User Marc

74 votes

Accepted

Is there any security risk in not setting a maximum password length?

answered Sep 6, 2020 at 19:49

46 votes

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

answered Jun 2, 2020 at 14:08

31 votes

Accepted

Do browsers know domains that are supposed to be encrypted?

answered Jul 31, 2020 at 12:00

29 votes

Accepted

How does a 'rainbow table' hacker obtain password hashes in the first place?

answered Jun 22, 2020 at 8:55

21 votes

What's more vulnerable; the data or the DBMS?

answered Sep 12, 2020 at 15:20

14 votes

Why would a password be hashed before being used to encrypt something?

answered Feb 15, 2018 at 10:33

14 votes

Accepted

Where to store private and public keys?

answered May 4, 2020 at 4:58

12 votes

Accepted

In-memory pepper

answered Aug 4, 2020 at 15:14

10 votes

Accepted

Where are FIDO U2F Keys Stored?

answered Aug 19, 2020 at 5:14

8 votes

Accepted

Why is salt+nonce authentication over insecure channel vulnerable to man-in-the-middle attack?

answered Dec 16, 2017 at 21:20

7 votes

Accepted

Securing internal micro-services - Letsencrypt vs. Self-signed certificates - Best practices

answered Dec 16, 2017 at 22:47

6 votes

Accepted

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

answered Jun 5, 2020 at 7:06

6 votes

Accepted

Does the CA create the public key or is it created by the requesting server and sent to the CA?

answered Jul 7, 2020 at 12:44

6 votes

Accepted

how to anonymously contribute to Github

answered Aug 17, 2020 at 14:31

6 votes

If certificate authority generates key pair for us, do they maintain/have access to our private key?

answered Sep 11, 2020 at 17:44

5 votes

Accepted

How is public key included in the CSR?

answered Aug 21, 2020 at 14:35

5 votes

Does the terms stream and block ciphers apply to both symmetric and asymmetric ciphers?

answered Dec 14, 2017 at 19:21

5 votes

Why are SSH host keys stored un-encrypted?

answered Dec 27, 2017 at 8:48

5 votes

What exactly is client-side encryption?

answered Dec 30, 2017 at 16:47

4 votes

AES-256 Key Length Importance

answered Jan 5, 2018 at 9:36

4 votes

How can cloudflare read encrypted request without private key?

answered Dec 19, 2017 at 1:49

4 votes

Accepted

Phishing: allow # in user provided redirect URL?

answered Feb 15, 2018 at 11:35

4 votes

Accepted

Is it the public key or the key pair that is included in the x509 certificate?

answered Aug 31, 2020 at 9:35

3 votes

Accepted

Is certificate signature encoded to ASN.1 format?

answered Aug 24, 2020 at 16:13

3 votes

can anyone with valid ssl certificate do man in middle attack?

answered Aug 18, 2020 at 14:43

3 votes

Accepted

What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?

answered Aug 13, 2020 at 18:32

3 votes

Is HTTP Strict Transport Security needed when only listening on port 443?

answered May 18, 2020 at 11:38

3 votes

Accepted

Explaining a bad approach - not comparing hashes

answered Jun 4, 2020 at 9:44

3 votes

Accepted

Help understanding CSR fields

answered Jul 8, 2020 at 7:49

3 votes

Accepted

PKI: How does CA certificate revocation affect leaf certificates?

answered Jul 10, 2020 at 12:14

Stack Exchange Network

57 Answers

Is there any security risk in not setting a maximum password length?

HTTPS is widely adopted, why isn't encrypted e-mail as popular?

Do browsers know domains that are supposed to be encrypted?

How does a 'rainbow table' hacker obtain password hashes in the first place?

What's more vulnerable; the data or the DBMS?

Why would a password be hashed before being used to encrypt something?

Where to store private and public keys?

In-memory pepper

Where are FIDO U2F Keys Stored?

Why is salt+nonce authentication over insecure channel vulnerable to man-in-the-middle attack?

Securing internal micro-services - Letsencrypt vs. Self-signed certificates - Best practices

Is single iteration SHA-256 safe enough for hashing 128bit random number API keys?

Does the CA create the public key or is it created by the requesting server and sent to the CA?

how to anonymously contribute to Github

If certificate authority generates key pair for us, do they maintain/have access to our private key?

How is public key included in the CSR?

Does the terms stream and block ciphers apply to both symmetric and asymmetric ciphers?

Why are SSH host keys stored un-encrypted?

What exactly is client-side encryption?

AES-256 Key Length Importance

How can cloudflare read encrypted request without private key?

Phishing: allow # in user provided redirect URL?

Is it the public key or the key pair that is included in the x509 certificate?

Is certificate signature encoded to ASN.1 format?

can anyone with valid ssl certificate do man in middle attack?

What are the security implications of adding an Intermediate Certificate into the Trusted Root Store in Windows?

Is HTTP Strict Transport Security needed when only listening on port 443?

Explaining a bad approach - not comparing hashes

Help understanding CSR fields

PKI: How does CA certificate revocation affect leaf certificates?