User MechMK1

8

77

votes

5

answers

13k

views

Does code obfuscation give any measurable security benefit?

obfuscation

Oct 12 at 14:00 Community♦ 1

20

59

votes

4

answers

5k

views

What is a threat model, and how do I make one?

threat-modeling

Apr 4 at 15:54 Adam Shostack 2,499

9

47

votes

5

answers

7k

views

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

vulnerability bash

Jun 8 '19 at 8:07 Peter Cordes 841

14

44

votes

4

answers

13k

views

Is Diceware more secure than a long passphrase?

passwords entropy

Dec 22 at 19:39 curiousguy 4,768

6

27

votes

3

answers

7k

views

How bad would a partial hash leak be, realistically?

hash password-cracking

Jun 3 '19 at 13:55 jpmc26 833

6

22

votes

2

answers

6k

views

What is the risk of having a 2FA key permanently plugged into my device?

multi-factor

Jun 14 at 12:02 user236612 1

1

16

votes

2

answers

1k

views

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

android disk-encryption file-encryption

Sep 13 at 8:35 Xavier59 2,754

2

14

votes

3

answers

2k

views

Can the Host Header be used to hide the existence of a service?

web-service

Apr 24 at 12:19 James_pic 2,240

1

12

votes

5

answers

524

views

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

linux privilege-escalation sudo

Dec 1 at 18:57 Ángel 14.7k

2

9

votes

1

answer

413

views

Are there any reasons for Kerberos being based on symmetric cryptography?

kerberos

Mar 15 at 17:29 MechMK1 23.8k

1

8

votes

2

answers

422

views

Why does Chrome not allow the modification of these headers by extensions?

chrome header

Jul 17 at 23:34 iraleigh 190

2

7

votes

2

answers

766

views

What are the dangers of not setting the HSTS header on every response?

hsts

Apr 13 at 14:02 auspicious99 407

2

5

votes

1

answer

287

views

Why does Chrome claim that this stylesheet violates the Content Security Policy?

content-security-policy

Dec 9 at 15:05 Steffen Ullrich 149k

5

votes

1

answer

164

views

Can a non-privileged user modify the file descriptor table of an elevated process?

linux file-access kernel

Dec 2 at 10:23 J.J 1,552

4

5

votes

2

answers

266

views

How can I protect the confidentiality, integrity and authenticity of my communication if I am victim of a Man-in-the-Middle attack?

man-in-the-middle

Aug 14 '19 at 11:49 multithr3at3d 9,606

5

votes

1

answer

463

views

What are the minimum parameters for Argon2?

hash argon2

Jun 1 '19 at 3:29 Community♦ 1

4

votes

2

answers

9k

views

How would one scan a large, untrusted file?

malware antivirus

Jul 6 '19 at 15:22 user211743 1

3

votes

2

answers

2k

views

Why do DESFire and Mifare Plus cards offer a random UID feature?

rfid mifare

May 26 '18 at 17:22 schroeder♦ 104k

2

votes

1

answer

110

views

Why does Wireshark not recognize WCF traffic as TLS encrypted?

tls .net wcf

Jun 12 at 15:06 Community♦ 1

2

votes

2

answers

196

views

Does the use of a Hardware Security Module improve the security of a password storage?

password-cracking hsm

Jul 9 '19 at 22:27 LvB 6,758

2

votes

1

answer

185

views

How to rate CVSS3's “Privileges Required” when an attacker can create an account?

cvss

May 28 '19 at 8:52 alnbhclyn 294

1

2

votes

1

answer

531

views

Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?

content-security-policy

May 18 '19 at 6:47 Artur Janc 56

2

votes

1

answer

600

views

How common is steganography in real world applications?

steganography

May 16 '19 at 11:54 Overmind 8,229

1

vote

0

answers

70

views

Has SQRL been extensively audited? [duplicate]

sqrl

Aug 22 '19 at 11:30 MechMK1 23.8k

1

vote

1

answer

301

views

How can a Trusted Platform Module “enhance network security”?

tpm

Jun 20 '18 at 18:26 vrtjason 840

0

votes

0

answers

44

views

Are there any standards or guidelines tamper-evident devices can adhere to?

standards tampering

Feb 4 at 13:18 MechMK1 23.8k

0

votes

1

answer

62

views

How much entropy is required for a Grid Card?

multi-factor entropy

May 24 '18 at 9:59 Steffen Ullrich 149k

Stack Exchange Network

current community

your communities

more stack exchange communities

Next badge

27 Questions

Does code obfuscation give any measurable security benefit?

What is a threat model, and how do I make one?

Is using 'echo' to display attacker-controlled data on the terminal dangerous?

Is Diceware more secure than a long passphrase?

How bad would a partial hash leak be, realistically?

What is the risk of having a 2FA key permanently plugged into my device?

Does File-Based Encryption offer comparable security to Full-Disk Encryption on Android?

Can the Host Header be used to hide the existence of a service?

How can one tell if a binary is safe to give sudo permissions for to an untrusted user?

Are there any reasons for Kerberos being based on symmetric cryptography?

Why does Chrome not allow the modification of these headers by extensions?

What are the dangers of not setting the HSTS header on every response?

Why does Chrome claim that this stylesheet violates the Content Security Policy?

Can a non-privileged user modify the file descriptor table of an elevated process?

How can I protect the confidentiality, integrity and authenticity of my communication if I am victim of a Man-in-the-Middle attack?

What are the minimum parameters for Argon2?

How would one scan a large, untrusted file?

Why do DESFire and Mifare Plus cards offer a random UID feature?

Why does Wireshark not recognize WCF traffic as TLS encrypted?

Does the use of a Hardware Security Module improve the security of a password storage?

How to rate CVSS3's “Privileges Required” when an attacker can create an account?

Does it pose a problem to use 'strict-dynamic' with a hash and not a nonce?

How common is steganography in real world applications?

Has SQRL been extensively audited? [duplicate]

How can a Trusted Platform Module “enhance network security”?

Are there any standards or guidelines tamper-evident devices can adhere to?

How much entropy is required for a Grid Card?