  Are there any lists of known, or unknown support browsers.  Our F5 will be setup to use Elliptic Curve cryptography (ECDHE) ciphers.

Most browsers (all the major ones) allow you to change the set of cipher suites in use. Some may require obscure ways to do this (I'm looking at you chrome) and others may depend upon the cryptography packages provided by the operating systems.

Chrome, Opera and Firefox support FS pretty well out of the box. IE and Safari will require some tweaking. Check out SSL Lab's list of user agent capabilities.

Forward secrecy involves the use of ephemeral keys which are not transmitted across the network. This assumes that neither side has been compromised. Qualys has a good overview of FS.


Client Hello and Server Hello extensions indexes I was looking for indexes of client hello and server hello extensions. the problem is that new extensions has dedicated RFC and the protocol RFC does not include all of them.

is there a place centralizing the indexes (the type number) of all client hello and server hello extensions?

IANA has the official extension registry and links to the defining RFCs:

http://www.iana.org/assignments/tls-extensiontype-values


Can a form I filled in online using 3G be traced to my phone? My friend is trying to ascertain if a form completed online was done so by her ex. If he completed an online form on a website on his phone (contract phone) using 3G connection, could that form be traced back to him having completed it? If so is it an easy thing to do? could she do this? or would it be a Police remit and if so is it something easy for the Police to do?
Here is the senerio- a vindictive ex trying to wind her up. Sent (she thinks it was him) anonymous complaints letter to her work claiming incompetence (work totally ignored it), then she receives a pack in the post thanking her for her enquiry into pre paid funeral plans. Only issue here, as a friend, firstly I think, is really although shitty, there is no crime per se here. Secondly, in the UK with Police budgets as they are and with new data protection laws recently come in, will they go to the lengths to contact the funeral plan company to see if they have records, cross reference those to a ISP and then go to the ISP to track the device it came from? For major crimes or terrorism, yes, for this?...however, that said I do not know if this is actually something that is mega easy to do and if the Police can do it at the click of a button. Advice if possible?

In a word, Yes

All connections you make to the internet are through an ISP who most likly has a record of the device you connected from and what servers you connected too.


How can I decrypt my files from "Cryptowall" encryption? I just got infected with "Crypt0L0cker" malware,virus or whatever that might be. They gave me a link (http://bica3zjnvl6fxkqf.tor-area.org/jrrk14.php?%20user_code=94aya99&user_pass=2616, the target site being suspicious the link is voluntary not clickable) to pay the ransom.

I don't know if is the "real" "cryptolocker or a copycat, but since I've opened the e-mail, (the virus was attached to a simulated electrical bill), it encrypted all my files in minutes.

One of the problems is that the external backup HD was also attached at the time.

I don't have any possibility to pay, and even if I would, I wouldn't pay them a nickle, since they will most certainly use the ransom money to develop an even more awful tool.

I've tried already "HexCmp2", "Decrypt_mblblock", "RakhniDecryptor", "ReactorDecryptor" and "TorrentUnlocker" but nothing seems to work.

Is there any way I could decrypt my files, any tool that will work?

I do not want to be pessimistic but the ransomware author is the only party that knows the needed private decryption key. CryptoLocker uses using a mixture of RSA & AES encryption. There are good security practices to prevent your computer from being infected by it, but once infected there is not something to do really about it for the moment. Do not waste money in buying tools pretending to be able to decrypt the files. But if you have done previous some restore point using System Restore of Windows then you have a big chance to recover your files.


How do backup codes work in TOTP, like Google Authenticator? My understanding is that in TOTPs are like HMAC where code is derived from time.

However, I am struggling to understand the concept of Backup Codes in Google Authenticator, and how are they calculated as they are not time sensitive and can be used in any sequence. So how Google has implemented that?

On Google Auth and any other service using TOTP provides you the time-based tokens, but they understand the possibility of losing the device or not being able to access the codes.

Eg. Your phone got stolen or heavily damaged.

So when you add a service like this they provide you Another login mechanism apart from TOTP, those are the backup codes, they are not part from TOTP but remediation method if you lose access to them.


What to do when I find a possible security vulnerability of public interest? Let's say I found a possible vulnerability in a security system. The system has been universally considered sound for years and nowadays is used worldwide.

I am not an expert in security, but there are things that worry me:

Using a security system believing it is safe is worse then not using one, as I completely rely on its security for whatever reason;
The system is implemented in different countries, therefore revealing details about why it is not safe may compromise those who do not update their systems straight away;
I would like to take credit for my work / discovery, but in the same time the discovery may be too big for me;
There is currently no real alternative to this security system since it has been considered the best for years and nobody expended time and resources to find a better one;
Revealing problems without bringing a solution seems like saying to the scientific community "Hey, everything you considered safe is not, hurry and find a better solution".

For all the reasons above, I wonder what should someone do in such a clunky situation.

Forgive my vagueness, but I think you understand the reason.

It would be a matter of opinion on how you should proceed. We already have a question explaining different ethical ways to report a vulnerability.

