Skip to main content
Share Your Experience: Take the 2024 Developer Survey
119 votes
Accepted

Can "Accept cookie" button in a website be malicious?

Technically, browsers do not have to ask the user a question in order to use cookies. Furthermore, they are not technically bound to the answer given by the user. Legally, that is another matter. In ...
A. Hersean's user avatar
  • 10.5k
114 votes
Accepted

What is the website checking about my browser to protect the website from a DDoS?

Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very ...
WhiteWinterWolf's user avatar
104 votes

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like ...
schroeder's user avatar
  • 131k
103 votes
Accepted

Email received regarding Security flaw in website

TL;DR: It's probably well-intentioned and not a scam, but just poorly written. I don't know of any kind of scam that would be based on this. Certainly there have been attempts to extort website ...
David's user avatar
  • 16.1k
79 votes

Can "Accept cookie" button in a website be malicious?

A malicious website could harm you without you having to click on anything. However, the fact that the user clicked on a page element simplifies the task: for example, most browsers would ...
Dmitry Grigoryev's user avatar
71 votes

What does a website see if I am connected on my native IP and then enable my VPN?

Since you asked specifically what the website will see, rather than any intermediary watching your network connection, we should think in terms of requests: Your old ("native") IP will disconnect any ...
IMSoP's user avatar
  • 3,900
69 votes
Accepted

More than three domains hosted on the same IP address

This is not a sign of a problem for your server. There's an important detail here, which is: 104.27.182.86 is not your server. That IP belongs to cloudflare. Cloudflare provides a large number of ...
Conor Mancone's user avatar
65 votes

Why don't websites and devices offer fake logins for hackers?

That way the hacker won't know if they have got the login details correct or not. If the information presented after login has no relationship to the person who the login should be for, then most ...
Steffen Ullrich's user avatar
54 votes
Accepted

What is the purpose of hiding spam links in some obscure forum posts?

It could be an attempt to boost the spam sites in search engine results by creating backlinks to it, which is a common SEO technique (although debatable how effective it is, as search engines can ...
Gh0stFish's user avatar
  • 12.2k
49 votes

Why don't websites and devices offer fake logins for hackers?

The concept you're describing is called Plausible Deniability and methods to provide it have indeed been implemented in some software, VeraCrypt being one example. One problem with implementing it in ...
TheWolf's user avatar
  • 1,069
38 votes
Accepted

What is more safe for browsing the web: PC or smartphone?

First, here I compare an up-to-date Android phone which receives regular updates with a Windows PC which receives regular updates. While this might be the normal case if you buy a PC with Windows 10 ...
Steffen Ullrich's user avatar
35 votes

Email received regarding Security flaw in website

Does not appear to be a scam, though it might be a type of mass-mailing due to lack of details. Maybe some guy needs money, runs Nessus on a bunch of sites and is now angling for a small reward from ...
Tom's user avatar
  • 10.4k
33 votes
Accepted

How can I safely check whether an email link leads to a malicious website?

VPN Virtual Machine View-Source for those who know Javascript [Tinfoil Hat (Mythic Warforged)] here. If you are handy with Javascript and the like, I've always appreciated view-source:http://www....
Mark Buffalo's user avatar
  • 22.5k
33 votes

What parties have access to the *full* requested URL of a website accessed via the HTTPS protocol?

Only the TLS endpoints1 can read the the full URL because HTTPS provides end-to-end encryption. HTTPS wraps the full HTTP protocol, including the request line, request/response body and all the ...
Arminius's user avatar
  • 44.8k
32 votes

Why don't websites and devices offer fake logins for hackers?

Because hackers don't attack login forms The flaw is that you assume hackers get into accounts by brute-forcing credentials against remote services. But that's futile anyway. Any website with decent ...
Siguza's user avatar
  • 417
32 votes

More than three domains hosted on the same IP address

This is perfectly normal. There is a big shortage of IPv4 addresses. In fact, we should have run out of them a long time ago. But since so much infrastructure is based on IPv4, it keeps getting "...
manassehkatz-Moving 2 Codidact's user avatar
29 votes
Accepted

Why doesn't Tornado have session

I've heard that cookies is less secure than the session. You must have misinterpreted something. In fact HTTP sessions are usually implemented using cookies. I'm thinking that if I could get &...
Steffen Ullrich's user avatar
29 votes

Employer makes me use what I believe to be an insecure website for HR functions. What to do?

To me this says you haven't investigated enough to confidently say it's insecure. You haven't shown any particular direct exploit nor really dug into their system (in a non-hacking, poking around kind ...
Jarrod Christman's user avatar
26 votes

What is the purpose of hiding spam links in some obscure forum posts?

It's all about search engine reputation, as discussed. However, it's not going to work on your site. Because you are a conscientious forum operator, so of course you add the meta tag "rel=...
Harper - Reinstate Monica's user avatar
23 votes

How can I safely check whether an email link leads to a malicious website?

The other answers cover the threats to your computer quite well. However there is a further threat that was not covered. It is possible that URL's are unique to each recipient, allowing the hacker to ...
AstroDan's user avatar
  • 2,238
23 votes
Accepted

Is a plain password in the URL a potential security threat?

This is a serious security problem. URLs should never contain sensitive information. URLs show up in your browsing history. So even after logging out it will be trivial to access your account for ...
Arminius's user avatar
  • 44.8k
20 votes
Accepted

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header?

Did XSS reach its end-of-life with the introduction of the HTTP X-XSS-Protection header? No. X-XSS-Protection is only used to enable or disable the inbuilt filtering[*] - which is generally enabled ...
tim's user avatar
  • 29.6k
19 votes

What is the website checking about my browser to protect the website from a DDoS?

Just to add what I know from experience: Cloudflare blocks non-graphical browsers (tested: links, lynx), not on the first page view, but from the second one. These browsers (presumably) don't load ...
user2394284's user avatar
19 votes

Email received regarding Security flaw in website

This is called fear marketing or fear appeal. It's a marketing method that uses fear as the trigger for action. https://en.wikipedia.org/wiki/Fear_appeal The email contains the 3 basic stages of ...
Reactgular's user avatar
18 votes

What is more safe for browsing the web: PC or smartphone?

It depends on the user's behavior. Windows is extremely susceptible to people who open spam emails, double-click an attached file, and click away that UAC prompt so they can view naughtygirl.jpg.exe....
Peter's user avatar
  • 3,630
17 votes

What does a website see if I am connected on my native IP and then enable my VPN?

Your old http session will end and a new one will start. If you haven't so much as switched to a new browser, the site will be able to very easily figure out that you're the same person, just coming ...
mricon's user avatar
  • 6,538
16 votes

Why don't websites and devices offer fake logins for hackers?

I have never heard of any service or device implementing this either. The case where an attacker is present and forcing you to login is pretty unlikely. They are more likely to just take your $1000 ...
sam's user avatar
  • 283
13 votes

Why don't websites and devices offer fake logins for hackers?

It's not exactly the context you had in mind but there are in fact systems which implemented this idea. I used to work at a (somewhat sensitive) facility where each employee had two codes to disable ...
Relaxed's user avatar
  • 1,738

Only top scored, non community-wiki answers of a minimum length are eligible