Luc
  • Member for 9 years, 7 months
  • Last seen this week
How does SSL/TLS work?
Accepted answer
1k votes

General SSL (and its successor, TLS) is a protocol that operates directly on top of TCP (although there are also implementations for datagram based protocols such as UDP). This way, protocols on ...

View answer
Consequences of the WPA2 KRACK attack
Accepted answer
173 votes

Citing the relevant parts from https://www.krackattacks.com: Who is vulnerable? Both clients and access points are listed in the paper as being vulnerable. See the tables 1 and 2 on pages 5 and 8 ...

View answer
How did I get this email without a "To" field?
Accepted answer
84 votes

Why? Two explanations: BCC Spam I've often gotten spam where they seem to want to hide to whom it was addressed for some reason. Since I have a catch-all on my domain, it will arrive for me no ...

View answer
What should you do if you catch encryption ransomware mid-operation?
79 votes

What I would do: Suspend the process. Don't kill it, just pause it. Look in the process tree if there are any parents that might need suspending as well. Pull the network cable and/or turn off WiFi (...

View answer
Is Diceware more secure than a long passphrase?
Accepted answer
75 votes

Most people that use passphrases, use passphrases wrong. The remark that Diceware is better probably comes from the fact that, when people use passphrases, they usually take a well-known or otherwise ...

View answer
What is the use case for using TLS on an internal network?
73 votes

See the note in the bottom center of this classic slide: This is from a leaked NSA slide deck. Tapping internal traffic is not rocket science, the only real requirement is that someone is targeting ...

View answer
What technical reasons are there to have low maximum password lengths?
73 votes

I asked this question at Bol.com, one of the biggest webshops in the Netherlands. Their response was to prevent being flooded with support emails about forgotten passwords. They then curiously ignored ...

View answer
Why is Math.random() not designed to be cryptographically secure?
72 votes

JavaScript (JS) was invented in 1995. Potentially illegal: cryptography was still under tight export control in 1995, so a good CSPRNG might not even have been legal to distribute in a browser. ...

View answer
Is a public /admin route a security flaw?
Accepted answer
70 votes

It is not a security flaw to use a known admin URL. The things that should be secret are the management credentials, not the URL. It's like hiding a door, while really it's the key that you should ...

View answer
What does the tilde (~) mean at the end of a file extension?
60 votes

It's just part of the filename, just like letters, numbers, and other special characters can be part of the filename. It's conventional to create "backups" of files before editing them by appending a ...

View answer
IMG tag vulnerability
54 votes

There used to be a "vulnerability" where the image could send a HTTP 401 Unauthenticated response, which would trigger a login screen for the user. If you set this as forum avatar, it would spawn a ...

View answer
Is an 80 bit password good enough for all practical purposes?
42 votes

Short answer: The more the better, but for now (2014) this is probably enough. There is an important distinction between hacking into your Gmail and cracking an offline password. If you want to hack ...

View answer
Is "Have I Been Pwned's" Pwned Passwords List really that useful?
31 votes

Yes, someone in the world will have the same front door key as you because (for a common type of lock) there are only 5^6 = 16 000 possible combinations. But for a door key, you need to physically try ...

View answer
Is UPnP still insecure?
25 votes

Why is/was UPnP insecure anyway? UPnP's bad name comes from implementation issues found in 2011-2013. It's like saying email is insecure and should be disabled because someone found a common issue in ...

View answer
Can a network vulnerability be exploited locally?
25 votes

this means that the vulnerability can be exploited remotely, but possibly also locally You are correct. If something is network-exploitable, then under typical circumstances, one can also exploit it ...

View answer
Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?
25 votes

It would be helpful to publish the CVE so that others know it's necessary to update: as you said, they can see it in threat intelligence feeds (or CVE scans) instead of having to read the changelog of ...

View answer
How is 'Removing RAM' a security risk?
25 votes

If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is ...

View answer
How can i find what hashing algorithm was used?
Accepted answer
25 votes

The algorithm here is: function makehash(pw, mult) { // Password and... multiplier? pass = pw.toUpperCase(); // Case insensitivity var hash = 0; for (i = 0; i < Math.min(pass.length, 8)...

View answer
Can I block based on MAC address?
24 votes

In short, the answer is no, you usually can't block based on MAC address. And if you could, it would be useless. To understand why, you must know a thing or two about how the internet works. ...

View answer
ssh-keygen: What is the passphrase for?
Accepted answer
23 votes

$ man ssh-keygen [...] It is possible to specify a passphrase when generating the key; that passphrase will be used to encrypt the private part of this file using 128-bit AES. So this passphrase just ...

View answer
How long will it take to crack the passwords stolen in the Yahoo hack announced 14 Dec 2016?
21 votes

(Summary is in the last paragraph.) How long will it take to crack 1 password? Is the time to crack 1 billion, just 1e9 * t? Imagine I have this hashing algorithm: function hash(password): ...

View answer
Why users want to disable cookies?
21 votes

With tracking cookies, advertisers can track users across different websites and even across IP addresses (e.g. for laptop users). This has been going on since forever (literally since the beginning ...

View answer
Why aren't application downloads routinely done over HTTPS?
17 votes

(Update: please note that this answer is now almost a decade old and does not necessarily reflect the 2021 state of things. I find the zeitgeist interesting to read even if I apparently wrote this ...

View answer
What maximum password length to choose when using bcrypt?
17 votes

I am usually the person who argues against silly limits but I have to wonder: who seriously uses passwords of over 72 characters? Such a long password would be very impractical to type so it's almost ...

View answer
Why is this certificate valid for so many domains?
17 votes

It seems that this certificate works for so many domains because it's part of a CDN. CDNs, or Content Delivery Networks, deliver files which are always the same (or 'static'). The site's logo, some ...

View answer
Does Tor help us to prevent ISP tracking?
Accepted answer
16 votes

You cannot hide how much data you are sending and when you are online. But, Tor encrypts data and sends it through proxies before it reaches the target server, so that hides the contents of the ...

View answer
What is this Russian calendar reminder that popped up?
Accepted answer
16 votes

It appears to be this: https://www.androidpolice.com/2019/06/22/google-calendar-phising-scam/ Scammers are exploiting [Google] Calendar['s] default setting, which automatically adds invites to your ...

View answer
Secure FTP access; best practices
15 votes

The problem with standard FTP The standard FTP protocol is unsecured. Anybody on the network (any "man in the middle", as it's called, who can read and/or modify the data on the connection) can see ...

View answer
How could Craig Wright obtain Satoshi Nakamoto's private key?
15 votes

He didn't. What people are saying is that he "used a signature from early in the block chain as evidence" which still sounds like he could prove he made an early block signature, even if it wasn't ...

View answer
Why am I allowed to access protected Windows files when I boot Ubuntu from USB?
15 votes

Because Windows only shows you what they think you should see, and other operating systems don't necessarily care and just show you what's on the disk. That is the gist of it. It's not a Microsoft ...

View answer
1
2 3 4 5
8