Collaborate Disseminate
Android allows now to set "private DNS" in the settings (which also allows using DNS over TLS – sadly over HTTPS atm only works for specific DNS providers).
What I am trying to establish is: if I set private DNS and use VPN at th… Continue reading Using Android private DNS with VPN
While not particularly knowledgeable on public key infrastructure, I’ve noticed strange issues with SSL and TLS lately that I’m unable to diagnose. As these issues have currently left me dumbfounded I’m hoping someone more knowledgeable ma… Continue reading Extremely strange and concerning SSL issues. MITM attack?
With the authorization of the owner, I was testing a website and when I put in some sql query and has some syntax error, it shows me, but when I test it with a parameter like
p.php?id=66+/*!60000select*/+*+/*!60000from*/+data
the output do… Continue reading SQLi with error messages but no output
I have been looking into XSS pertaining to base64 encoding a data URI into an <object> tag (which is typically considered only a feasible XSS payload in Firefox), but I am failing to understand how this is a XSS attack? For example (… Continue reading How is Object Tag data URI XSS actually XSS?
The traditional login page has two fields: username and password. But some sites, notably Google and Amazon, first ask for the username and only later provide a password field, placing each field on its own page. Is this design choice moti… Continue reading Is it more secure to ask only for the username before the password? [duplicate]
Libsodium supports Blake2 for key derivation. It seems like you shouldn’t truncate the output to get two keys (eg one encryption/one mac) as the recommended way is to use a counter as the salt for different keys.
Would it be ok to use the … Continue reading Using encryption key as input keying material
Say your server has a certificate signed by your root CA (no intermediates for simplicity). Does this mean the private key of the root certificate is used to encrypt the hash of the server certificate? If correct, is this why you need to… Continue reading questions about private keys [duplicate]
DNSCrypt queries and responses are encrypted but it also uses TLS/SSL. Is DNScrypt traffic subject to the weaknesses to TLS/SSL? How to secure it assuming a simple connection (router, ISP, DNS Server and back).
This is an experience which was disappointing to say the least. Whilst within a VPN, DNSCrypt traffic was somehow being blocked in that no results would return or just timeout. Not only that the RTT value would change seemingly to a faster… Continue reading How to secure DNSCrypt traffic?
He stolen my imei number and even he knows my phone number. Using this can he get my any information such as call details, whats app messages and other phone activity???