Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.

Sign up to join this community
Anybody can ask a question
Anybody can answer
The best answers are voted up and rise to the top

Explore our questions

1 vote
1 answer
30 views

Why is it a bad idea to accept passwords one character at a time for an authentication mechanism?

4 votes
2 answers
253 views

Adding SSO to an existing website - should SSO login link to matching email address?

1 vote
1 answer
165 views

Multiple SMS activation codes received by error

6 votes
1 answer
3k views

Are JWT refresh tokens in browser really that bad?

0 votes
1 answer
119 views

How to bypass XMLRPC lockout policy?

2 votes
1 answer
201 views

What is the recommended way to generate API tokens using Laravel framework?

0 votes
2 answers
30 views

How does a validity check on a stylus-made signature compare to a validity check for a pen-made signature

2 votes
2 answers
707 views

OpenID Connect with or without reverse proxy?

1 vote
1 answer
45 views

AEAD: Authenticating a digest of my data instead the data itself

1 vote
0 answers
19 views

Is SRP/PAKE equivalent to an asymmetric crypto challenge?

1 vote
1 answer
144 views

For cookie containing access_token, setting secure = false, is that bad practice? Even if signed with jwt?

6 votes
7 answers
878 views

Is there a way to prove some content came from a specific website?

6 votes
1 answer
981 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

0 votes
3 answers
75 views

Avoid checking passwords for dos attacks

Browse more Questions