Tag Info

New answers tagged

0

i don't know offhand how to get that prompt to appear when you want it. But I can tell you why you're not getting it! UAC presents the elevation prompt when you try to run exe's under these circumstances: The exe is known (hardwired in) to UAC. The exe requests elevation in its manifest (XML that's buried in the exe) Some older installers (like ...


0

I think this will end up being a personal preference answer, but I prefer the rsync+ssh solution because ssh is always installed these days, but stunnel isn't always available. I don't have to manage yet another service (I'm already managing sshd) all of my troubleshooting happens in one terminal window if I need it (-vvv on ssh) An example command rsync ...


0

It's much easier to modify a shell script than it is to modify a binary file. No special tools are needed other than an editor , and write access to the file. Even sed works, but that is still a stream editor. It does make sense from a security perspective, though. You can run a script through sudo, or su to root. You can always run an suid program ...


0

Sure, it's possible to change the implementation to be secure, but in practice, it requires the cooperation of every Unix vendor, and a lot of user re-education. If you're able to coordinate such an effort, more power to you. :) The alternative (e.g., sticking with setuid wrapper programs) may be inconvenient, but it's not intolerable. Put another way, ...


-1

I have solved the same problem for myself by creating task in Windows Task Scheduler which disable/enable the screensaver depending on how you connect (locally or remote) to computer. To create tasks: Open Task Scheduler snap-in (taskschd.msc) Click "Create Task..." Name task (ex. "SetScreenSaver") Go to "Triggers" tab Click "New..." Chose "At log on" for ...


0

Goto Network connections. on the printer server computer Click the Advanced tab and select Advanced Settings. Select Provider Order "TAB" Ensure the Print provider "HTTP Print Services" is first. Violla!! You can now print to a network connected printer.


0

It's not there because it adds cost to the motherboard, and gives very little benefit to the average end user. Even if you want to do something that TPM enables (like a very secure boot of encrypted storage) you have to decide whether you can actually trust: That the TPM is necessary and helpful for that application That the TPM doesn't have any bugs That ...


2

TPM comes with a lot of Enterprise/server motherboards, my HP Elitebook has one built in and comes as standard. TPM has been sold more to business's and governments as a way to secure their data easily hence its more prevalent in enterprise settings. Consumer grade kit wont come with it because many people wont know what it is actually for and wont use it, ...


2

My guess would be following: Very few users know what they want or need these days. In fact average computer user needs to be told what he wants or needs. This is effectively done by advertising. You do not decide that you need a quad-core processor running at 4Ghz, in most cases you are told through clever advertising that this is exactly what you need and ...


1

For files, you can use the icacls tool to add access entries by SID: icacls C:\Temp /grant *S-1-5-113:(oi)(ci)(f) Though, using the full name NT AUTHORITY\Local account should work as well.


1

From How do I control when an untrusted applet or application runs in my web browser? : Starting with Java 8 Update 20, the Medium security level has been removed from the Java Control Panel. Only High and Very High levels are available. The exception site list provides users with the option of allowing the same applets that would have been allowed by ...


0

SETHC.exe can also be replaced with a copy of explorer.exe (or any other .exe) giving full system level access from the logon screen as well. Not to repeat others, but if you are talking about server security, I would think that a certain amount of physical security is already in place. How much, depends on acceptable risk outlined by your organization. ...


1

127.0.0.1 is a loopback address. If the process is bound to only that address, then it can only be accessed from that machine. Note that a process can be bound to multiple addresses, so run a netstat -ano (Windows) or netstat -npla (Linux) to verify what ports are open and to which process.


1

From RFC 6520: A HeartbeatRequest message can arrive almost at any time during the lifetime of a connection. Whenever a HeartbeatRequest message is received, it SHOULD be answered with a corresponding HeartbeatResponse message. I believe this implies it could happen during the "hello" phase of TLS where client and server are exchanging ...


2

There isn't much you can do in this situation - if your program can decrypt the key from the file, and this program is run on the client's computer, then the client can go through your program, disassemble it, and find out exactly how it decrypts the key - not to mention finding it in memory. I am not an expert in this, but TPM modules were created to help ...


0

Even the most basic consumer routers have the ability to only accept connections from specified MAC Addresses. Setting up MAC Address Filtering should at least protect you from wireless hack attempts.


2

To answer the question, in my opinion Option 3 (custom key) is most secure provided the custom key consists of truly random characters. CrashPlan also rates this as the most secure option (see table after following link to CrashPlan information below). However, it seems to me that three important differences between options 2 and 3 are being ignored: ...


0

No, you don't have to export them separately; when exporting the secret key everything public is also contained. From RFC 4880, OpenPGP, highlighting added by me: 5.5.1.3. Secret-Key Packet (Tag 5) A Secret-Key packet contains all the information that is found in a Public-Key packet, including the public-key material, but also includes ...


0

Yes that is possible and thoroughly explained at http://forum.bittorrent.com/topic/25823-generate-encrypted-read-only-secret-without-api-key/?p=76262 In a nutshell: you only give the encrypted node an encrypted (read only)-key which allows taking part in the torrent-swarm without decrypting the files on it and all trusted nodes a key which enables ...


0

On Mac Mavericks, TeamViewer 9.0.31181 what worked for me was under Partner ID > unfold > clear this history. Firstly it forgets ID, and if you enter it again it has forgotten the password.


1

No, rm will not erase filesystems. However it will delete the files on them. Note that the -r means recursive so it would delete: All files in dir/ all directories in dir/ and do the same for all subdirectories (including /dir/a, or if it exists /dir/a/b/ ... )


1

Don't worry about it, it's people doing a network scan, not intruding your network. They are poking your network to see if anything is open or vulnerable, and if not, they move on. As long as you don't have ports open and pointing to vulnerable services, there is no reason to be concerned. Your home has a public IP, and anyone can reach out to it, but it ...