First off, for something this big I would personally recommend you remain anonymous at first, while leaving a way to later prove it was indeed you who discovered the vulnerability. Create a brand new PGP key (not tied to your identity), sign your messages with it and publish them anonymously (over Tor for example). If you later feel confident everything's fine and there are no hundreds of blood thirsty lawyers coming after you, you can use that key to sign a message saying that it was you (with your full name).

I recommend the responsible disclosure approach : you get in touch with the developers of said security system and leave them some time to deploy a patch.

Should you get no response, a stupid response or even hordes of angry lawyers barking at you, just use your anonymity to go public and let everyone know how that company deals with security flaws.

I disagree on the fact that disclosing a flaw while not providing an alternative is a bad idea. That flaw may already be known to the bad guys and it's better that everyone knows about it (and can at least know it's not secure) rather than letting the bad guys quitely enjoy using that information. Also, even if there is no alternative now, this discovery may motivate someone to actually make a secure alternative.

Finally, while I do not know what kind of "security system" we're talking about, security should be done in layers and any corporation which relies on that system as its only defense deserves to go down, just like those who don't bother to update once a fix becomes available.


Is there a cyber equivalent to the JTLS? Is there a cyber warfare equivalent to the JTLS? Is a "cyber range" the correct term for something like that?

Are you familiar with the the DETER project?  It might be the sort of thing you are looking for.

A note of caution: I find that those new to the area sometimes have a lot of enthusiasm for the idea of "cyber testbeds", "cyber ranges", and the like, but personally, I am more skeptical.  Unless you already have substantial experience in the field, I think it is easy to overestimate the benefits of these things.  There is no silver bullet to security.


Friend borrowed gaming keyboard to use on severely virus infected pc. danger to keyboard? is it possible for my keyboard, a Logitech G910 Orion Spark to get infected with a virus or a keylogger after a friend used it to type in his log in password? his laptop's built in keyboard wasnt working so he used mine merely to type in his password then he unplugged it (he only wanted to watch some youtube vids and only needed his mouse for that). my question is, since this is a mechanical keyboard with on board memory and macro capabilities, is it possible that it got infected in that short time frame? what are the odds of that? shouldnt the potential exploit have to be specifically coded to infect this specific product? if its possible to infect, how does one check and by extension how does one remove the potential exploit? i havent seen any signs, im just paranoid about stuff like this and wish to make sure.

In fact, this is possible and Logitech peripherals have been used to attack machines, or to move malware from one host to another. Time doesn't really matter, because an infected PC can flash a hardware device in seconds (probably less).

Though I think it is highly unlikely you have been infected, for two reasons:

This type of expolit has not been seen on mass scale (yet) and has primarily been a topic of studies.
In addition to that, the malware must have been on the PC in the first place, and should have been capable of infecting you keyboard without any firmware corruption. This requires skills and a highly sophisticated piece of malware.

From what I gather, I don not think you have anything to worry about.

Update:

Like you said, a keyboard firmware will likely whipe the ROM.


Obfuscating IDs for greater security in DB? Original post: https://laracasts.com/discuss/channels/general-discussion/best-way-to-secure-healthcare-data-in-db

I have a problem dealing with high secure/sensitive (healthcare) data. I know about encryption and I'm encrypting some of my fields.

But what I have been told is to "obfuscate IDs" between tables.

The idea is: even if someone gets the DB, he cannot see which doctor a patient had appointments with (basic example).

But I'm googling and reading all over the place that it's not a very good practice (because it's harder to make joins, poor performance etc...).

Is obfuscating IDs necessary?

If you are attempting to be compliant and/or avoid the breach notification rule under HIPAA in the United States, then obfuscating data relationships within your database will not help you at all.

Under HIPAA, if data is encrypted you need not notify patients/insurance providers/etc about the breach.  However, encrypted means that it was encrypted using a FIPS 140-2 compliant cipher and only this encrypted data was obtained by the third party.

On a database, you can make use of tools such as transparent database encryption, or third-party encryption suites.  This would mean if someone got a copy of the database, it would be FIPS 140-2 compliantly encrypted, and thus not triggering breach notifications or other consequences under HIPAA.

However, simply having a hard to understand database is covered nowhere under HIPAA, and security-by-obscurity doesn't win you any points on a CMS audit...even if you explain obscurity is a "compensating control" for a HIPAA requirement.

Also while security typically means keeping unauthorized individuals out, the next worst thing to be able to happen to an organization keeping PHI data is losing that data.  Having a DB with complex relationships makes it easy to lose that data, and integrity of your data should be considered a security concern when dealing with HIPAA.

Note that transparent database encryption or other on-line encryption methods will do little against the online compromise of the database, e.g. through SQL injection.  If someone gets a DB dump by running SELECT * statements, this data wouldn't be encrypted.  For this, youl'l need to secure/segment your database users and also look into best practices for securing the frontend web application.

In short, encrypt the database somehow; but DB encryption should only be a small part of a larger HIPAA compliance strategy.  Security by obscurity, however, should not be any part of your security strategy.


how to secure terminal logs There might be a misconception from my side on wether I should worry about this or not. But if I should, what measures should I take to secure my terminal logs / command history?

