Information Security Stack Exchange Community Digest

Top new questions this week:

Can I prove that I did not receive an email?

A company are saying they sent an email to me. I have gone through all of my inbox, junk, and deleted files and the email still doesn’t exist. They have asked me to prove the email never got to me by ...

asked by Mark Score of 22

answered by schroeder Score of 40

Redirect to login page if authorization required -- security flaw?

Suppose we have a site that has public and private areas. The private areas require login. For example "www.site.com/about" is publicly accessible. But "www.site.com/message_inbox"...

authorization user-interface

asked by CaptainCodeman Score of 22

answered by Tom Score of 54

What cybersecurity jobs are mostly technical?

I am doing my bachelor's in computer science and I have the chance to take multiple cybersecurity courses. Of course, before taking these course, I did some research about jobs in the field of ...

career

asked by Alfech Score of 5

answered by Esa Jokinen Score of 4

Possible to avoid device fingerprinting with imagemagick?

If I took a picture with my mobile phone and wanted to publish that photo without any artefacts connect to me, the first thing I would do is strip all of the image metadata with 'exiftool': exiftool -...

fingerprinting image

asked by user227963 Score of 3

answered by belkarx Score of 1

Normative reference for a web application disclosing existing values of integration secrets to users

In a web-based SaaS product, one of the configuration pages allows users to set credentials for system-wide integrations with other products. These include usernames, passwords, and API secrets. The ...

defense owasp

asked by rmc47 Score of 2

Where to store the password: in RAM or another user's home folder (Linux)

There is user1 and user2. All work is done from under user1. user2 is only created to store important information. If important information is stored in RAM, but in the session of user1, which is ...

passwords linux

asked by bomiam Score of 2

answered by forest Score of 3

Should deprecated versions of TLS not be used

I'm setting up an server, the default configurations allow for connections with deprecated TLS versions. Should I remove deprecated TLS versions from my server? What is the difference between a ...

encryption tls web-application server apache

asked by blank Score of 1

answered by mti2935 Score of 1

Greatest hits from previous weeks:

What is the difference between Federated Login and Single Sign On?

What is the difference between Federated Login and Single Sign On authentication methods?

authentication federation single-sign-on

asked by c card Score of 111

answered by Mark Beadles Score of 131

Provide subjectAltName to openssl directly on the command line

Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line? I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...

certificates openssl bash

asked by Michael Seiwald Score of 244

answered by Peter W Score of 158

How to determine if a browser is using an SSL or TLS connection?

I want to know whether my browser is using SSL or TLS connection if I see HTTPS. I want to know for IE, Firefox, Chrome and Safari. I want to know the protocol version.

tls web-browser

asked by zhtway Score of 89

answered by Thomas Pornin Score of 74

Converting keys between openssl and openssh

If I use the following openssl req -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.pem -nodes I get private.pem and public.pem If I use ssh-keygen -t rsa -f rsa I get rsa and ...

ssh openssl

asked by anshul Score of 72

How do I get the RSA bit length with the pubkey and openssl?

I have a public key generated with ssh-keygen and I'm just wondering how I get information on the keylength with openssl?

ssh openssl

asked by Evan Carroll Score of 97

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...

web-application sql-injection data-leakage

asked by Ishan Mathur Score of 307

answered by Steffen Ullrich Score of 478

Is it safe to give my email address to a service like haveibeenpwned in light of the publication of "Collection #1"?

There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g. Have I Been Pwned. ...

passwords breach have-i-been-pwned

asked by godwana Score of 107

Can you answer these questions?

Penetration testing framework for Windows Desktop applications

Is there a burpsuite-like framework for Windows Desktop applications? I.e. I'm looking for something that would allow me to intercept user-input data sent to my application for manipulation to test ...

appsec debugging

asked by Amir Ashar Score of 1

What are the security best practices to implement offline login of android apps?

My client has an android application requirement. The users of the application are workers who might have to work at places where internet connectivity is unavailable. So an offline login feature is ...

authentication android offline

asked by Anonymous Platypus Score of 1

answered by defalt Score of 0

Protection against JPEG compression bombs

There is a well-known threat named compression bombs. Such image formats as PNG and JPEG use compression methods, and therefore and threory PNG/JPEG images might be a comperssion-bomb. I've found an ...

attack-prevention denial-of-service file-upload compression

asked by salazar324 Score of 1