Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
120 votes

What to do if stuck with website that has poor security?

Financial institutions in the United States are obliged by the Gramm-Leach-Bliley Act to ensure the security and confidentiality of personal information. What you describe is a flagrant violation of ...
Emmet's user avatar
  • 1,091
119 votes
Accepted

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

Assuming that people trust your site, abusing redirections like this can help avoid spam filters or other automated filtering on forums/comment forms/etc. by appearing to link to pages on your site. ...
Matthew's user avatar
  • 27.3k
91 votes

How to deal with WPE users

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are ...
Tobi Nary's user avatar
  • 14.4k
91 votes
Accepted

What to do if stuck with website that has poor security?

If you are concerned about the privacy of your password and thus your account (which should be the case), you should try to educate the customer service. The developer FAQ from the public shaming ...
Tobi Nary's user avatar
  • 14.4k
86 votes

Are security flaws acceptable if not much harm can derive from them?

Yes. This is a problem - a big problem. Lately I found a design flaw in a business' webshop that allowed me to insert innocent notes in other visitors' charts. Seems innocent, and only annoying, ...
O'Niel's user avatar
  • 2,914
75 votes

How are short passwords not safe if you limit the number of attempts?

The main reason passwords need to be long and random (i.e. high entropy) is to protect against offline brute force attacks. Passwords are usually not stored in plain text. Instead, they are hashed. ...
Anders's user avatar
  • 65.6k
73 votes

Why submit a website to plaintext offenders?

To quote their FAQ: Aren’t you worried hackers will use your site to find targets? Yes, but less worried than having this information remain secret and relying on Security Through Obscurity. ...
Tobi Nary's user avatar
  • 14.4k
70 votes
Accepted

Does a client certificate identify the owner to unrelated websites?

Interesting question! I just so happen to have a browser full of test certs, and a number of test sites to connect to! Let's test this! (Skip to the bottom for a summary) Investigation Testing on ...
Mike Ounsworth's user avatar
61 votes
Accepted

Are security flaws acceptable if not much harm can derive from them?

Your question is: Are security flaws acceptable if no much harm can derive from them? The answer is yes, if decided by business while understanding the consequences. What you are doing is called a ...
WoJ's user avatar
  • 9,038
59 votes
Accepted

What exploit are these user agents trying to use?

It looks to be trying to exploit some form of command injection. As DarkMatter mentioned in his answer, this was likely a broad attempt to find any vulnerable servers, rather than targeting you ...
Dan Landberg's user avatar
  • 3,322
50 votes

How to deal with WPE users

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model,...
Mike Ounsworth's user avatar
36 votes
Accepted

Could hashing prevent SQL injection?

So, hashing the user password before entering it into the query is a coincidental security feature to prevent SQL injection, but you can't necessarily do that with all user input. If I'm looking up a ...
Ryan Kelso's user avatar
  • 1,220
36 votes
Accepted

Why do some sites ask for username/email and password on two separate screens?

Security / Privacy disadvantage There are security and privacy risks involved with this approach when badly implemented. An attacker could figure out if the email- or login already exists, when not ...
Ludisposed's user avatar
36 votes
Accepted

How are short passwords not safe if you limit the number of attempts?

It's not as simple... About online brute force If an account becomes completely locked after 3 attempts, it will be easy to make a DOS (Denial Of Service) attack by locking all accounts! Servers have ...
F. Hauri  - Give Up GitHub's user avatar
33 votes

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol?

Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption. HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the ...
Arminius's user avatar
  • 44.8k
32 votes

Are security flaws acceptable if not much harm can derive from them?

The problem that I see with such a simple password reset scheme is that it suggests further vulnerabilities in the platform. A flawed concept of security is rarely so isolated as to only happen once, ...
phyrfox's user avatar
  • 5,724
31 votes

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

If you have a login page on your site, the bad guys could have used your open redirect to make a more successful phishing page for your users. From https://www.owasp.org/index.php/...
JesseM's user avatar
  • 1,952
25 votes

How to deal with WPE users

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you ...
UTF-8's user avatar
  • 2,330
22 votes

What exploit are these user agents trying to use?

It is probably nothing. It seems like the broad spam of a scanner looking across the web for any website that evaluates and returns that subtraction when it shouldn't. It is a pretty common thing to ...
DarkMatter's user avatar
  • 2,691
22 votes

What exploit are these user agents trying to use?

The use of actual function names (e.g. print) suggests they're looking for websites that are using eval in some way (note that this could be PHP's eval(string $code), JavaScript's eval(string), and ...
Dai's user avatar
  • 1,726
21 votes
Accepted

What is this potential identity leak that NoScript warns about?

So after some digging into NoScript's settings, I found some settings for something called "Cross-tab identity leak protection". Googling this led to a tor project issue Targeted ...
nobody's user avatar
  • 11.6k
18 votes

Why do some sites ask for username/email and password on two separate screens?

Passwords are not a requirement for authentication in some cases. The username generally determines how and what authenticates a user; in a federated login the username will identify the Identity ...
Joe's user avatar
  • 456
16 votes

Are security flaws acceptable if not much harm can derive from them?

If I see this scenario right, they can change E-Mail address and password of any account, then start a repair-form and continue the repair-process via mail. The support team will probably assume that ...
Falco's user avatar
  • 1,502
13 votes

Why submit a website to plaintext offenders?

The question seems to make the assumption that plaintext offenders is the only site which maintains such a list, rather than just being the one with the highest white-hat public profile. There are, ...
Dewi Morgan's user avatar
  • 1,429
12 votes

Why submit a website to plaintext offenders?

One thing that's important to understand is that there a practical difference between "password exposure" and "more risk." You can say with certainty that submitting a site to plaintext offenders ...
Xander's user avatar
  • 35.8k
12 votes
Accepted

How to perform a proper DDoS test in a safe and controlled way?

If you are performing load testing at high packet rates, the most safe way is to isolate it completely from the rest of the network. For example, you can connect two servers by direct 10GBps link ...
Aria's user avatar
  • 2,701
9 votes

What is the purpose of (ab)using the redirect page of my website for dubious URLs?

The crux is that using your redirect leverages the good name of your business to get someone to click on the malicious link.
Joe M's user avatar
  • 3,002
9 votes

How are short passwords not safe if you limit the number of attempts?

To prevent "password spraying" where someone tries a common password against many accounts.
paj28's user avatar
  • 33.4k
8 votes
Accepted

Why are common security measures on a webserver not enough on a large scale?

I consider things like "script injections awareness" and "firewall" and also "..." as far from simple. And don't forget the bugs, backdoors, critical information leaks etc you regularly find in ...
Steffen Ullrich's user avatar
8 votes

Is there any reason to log out of websites?

HTTP is a stateless protocol. Being logged into a website means that a shared state need to be kept between client and server. This is usually accomplished using a shared session ID which is commonly ...
Steffen Ullrich's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible