All Questions
68,000
questions
1285
votes
23
answers
284k
views
XKCD #936: Short complex password, or long dictionary passphrase?
How accurate is this XKCD comic from August 10, 2011?
I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are against ...
1277
votes
3
answers
681k
views
How does SSL/TLS work?
How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering.
I'd like to see details in terms of:
A high level description of the protocol.
...
- 134k
937
votes
11
answers
318k
views
How to securely hash passwords?
If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone?
I should point out that this relates only to retrieval directly from the database,...
AviD♦
- 73k
884
votes
14
answers
174k
views
What technical reasons are there to have low maximum password lengths?
I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites where I actually care ...
- 8,161
664
votes
4
answers
325k
views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
- 6,725
623
votes
23
answers
152k
views
How does changing your password every 90 days increase security?
Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...
- 6,781
616
votes
7
answers
227k
views
How to store salt?
If you expect to store user password securely, you need to do at least the following:
$pwd=hash(hash($password) + salt)
Then, you store $pwd in your system instead of the real password. I have seen ...
- 6,347
580
votes
3
answers
522k
views
What's the difference between SSL, TLS, and HTTPS?
I get confused with the terms in this area. What is SSL, TLS, and HTTPS? What are the differences between them?
- 13.1k
567
votes
20
answers
88k
views
How can I explain SQL injection without technical jargon?
I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?
- 4,575
559
votes
3
answers
100k
views
Why can I log in to my Facebook account with a misspelled email/password?
I've been playing around with different login forms online lately to see how they work. One of them was the Facebook login form. When I logged out of my account my email and password were ...
- 3,675
548
votes
11
answers
93k
views
Is my developer's home-brew password security right or wrong, and why?
A developer, let's call him 'Dave', insists on using home-brew scripts for password security. See Dave's proposal below.
His team spent months adopting an industry standard protocol using Bcrypt. ...
- 4,749
536
votes
18
answers
117k
views
Police forcing me to install Jingwang spyware app, how to minimize impact?
Chinese police are forcing whole cities to install an Android spyware app Jingwang Weishi. They are stopping people in the street and detaining those who refuse to install it.
Knowing that I may be ...
- 2,741
503
votes
8
answers
507k
views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
- 13.1k
472
votes
13
answers
107k
views
Are passwords stored in memory safe?
I just realized that, in any language, when you save a password in a variable, it is stored as plain text in the memory.
I think the OS does its job and forbids processes from accessing each other's ...
- 4,657
448
votes
14
answers
133k
views
Is it bad practice to use your real name online?
On some accounts I use my real name on-line (Google+/Facebook/Wikipedia/personal blog), others (Q&A/Gaming) I use an alias.
My question is: Security and privacy wise, what can people do with my ...
- 3,601
432
votes
9
answers
306k
views
Is BASIC-Auth secure if done over HTTPS?
I'm making a REST-API and it's straight forward to do BASIC auth login. Then let HTTPS secure the connection so the password is protected when the api is used.
Can this be considered secure?
- 4,473
417
votes
14
answers
68k
views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
- 4,465
414
votes
5
answers
543k
views
Why is 'Bearer' required before the token in 'Authorization' header in a HTTP request?
What exactly is the difference between following two headers:
Authorization : Bearer cn389ncoiwuencr
vs
Authorization : cn389ncoiwuencr
All the sources which I have gone through, sets ...
- 4,241
369
votes
6
answers
337k
views
What is certificate pinning?
I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...
- 3,815
363
votes
22
answers
303k
views
I found that the company I work for is putting a backdoor into mobile phones
I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval.
We are not using this option, and it is probably there ...
- 2,981
312
votes
25
answers
49k
views
Should I let my child's school have access to my kid's personal laptop?
My kid is starting 6th grade and the school requires him to get a laptop and bring it to school. Now the school IT department wants to install some software on the laptop and is asking for ...
- 2,109
310
votes
16
answers
62k
views
SQL injection is 17 years old. Why is it still around?
I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper.
It strikes me as odd. Why do so many data breaches still happen ...
- 2,603
309
votes
3
answers
77k
views
CRIME - How to beat the BEAST successor?
With the advent of CRIME, BEAST's successor, what possible protection is available for an individual and/or system owner in order to protect themselves and their users against this new attack on TLS?
- 4,025
309
votes
9
answers
54k
views
What makes Docker more secure than VMs or bare metal?
I recently had a discussion with a Docker expert about the security of Docker vs. virtual machines. When I told that I've read from different sources that it's easier for code running within a Docker ...
- 4,714
306
votes
7
answers
45k
views
Is it normal for auditors to require all company passwords?
My company is currently engaged in a security audit framed as a pentest. They've requested all admin passwords for every one of our services and all source code of our software. They want logins for ...
- 2,181
306
votes
8
answers
1.1m
views
How to find live hosts on my network?
I am trying to find the live hosts on my network using nmap. I am scanning the network in Ubuntu using the command sudo nmap -sP 192.168.2.1/24. However, I am unable to find the live hosts. I just get ...
- 4,262
302
votes
10
answers
73k
views
Why is Gbt3fC79ZmMEFUFJ a weak password?
On https://passwordsgenerator.net/, it says
Examples of weak passwords: qwert12345, Gbt3fC79ZmMEFUFJ, 1234567890, 987654321, nortonpassword
The first, third, and fourth examples are obviously weak....
- 2,321
300
votes
20
answers
51k
views
How can someone go off-web, and anonymise themselves after a life online?
With data mining tools like Maltego and other correlation tools for large data sets, if we conduct any transactions online assume that these can all be collated to build a good picture of what we do, ...
