Skip to main content
Information Security

Guru

 Guru
Accepted answer and score of 40 or more. This badge can be awarded multiple times.
Awarded 1506 times.
Does Google collect and store data about activity done in Incognito mode?
Awarded Nov 10, 2020 at 12:10
When to use HMAC alongside AES?
Awarded Nov 6, 2020 at 13:46
What is the impact of an exposed secret key for a JWT token implementation?
Awarded Oct 28, 2020 at 21:58
Best place to store authentication tokens client side
Awarded Oct 21, 2020 at 12:35
Any reason NOT to set all cookies to use httponly and secure
Awarded Oct 19, 2020 at 18:04
Docker as a sandbox for untrusted code
Awarded Oct 18, 2020 at 16:37
Why is social engineering often excluded from bug bounties?
Awarded Sep 25, 2020 at 23:50
How to verify the checksum of a downloaded file (pgp, sha, etc.)?
Awarded Sep 23, 2020 at 23:27
Is there any security risk in not setting a maximum password length?
Awarded Sep 7, 2020 at 18:04
Should I use CSRF protection for GET requests?
Awarded Sep 4, 2020 at 18:57
New Hires get phishing emails very quickly - Reasoning and how to stop
Awarded Sep 2, 2020 at 20:25
Password entry: are "paste from password manager" and "eyeball to view passwords" mutually-exclusive features?
Awarded Aug 27, 2020 at 17:31
Reply to potentially spoofed email
Awarded Aug 20, 2020 at 11:07
Can ISPs replace a website's HTML/JavaScript/HTTP headers with something else?
Awarded Aug 14, 2020 at 11:25
Forced into using a static IV (AES)
Awarded Aug 9, 2020 at 19:55
How does CORS prevent XSS?
Awarded Aug 7, 2020 at 20:12
Is bcrypt(strtolower(hex(md5(pass)))) ok for storing passwords?
Awarded Jul 29, 2020 at 7:56
Emergency method to erase all data off a machine within seconds
Awarded Jul 24, 2020 at 13:23
Can an identity provider impersonate me? (Can Facebook post Stack Overflow questions under my name?)
Awarded Jul 23, 2020 at 18:52
How can a company ensure cybercriminals destroy hacked data after payment?
Awarded Jul 23, 2020 at 0:08
On my website's account creation form, how to avoid leaking the information that an email address already has an account?
Awarded Jul 17, 2020 at 16:22
Is revealing the phone number during OTP verification process considered a vulnerability?
Awarded Jul 15, 2020 at 18:50
Why does my digital bank need my phone date and hour to be correct?
Awarded Jul 13, 2020 at 17:08
What is the suggested best practice for changing a user's email address?
Awarded Jul 12, 2020 at 11:27
How can we eliminate passwords given the problems with biometric authentication?
Awarded Jul 7, 2020 at 2:07
Can a virus destroy the BIOS of a modern computer?
Awarded Jul 6, 2020 at 3:50
Does legitimate tech support use remote control software?
Awarded Jul 5, 2020 at 12:41
How do "Confidence images" on my bank's login page improve security?
Awarded Jul 2, 2020 at 6:01
Where to report malicious URLs, phishing, and malicious web sites?
Awarded Jul 1, 2020 at 8:02
Where should I store a username during a password reset?
Awarded Jun 25, 2020 at 19:36
What is the use case for using TLS on an internal network?
Awarded Jun 25, 2020 at 11:06
What's the point of Microsoft Account 2FA if it still lets me log in using password instead?
Awarded Jun 24, 2020 at 7:06
What is the actual value of a certificate fingerprint?
Awarded Jun 22, 2020 at 23:35
Provide subjectAltName to openssl directly on the command line
Awarded Jun 20, 2020 at 21:34
What is the risk of having a 2FA key permanently plugged into my device?
Awarded Jun 14, 2020 at 21:11
What are the potential vulnerabilities of allowing non-root users to run apt-get?
Awarded Jun 14, 2020 at 14:10
What are the potential vulnerabilities of allowing non-root users to run apt-get?
Awarded Jun 13, 2020 at 23:15
How to secure a mobile app against its user?
Awarded Jun 12, 2020 at 8:26
Is refreshing an expired JWT token a good strategy?
Awarded Jun 11, 2020 at 23:46
Is `sudo` almost useless?
Awarded Jun 9, 2020 at 7:11
Protect API from being tampered?
Awarded Jun 2, 2020 at 19:50
How does Google Maps know where I am, when I'm using a VPN?
Awarded Jun 1, 2020 at 23:35
eBay web site tries to connect to wss://localhost:xxxxx - is this legit or they have some Malware JS running?
Awarded May 30, 2020 at 0:56
Is publishing your public IP address a security threat?
Awarded May 28, 2020 at 19:58
How do I inform a company I found a leaked database of theirs on the Internet?
Awarded May 27, 2020 at 21:26
Aren't keyfiles defeating the purpose of encryption?
Awarded May 20, 2020 at 7:11
Why is this 435 × 652 pixel JPEG over 6 MB?
Awarded May 19, 2020 at 23:03
Is it possible for a name server provider to hijack MX records?
Awarded May 14, 2020 at 10:55
What is the attack scenario against which encrypted files provide protection?
Awarded May 11, 2020 at 20:02
Does the saying "physical access = game over" apply to smartphones, too?
Awarded May 7, 2020 at 1:06
GnuPG decryption not asking for passphrase
Awarded May 6, 2020 at 23:25
Why would I sign my git commits with a GPG key when I already use an SSH key to authenticate myself when I push?
Awarded May 2, 2020 at 8:32
How secure is this hash-based personal password scheme?
Awarded May 1, 2020 at 18:35
Security risks of fetching user-supplied URLs
Awarded Apr 27, 2020 at 16:51
Are password managers more secure than a slightly different password for each website?
Awarded Apr 27, 2020 at 3:36
How do unzip programs check if the password is correct?
Awarded Apr 22, 2020 at 16:31
When encrypting cloud-stored data, is it acceptable to use the user's account password?
Awarded Apr 22, 2020 at 16:31
Why is 0x41414141 associated with security exploits?
Awarded Apr 22, 2020 at 16:31
Why can't I just let customers connect directly to my database?
Awarded Apr 22, 2020 at 7:05
If a server only opens port 22 and 80, do we only have those two ways to hack it?
Awarded Apr 22, 2020 at 2:51
1
…
3 4
5
6 7
…
26