User ste-fu

26 votes

Why is Mother’s Maiden Name still used as a security question?

answered May 16, 2018 at 14:30

6 votes

What actions should I, as an end user, take in response to EFAIL?

answered May 14, 2018 at 14:34

5 votes

Is auth with a number of memorable questions better than regular password auth?

answered Oct 11, 2017 at 20:13

3 votes

How can I prevent requests from the browser console while still using ajax?

answered Oct 20, 2017 at 21:07

3 votes

Accepted

What threat model implies any benefit to drug dealers using candy bar dumb phones for business with iPhones for personal use?

answered Nov 2, 2017 at 18:38

3 votes

Accepted

Multiple CSRs from the same private key

answered Jun 22, 2018 at 8:43

3 votes

Is a second, "old" (dumb) phone dedicated just to receiving bank tokens as safe as "modern" (smart) phone?

answered Nov 22, 2018 at 9:34

2 votes

Accepted

Limiting database lookups by token metadata

answered Nov 26, 2017 at 21:07

2 votes

Security for KeePass Emergencey Sheet

answered Oct 13, 2017 at 19:38

2 votes

How can Draytek products not be affected by KRACK as they claim?

answered Oct 17, 2017 at 13:33

2 votes

What is pervasive encryption?

answered Nov 8, 2017 at 9:42

2 votes

Are smartphone apps theoretically capable of detecting what a user is looking at?

answered Nov 16, 2017 at 19:00

2 votes

Accepted

Can I store government ID numbers according to the PCI DSS?

answered Jan 21, 2017 at 22:36

2 votes

Would user workstations be considered part of the PCI-DSS CDE when collecting cardholder data using a secure portal

answered Dec 13, 2016 at 0:37

2 votes

PCI DSS compliance on shopify using the client's payment processor

answered Jun 17, 2017 at 19:53

2 votes

Should an access token reflect the current user roles?

answered Oct 9, 2017 at 17:31

1 vote

What does the message mean and is it not safe to pay online at this website?

answered Jun 16, 2017 at 15:40

1 vote

Secure email hosting service for a law firm

answered Jun 27, 2017 at 21:01

1 vote

Accepted

How effective is a basic password modification algorithm compared to password reuse

answered Jul 10, 2017 at 14:45

1 vote

Are Salt strings stored by application?

answered Jul 22, 2017 at 11:37

1 vote

Accepted

Can APK's installed from unknown sources without special permission be considered safe?

answered Apr 21, 2017 at 20:02

1 vote

Good method to store user content encrypted without storing the user's key in plaintext?

answered Feb 9, 2017 at 0:49

1 vote

Accepted

Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

answered Nov 19, 2017 at 9:59

1 vote

How to know if an ASP web page is vulnerable to SQL injection?

answered Nov 20, 2017 at 23:18

1 vote

Accepted

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

answered Nov 30, 2017 at 19:26

1 vote

How to handle credit card information on my server

answered Dec 2, 2017 at 20:17

1 vote

Secure flag for ASPXAUTH Cookie in MVC

answered Oct 13, 2017 at 11:57

1 vote

Accepted

Is CBC mode for AES still safe to use in 2018?

answered Jun 22, 2018 at 15:33

1 vote

If a password repeats a sequence of characters, does it become easier to crack?

answered Jun 30, 2018 at 14:34

0 votes

Is using WebAuthn alone considered as two factor authentication?

answered Dec 12, 2018 at 9:59

Stack Exchange Network

40 Answers

Why is Mother’s Maiden Name still used as a security question?

What actions should I, as an end user, take in response to EFAIL?

Is auth with a number of memorable questions better than regular password auth?

How can I prevent requests from the browser console while still using ajax?

What threat model implies any benefit to drug dealers using candy bar dumb phones for business with iPhones for personal use?

Multiple CSRs from the same private key

Is a second, "old" (dumb) phone dedicated just to receiving bank tokens as safe as "modern" (smart) phone?

Limiting database lookups by token metadata

Security for KeePass Emergencey Sheet

How can Draytek products not be affected by KRACK as they claim?

What is pervasive encryption?

Are smartphone apps theoretically capable of detecting what a user is looking at?

Can I store government ID numbers according to the PCI DSS?

Would user workstations be considered part of the PCI-DSS CDE when collecting cardholder data using a secure portal

PCI DSS compliance on shopify using the client's payment processor

Should an access token reflect the current user roles?

What does the message mean and is it not safe to pay online at this website?

Secure email hosting service for a law firm

How effective is a basic password modification algorithm compared to password reuse

Are Salt strings stored by application?

Can APK's installed from unknown sources without special permission be considered safe?

Good method to store user content encrypted without storing the user's key in plaintext?

Is the following scheme for Google OAuth2 authentication and authorization satisfactory and secure?

How to know if an ASP web page is vulnerable to SQL injection?

localStorage vs. HTTP-Only Cookies + XSRF: Is either better when it comes to XSS?

How to handle credit card information on my server

Secure flag for ASPXAUTH Cookie in MVC

Is CBC mode for AES still safe to use in 2018?

If a password repeats a sequence of characters, does it become easier to crack?

Is using WebAuthn alone considered as two factor authentication?