User MechMK1

8

78

votes

5

answers

13k

views

Does code obfuscation give any measurable security benefit?

obfuscation

Oct 12 '19 at 14:00 Community♦ 1

21

61

votes

4

answers

6k

views

What is a threat model, and how do I make one?

threat-modeling

Apr 4 at 15:54 Adam Shostack 2,519

9

49

votes

5

answers

7k

views

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

vulnerability bash

Jun 8 '19 at 8:07 Peter Cordes 840

14

45

votes

4

answers

14k

views

Is Diceware more secure than a long passphrase?

passwords entropy

Dec 22 '19 at 19:39 curiousguy 4,858

6

27

votes

3

answers

7k

views

How bad would a partial hash leak be, realistically?

hash password-cracking

Jun 3 '19 at 13:55 jpmc26 833

6

23

votes

2

answers

6k

views

What is the risk of having a 2FA key permanently plugged into my device?

multi-factor

Jun 14 at 12:02 user236612 1

2

19

votes

2

answers

2k

views

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

android disk-encryption file-encryption

Sep 13 '19 at 8:35 Xavier59 2,834

2

14

votes

3

answers

2k

views

Can the Host Header be used to hide the existence of a service?

web-service

Apr 24 at 12:19 James_pic 2,350

1

12

votes

5

answers

573

views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

linux privilege-escalation sudo

Dec 1 '19 at 18:57 Ángel 16.4k

10

votes

1

answer

3k

views

How is it possible that a <script> tag was injected, but not executed?

web-application xss

Nov 3 at 14:28 Anders 61.5k

2

10

votes

1

answer

637

views

Are there any reasons for Kerberos being based on symmetric cryptography?

kerberos

Mar 15 at 17:29 MechMK1 27.3k

1

9

votes

3

answers

550

views

Why does Chrome not allow the modification of these headers by extensions?

chrome header

Aug 17 at 1:09 K4M 512

5

7

votes

1

answer

754

views

What are the minimum parameters for Argon2?

hash argon2

Jan 9 at 22:42 forest 53.2k

2

7

votes

2

answers

831

views

What are the dangers of not setting the HSTS header on every response?

hsts

Apr 13 at 14:02 auspicious99 439

2

5

votes

1

answer

290

views

Why does Chrome claim that this stylesheet violates the Content Security Policy?

content-security-policy

Dec 9 '19 at 15:05 Steffen Ullrich 159k

5

votes

1

answer

179

views

Can a non-privileged user modify the file descriptor table of an elevated process?

linux file-access kernel

Dec 2 '19 at 10:23 J.J 1,607

4

5

votes

2

answers

291

views

How can I protect the confidentiality, integrity and authenticity of my communication if I am victim of a Man-in-the-Middle attack?

man-in-the-middle

Aug 14 '19 at 11:49 multithr3at3d 11k

4

votes

1

answer

2k

views

Why do DESFire and Mifare Plus cards offer a random UID feature?

rfid mifare

Sep 1 at 7:41 StackzOfZtuff 16.9k

4

votes

2

answers

12k

views

How would one scan a large, untrusted file?

malware antivirus

Jul 6 '19 at 15:22 user211743 1

3

votes

0

answers

73

views

Is this nginx config suitable to enforce proper authorization?

certificates nginx

Dec 30 at 14:11 MechMK1 27.3k

2

votes

1

answer

246

views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

tls .net wcf

Oct 10 at 16:00 Community♦ 1

2

votes

2

answers

269

views

Does the use of a Hardware Security Module improve the security of a password storage?

password-cracking hsm

Jul 9 '19 at 22:27 LvB 7,911

2

votes

1

answer

254

views

How to rate CVSS3's “Privileges Required” when an attacker can create an account?

cvss

May 28 '19 at 8:52 alnbhclyn 294

1

2

votes

1

answer

696

views

Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?

content-security-policy

May 18 '19 at 6:47 Artur Janc 56

2

votes

1

answer

800

views

How common is steganography in real world applications?

steganography

May 16 '19 at 11:54 Overmind 8,374

1

vote

0

answers

74

views

Has SQRL been extensively audited? [duplicate]

sqrl

Aug 22 '19 at 11:30 MechMK1 27.3k

1

vote

1

answer

326

views

How can a Trusted Platform Module “enhance network security”?

tpm

Jun 20 '18 at 18:26 vrtjason 890

0

votes

0

answers

41

views

Are libhydrogen's Gimli permutations production ready? [migrated]

cryptography

Jan 15 at 15:42 MechMK1 27.3k

0

votes

0

answers

47

views

Are there any standards or guidelines tamper-evident devices can adhere to?

standards tampering

Feb 4 '20 at 13:18 MechMK1 27.3k

0

votes

1

answer

62

views

How much entropy is required for a Grid Card?

multi-factor entropy

May 24 '18 at 9:59 Steffen Ullrich 159k

Stack Exchange Network

current community

your communities

more stack exchange communities

Next badge

30 Questions

Does code obfuscation give any measurable security benefit?

What is a threat model, and how do I make one?

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Is Diceware more secure than a long passphrase?

How bad would a partial hash leak be, realistically?

What is the risk of having a 2FA key permanently plugged into my device?

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Can the Host Header be used to hide the existence of a service?

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

How is it possible that a <script> tag was injected, but not executed?

Are there any reasons for Kerberos being based on symmetric cryptography?

Why does Chrome not allow the modification of these headers by extensions?

What are the minimum parameters for Argon2?

What are the dangers of not setting the HSTS header on every response?

Why does Chrome claim that this stylesheet violates the Content Security Policy?

Can a non-privileged user modify the file descriptor table of an elevated process?

How can I protect the confidentiality, integrity and authenticity of my communication if I am victim of a Man-in-the-Middle attack?

Why do DESFire and Mifare Plus cards offer a random UID feature?

How would one scan a large, untrusted file?

Is this nginx config suitable to enforce proper authorization?

Why does Wireshark not recognize WCF traffic as TLS encrypted?

Does the use of a Hardware Security Module improve the security of a password storage?

How to rate CVSS3's “Privileges Required” when an attacker can create an account?

Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?

How common is steganography in real world applications?

Has SQRL been extensively audited? [duplicate]

How can a Trusted Platform Module “enhance network security”?

Are libhydrogen's Gimli permutations production ready? [migrated]

Are there any standards or guidelines tamper-evident devices can adhere to?

How much entropy is required for a Grid Card?