Gh0stFish's user avatar
Gh0stFish's user avatar
Gh0stFish's user avatar
Gh0stFish
  • Member for 2 years, 6 months
  • Last seen this week
86 votes
Accepted

Does open source "protestware" represent a security risk?

81 votes
Accepted

Why does this attack check the location of the server?

58 votes
Accepted

How could a security control introduce a privacy issue?

55 votes
Accepted

What is the purpose of hiding spam links in some obscure forum posts?

48 votes
Accepted

Is there any security benefit from emailing a "secure link"?

42 votes
Accepted

Why is the absence of a Content-Type header with a HTTP 204 response considered a security vulnerability and what should we do about it?

40 votes

Increasing trust in a downloaded binary

40 votes
Accepted

Is it a good practice to add hard-coded salt to BCrypt passwords?

39 votes

What is the best way to calculate true password entropy for human created passwords?

39 votes

Is it insecure to display the number of characters when users enter a new passphrase?

36 votes
Accepted

Can fingerprint readers be trusted?

34 votes
Accepted

Why create a CSR on my own server to have it signed by a 3rd party?

33 votes
Accepted

In the RoE for a pentest, do you include a list of all tools?

32 votes

What's wrong with the use of a WAF (Web Application Firewall)?

24 votes

Why use random characters in passwords?

22 votes

What are the risks of desktop personalization on Windows?

21 votes

Is a BitLocker recovery key an unavoidable brute-force attack vulnerability?

21 votes

Showing prefix of token in error message?

19 votes
Accepted

Escalating user privileges on Linux

15 votes

Why are iframes allowed by default?

15 votes

Why did they stop adding physical "write protect" mechanism?

13 votes

Pros & cons of including requesting IP address in password reset emails?

10 votes

Can 777-characters long passphrase be considered too short?

9 votes

Do I need to use TLS if data is already encrypted and gets decrypted client-side?

8 votes

Is a + on an email address a security vulnerability for a registration process?

7 votes

What are the dangers of using niche Linux distributions?

6 votes

Mitigating vulnerabilities in audio libraries that cause physical damage

6 votes

Does "risk score" always have to be a numerical value?

5 votes

A stolen security key enables full access; why are such keys considered more secure than authenticator apps?

4 votes
Accepted

Would storing the users IP address in a session token be more secure?

1
2 3 4 5