- 61.5k
297
votes
7
answers
85k
views
What's the rationale behind Ctrl-Alt-Del for login
Why is Ctrl+Alt+Del required at login on certain Windows systems (I have not seen it elsewhere, but contradict me if I'm wrong) before the password can be typed in? From a usability point of view, it'...
- 2,909
296
votes
11
answers
466k
views
"Diffie-Hellman Key Exchange" in plain English
Can someone explain what the Diffie-Hellman Key Exchange algorithm in plain English? I have read that Twitter has implemented this technology which allows two parties to exchange encrypted messages on ...
user15119
296
votes
6
answers
159k
views
How does Google know where I am?
Whenever I open the Google Maps app on my Android mobile phone, Google always seems to know my location, and it is very accurate (usually it places me on the map even in the correct room). Also, this ...
- 2,247
287
votes
18
answers
494k
views
Provide subjectAltName to openssl directly on the command line
Is it possible to provide a subjectAltName-Extension to the openssl req module directly on the command line?
I know it's possible via a openssl.cnf file, but that's not really elegant for batch-...
- 3,003
285
votes
11
answers
87k
views
Why shouldn't we roll our own?
Why shouldn't we create our own security schemes?
I see a lot of questions around here about custom crypto and custom security mechanisms, especially around password hashing.
With that in mind, I'm ...
- 134k
281
votes
3
answers
24k
views
How did "tech-supportcenter" phishers trick Google?
Related: Is the Web browser status bar always trustable?
How can Google search change the location in a URL tooltip?
I've always thought you can "hover" over a link to see where it really goes, ...
- 2,100
269
votes
7
answers
114k
views
Password Hashing: add salt + pepper or is salt enough?
Please Note: I'm aware that the proper method for secure password storage hashing is either scrypt or bcrypt. This question isn't for implementation in actual software, it's for my own understanding.
...
- 7,602
264
votes
4
answers
167k
views
How does Google Authenticator work?
Google Authenticator is an alternative to SMS for 2Step verification, installing an app on Android where the codes will be sent.
It works without any connectivity; it even works on plane mode. This ...
user15194
262
votes
3
answers
143k
views
What are ssh-keygen best practices?
Most users would simply type ssh-keygen and accept what they're given by default.
But what are the best practices for generating ssh keys with ssh-keygen?
For example:
Use -o for the OpenSSH key ...
- 2,795
260
votes
11
answers
38k
views
How to explain Heartbleed without technical terms?
Most of my friends who are not experienced in computers want to know what Heartbleed is and how it works. How would one explain Heartbleed to someone without a technical background?
- 3,233
259
votes
7
answers
50k
views
How do certification authorities store their private root keys?
Knowledge of a CA private key would allow MitM attackers to transparently supplant any certificates signed by that private key. It would also allow cyber criminals to start forging their own trusted ...
- 10.6k
258
votes
12
answers
138k
views
Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
Why can't a password hash be reverse engineered?
I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
- 2,697
257
votes
7
answers
161k
views
Should I use CSRF protection on Rest API endpoints?
Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...
- 30.8k
256
votes
8
answers
77k
views
Why are salted hashes more secure for password storage?
I know there are many discussions on salted hashes, and I understand that the purpose is to make it impossible to build a rainbow table of all possible hashes (generally up to 7 characters).
My ...
- 2,631
256
votes
5
answers
23k
views
Is the save button delay in a Firefox download dialog a security feature? What does it protect?
When I click to download a file through Firefox, a dialog window appears asking me whether I want to save the file somewhere or open it immediately once downloaded.
The OK button in the dialog window ...
- 2,485
256
votes
5
answers
30k
views
Consequences of the WPA2 KRACK attack
Today new research was published on vulnerabilities in wireless network security called Krack.
What are the real-world consequences of these attacks for users and owners of wireless networks, what ...
- 62k
253
votes
2
answers
42k
views
Can ads on a page read my password?
Disclaimer: I have minimal web-dev/security knowledge so please answer as if talking to a "layman."
I've heard that web-advertisements need to be able to run their own JavaScript so that they can ...
- 1,045
250
votes
10
answers
83k
views
How is the "WannaCry" Malware spreading and how should users defend themselves from it?
There's a new strain of attacks which is affecting a lot of systems around the world (including the NHS in the UK and Telefonica in Spain) which is being called "WannaCry" amongst other names.
It ...
- 62k
249
votes
4
answers
428k
views
What is the difference between authorized_keys and known_hosts file for SSH?
I am learning the basics of SSH protocol. I am confused between the contents of the following 2 files:
~/.ssh/authorized_keys: Holds a list of authorized public keys for servers. When the client ...
- 2,713
248
votes
4
answers
112k
views
SSL3 "POODLE" Vulnerability
Canonical question regarding the recently disclosed padding oracle vulnerability in SSL v3. Other identical or significantly similar questions should be closed as a duplicate of this one.
What is the ...
- 83.1k
245
votes
14
answers
47k
views
My college is forcing me to install their SSL certificate. How to protect my privacy?
My college administration is forcing us to install Cyberoam Firewall SSL certificate so that they can view all the encrypted traffic to "improve our security". If I don't install the certificate than ...
- 2,161
245
votes
18
answers
30k
views
Passwords being sent in clear text due to users' mistake in typing it in the username field
Upon reviewing the Logs generated by different SIEMs (Splunk, HP Logger Trial and the AlienVault platform’s SIEM) I noticed that for some reason quite a few users tend to make the mistake of typing ...
- 4,257