Information Security Stack Exchange Community Digest

Top new questions this week:

Why does this attack check the location of the server?

Recently (just now) the npm package ua-parser-js was found to be hijacked. The hijack installs a crypto miner on preinstall but I noticed the following passage in the preinstall script: IP=$(curl -k ...

asked by Calin Leafshade 55 votes
answered by Gh0stFish 77 votes

Why does DocuSign require that your password "must not contain the characters <, > or spaces."?

DocuSign requires that your password "must not contain the characters <, > or spaces." Is this not an odd requirement? Despite being a leader in online document signing, my gut tells ...

asked by carrier 54 votes
answered by CBHacking 95 votes

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator?

Why is SMS OTP not as secure as Authenticator Applications such as Microsoft Authenticator, etc? Is it because of snooping of mobile communications? or?

multi-factor sms  
asked by Nathan Aw 28 votes
answered by CBHacking 44 votes

Can an HTTPS request be sent twice?

When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data. I am wondering what would happen if this packet is copied and then re-sent. Is there a protocol at some layer ...

tls network man-in-the-middle wireshark sniffer  
asked by Reedy 15 votes
answered by Steffen Ullrich 36 votes

How Google is abused for DDoS attacks?

While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent. I'm ...

google ddos botnet  
asked by blnks 14 votes
answered by Dan 31 votes

How do big websites (e.g. Google, Twitter, GitHub, ...) have practically infinite session lengths without compromising on security?

I'm currently implementing a login session system for a web application. I've read lots of articles recommending very low session and idle timeouts. For example OWASP says: Both the idle and absolute ...

cookies session-management  
asked by Lukas Kalbertodt 9 votes

In a synchronous environment, does Signal offer any security benefits that can’t be achieved with a modern version of TLS?

The Signal protocol utilizes the double ratchet algorithm to achieve end-to-end encryption with forward secrecy and future secrecy (aka break-in recovery). Forward secrecy ensures that if any of the ...

tls signal  
asked by weaver 4 votes
answered by CBHacking 0 votes

Greatest hits from previous weeks:

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...

encryption cryptography authentication key-management ssh  
asked by jrdioko 489 votes
answered by emboss 350 votes

Police forcing me to install Jingwang spyware app, how to minimize impact?

Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it. Knowing that I may be ...

android mobile spyware surveillance  
asked by Citizen 532 votes
answered by wha7ever 353 votes

Where to find Google Authenticator backup codes?

I'm slightly confused about obtaining Google Authenticator backup codes. I can find my Google Account backup codes at: But have no ...

google recovery authenticator  
asked by a.s.t.r.o 21 votes
answered by Sas3 18 votes

Is Plaid, a service which collects user’s banking login information, safe to use?

I recently signed up for, which uses a service called Plaid to link a bank account. To do this, it requires the user to provide their banking username and password to a webpage from Plaid,...

authentication banks  
asked by gfrung4 156 votes
answered by Ilikeprivacy 80 votes

How to verify the checksum of a downloaded file (pgp, sha, etc.)?

Maybe I have been negligent towards the verification of software I download over the Internet, but I (or anybody I ever met) have never tried to verify the checksum of the contents I download. And ...

hash man-in-the-middle integrity  
asked by ThankYouSRT 46 votes
answered by Connor J 54 votes

Why are salted hashes more secure for password storage?

I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters). My ...

passwords cryptography hash salt rainbow-table  
asked by Tsyras 252 votes
answered by tylerl 407 votes

Who can spy on my wifi usage and websites I visit?

I'm using a WPA/WPA2 encrypted WiFi. Who can view what I'm doing? Also how? Can the person that pays for the WiFi look up exactly what I am doing (e.g. look up exact messages I've sent on Facebook)?...

network wifi wireless  
asked by Not important 1 vote
answered by Julie Pelletier 3 votes

Can you answer these questions?

buffer overflow without return in main()?

I am trying to exploit a stack-based overflow vulnerability. I couldn't find an example similar to this. Here is the code void win() { printf("You need to hit this\n"); exit(0); } ...

asked by uyyFactorio 1 vote

Why does Windows facial recognition not require a password on startup?

I was reading the following question: Why do mobile devices force user to type password after reboot? To find out why fingerprint authentication on my Windows 10 laptop isn't an option on startup. It ...

authentication windows fingerprint facial-recognition  
asked by pigeonburger 1 vote

Cross OS GPU based malware

I've been doing some research into GPU based malwares, and would like to know if there is a way to run them on a dual boot scenario with the code being executed only on one Operational System and be &...

malware hardware operating-systems  
asked by Lucius 1 vote
answered by Dan 0 votes
You're receiving this message because you subscribed to the Information Security community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 110 William Street, 28th floor, New York, NY 10038