119
votes
Accepted
Can "Accept cookie" button in a website be malicious?
Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user.
Legally, that is another matter. In ...
- 10.7k
114
votes
Accepted
What is the website checking about my browser to protect the website from a DDoS?
Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very ...
- 19.4k
104
votes
Employer makes me use what I believe to be an insecure website for HR functions. What to do?
To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like ...
- 132k
103
votes
Accepted
Email received regarding Security flaw in website
TL;DR: It's probably well-intentioned and not a scam, but just poorly written.
I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website ...
- 16.1k
79
votes
Can "Accept cookie" button in a website be malicious?
A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would ...
- 10.2k
71
votes
What does a website see if I am connected on my native IP and then enable my VPN?
Since you asked specifically what the website will see, rather than any intermediary watching your network connection, we should think in terms of requests:
Your old ("native") IP will disconnect any ...
- 3,920
69
votes
Accepted
More than three domains hosted on the same IP address
This is not a sign of a problem for your server. There's an important detail here, which is:
104.27.182.86 is not your server. That IP belongs to cloudflare.
Cloudflare provides a large number of ...
- 31.7k
65
votes
Why don't websites and devices offer fake logins for hackers?
That way the hacker won't know if they have got the login details correct or not.
If the information presented after login has no relationship to the person who the login should be for, then most ...
- 208k
54
votes
Accepted
What is the purpose of hiding spam links in some obscure forum posts?
It could be an attempt to boost the spam sites in search engine results by creating backlinks to it, which is a common SEO technique (although debatable how effective it is, as search engines can ...
- 16.5k
49
votes
Why don't websites and devices offer fake logins for hackers?
The concept you're describing is called Plausible Deniability and methods to provide it have indeed been implemented in some software, VeraCrypt being one example.
One problem with implementing it in ...
- 1,069
38
votes
Accepted
What is more safe for browsing the web: PC or smartphone?
First, here I compare an up-to-date Android phone which receives regular updates with a Windows PC which receives regular updates. While this might be the normal case if you buy a PC with Windows 10 ...
- 208k
35
votes
Email received regarding Security flaw in website
Does not appear to be a scam, though it might be a type of mass-mailing due to lack of details. Maybe some guy needs money, runs Nessus on a bunch of sites and is now angling for a small reward from ...
- 10.7k
33
votes
What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol?
Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption.
HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the ...
- 45.1k
32
votes
Why don't websites and devices offer fake logins for hackers?
Because hackers don't attack login forms
The flaw is that you assume hackers get into accounts by brute-forcing credentials against remote services. But that's futile anyway.
Any website with decent ...
- 414
32
votes
More than three domains hosted on the same IP address
This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "...
30
votes
Accepted
Why doesn't Tornado have session
I've heard that cookies is less secure than the session.
You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies.
I'm thinking that if I could get &...
- 208k
29
votes
Employer makes me use what I believe to be an insecure website for HR functions. What to do?
To me this says you haven't investigated enough to confidently say it's insecure. You haven't shown any particular direct exploit nor really dug into their system (in a non-hacking, poking around kind ...
- 660
26
votes
What is the purpose of hiding spam links in some obscure forum posts?
It's all about search engine reputation, as discussed.
However, it's not going to work on your site. Because you are a conscientious forum operator, so of course you add the meta tag "rel=...
23
votes
Accepted
Is a plain password in the URL a potential security threat?
This is a serious security problem. URLs should never contain sensitive information.
URLs show up in your browsing history. So even after logging out it will be trivial to access your account for ...
- 45.1k
19
votes
What is the website checking about my browser to protect the website from a DDoS?
Just to add what I know from experience: Cloudflare blocks non-graphical browsers (tested: links, lynx), not on the first page view, but from the second one. These browsers (presumably) don't load ...
- 289
19
votes
Email received regarding Security flaw in website
This is called fear marketing or fear appeal. It's a marketing method that uses fear as the trigger for action.
https://en.wikipedia.org/wiki/Fear_appeal
The email contains the 3 basic stages of ...
- 320
18
votes
What is more safe for browsing the web: PC or smartphone?
It depends on the user's behavior.
Windows is extremely susceptible to people who open spam emails, double-click an attached file, and click away that UAC prompt so they can view naughtygirl.jpg.exe....
- 3,630
17
votes
What does a website see if I am connected on my native IP and then enable my VPN?
Your old http session will end and a new one will start. If you haven't so much as switched to a new browser, the site will be able to very easily figure out that you're the same person, just coming ...
- 6,578
16
votes
Why don't websites and devices offer fake logins for hackers?
I have never heard of any service or device implementing this either.
The case where an attacker is present and forcing you to login is pretty unlikely. They are more likely to just take your $1000 ...
- 283
13
votes
Why don't websites and devices offer fake logins for hackers?
It's not exactly the context you had in mind but there are in fact systems which implemented this idea. I used to work at a (somewhat sensitive) facility where each employee had two codes to disable ...
- 1,745
12
votes
Accepted
How is the lack of the "SameSite" cookie flag a risk?
The goals of the SameSite flag are:
prevent cross-site timing attacks (see eg here)
prevent cross-site script inclusion (see here)
prevent CSRF: SameSite cookies are only sent if the site the request ...
- 29.8k
12
votes
Can "Accept cookie" button in a website be malicious?
With recent regulations around data privacy, websites are asking for express permission from users to collect their info from cookies.
Cookies do not harm PCs. The data collected from cookies could ...
- 132k
10
votes
Accepted
How to validate user input
Is a basic question. You should validate EVERYTHING on your server side. The back-end is the right place to make validations. Of course javascript validations are useful too to drive standard users ...
- 5,365
Only top scored, non community-wiki answers of a minimum length are eligible