user avatar
user avatar
user avatar
eckes
  • Member for 9 years, 8 months
  • Last seen more than a month ago
107 votes
8 answers
94k views

Why refresh CSRF token per form request?

101 votes
3 answers
19k views

Why is Sojdlg123aljg a common password?

  • 743
57 votes
6 answers
8k views

Should we release the security issues we found in our product as CVE or we can just update those on weekly release notes?

  • 1,204
38 votes
3 answers
22k views

What specific padding weakness does OAEP address in RSA?

  • 2,143
28 votes
1 answer
6k views

Is Dom based XSS still a valid security concern in modern browsers?

25 votes
6 answers
15k views

Is HTTPS required for local network server to server communication

23 votes
4 answers
11k views

Protection against account lockout DoS

  • 1,366
19 votes
1 answer
8k views

What's the hash for in ECDHE-RSA-AES-GCM-SHA?

15 votes
2 answers
12k views

Why do I need to add intermediate CA certificates to JVM's cacerts file?

  • 724
12 votes
4 answers
11k views

Location to store an encryption key

  • 277
11 votes
2 answers
1k views

If a CORS request doesn't need authentication, why can't I send it without the cookies?

  • 211
9 votes
1 answer
2k views

New TLS encryption-busting attack also impacts the newer TLS 1.3, is ECDHE_RSA also affected?

  • 417
7 votes
4 answers
10k views

Preferred UAC configuration in Enterprises that use Login scripts to map drives?

6 votes
3 answers
16k views

How Facebook hashes passwords

  • 247
6 votes
2 answers
3k views

What does the PCI-DSS statement "Store separately from the data encrypting key" mean?

6 votes
3 answers
10k views

Why is OAuth2/OpenID Connect considered less secure than SAML/WS-*?

6 votes
2 answers
4k views

OWASP Secure Headers for Web Services

4 votes
1 answer
641 views

What are vendor affirmed algorithms in FIPS 140-2

4 votes
1 answer
1k views

Unrestricted File Upload on JBoss

  • 141
2 votes
1 answer
6k views

How to test ldap that authenticates with kerberos

2 votes
1 answer
681 views

Putting secrets into enclave

2 votes
2 answers
896 views

Why only script-src unsafe-inline is reported as a high severity finding?

  • 487
2 votes
0 answers
179 views

Extracted LM Hashes doesnt match actual password

1 vote
2 answers
175 views

Why would a phishing blacklist be hashed?

1 vote
3 answers
2k views

Password Cracking Mandarin Words English Character Set

1 vote
0 answers
207 views

ROCA attack on TPM - public key extraction