Skip to main content
atk's user avatar
atk's user avatar
atk's user avatar
atk
  • Member for 11 years, 11 months
  • Last seen this week
25 votes

Why do some websites require logging in twice? Not two steps, but two full username/password entries

20 votes

Are there any holes in this security design?

17 votes

Two-factor authentication Without Mobile Phone

12 votes
Accepted

Is there an attack that can modify ciphertext while still allowing it to be decrypted?

12 votes
Accepted

What is same site scripting and what are some exploit scenarios?

9 votes

Isn't "Dave's protocol" good if only the database, and not the code, is leaked?

8 votes

Why would you need a salt for AES-CBS when IV is already randomly generated and stored with the encrypted data?

7 votes

Should every post request include csrf token?

7 votes
Accepted

Is it possible to change IP after each request

6 votes

How to send GET/POST requests without header and agent information

6 votes
Accepted

What is the excellence of RSA vs my algorithm

5 votes
Accepted

Can a sql query with both user input and parameter be prone to sql injection?

5 votes
Accepted

Can Your ISP use a Packet Sniffer?

4 votes

Do password complexity requirements reduce security by limiting search space?

4 votes
Accepted

How do arbitrary payloads execute on the remote machine?

3 votes

Using "Dynamic Hash Technique" to protect cookies from XSS?

3 votes

Additional security benefits from Multi-Factor Authentication?

3 votes

Don't one-time recovery codes for 2FA introduce a backdoor?

3 votes
Accepted

Do we still refer to a threat as a threat once it has been realised?

3 votes
Accepted

If perl/python is not guaranteed to be installed on a target system why are those scripts useful to hackers?

3 votes

Is there a best practice to handle vulnerability scanning attempts?

2 votes

Is there a solution for runing processes in encrypted mode on runtime?

2 votes

Is digested password safer than salted password?

2 votes

Is it OK (from a security perspective) to add only the the server cert to client trusted store with out adding the root Certificate in SSL?

2 votes
Accepted

How do you log into Amazon Web Services if you lose your phone which has Google 2-factor authentication set up?

2 votes

Why should XSS filters escape forward slash?

2 votes

Have I crossed my t's and dotted my lower-case j's? (or, implementing AES, please help get some eyes on my code)

2 votes
Accepted

How do I find out if I'm connecting to a spoofed server after getting "The authenticity of host [hostname] can't be estabilished"?

2 votes
Accepted

How can I succesfully pentest site with two factor authentication?

2 votes

Why not hashing and salting passwords?