Information Security Stack Exchange Community Digest

Top new questions this week:

Suspicious GitHub fork

Update (April 15): The forked repo and the user do not exist any more. Yesterday, one of my GitHub projects was forked and there is a suspicious commit on the fork of the repo. As you can see from the ...

github  
asked by Giorgi 100 votes
answered by user253751 123 votes

Why do "remote desktop" software (allegedly) commonly have a "blackout" feature?

I've been watching videos of scammers being tricked. Frequently, the scammer makes their scam victim install some weird "remote desktop" program claimed to be for tech support purposes. ...

remote-desktop  
asked by Cutter 59 votes
answered by schroeder 115 votes

Why can't we perform a replay attack on wifi networks?

I was wondering that, when a hacker is trying to hack a Wi-Fi network, he/she would try to capture a handshake and then try to decrypt it, whereas when you want to log in to your Wi-Fi access point, ...

network wifi penetration-test  
asked by nonope2454 20 votes
answered by vidarlo 54 votes

Is it possible to calculate an encryption key when both the plain text and ciphertext are known?

I have implemented an authentication system which works like this: Upon successful login, the server takes the username of client and encrypts it with AES-256. This ciphertext is stored in the ...

encryption authentication web-authentication  
asked by Mr. Engineer 19 votes
answered by Jason Goemaat 25 votes

Can my ISP see which VPN protocol I am using?

I know that my ISP can detect when I am using a VPN, but can it see which protocol I am using?

vpn protocols surveillance isp  
asked by E. M. 16 votes
answered by vidarlo 21 votes

Should I trust that the Android factory reset actually erases my data?

I bought a Galaxy S20 Fe, logged my LastPass in it and all of my accounts (google, twitter, etc). Now it has a malfunction and I'm going to have to send it back to get my money back. When I factory ...

android ssd hard-drive  
asked by Guerlando OCs 8 votes
answered by defalt 15 votes

Is Windows+L a secure attention sequence?

Ctrl+Alt+Del is a secure attention sequence (Microsoft) (or secure attention key (Wikipedia), but it's more a Linux term). As we can read, A key sequence that begins the process of logging on or off. ...

authentication windows  
asked by Thomas Weller 6 votes
answered by Kamil Kurzynowski 3 votes

Greatest hits from previous weeks:

What's the rationale behind Ctrl-Alt-Del for login

Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...

authentication windows password-management  
asked by Count Zero 290 votes
answered by Adi 330 votes

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...

passwords cryptography entropy usability  
asked by Billy ONeal 1239 votes
answered by AviD 1523 votes

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...

authentication account-security facebook  
asked by aMJay 540 votes
answered by Allison 620 votes

Why are salted hashes more secure for password storage?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...

passwords cryptography hash salt rainbow-table  
asked by Tsyras 252 votes
answered by tylerl 406 votes

How can I explain SQL injection without technical jargon?

I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?

sql-injection  
asked by torayeff 554 votes
answered by Polynomial 929 votes

How does Google know where I am?

Whenever I open the Google Maps app on my Android mobile phone, Google always seems to know my location, and it is very accurate (usually it places me on the map even in the correct room). Also, this ...

google geolocation google-apps  
asked by MNLR 291 votes
answered by INV3NT3D 309 votes

What is the real function and use of a DMZ on a network?

I read the article on Wikipedia describing what a DMZ (demilitarized zone) is on a network, but am still failing to grasp both how it is set up (ie: is it within the main network or sequestered away?) ...

network  
asked by Naftuli Kay 56 votes
answered by john 65 votes

Can you answer these questions?

What are the advantages of using JWT over Basic Auth with Https?

As per my understanding both JWT and Basic Auth used to store login credentials on client side and avoid sessions for better scalability. I understand with Basic Auth login credentials will be sent ...

oauth jwt http-basic-auth  
asked by Arjun 1 vote
answered by bk2204 0 votes

Isolating permissions available to browser JS via oauth and referer

This proposal concerns a strategy for isolating the permissions given to plugins in a plugin architecture. I'm looking for insight into whether this design can succeed in isolating those permissions. ...

oauth oauth2 isolation plugins  
asked by tasteslikelemons 1 vote

With SCTP and SHA-1 the random parameters are exchanged in init and init ack. What is used as HMAC key?

SCTP INIT has client random parameter. SCTP INIT ACK has server random parameter. There are no shared keys. Using SHA-1, what key does the client or server use when performing the HMAC calculation? ...

dtls  
asked by Jay Johnson 1 vote
You're receiving this message because you subscribed to the Information Security community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 110 William Street, 28th floor, New York, NY 10038

<3