Information Security Stack Exchange Community Digest

Top new questions this week:

Can ISP replace a website html/js/httpHeaders with something else?

It seems to me that "yes they can do". As I saw it in some countries, entering adult content will simply give a warning message that the site is blocked. Some places even block Facebook ...

javascript cookies isp  
asked by Phung D. An 21 votes
answered by Demento 24 votes

Couldn't we create a string that produces the same hash as another string in sha-256?

Let's say we have a separate hashing algorithm called s2 and it would convert Hello into dug84nd8. If we could take the algorithm and just reverse engineer it to generate a string like 8GN492MD that ...

hash password-cracking sha256  
asked by BOI 11 votes
answered by abligh 50 votes

How safe is it to store your passwords in a modern browser?

There's a few questions here along these same lines already, but they're nearly a decade old. I'd like to know if things have changed, especially now that Chrome has become more aggressive about ...

web-browser password-management account-security  
asked by Django Reinhardt 5 votes
answered by Paolo Celati 1 vote

How does Windows Hello recognize me with a mask on?

The first time I forgot to take my mask off before using the facial recognition login to my Windows 10 computer, it wouldn't work (which I expected). After a couple times, though, it started logging ...

facial-recognition windows-hello  
asked by Benjamin 4 votes
answered by user10216038 3 votes

Why would a certificate authority have multiple root certificates?

When I look at the trusted certificates in my browser, I see that many certificate authorities have multiple root certificates associated with them. For example, org-Amazon has Amazon Root CA 1, ...

tls certificates web-browser public-key-infrastructure certificate-authority  
asked by xymox 3 votes
answered by Crypt32 3 votes

Pros/Cons for showing a user how many failed login attempts they have remaining before getting blocked?

For context, my web app will be used by users who don't have a strong technical background. What are the pros or cons for displaying a message like this? Something like:

authentication error-handling  
asked by Varun S. Ranipeta 2 votes
answered by Dean Valentine 0 votes

reading a file with other read permissions set

For this question assume a file with 604 perms in a directory with 700 permissions. Assume this file exists: /test/file A non-root user can techincally read that file but in practice to read it the ...

linux permissions  
asked by sashang 2 votes
answered by Dean Valentine 0 votes

Greatest hits from previous weeks:

How to find out what programming language a website is built in?

I think that it's fundamental for security testers to gather information about how a web application works and eventually what language it's written in. I know that URL extensions, HTTP headers, ...

web-application tools reconnaissance information-gathering  
asked by storm 107 votes
answered by Benoit Esnard 149 votes

Google Chrome "Your connection to website is encrypted with obsolete cryptography"

Google Chrome is showing new information in the certificate section. Is this a big deal? If so how can I fix it on the server end? EDIT: Thanks for the answers but I'm not skilled in cryptography ...

cryptography chrome  
asked by Carleton Stuberg 65 votes
answered by Adm Selec 55 votes

Where to find Google Authenticator backup codes?

I'm slightly confused about obtaining Google Authenticator backup codes. I can find my Google Account backup codes at: https://myaccount.google.com/signinoptions/two-step-verification But have no ...

google recovery authenticator  
asked by a.s.t.r.o 19 votes
answered by Sas3 17 votes

Why can I log in to my Facebook account with a misspelled email/password?

I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...

authentication account-security facebook  
asked by aMJay 533 votes
answered by Sirens 614 votes

If someone hacks my wi-fi password, what can they see and how?

If someone knows my wifi password (be it WEP or WPA) what can they see? Do they just see URLs I visit, or can they see everything in my browser, or even everything I do on my computer? Does using ...

network privacy wifi wireless  
asked by user20378 63 votes
answered by dr jimbob 57 votes

How do I use "openssl s_client" to test for (absence of) SSLv3 support?

In order to mitigate the "Poodle" vulnerability, I'd like to disable SSLv3 support in my (in this case, TLS, rather than HTTPS) server. How can I use openssl s_client to verify that I've done this?

tls openssl  
asked by Roger Lipscombe 122 votes
answered by P4cK3tHuNt3R 161 votes

How safe are password managers like LastPass?

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long. How safe are password ...

passwords password-management  
asked by blended 188 votes
answered by paj28 140 votes

Can you answer these questions?

How smart cards are blocked?

I have a Yubikey NFC 5, when I enter a wrong PIN or PUK three times the smart card is blocked. Can someone please explain to me how it is blocked ? Does the PIN/PUK functionality is disabled somehow ? ...

cryptography smartcard  
asked by No name 1 vote

Lost GPG private key and revocation certificate

I have created a GPG key and uploaded it to pgp.mit.edu. Then I accidentally wiped the drive that contained both the key and the revocation certificate. So what to do now? I found a possible answer ...

gnupg pgp key  
asked by SchoolBusesC2 1 vote

Detecting changes in surrounding WiFi networks

I’m considering developing a simple WiFi scanner and logging App that can run as a service 24 hours a day for months, passively collecting changes in the surrounding wireless environment with the ...

wifi logging aircrack-ng kismet  
asked by Gerard de Jong 1 vote
You're receiving this message because you subscribed to the Information Security community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 110 William Street, 28th floor, New York, NY 10038

<3