User eckes

9 votes

Password Hashing: add salt + pepper or is salt enough?

answered May 6, 2017 at 18:08

4 votes

How to recognize if this code is dangerous

answered Dec 27, 2019 at 13:42

3 votes

Would using RSA SecurID Token across security domains introduce any weakness?

answered Apr 23, 2020 at 11:24

3 votes

Why is a link in an email more dangerous than a link from a web search?

answered Nov 24, 2020 at 11:50

3 votes

Accepted

What's the purpose of anonymous Diffie-Hellman key exchange + verification?

answered Sep 28, 2017 at 22:15

3 votes

Accepted

Why don't web interfaces on consumer routers trigger untrusted certificate warnings?

answered Nov 9, 2017 at 3:45

3 votes

Is a "trusted device" a factor on its own?

answered Mar 24, 2022 at 7:50

3 votes

Issues with html code

answered May 7, 2017 at 10:28

3 votes

Does NIST really recommend PBKDF2 for password hashing?

answered Mar 19, 2017 at 10:37

3 votes

Is BCRYPT easy do decrypt?

answered May 14, 2017 at 14:52

3 votes

TPM- Symmetric key storage

answered Jan 4, 2014 at 5:23

3 votes

What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?

answered Jan 4, 2014 at 6:23

3 votes

Benefit to disabling TLS1.1 and TLS1.2?

answered Apr 7, 2015 at 22:22

2 votes

How widely deployed is TLS with cipher ECDHE?

answered Nov 4, 2014 at 22:58

2 votes

How exactly are registration authorities related to certificate authorities?

answered Apr 26, 2017 at 3:32

2 votes

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

answered Apr 27, 2017 at 19:25

2 votes

TextSecure protocol

answered Jan 4, 2014 at 8:15

2 votes

Preventing user supplied javascript from posting to external server

answered Dec 21, 2012 at 4:52

2 votes

Why does generating a self-signed X509 certificate not require my public key?

answered Jun 8, 2017 at 22:07

2 votes

Adding custom embedded Precertificate SCTs into the certificate?

answered Jul 5, 2017 at 22:30

2 votes

Why does SSH use random padding?

answered May 6, 2017 at 0:52

2 votes

How Facebook hashes passwords

answered Mar 16, 2018 at 21:47

2 votes

Is it ok to allow a web application to write its own executable files?

answered Jun 19, 2019 at 6:42

1 vote

Is it allowed to store 8-digit BINs outside of CDE

answered Jan 30, 2020 at 21:40

1 vote

Password reset giving clues of possible valid email addresses

answered Mar 21, 2020 at 4:42

1 vote

Accepted

How is resynchronization performed for security keys / MFA devices?

answered Nov 14, 2017 at 9:44

1 vote

Why do (many) TOTP devices or TFA apps use none or simple access password?

answered Jul 25, 2018 at 8:23

1 vote

OAuth2 - Obtaining Refresh Tokens

answered Mar 16, 2019 at 3:19

1 vote

CVSS Score for self-XSS (stored XSS)

answered Aug 21, 2019 at 10:25

1 vote

How should I audit and monitor shared TCP ports in Windows?

answered Dec 21, 2012 at 4:45

Stack Exchange Network

55 Answers

Password Hashing: add salt + pepper or is salt enough?

How to recognize if this code is dangerous

Would using RSA SecurID Token across security domains introduce any weakness?

Why is a link in an email more dangerous than a link from a web search?

What's the purpose of anonymous Diffie-Hellman key exchange + verification?

Why don't web interfaces on consumer routers trigger untrusted certificate warnings?

Is a "trusted device" a factor on its own?

Issues with html code

Does NIST really recommend PBKDF2 for password hashing?

Is BCRYPT easy do decrypt?

TPM- Symmetric key storage

What are the security concerns with turning off Extended protection for authentication in IIS7 on ADFS?

Benefit to disabling TLS1.1 and TLS1.2?

How widely deployed is TLS with cipher ECDHE?

How exactly are registration authorities related to certificate authorities?

What are the security implications of net.ipv4.conf.eth0.route_localnet=1 / route_localnet?

TextSecure protocol

Preventing user supplied javascript from posting to external server

Why does generating a self-signed X509 certificate not require my public key?

Adding custom embedded Precertificate SCTs into the certificate?

Why does SSH use random padding?

How Facebook hashes passwords

Is it ok to allow a web application to write its own executable files?

Is it allowed to store 8-digit BINs outside of CDE

Password reset giving clues of possible valid email addresses

How is resynchronization performed for security keys / MFA devices?

Why do (many) TOTP devices or TFA apps use none or simple access password?

OAuth2 - Obtaining Refresh Tokens

CVSS Score for self-XSS (stored XSS)

How should I audit and monitor shared TCP ports in Windows?