User Gh0stFish

85 votes

Accepted

Does open source "protestware" represent a security risk?

answered Mar 27, 2022 at 10:16

81 votes

Accepted

Why does this attack check the location of the server?

answered Oct 22, 2021 at 21:27

58 votes

Accepted

How could a security control introduce a privacy issue?

answered Oct 16 at 11:19

55 votes

Accepted

What is the purpose of hiding spam links in some obscure forum posts?

answered Dec 27, 2022 at 21:14

48 votes

Accepted

Is there any security benefit from emailing a "secure link"?

answered Jun 10, 2022 at 8:18

42 votes

Accepted

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

answered Nov 21 at 17:00

40 votes

Accepted

Is it a good practice to add hard-coded salt to BCrypt passwords?

answered Oct 17, 2022 at 8:12

39 votes

Is it insecure to display the number of characters when users enter a new passphrase?

answered Aug 31, 2021 at 18:53

38 votes

What is the best way to calculate true password entropy for human created passwords?

answered Oct 8, 2022 at 19:36

36 votes

Accepted

Can fingerprint readers be trusted?

answered Oct 17 at 9:36

35 votes

Accepted

Why create a CSR on my own server to have it signed by a 3rd party?

answered Nov 27, 2022 at 11:10

33 votes

Accepted

In the RoE for a pentest, do you include a list of all tools?

answered Sep 19, 2022 at 8:42

26 votes

What's wrong with the use of a WAF (Web Application Firewall)?

answered Nov 27 at 10:39

24 votes

Why use random characters in passwords?

answered Dec 1, 2021 at 18:22

22 votes

What are the risks of desktop personalization on Windows?

answered Aug 20, 2021 at 20:35

21 votes

Is a BitLocker recovery key an unavoidable brute-force attack vulnerability?

answered Aug 26, 2021 at 8:07

18 votes

Accepted

Escalating user privileges on Linux

answered Nov 17 at 11:56

15 votes

Why did they stop adding physical "write protect" mechanism?

answered Oct 18, 2022 at 8:49

13 votes

Pros & cons of including requesting IP address in password reset emails?

answered Oct 24 at 13:03

10 votes

Can 777-characters long passphrase be considered too short?

answered Dec 18, 2022 at 16:52

9 votes

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

answered Nov 14, 2021 at 17:51

8 votes

Is a + on an email address a security vulnerability for a registration process?

answered Aug 8 at 13:00

7 votes

What are the dangers of using niche Linux distributions?

answered Apr 7, 2022 at 21:38

6 votes

Mitigating vulnerabilities in audio libraries that cause physical damage

answered Nov 3 at 12:33

6 votes

Does "risk score" always have to be a numerical value?

answered Nov 7 at 20:07

5 votes

A stolen security key enables full access; why are such keys considered more secure than authenticator apps?

answered Aug 26, 2021 at 14:23

4 votes

Accepted

Would storing the users IP address in a session token be more secure?

answered May 14, 2022 at 15:07

4 votes

Is it common practice to take multiple hashes of the same object?

answered Sep 21 at 7:47

4 votes

John the Ripper - Zip Password help - Latter half digit command advice

answered Aug 20 at 19:56

4 votes

Is it a security risk to require passwords to be unique across all users?

answered Dec 5, 2022 at 18:01

Stack Exchange Network

116 Answers

Does open source "protestware" represent a security risk?

Why does this attack check the location of the server?

How could a security control introduce a privacy issue?

What is the purpose of hiding spam links in some obscure forum posts?

Is there any security benefit from emailing a "secure link"?

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

Is it a good practice to add hard-coded salt to BCrypt passwords?

Is it insecure to display the number of characters when users enter a new passphrase?

What is the best way to calculate true password entropy for human created passwords?

Can fingerprint readers be trusted?

Why create a CSR on my own server to have it signed by a 3rd party?

In the RoE for a pentest, do you include a list of all tools?

What's wrong with the use of a WAF (Web Application Firewall)?

Why use random characters in passwords?

What are the risks of desktop personalization on Windows?

Is a BitLocker recovery key an unavoidable brute-force attack vulnerability?

Escalating user privileges on Linux

Why did they stop adding physical "write protect" mechanism?

Pros & cons of including requesting IP address in password reset emails?

Can 777-characters long passphrase be considered too short?

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

Is a + on an email address a security vulnerability for a registration process?

What are the dangers of using niche Linux distributions?

Mitigating vulnerabilities in audio libraries that cause physical damage

Does "risk score" always have to be a numerical value?

A stolen security key enables full access; why are such keys considered more secure than authenticator apps?

Would storing the users IP address in a session token be more secure?

Is it common practice to take multiple hashes of the same object?

John the Ripper - Zip Password help - Latter half digit command advice

Is it a security risk to require passwords to be unique across all users?