Top new questions this week:
|
|
Recently (just now) the npm package ua-parser-js was found to be hijacked. The hijack installs a crypto miner on preinstall but I noticed the following passage in the preinstall script:
IP=$(curl -k ...
|
|
DocuSign requires that your password "must not contain the characters <, > or spaces."
Is this not an odd requirement? Despite being a leader in online document signing, my gut tells ...
|
|
Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?
|
|
When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data.
I am wondering what would happen if this packet is copied and then re-sent.
Is there a protocol at some layer ...
|
|
While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent.
I'm ...
|
|
I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says:
Both the idle and absolute ...
|
|
The Signal protocol utilizes the double ratchet algorithm to achieve end-to-end encryption with forward secrecy and future secrecy (aka break-in recovery).
Forward secrecy ensures that if any of the ...
|
Greatest hits from previous weeks:
|
|
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
|
|
Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.
Knowing that I may be ...
|
|
I'm slightly confused about obtaining Google Authenticator backup codes.
I can find my Google Account backup codes at:
https://myaccount.google.com/signinoptions/two-step-verification
But have no ...
|
|
I recently signed up for Privacy.com, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...
|
|
Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...
|
|
I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters).
My ...
|
|
I'm using a WPA/WPA2 encrypted WiFi.
Who can view what I'm doing? Also how?
Can the person that pays for the WiFi look up exactly what I am doing (e.g. look up exact messages I've sent on Facebook)?...
|
Can you answer these questions?
|
|
I am trying to exploit a stack-based overflow vulnerability. I couldn't find an example similar to this.
Here is the code
void win()
{
printf("You need to hit this\n");
exit(0);
}
...
|
|
I was reading the following question:
Why do mobile devices force user to type password after reboot?
To find out why fingerprint authentication on my Windows 10 laptop isn't an option on startup. It ...
|
|
I've been doing some research into GPU based malwares, and would like to know if there is a way to run them on a dual boot scenario with the code being executed only on one Operational System and be &...
|
