Andrew Jenkins

Is the HTTP options method secure?

I would say implementing the HTTP OPTIONS method, in itself, is not a significant security risk. Yes, it nicely enumerates which other methods are implemented by a server, but it is in the handling of those other methods that the potential for danger lies, not in the reporting that they are handled. For example, the…

Cyber Security

Answered Feb 2, 2022 · 1.5K Views Read answer →

Can MP3 files have viruses? How can they be detected?

The answer to your question of Can MP3 files have viruses is that just like PDFs, websites, and other complex formats which need to be parsed, there could be parsing bugs. At best, such bugs trigger a warning or crash the program, and at worst (but not uncommonly) they are able to run code on your machine. Because it…

SQL Server

Answered Jan 18, 2022 · 3.0K Views Read answer →

Is there any information stored related to the server side cookies in an app?

This is a great security question regarding the server side cookies. One must understand the mechanics of what they work with to ensure they are building secure software. Security There is no added significant security risk when a server has access to cookie information. Servers are already a privileged system that…

SQL Server

Answered Jan 17, 2022 · 1.1K Views Read answer →

Explain the use of packet injections within the WiFi Attacks.

Wireless networks work in predefined modes which have specific functionality but also come with strict functional restrictions. Wireless attacks require a higher control over the lower layers of communication in order to send and receive any kind of data. When you are in the default mode (Station Infrastructure Mode),…

SQL Server

Answered Jan 13, 2022 · 2.2K Views Read answer →

Explain the working of X CSRF Token.

The intention with sending a custom header such as X CSRF Token as well as a cookie is that the technique, called double submit, will mitigate CSRF if implemented properly. The way it works is that while cookies will be automatically sent with a forced request as in the case of CSRF, the custom header will not,…

SQL Server

Answered Jan 6, 2022 · 1.3K Views Read answer →

Why is YubiHSM considered an HSM?

Size and performance don't matter, as a hardware security module (HSM) is defined by its functions to perform cryptographic operations and protection. From Peter Smirnoff on Cryptomathic: Understanding Hardware Security Modules (HSMs): The hardware security module (HSM) is a special “trusted” network computer…

SQL Server

Answered Jan 5, 2022 · 1.5K Views Read answer →

I would like to know how to hide browsing history from wifi router so that my neighbors with whom I share the wifi won't be able to see sites I've visited?

When my laptop is using a network I don't control (basically anything that's not home) it wears pretty red socks to reroute all traffic into the SOCKS5 proxy built into OpenSSH and then to a server I rent anyways for my website to protect my traffic. Your question of how to hide browsing history from wifi router can…

SQL Server

Answered Jan 5, 2022 · 1.7K Views Read answer →

Can anyone see my Tumblr search history, like my internet provider or the legal & authorized government individuals?

I'll answer your question of Can anyone see my Tumblr search history from both options available - Without a VPN Assuming that you are only using HTTPS, there will likely be a difference between your ISP and the government. This also depends on where in the world you are. In many countries your ISP couldn't care less…

SQL Server

Answered Jan 4, 2022 · 5.1K Views Read answer →

Explain the use of OpenVPN kill switch on Linux.

In Linux, to use the OpenVPN kill switch, you should use a simpler firewall which does nothing more than block all non-OpenVPN client output to the outside. If you do not have an openvpn group, create it. The -r makes it a system group. groupadd -r openvpn Once it exists, add this line to your OpenVPN configuration…

SQL Server

Answered Jan 3, 2022 · 1.2K Views Read answer →

How can you differentiate between hips hids and an antivirus?

We'll talk about HIDS HIPS one by one. The 'D' stands for "Detection". It means that the protection system will be able to detect and alert upon a possible security event, but it will not attempt to block anything. The 'P' stands for "Prevention". This means that when the protection system detects a possible security…

SQL Server

Answered Dec 31, 2021 · 2.7K Views Read answer →

Can I allow the index listing of the well known acme-challenge directory without compromising on the security?

Exposing your ACME-challenges is not a security concern. These unique tokens are given to you to aid automatic domain ownership verification. They should be unique in path and content. Since your site has no certificate when the challenge phase happens your tokens are exposed via a plaintext HTTP connection anyway.…

SQL Server

Answered Dec 31, 2021 · 1.1K Views Read answer →

What are the points of differentiation between the CA cert and the server cert?

This only makes sense if the root is saying not only "this intermediate cert is who they claim to be," but "this intermediate cert is allowed to issue new certs on my behalf." When signing a CA Cert, the CA asserts indeed that the private key belongs to a particular entity and what that private key is allowed to do.…

SQL Server

Answered Dec 29, 2021 · 1.2K Views Read answer →