Information Security Stack Exchange Community Digest

Top new questions this week:

How to explain to traditional people why they should upgrade their old Windows XP device?

This is an issue I'm recurringly facing: older people from my family (or people who my family members know) can be surprisingly reluctant to apply most basic security measures when they're using their ...

exploit defense updates user-education  
asked by gaazkam 97 votes
answered by LSerni 117 votes

Is it a mistake to use a password that has previously been used (by anyone ever)?

A few months ago, kutschkem answered a question about HIBP with this: Let's say every person on earth has used ~1000 passwords so far. That makes approximately 10 trillion passwords, which is ~243 ...

passwords password-policy  
asked by Michael 34 votes
answered by Martin Weil 30 votes

Should I present forged documents in a Penetration Test/Red team engagement?

A previous question of mine lead to this discussion which mentioned the subject of Document forgery. I've seen many people (in videos) forge IDs and employee badges for such engagements so that seems ...

penetration-test documents  
asked by John Zhau 31 votes
answered by MechMK1 96 votes

How can I check password strength client-side?

I have a website and my users will be using their selected password to encrypt their RSA private key using JavaScript client-side. How should I be making sure they are using a strong password without ...

passwords password-management  
asked by mark820850 10 votes
answered by Sjoerd 26 votes

Content Security Policy Style Hash

I have an img tag on a page with an line style that looks like this: style="height:50px;width:180px;display:block;" I can't move it to an external stylesheet because the img tag is generated by a ...

asked by td48260 8 votes
answered by Steffen Ullrich 5 votes

Could a desktop application disclose location even if a VPN is used?

When using a proper VPN to access a remote server, the server should not be able to resolve your country of origin using your IP address because the IP provided in the request will be the one of the ...

network privacy vpn geolocation  
asked by MedAl 5 votes

Browser setups for stay safe from malware and unwanted stuff

I have to setup a browser to surf the internet trying to stay safe from malware as much as possible(i already know that there's no way to stay safe at 100%) My idea is: use Firefox with this ...

malware web-browser chrome firefox browser-extensions  
asked by secon25 4 votes

Greatest hits from previous weeks:

How do I clear cached credentials from my Windows Profile?

Windows seems to be saving my credentials for a variety of applications (terminal servers, etc) and I'd like to purge this data. How can I backup and purge this data?

authentication windows certificates  
asked by goodguys_activate 62 votes
answered by goodguys_activate 73 votes

How is an ATM secure?

I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since ...

attack-prevention physical atm  
asked by asteri 177 votes

Phone Call from weird number

I just got a call from a very weird number. On my phone it displays as "+1 (1) (5 )" and "USA" below. I answered the call and there was 100% silence. Then about 2 seconds later the call ended. Next ...

phone iphone  
asked by KaareZ 4 votes

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...

asked by Griffin Nowak 79 votes
answered by Gilles 'SO- stop being evil' 111 votes

Google Chrome "Your connection to website is encrypted with obsolete cryptography"

Google Chrome is showing new information in the certificate section. Is this a big deal? If so how can I fix it on the server end? EDIT: Thanks for the answers but I'm not skilled in cryptography ...

cryptography chrome  
asked by Carleton Stuberg 65 votes
answered by Adm Selec 55 votes

What happens if an attacker steals my phone's IMEI number?

I have some questions regarding IMEI numbers and data and identity theft. While searching online I have found many conflicting answers regarding this topic and would like some clarification if ...

passwords privacy mobile  
asked by Billy Bear 11 votes
answered by flohack 6 votes

Wordlists on Kali Linux?

I notice that in /usr/share/wordlists in Kali Linux (former Backtrack) there are some lists. Are they used to bruteforce something? Is there specific list for specific kind of attacks?

passwords brute-force kali-linux dictionary  
asked by Stephenloky 16 votes
answered by GdD 26 votes

Can you answer these questions?

Could Redirection URI be a Client URI in OAuth2 Autorization code flow?

For Authorization code grant flow, RFC says the authorization server will send back the code to the redirect_uri specified. I believe it means the browser will recieve a URL like ...

asked by tom johnes 1 vote
answered by AGrzes 0 votes

What should I think about users with huge numbers of successful login attempts in a short period?

What to think about a user making thousands of successful login attempts over a short period? What are the dangers of such a behavior and how to protect against them? A couple of examples of dangers ...

encryption authentication exploit attacks  
asked by Heschoon 1 vote

Are these log messages in my nginx server evidence of an attempted attack?

My AWS Elastic Beanstalk server is often reporting Environment health has transitioned from Ok to Severe. 100.0 % of the requests are erroring with HTTP 4xx. This happens almost daily for a few ...

denial-of-service aws nginx  
asked by Glen Pierce 1 vote
You're receiving this message because you subscribed to the Information Security community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 110 William Street, 28th floor, New York, NY 10038