0

I think i have found the extension causing your issue. I was a bit suspicious of the extension so checked out its code, and found an obfuscated bit of javascript that seems to do what you are suggesting. The extension is called "Fabulous for Facebook". Do you have that installed? If so, uninstall it, and the problem should go away.


24

Having used IPv6 for the better part of a decade now, and watching the changes go by, I have a little bit of perspective on this. The most important point here is this: NAT is not the firewall. These are two completely distinct things. In Linux it happens to be implemented as part of the firewall code, but this is merely an implementation detail, and isn't ...


7

NAT isn't really security, except by a certain kind of obscurity.The internet, and most tools are designed to be used from end to end anyway. I would treat any individual system behind a nat the same way I would treat a system on the open internet. Its worth considering the different mechanisms of getting ipv6 access, from the least native (Teredo), Tunnels ...


0

I had a reply from support that solved my problem. To change the default Admin Key you will need to use a program called .Net card explorer. This program is part of the SDK produced by Gemalto and is available for download in the following link http://www.gemalto.com/products/dotnet_card/dotnet_sdk.html


2

If there's no address translation problem to solve with IPv6, and if it still uses ports, is it now my responsibility to manage this? Without NAT, everything behind your router has a unique public IP address. Typical consumer routers perform many functions other than routing: firewall/packet filtering/"Stateful Packet Inspection" NAT DHCP etc. If ...


11

NAT really did very little for security. To implement NAT you basically have to have a stateful packet filter. Having a stateful packet filter is still a strong requirement to be secure with IPv6; you simply no longer need the address translation since we have lots of address space. A stateful packet filter is what permits outgoing traffic without ...


0

Locking a session (either local or remote) is done using the screen saver settings. User Configuration > Policies > Administrative Templates > Control Panel > Personalization: Enable screen saver - Enabled Force specific screen saver - Enabled Password protect screen saver - Enabled Screen saver timeout - Enabled As far as I remember, you need to configure ...


1

A secure way to connect to your computer through SSH is to use public key encryption, see here for an example of how to set it up. Public key encryption sets up a public/private key for you to use to connect to a server without having to enter a password each time you connect. It is more secure than just username/password, although a username/password ...


1

When it comes down to it, nothing online is completely safe. Look at recent news about leaked user information and you'll understand big or small, someone somewhere will find a loophole. I suppose it's one of those things you'll need decide if you want to take a risk on.


1

Keepass is open source and therefore everyone with needed skills can "audit" it and proove it (relatively) safe (relatively because never say never). That's what i personally use, it's very efficient and has plenty of plugins for browsers, backup, sync, etc. IMHO, you can trust most of opensource well known software like Keepass. If you want to trust a 3rd ...


0

448 bits is quite a lot of entropy. In order to match the security of the key, the passphrase must provide a similar level of entropy. If there is any significant difference in entropy between the two, an attacker will just go for attacking whatever has less entropy. I don't recall the exact figure, and it probably varies with language, but natural language ...


0

An encrypted file is only as secure as is the password. You would need quite a long and random password to get the same security as a 448-bit key, so presumably you would also need to keep a copy of it somewhere. So it seems to me that both options 2 & 3 are more or less equivalent. With secure sites being hacked all over the Web, I wouldn't trust ...


1

Where this password stored? From System Key Utility Technical Overview: The SysKey utility lets you choose where that startup key is stored. By default, the computer generates a random key and scatters it throughout the registry; a complex obfuscation algorithm ensures that the scatter pattern is different on every Windows installation. You can ...


2

HTTPS uses SSL/TLS to encrypt data sent between you and the server, so the http requests you send, and the responses you receive will be hidden from others. On the other hand, it is still possible for eavesdroppers to see which servers you are connecting to. TOR can prevent eavesdroppers from telling which sites you are connecting to, but the exit node can ...


2

Something a lot of people don't seem to get is this one simple thing: Unless you personally own the computer, and you are the sole individual authorized and responsible for its configuration and maintenance, the computer is not your computer. So don't bother thinking it is, let alone treating it as such. Yes, your employer can - and generally has every ...


1

From http://en.wikipedia.org/wiki/Microsoft_Office_password_protection: Currently, the 40-bit key protection used in Office 97–2003 can be easily cracked by the password-hacking software. The 128-bit key AES protection employed in Office 2007–2010 can still be considered as a relatively secure one. At the moment, however, cloud computing ...


0

From a message in the GnuPG user group: If you import a secret key and you don't have the public key, GPG will use the embedded public key data to recreate the public key, so effectively an exported secret key is like exporting a key pair. But it is a good idea to also send you public key with all signatures. Also, you can consider submitting your ...


4

Signatures created using gpg --detach-sign contain one OpenPGP "signature" packet each. You can combine them to one file using ordinary cat, and most PGP programs should automatically recognize multiple signature packets in a single file.


0

Beside Windows Security Essentials and Firewall I would also install EMET (The Enhanced Mitigation Experience Toolkit from Microsoft) don't forget to read the EMET user guide. Always use Standard User Account as your default account. Turn UAC settings all the way up. If you are downloading much from the internet install the free version of MalwareBytes and ...


2

This shouldn't be an issue as arriving at that page likely requires that information. For instance if you go to www.mycompanysite.com/wherever in your browser it assumes you to be on port 80 (http). Further, it's giving the external/public name of your server so no internal information is being given out. That being said, if you want it is not a challenge ...



Top 50 recent answers are included