Gh0stFish's user avatar
Gh0stFish's user avatar
Gh0stFish's user avatar
  • Member for 2 years, 3 months
  • Last seen this week
85 votes

Does open source "protestware" represent a security risk?

81 votes

Why does this attack check the location of the server?

58 votes

How could a security control introduce a privacy issue?

55 votes

What is the purpose of hiding spam links in some obscure forum posts?

48 votes

Is there any security benefit from emailing a "secure link"?

42 votes

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

40 votes

Is it a good practice to add hard-coded salt to BCrypt passwords?

39 votes

Is it insecure to display the number of characters when users enter a new passphrase?

38 votes

What is the best way to calculate true password entropy for human created passwords?

36 votes

Can fingerprint readers be trusted?

35 votes

Why create a CSR on my own server to have it signed by a 3rd party?

33 votes

In the RoE for a pentest, do you include a list of all tools?

26 votes

What's wrong with the use of a WAF (Web Application Firewall)?

24 votes

Why use random characters in passwords?

22 votes

What are the risks of desktop personalization on Windows?

21 votes

Is a BitLocker recovery key an unavoidable brute-force attack vulnerability?

18 votes

Escalating user privileges on Linux

15 votes

Why did they stop adding physical "write protect" mechanism?

13 votes

Pros & cons of including requesting IP address in password reset emails?

10 votes

Can 777-characters long passphrase be considered too short?

9 votes

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

8 votes

Is a + on an email address a security vulnerability for a registration process?

7 votes

What are the dangers of using niche Linux distributions?

6 votes

Mitigating vulnerabilities in audio libraries that cause physical damage

6 votes

Does "risk score" always have to be a numerical value?

5 votes

A stolen security key enables full access; why are such keys considered more secure than authenticator apps?

4 votes

Would storing the users IP address in a session token be more secure?

4 votes

Is it common practice to take multiple hashes of the same object?

4 votes

John the Ripper - Zip Password help - Latter half digit command advice

4 votes

Is it a security risk to require passwords to be unique across all users?