Most Popular
1500 questions
40
votes
8 answers
Is "different usernames" as good as "different passwords"
The answers to this question , and the associated xkcd got me wondering: if I use different account names in every service, then can I use the same hard-to-crack password in each? I'm thinking that cross-site password hacking, a-la-xkcd, is done by…
GreenAsJade
- 1,021
- 1
- 9
- 10
40
votes
5 answers
Why do you need to close your browser window after logging out of a website?
I might be wrong, but I believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (assuming the browser is completely up-to-date) and why…
blunders
- 5,102
- 4
- 33
- 49
40
votes
5 answers
Can I specify a public key file instead of recipient when encrypting with GPG
Can I do something like: gpg --public-key my.pub -e file.txt If I can, any reason that I should not do that? P/s: I think I don't need to know about the recipient because my machine only has one public key at a time. But that key will change soon…
nvcnvn
- 503
- 1
- 4
- 6
40
votes
3 answers
Predicting Math.random() numbers?
I was reading up on the documentation for Math.random() and I found the note: Math.random() does not provide cryptographically secure random numbers. Do not use them for anything related to security. Use the Web Crypto API instead, and more…
Abe Miessler
- 8,185
- 12
- 53
- 75
40
votes
3 answers
How to detect if I am vulnerable to "Superfish," and how to remove it?
The site has already a discussion of the security risks of "Superfish". It seems to me that anything that tampers with the bits of one's connection is bad. If it tampers with TLS connections, it is evil. How can I determine if I am vulnerable to…
Bob Brown
- 5,363
- 1
- 23
- 29
40
votes
6 answers
Is SQL injection possible with LIMIT?
A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any number or string I like as a limit. I realize that…
Ali
- 519
- 1
- 4
- 8
40
votes
5 answers
Are there actions taken against websites that deliver malware?
There are serious tools and services such as Google Safe Browsing for malicious and phishing websites, and others fully dedicated to phishing websites such as Phishing.org . What is done against these websites (especially the ones that distribute…
user45139
40
votes
5 answers
Why do some websites enforce lack of SSL?
When trying to visit https://www.ebay.com , I noticed that I get redirected to HTTP immediately. Here's what cURL says about that: $ curl --max-redirs 0 -v -L https://www.ebay.com * Rebuilt URL to: https://www.ebay.com/ * Adding handle: conn:…
d33tah
- 6,734
- 8
- 43
- 63
40
votes
1 answer
Which is the Best Cipher Mode and Padding Mode for AES Encryption?
As per PCI-DSS 3.4 requirement: For storing Credit Card Data Strong Cryptography should be used. I decided to use AES Encryption which is a strong and mostly recommended crypto for encrypting Credit Card Details. I saw that AES has Cipher Mode and…
RajeshKannan
- 635
- 2
- 8
- 12
40
votes
1 answer
Should I publish my public SSH key with user@hostname at the end?
In ~/.ssh/id_rsa.pub my public key is stored as: ssh-rsa magicmagicmagicmagic...magicmagic username@hostname When publishing my public key, should I include the username@hostname bit? Can I replace it with something else? My concerns are that: I may…
lofidevops
- 3,630
- 7
- 28
- 32
40
votes
2 answers
Why does Google cripple the 2FA Google Authenticator PAM module?
If you enable 2FA for Google Apps the shared secret is 160 bits. The google_authenticator PAM module on the other hand seems to use 80 bits for the shared secret. According to RFC 4226 : R6 - The algorithm MUST use a strong shared secret. The length…
Akshay Kumar
- 502
- 4
- 7
40
votes
6 answers
Security of an initial redirection from http://example.com to https://example.com
Suppose that http://example.com/<foo> systematically redirects to https://example.com/<foo> . I enter http://example.com in my browser's URL bar, and I see a page load and the URL bar now displays exactly https://example.com/ (no Unicode hack, no…
Gilles 'SO- stop being evil'
- 52,796
- 14
- 128
- 185
40
votes
4 answers
Is generating random numbers using a smartphone camera a good idea?
Forgive my ignorance on the subject, but I wish to know more and asking (stupid) questions are one way. I was reading http://www.random.org/randomness/ and this idea popped into my head (before the bit about lava-lamps) Considering the following:…
ian
- 1,312
- 12
- 21
40
votes
2 answers
Is it possible to decrypt a satellite TV signal without using a smart card?
And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if possible).
Israfel_21
- 409
- 1
- 4
- 3
40
votes
6 answers
Secure Linux Desktop
I'm looking for hints about secure linux desktops. Securing servers is no problem. Most recent Software Updates, run only the services required etc. But what about desktops? I'm thinking about details like Noscript for Firefox. ASLR, PIE and similar…
chris
- 401
- 1
- 5
- 3