Collaborate Disseminate
Given a set of traces coming from different websites, where each trace is a packet. Assume we only know the time of arrival, size and direction of each packet. How do we go about fingerprinting these traces to a particular website?
I am lo… Continue reading Website fingerprinting based on packet traces
My YubiKey stores my OpenPGP subkeys for signing, encryption and authentication with SSH, emails, code signing, etc. However, it also implements WebAuthn (not all sites enforce PIN checks), PIV and TOTP.
Anyone with the device can simply p… Continue reading How do I hide OpenPGP key fingerprints from smartcard info (specifically YubiKey)?
Even if someone’s fingerprints are found on an incriminating document, that person may claim that they only handled the blank sheet of paper before the real criminal printed anything on it. A new technique, however, can now be used to check if that rea… Continue reading Forensic tech shows if fingerprints were applied to incriminating text
I am aware that I can get the fingerprint of an x509 certificate by typing
openssl x509 -in certificate.crt -noout -fingerprint
But if I try to get the fingerprint of a CSR (openssl req -in certrequest.csr -fingerprint) I get
req: Unrecog… Continue reading Getting fingerprint of certificate signing request
I’m a developer of a mobile Android app. In my app, I’ve implemented code that reports the SHA-1 certificate fingerprint (implemented in Java code, as described in this post), in this way we can tell which users are using the real (Google … Continue reading Can a hacker resign an APK and keep the same certificate fingerprint
I asked this question https://askubuntu.com/questions/1404973/do-i-have-to-check-the-fingerprint-of-new-received-openpgp-public-key-if-it-has and the answer to my question was "This should really be asked in Information Security. – mu… Continue reading Do I have to check the fingerprint of new received OpenPGP public key, if it has been sent in a signed and encrypted email from a verified source?
I asked this question before at https://askubuntu.com/questions/1404973/do-i-have-to-check-the-fingerprint-of-new-received-openpgp-public-key-if-it-has and the answer to my question was "This should really be asked in Information Secu… Continue reading Do I have to check the fingerprint of new received OpenPGP public key, if it has been sent in a signed and encrypted email from a verified source?
Is it possible to lock and unlock VMs in VirtualBox or VMware using a fingerprint device in Linux? I know that VMware’s latest versions support TPM, but i want to encrypt and unlock the entire Virtual Machine content with a FingerPrint dev… Continue reading How to lock and unlock VMware or VirtualBox VMs with a fingerprint device? [migrated]
It would be great if forensics teams could easily lift fingerprints off of bullet casings left at crime scenes, but unfortunately doing so is often quite difficult. A new technique developed at the University of Nottingham could change that.Continue Re… Continue reading New technique excels at lifting fingerprints from shell casings
The first time I connect via SSH, a "fingerprint" appears. How can I be sure that it belongs to my server/router/etc. and has not been tampered with by a fraudster (MITM)?
For example, for key-based authentication, I decide to se… Continue reading SSH: MITM attack during fingerprint verification?