User Xander

226 votes

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

answered Feb 18, 2016 at 18:14

117 votes

Accepted

Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?

answered Jul 19, 2017 at 16:09

90 votes

This company is telling me that I need a firewall. Do I?

answered Aug 22, 2016 at 19:07

89 votes

Is there a field length that is too short to allow harmful SQL injection?

answered Feb 28, 2017 at 17:18

87 votes

Accepted

Do bad passwords produce bad salted hashes?

answered Oct 27, 2014 at 21:23

67 votes

Accepted

Windows language pack update with a gibberish name

answered Sep 30, 2015 at 19:01

65 votes

Accepted

How should high net worth individuals secure their financial accounts?

answered Jul 27, 2016 at 16:58

57 votes

What is different about being targeted by a professional attacker?

answered Oct 5, 2014 at 3:31

52 votes

Are passwords that are manually typed in really unrecoverable from memory or disk?

answered Jan 22, 2015 at 15:28

50 votes

Accepted

Can an HTTPS site be malicious or unsafe?

answered Aug 29, 2014 at 0:34

47 votes

Accepted

Are GUIDs safe for one-time tokens?

answered Nov 30, 2010 at 15:49

47 votes

Is XSS a server-side or client-side vulnerability?

answered Nov 26, 2014 at 14:46

47 votes

Attacker circumventing 2FA. How to defend?

answered Jun 7, 2017 at 15:17

45 votes

Is showing your IP address in the URL a bad practice?

answered May 9, 2013 at 14:41

43 votes

Accepted

Methods for slowing down a hashing algorithm

answered Aug 8, 2014 at 15:29

43 votes

Do I have to hash users' IP addresses when I log them?

answered Dec 2, 2014 at 14:27

43 votes

How useful are CVE entries?

answered Feb 9, 2017 at 18:19

42 votes

Accepted

Is it dangerous to publicly share ciphertext?

answered Mar 13, 2015 at 0:14

42 votes

Is email less secure than voicemail, snail mail, or internet portals for transferring sensitive information?

answered Sep 18, 2014 at 16:40

40 votes

Why don't popular web services mask the CVV?

answered Mar 30, 2015 at 19:02

40 votes

Accepted

When encrypting cloud-stored data, is it acceptable to use the user's account password?

answered Mar 25, 2016 at 18:20

39 votes

Accepted

Does holding an AES-encrypted string and its cleartext from a database help an attacker in decrypting other parts of the database

answered Jan 8, 2016 at 21:31

39 votes

Accepted

What are the disadvantages of implementing HTTP authentication in a web application?

answered Sep 15, 2014 at 13:40

35 votes

Accepted

Do Chrome and Firefox send random values rather than the actual timestamp in ClientHello of TLS?

answered Apr 2, 2015 at 0:36

33 votes

How is hashing safe if a given string always generates the same hash?

answered Jan 20, 2015 at 22:38

33 votes

Effect on PCI compliance of not checking SSL certificate?

answered Oct 1, 2014 at 18:46

33 votes

Accepted

How does a clean desk policy provide security benefits?

answered Mar 6, 2013 at 14:03

33 votes

Accepted

Ransomware encryption keys

answered May 15, 2017 at 17:49

32 votes

Accepted

Is it possible to inject values in a drop down list?

answered Sep 11, 2013 at 16:37

31 votes

Hashing a credit card number for use as a fingerprint

answered Jul 16, 2014 at 19:06

Stack Exchange Network

400 Answers

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

Why would I choose SHA-256 over SHA-512 for a SSL/TLS certificate?

This company is telling me that I need a firewall. Do I?

Is there a field length that is too short to allow harmful SQL injection?

Do bad passwords produce bad salted hashes?

Windows language pack update with a gibberish name

How should high net worth individuals secure their financial accounts?

What is different about being targeted by a professional attacker?

Are passwords that are manually typed in really unrecoverable from memory or disk?

Can an HTTPS site be malicious or unsafe?

Are GUIDs safe for one-time tokens?

Is XSS a server-side or client-side vulnerability?

Attacker circumventing 2FA. How to defend?

Is showing your IP address in the URL a bad practice?

Methods for slowing down a hashing algorithm

Do I have to hash users' IP addresses when I log them?

How useful are CVE entries?

Is it dangerous to publicly share ciphertext?

Is email less secure than voicemail, snail mail, or internet portals for transferring sensitive information?

Why don't popular web services mask the CVV?

When encrypting cloud-stored data, is it acceptable to use the user's account password?

Does holding an AES-encrypted string and its cleartext from a database help an attacker in decrypting other parts of the database

What are the disadvantages of implementing HTTP authentication in a web application?

Do Chrome and Firefox send random values rather than the actual timestamp in ClientHello of TLS?

How is hashing safe if a given string always generates the same hash?

Effect on PCI compliance of not checking SSL certificate?

How does a clean desk policy provide security benefits?

Ransomware encryption keys

Is it possible to inject values in a drop down list?

Hashing a credit card number for use as a fingerprint