User Krzysztof Kotowicz

39 votes

Accepted

How secure is asking for specific characters of passwords instead of the entire thing?

answered Sep 23, 2011 at 21:56

30 votes

CRIME - How to beat the BEAST successor?

answered Sep 11, 2012 at 8:52

21 votes

Accepted

If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?

answered Sep 28, 2011 at 13:47

19 votes

Accepted

Why don't we use MAC address instead of IP address?

answered Dec 26, 2011 at 12:30

17 votes

Accepted

Is strip_tags() horribly unsafe?

answered Dec 23, 2011 at 16:22

14 votes

Accepted

Is this jQuery ajax call vulnerable to XSS?

answered Jan 19, 2012 at 14:27

14 votes

Accepted

Implications of Trace/Track Methods on Apache

answered Sep 29, 2011 at 13:32

13 votes

Accepted

Is it safe to store and replay user-provided mime types?

answered Nov 3, 2011 at 23:10

11 votes

Is it safe to serve any user uploaded file under only white-listed MIME content types?

answered Feb 15, 2012 at 18:18

10 votes

Accepted

Designing a Capture The Flag target and game management system

answered Oct 11, 2011 at 20:07

10 votes

What is a Flash drive by download?

answered Sep 18, 2011 at 21:53

9 votes

Virus detection with Process Explorer

answered Sep 19, 2011 at 13:29

9 votes

Accepted

Elaborate websockets security

answered Jun 2, 2011 at 13:07

9 votes

Accepted

Is Teredo in my router a back door?

answered Dec 26, 2011 at 15:22

9 votes

Accepted

Is Request.getHeader("host") vulnerable?

answered Dec 20, 2011 at 12:06

9 votes

Accepted

How bad is a Self Contained XSS attack?

answered Dec 23, 2011 at 13:42

8 votes

Does this htaccess snippet provide sufficient security?

answered Dec 29, 2011 at 14:47

8 votes

Is my Company Tracking Me?

answered Sep 20, 2011 at 11:11

7 votes

Accepted

Should we be checking password restraints on log in forms?

answered Oct 12, 2011 at 22:03

7 votes

Accepted

Is security increased by using a subdomain per customer in a web-app?

answered Sep 23, 2011 at 22:27

7 votes

Accepted

localStorage for apps over https. What expectations are there?

answered Nov 30, 2011 at 0:14

7 votes

How do I log all my internet-connections

answered Nov 15, 2011 at 12:50

6 votes

Is it correct to use form field(hidden) for storing Session Token

answered Nov 22, 2011 at 12:39

6 votes

Accepted

Guarding against rogue certificates

answered Sep 19, 2011 at 21:07

6 votes

How to perform a security audit for a PHP application?

answered Oct 10, 2011 at 15:30

4 votes

Accepted

What security features should a PHP framework have?

answered Sep 17, 2011 at 8:54

4 votes

Is silverlight and Java running on the web browser capable of saving "state" into the user's local machines?

answered Oct 18, 2011 at 14:10

4 votes

PHP functions for preventing XSS

answered Nov 9, 2011 at 22:11

4 votes

Accepted

Enforce Code/Script Signing

answered Jan 22, 2012 at 15:50

4 votes

HTML 5 Security Code Scanner

answered Jan 24, 2012 at 18:08

Stack Exchange Network

42 Answers

How secure is asking for specific characters of passwords instead of the entire thing?

CRIME - How to beat the BEAST successor?

If a website allows another person to get a list of the site's users passwords, how likely is it that the passwords are stored in cleartext?

Why don't we use MAC address instead of IP address?

Is strip_tags() horribly unsafe?

Is this jQuery ajax call vulnerable to XSS?

Implications of Trace/Track Methods on Apache

Is it safe to store and replay user-provided mime types?

Is it safe to serve any user uploaded file under only white-listed MIME content types?

Designing a Capture The Flag target and game management system

What is a Flash drive by download?

Virus detection with Process Explorer

Elaborate websockets security

Is Teredo in my router a back door?

Is Request.getHeader("host") vulnerable?

How bad is a Self Contained XSS attack?

Does this htaccess snippet provide sufficient security?

Is my Company Tracking Me?

Should we be checking password restraints on log in forms?

Is security increased by using a subdomain per customer in a web-app?

localStorage for apps over https. What expectations are there?

How do I log all my internet-connections

Is it correct to use form field(hidden) for storing Session Token

Guarding against rogue certificates

How to perform a security audit for a PHP application?

What security features should a PHP framework have?

Is silverlight and Java running on the web browser capable of saving "state" into the user's local machines?

PHP functions for preventing XSS

Enforce Code/Script Signing

HTML 5 Security Code Scanner