One of things largely mentioned is to not type passwords as part of the command params. And instead let the command prompt for the password.

What other practices should be put in place?

Use a logging server.
Have all your servers immediately send all events to a common logging server.  Then the hacker can delete all your files, but its to late the logged events are already out the hackers immediate reach.

Then, your next concern is making sure the logging server doesn't get compromised.  The logging server should ONLY be a logging server with all other services turned off.  All other ports beside the incoming log traffic should be dropped.  Ideally, another network interface on a private lan would be the only way to talk to this server.


Can my school read my GroupMe messages since they are not end-to-end encrypted? I used GroupMe on my personal phone on my school WiFi and sent some very private messages. I have confirmed that my school is not performing a MITM attack by comparing grc fingerprints.

However, I’ve read that GroupMe does not provide end-to-end encryption but only standard encryption. What does this mean? Can my school see the exact content of my messages if they wanted to?

If the application performs encryption on the traffic (and you haven't configured your phone in a special way for this net, like adding an extra CA provided by them), your school will not know what you said.

Not to mention that even if they had the technical ability to view the traffic, it could be illegal for them to look at your messages.

On the other hand, you mention that you “confirmed that the school is not performing a MITM attack by comparing grc fingerprints”. I guess you mean that you went to https://www.grc.com/fingerprints.htm and… compared the fingerprints listed there to the ones shown by your browser?

This has a couple of issues:

First of all, a MITM that intercepted all traffic might also replace the fingerprints that page shows (they would need to be quite determined, but it'd be possible). It would be better that you compared the fingerprints shown by your browser in the suspected network, with those when you are on a believed-to-be-safe network (eg. your home). Note that by default no client would accept such MITM certificates (the system would need to be configured to trust them). And if GroupME app is properly coded, it won't accept an invalid certificate…
That they are not doing MITM on one server doesn't mean they don't on any. They might not MITM pages that are listed as safe in a their proxy solution, but OTOH intercept with their own certificate pages in a different category (eg. social) to perform additional checking.

Even if the connection was not intercepted, GroupMe itself (or anyone with proper access to where it saves the data) could technically access that (it may or may not be legal).

This is in contrast to end-to-end encryption, where only the other device can decrypt the message (and where checking the conversation fingerprint with the other recipient shows that there has been no interception).

Nonetheless, even if the message safely reached the other device, a third party could still know about it, including by being forwarded, shown to another pupil (see what Mike told me!), confiscated, or even from analysis of external factors (a teacher may not know their exact communication during an exam, but if two pupils hold the same answers, he will conclude they cheated).


How can I restrict HTTP 1.0 or less using .htaccess? I want to use some restriction with SSL
for now my .htacess is

RewriteEngine On
RewriteCond %{HTTPS} !=on [OR]
RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC,OR]
RewriteCond %{REQUEST_METHOD} ^(delete|head|trace|track) [NC,OR]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R,L]

Edit

There are a lot of requests I can coming as HTTP1.0 and those are the requests that are trying to play with my forms so I want to restrict those as I read in a blog "there is more room for mischief with HTTP 1.0, primarily because the protocol does not require a Host header. Thus, another strategy for dealing with unwanted POST requests (and other types of requests, for that matter) is to require the HTTP 1.1 protocol."

I want the url to be always use SSL and also want to restrict requests from HTTP < 1.1. Why I have tried to explain below, please ask more question if I will try to describe my problem in better way.

Conceptually I would also like to understand in current time which version  HTTP requests we should expect and how we can keep the post requests to be as expected ( want to block attacks ) .

How can I restrict HTTP 1.0 or less using .htaccess?

I will not answer this question but I'm trying to explain why I think the idea of such restriction is wrong.

  but there is more room for mischief with HTTP 1.0, primarily because the protocol does not require a Host header.

I very much doubt that statement. First, in the very common case that you are using VirtualHost you will not get any requests without Host header outside the default VirtualHost anyway - simply because the server cannot use the Host header to find which VirtualHost to use.

Apart from that a HTTP/1.0 request is mostly the same as a HTTP/1.1 request. In fact it's HTTP/1.1 which has more capabilities because you could also use Transfer-Encoding chunked in the request with HTTP/1.1, provided that the web server can deal with it.

More doubt about the competence of the author regarding the HTTP protocol is also the following suggested statement in the blog:

RewriteCond %{THE_REQUEST} ^POST(.*)HTTP/(0\.9|1\.0)$ [NC]

This way the author tries to match HTTP/1.0 and HTTP/0.9 request. But, with HTTP 0.9 (there is no HTTP/0.9, only HTTP 0.9) a request does not have any kind of version number so this statement will never match real HTTP 0.9 requests. See The Original HTTP as defined in 1991.

More useful are actually the tips on white listing only the requests you actually expect and denying everything else. And I would really recommend to deny unexpected ones, no matter if these came in with HTTP or HTTPS instead of only forwarding the "good" ones to HTTPS as you currently try to do.