Most Popular
1500 questions
171
votes
10 answers
Should I be concerned if the "FBI" has logged onto my Ubuntu VPS?
Yesterday, I was performing a bit of general maintenance on a VPS of mine, using the IPMI console my host provided.
Upon setting up SSH keys again via the IPMI console, I logged in via SSH and was shocked to see this:
Welcome to Ubuntu 14.04.2 LTS…
lol what is this
- 1,551
- 2
- 9
- 11
170
votes
4 answers
Where to store a server side encryption key?
I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely store it?
Radek
- 1,803
- 2
- 12
- 5
168
votes
4 answers
What does it mean to "burn a zero-day"?
I noticed a comment on this answer where another user said
...but it requires risking burning a 0day, which people are not always all that willing to do.
I did an Internet Search for the phrase "burning a 0day" (and similar permutations like 0…
YetAnotherRandomUser
- 2,290
- 2
- 14
- 20
167
votes
4 answers
Difference between .pfx and .cert certificates
What is the difference between .pfx and .cert certificate files?
Do we distribute .pfx or .cert for client authentication?
Xsecure123
- 1,793
- 2
- 11
- 8
167
votes
6 answers
Apple's open letter - they can't or won't backdoor iOS?
Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism.
Here's a summary:
The FBI has an iPhone in their possession which they would like to access data…
TTT
- 9,132
- 4
- 19
- 32
166
votes
10 answers
How do you explain the necessity of "nuke it from orbit" to management and users?
When a machine has been infected with malware, most of us here immediately identify the appropriate action as "nuke it from orbit" - i.e. wipe the system and start over. Unfortunately, this is often costly for a company, especially if backups are…
Polynomial
- 133,763
- 43
- 302
- 380
166
votes
5 answers
Password management for kids - what's a good way to start?
Consider a young (primary-school age) child who is starting to collect passwords for online services. How can a parent (or equivalent) help them manage their passwords?
An example to make things clearer: My daughter might want to log on to…
Chris H
- 4,375
- 2
- 16
- 23
166
votes
11 answers
Is visiting HTTPS websites on a public hotspot secure?
It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone sniffs my packets, they will need zillions of…
Calmarius
- 1,905
- 2
- 12
- 6
165
votes
3 answers
What are rainbow tables and how are they used?
Where can I find one? Is there a pot of gold at the end?
How do I protect against them?
From the Area51 proposal
This question was IT Security Question of the Week.
Read the Sep 09, 2011 blog entry for more details or submit your own Question of…
AviD
- 72,708
- 22
- 137
- 218
165
votes
8 answers
Why is Mother’s Maiden Name still used as a security question?
From time to time, some web sites asks to enter a security question and an answer for it. The question list is standard and it usually includes "What is your mother's maiden name?".
Some people use their mother's real maiden name so that they are…
Alexei
- 2,183
- 3
- 10
- 23
164
votes
5 answers
How can USB sticks be dangerous?
We all know the story of the USB drive left outside a power plant which was found by a worker and inserted into a computer to see the contents which then allowed a hack to ensue.
Here is my question, how? I get that code is executed but how? I would…
TheHidden
- 4,315
- 3
- 22
- 40
163
votes
8 answers
What are the implications of NSA surveillance on the average internet user?
It would appear as though the tinfoil hat-wearing were vindicated today, as news broke of the true scale of the U.S. government's surveillance of its citizens' online activities, conducted primarily through the NSA and seemingly beyond the realm of…
nitrl
- 3,003
- 4
- 20
- 23
163
votes
2 answers
I found unknown PHP code on my server. How do I de-obfuscate the code?
We've been getting a lot of noise regarding hacked PHP files here, and it's taking a lot of time to answer these questions. In many cases, they are off-topic. We've had a discussion about this on Information Security Meta, and many people want these…
Mark Buffalo
- 22,508
- 8
- 74
- 91
162
votes
2 answers
What is DROWN and how does it work?
There is a new recent attack "on TLS" named "DROWN". I understand that it appears to use bad SSLv2 requests to recover static (certificate) keys.
My question is: How?
How can you recover static encryption or signature keys using SSLv2?
Bonus…
SEJPM
- 9,540
- 6
- 37
- 67
161
votes
5 answers
How does Amazon bill me without the CVC / CVV / CVV2?
The card in question is a VISA, if that's of any importance. I've noticed this only on Amazon. All other sites I've purchased something from, ever, have needed the CVC code for the card. However, I know I never entered the CVC on Amazon when I added…
TC1
- 1,713
- 2
- 11
- 9