@xce Heh, indepth cryptoanalysis of specific algorithms is the one thing which i'm not yet prepared to learn. It really is difficult to wrap your head around the math.
For QotW #32, scheduled for publishing to the Security Stack Exchange Blog on 3 August, please post as Answers, and vote for your favorite question from the whole Security Stackexchange site.
Please post any question that you feel is of worth and the reason why as an answer below. Try not to pro...
@TerryChia Well, while we call it Question of the Week, sometimes we have taken a while over it :-)
I am happy to add you as a contributor on the blog - and what we do is draft the post then let someone else on here review, before publishing on Friday
It's a standard Wordpress site, so I'm guessing you will find it all pretty straightforward
@LucasKauffman Well, I was supposed to be on holiday last week, and still ended up working too much, so I'm going somewhere with no power so I physically can not be asked to work. Love my job, but sometimes I do still like to have a holiday
@LucasKauffman It looks like I do need to make a few calls, and review a couple of documents this week...plus, I still need to check mod messages here :-)
@RoryAlsop well, my problem is the other way around - now, since my office is aaaalll the way downstairs, if I surface up for dinner, or bedtimes, I find it difficult to make the trek back down.
not to mention it's quite lonely there at night.
heck, I think I worked only one night since I've moved. No idea if that's good or bad.
aww, this is sad. Mcafee really hates security...
Since shortly after they acquired Foundstone, there hasnt been a single update to their once-awesome set of security tools since 2006.
The Web server (running the Web site) thinks that the HTTP data stream sent by the client was correct, but access to the resource identified by the URL is forbidden for some reason.
This indicates a fundamental access problem, which may be difficult to resolve because the HTTP protocol allows the Web server to give this response without providing any reason at all. So the 403 error is equivalent to a blanket 'NO' by the Web server - with no further discussion allowed.
Well, the difference is that 404 is: the HTTP standard response code indicating that the client was able to communicate with the server, but the server could not find what was requested.
so it's that difference between forbidden and not found
Yes, but reputation earned from bounties, accepted answers, accepting answers, and from accepted edits (if you're below the editing priv) don't count towards the rep cap.
> “If someone wants to compromise a Skype communication, all they have to do is hack the endpoint — the person’s computer or tablet or mobile phone, which is very easy to do,” said Tom Kellermann, vice president of cybersecurity for Trend Micro, a cloud security company.
.. is it?
what does "The authorities long have been able to wiretap Skype calls to traditional phones." mean?
A secure phone line is conceptually possible; this is not really different from, e.g., a secure communication between a Web browser and a HTTPS server (there are technical subtleties about lost packets and whether they should be tolerated, but that is not the issue here). However, the movie-secur...
In short: If you have to ask "Is this line secure?" then it's not.
Is it just me, or does questions/answers related to password storage and implementation tend to get upvoted more than any other kinds of question and answers in security.SE?
How can I store passwords to have them secure? Right now the site use md5 md5, I was thinking about sha1+salt but if the source code for the site will be open source (I'm rewriting the site and the code will be on gihub) everybody will know what the salt is.
So how can I secure passwords so they...
The gist of the question "So how can I secure passwords so they will not be easy cracked when the database leak? Any ideas?" is covered by the "how to securely hash passwords link"
Yeah, I don't get why the site is open sourced. Sure, the framework of it could be open sourced, but the exact implementation and configurations shouldn't be.
Lets say a user is logging into a typical site, entering their username and password, and they mistype one of their inputs. I have noticed that most, if not all, sites show the same message (something along the lines of, "Invalid username or password") despite only one input being wrong.
To me, ...
@Iszi The issue is that it isn't entirely about the crypto implementation. Website configurations like database names, passwords etc should not be made public. To do so is just asking for trouble.
The question isn't asking about an open sourced crypto system, but an open sourced website.
@TerryChia I'm not talking about configuration details, but it's a website, what about Wordpress or Drupal, tons of the configuration is open source as well
obviously the passwords and DB names shouldn't be made public
@Gilles I am not sure there is a VM implementation which can run off a USB key with no local installation and no Administrator rights (on a WinXP system). Also, the firewall would still block me.
I do use the software-on-USB-key trick to run GVim
it blocks a lot of security-related sites (“hacking”), too, which is really silly considering that my job and that of many of my colleagues involves keeping up-to-date with security issues
@Gilles My workaround for a range of hacking sites that publish a blog is to let google reader grab the RSS headlines for me to read, then if I see one that looks useful immediately I can go to somewhere to connect to it.
I've noticed this in a few episodes now, and have not been able to figure it out. The screenshot below, with a circle added to highlight the flag, is from Star Trek: The Next Generation - Season 5, Episode 26: Time's Arrow, Part I.
What is this flag?
It appears to be just a plain, white flag...
I'd already seen a few episodes with the flag, but none of them have a really good image to clearly show what the flag is. So, what does my geek brain think?
"I'll just hop on Star Trek Online, beam down to the Academy on Earth, and see the 'real thing'!"
Sadly, it seems the Starfleet Academy Headquarters facility in Star Trek Online is not the same as the TNG-era Headquarters. The flag is not there.
I've noticed this in a few episodes now, and have not been able to figure it out. The screenshot below, with a circle added to highlight the flag, is from Star Trek: The Next Generation - Season 5, Episode 26: Time's Arrow, Part I.
What is this flag?
It appears to be just a plain, white flag...
