Most Popular
1500 questions
41
votes
4 answers
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What alternatives are there to certificate authorities,…
Polynomial
- 133,763
- 43
- 302
- 380
41
votes
4 answers
Are password managers more secure than a slightly different password for each website?
Let's say I use a 5 word password composed of 4 words plus the name of the website I'm accessing. For example for GitHub, it would be something like "correct battery horse staple github".
How is that different to using a password manager with…
None
- 529
- 4
- 4
41
votes
9 answers
What are the potential risks of leaving a device in public, but locked?
Let's say you're in a public café, or conference, where you trust your device won't be stolen if you go to the bathroom for 5 minutes, but you don't trust it might not be tampered with.
What are the potential security risks I might run into here,…
Zee
- 529
- 1
- 4
- 7
41
votes
7 answers
Security risks of user generated HTML?
I am creating a website that allows people to upload HTML content.
Currently these are the tags that are banned:
Jevon
- 511
- 4
- 4
41
votes
1 answer
Why do I need two parameters in an HTTP parameter pollution attack?
I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this,
https://security.stackexchange.com/editpost/?postuid=19348
and you tried a HPP attack, that looked…
Kevin Lance
- 519
- 4
- 6
41
votes
3 answers
What is the meaning of Triage in Cybersec world?
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? Note that I heard this word for the first time in…
victor26567
- 513
- 4
- 6
41
votes
7 answers
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
attack_log("Possible SELECT SQLi…
reed
- 15,538
- 6
- 44
- 65
41
votes
14 answers
How can I make a strong password that's easy to remember? Is the 4 Word method safe?
I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember.
But that seems to be open to dictionary attacks, especially if the attacker has heard of the method as well, and brute force…
Lichtbringer
- 569
- 1
- 4
- 7
41
votes
4 answers
How could a public DNS server return bad results?
I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people).
In our country, YouTube, Twitter, Facebook and many other sites are blocked by default and we can only…
AlwaysLearner
- 499
- 4
- 6
41
votes
8 answers
Does password-protecting a database living next to the application add any security?
I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text.
What are the benefits of such a setup over a simply unprotected database?
Apart of some…
Cedric Reichenbach
- 542
- 4
- 8
41
votes
4 answers
What's the point in hashing phone numbers?
Some services (for instance ProtonMail) claim to store hashes of phone numbers, instead of phone numbers themselves (while they don't say how they hash it). Now, given that the number of potentially valid phone numbers is very small (about 26 bits…
BlenderBender
- 539
- 1
- 4
- 7
41
votes
3 answers
Is it safe to check password against the HIBP Pwned Passwords API during account registration?
User registers account on a web app. Passwords are salted and hashed.
But is it safe to check the password against the HIBP Pwned Passwords API, before salting and hashing it? Of course the app uses TLS.
So if the password is found on any breach -…
Bitenieks
- 533
- 1
- 4
- 5
41
votes
4 answers
What does the tilde (~) mean at the end of a file extension?
While I was playing some Capture the Flag (CTF), I couldn't solve a challenge because of this tilde ~. I'm playing on www.example.com/index.php but when I added (~) at the end: www.example.com/index.php~ , a file with name index.php started…
ReDa
- 563
- 1
- 4
- 12
41
votes
2 answers
Can advertisements read cookies of the website it is on?
I know many ads can store third-party cookies, but what about reading cookies? If so, what stops them from reading the session id to perform session hijacking?
user3500869
- 483
- 4
- 6
41
votes
4 answers
Microsoft email servers "require remote control of Android device security features"
Just tried to set up my student email address with the default email client on my Android device. The email servers used by the university are outlook.office365.com (incoming) and smtp.office365.com (outgoing). So I set it up like I always do with a…
voices
- 1,689
- 7
- 22
- 36