Skip to main content
gaazkam's user avatar
gaazkam's user avatar
gaazkam's user avatar
gaazkam
  • Member for 8 years, 1 month
  • Last seen this week
178 votes
12 answers
26k views

Why is it wrong to *implement* myself a known, published, widely believed to be secure crypto algorithm?

102 votes
19 answers
16k views

How to explain to traditional people why they should upgrade their old Windows XP device?

65 votes
4 answers
13k views

Are most Linux systems that allow non-root users to execute code straightforwardly rootable?

60 votes
9 answers
12k views

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

60 votes
9 answers
13k views

How hard should I try to prevent a user from XSSing themselves?

56 votes
5 answers
14k views

Is open-sourcing the code of a webapp not recommended?

38 votes
3 answers
13k views

Why should memcmp not be used to compare security critical data?

18 votes
5 answers
5k views

How do Yubikeys improve security if I am typically also forced to enable other, weaker 2FA methods?

15 votes
1 answer
4k views

How is it possible to poison JavaScript Array constructor and how does ECMAScript 5 prevent that?

13 votes
3 answers
3k views

How can malware immediately infect a Windows XP computer as soon as it goes online without any user action?

11 votes
3 answers
15k views

Full disk encryption vs home folder encryption - why should the former be chosen over the latter

9 votes
2 answers
588 views

What is the purpose of forcing people to provide "security questions" and answers to them?

9 votes
1 answer
1k views

How can utilities with setuid set to root be secure if they are debuggable?

8 votes
4 answers
15k views

Why do browsers disallow accessing files from local file system even if the HTML document is also on the local file system?

7 votes
4 answers
584 views

Realistically, how likely it is to have a computer compromised from browsing random websites?

6 votes
1 answer
286 views

Why does OWASP recommend to never return JSON arrays not wrapped in objects?

5 votes
4 answers
922 views

What is the use of disabling detailed exception pages on open-sourced apps?

5 votes
1 answer
766 views

Why can CSRF attack be prevented by issuing CSRF tokens?

5 votes
1 answer
291 views

If and why should any personal information be destroyed before putting scrap paper into the recycle container?

4 votes
1 answer
547 views

What is the point of blocking a potentially malicious domain by binding it in the hosts file to 0.0.0.0 rather than 127.0.0.1?

4 votes
3 answers
364 views

Why is it recommended to use accounts without sysop rights for everyday work?

4 votes
3 answers
270 views

Why are CSRF vulnerabilities considered to be a problem with the web app, rather than with the browser?

4 votes
3 answers
445 views

Given Diceware, why does the requirement to contain uppercase, numerics & punctuation in passwords still stand?

3 votes
2 answers
361 views

How strong is a password consisting of words arbitrarily chosen from the dictionary?

3 votes
1 answer
600 views

How secure is connecting to the Internet via Windows XP (or even older) nowadays only for e-mail?

3 votes
3 answers
417 views

Why is a fully-patched OS less important than AV?

3 votes
1 answer
434 views

What is the risk of compromise of an old, Internet-capable phone not used for browsing? (not smartphone)

3 votes
1 answer
450 views

Why are passphrases protecting GPG / SSH private keys needed? [duplicate]

3 votes
1 answer
344 views

Do security consultants routinely demonstrate hacking into attendees' PCs within minutes?

3 votes
1 answer
453 views

How can I make sure if my computer is infected and know if I have to nuke it from orbit?