Information Security Stack Exchange Community Digest

Top new questions this week:

A client did an unannounced penetration test on our platform

A client did an unannounced penetration test on our platform (SaaS, multi-tenant). The first test, they made an extreme number of requests in a short amount of time. It was not logged in and was ...

penetration-test  
user avatar asked by Dirk Boer Score of 31
user avatar answered by Gh0stFish Score of 48

What is a proper way to restore the master-password in case of potential memory loss?

I'm not sure if this the right place to ask but nonetheless. I practice using a password manager to provide the decent information security level in my everyday life - by generating strong passwords ...

privacy password-management  
user avatar asked by abyss.7 Score of 2

What are the security pros and cons of setting up passkeys for Gmail logins?

Today while signing on to Gmail with my iPad, I was prompted: With passkeys you can now use your fingerprint, face, or screen lock to verify it’s really you. I was wondering what the security pros ...

passkey  
user avatar asked by Will Octagon Gibson Score of 2
user avatar answered by Ja1024 Score of 2

Is it possible to create a random alphanumeric password with built in error detection?

A friend told me about a giant alphanumeric password that he had to enter somewhere. Although he was initially worried that he would need multiple attempts due to typos. He was pleasantly surprised ...

passwords  
user avatar asked by C Nielsen Score of 1

Why does Windows force you to do a mandatory restart once in a while? Apparently, its for 'security purposes.'

I haven't needed to restart my computer for a while now, as I just usually shut down when I'm finished, and then reboot when I use Windows again. I dual-boot, so of course I often restart to a ...

windows-10 boot  
user avatar asked by security_paranoid Score of 1
user avatar answered by vidarlo Score of 1

Does the CORS asteriks / wildcard include both encrypted and unencrypted origins?

Does the CORS asteriks / wildcard (*) include both encrypted (https) and unencrypted origins (http)? And is the null origin (i.e., when a local file is doing a xmlhttprequest, or within an iframe ...

tls http cors wildcard  
user avatar asked by Booger21 Score of 1
user avatar answered by Ja1024 Score of 0

Is it possible to exploit this supposedly boolean-based blind and time-based blind SQLi (sqlmap)?

I recently found a boolean-based blind SQLi and since I'm new to the bug bounty scene - I don't understand what impact I can extract from it. There is a website like example.com/tarif?tableId=136&...

vulnerability sql-injection sqlmap bug-bounty  
user avatar asked by Andrey Score of 1

Greatest hits from previous weeks:

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp ...

encryption cryptography smartphone instant-messaging telegram  
user avatar asked by ilazgo Score of 242
user avatar answered by Geremia Score of 18

How to decrypt a microSD card after a factory reset of the device used to encrypt it?

Two month ago, I encrypted my Micro SD card in my Android device (Samsung Galaxy S5) for security purposes, and yesterday I forgot to decrypt it whilst removing the card I and factory resetting the ...

encryption android decryption data-recovery  
user avatar asked by Honey Score of 3
user avatar answered by Colbe Score of 5

Is BASIC-Auth secure if done over HTTPS?

I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used. Can this be considered secure?

tls authentication web-application http http-basic-auth  
user avatar asked by Morten Score of 442
user avatar answered by AviD Score of 385

What is a specific example of how the Shellshock Bash bug could be exploited?

I read some articles (article1, article2, article3, article4) about the Shellshock Bash bug (CVE-2014-6271 reported Sep 24, 2014) and have a general idea of what the vulnerability is and how it could ...

linux exploit known-vulnerabilities bash shellshock  
user avatar asked by Rob Bednark Score of 213
user avatar answered by mgjk Score of 158

Is RAM wiped before use in another LXC container?

Edit: though my wording may not be exact, I understand that two containers don't have access to the same memory at the same time. My question is can one container see data that another has deallocated?...

container lxc  
user avatar asked by coolaj86 Score of 49
user avatar answered by Quitting Due To Antisemitism Score of 20

How to bypass tcpwrapped with nmap scan

I ran a scan with nmap -n -vv -A x.x.x.x --min-parallelism=50 --max-parallelism=150 -PN -T2 -oA x.x.x.x With the following result: Host is up (0.032s latency). Scanned at 2012-10-25 16:06:38 AST for ...

firewalls nmap  
user avatar asked by KING SABRI Score of 53
user avatar answered by bonsaiviking Score of 177

How dangerous is it to reveal your date of birth, and why?

At some point I told a friend that it's dangerous to reveal your birth date (kind of like your social security number or your mother's maiden name), because it's a crucial piece of information for ...

identity-theft persec  
user avatar asked by user541686 Score of 106
user avatar answered by Tim B Score of 33
You're receiving this message because you subscribed to the Information Security community digest.
Unsubscribe from this community digest       Edit email settings       Leave feedback       Privacy
Stack Overflow

Stack Overflow, 14 Wall Street, 20th Floor, New York, NY 10005

<3