User Steve

68 votes

Accepted

What is the difference between an X.509 "client certificate" and a normal SSL certificate?

answered Jan 3, 2011 at 18:52

37 votes

XSS cookie stealing without redirecting to another page

web-application javascript xss cookies

answered Jan 22, 2014 at 18:48

34 votes

Accepted

Why does Windows not always force me to confirm my password when changing it?

passwords account-security windows-10 password-reset cmd

answered Jul 15, 2020 at 18:36

33 votes

Accepted

Role Based Authorization vs. Claim Based Authorization

authentication authorization identity federation rbac

answered Nov 11, 2013 at 20:16

30 votes

Why is it difficult to catch "Anonymous" or "Lulzsec" (groups)?

ip-spoofing ddos anonymity

answered Feb 21, 2011 at 19:09

20 votes

Accepted

Is my JWT refresh plan secure?

authentication mobile oauth token

answered Jun 8, 2015 at 23:48

18 votes

Does Windows really still use unsalted MD4 for password storage?

hash windows password-management active-directory

answered Jul 7, 2011 at 18:41

18 votes

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

appsec malware virus injection binary-code

answered Oct 13, 2011 at 19:32

17 votes

Accepted

Is it possible to have a key for encryption, that cannot be used for decryption?

encryption key-exchange

answered Sep 22, 2011 at 1:23

17 votes

How does the Windows "Secure Desktop" mode work?

windows operating-systems desktop uac

answered May 12, 2011 at 14:36

17 votes

Accepted

Claims based vs Permission based authorization

authorization

answered Aug 18, 2014 at 18:35

13 votes

Accepted

What are the biggest unsolved problems in IT Security?

research

answered Nov 22, 2010 at 17:50

12 votes

Accepted

Are there any reasons for Kerberos being based on symmetric cryptography?

kerberos

answered Mar 13, 2020 at 17:30

11 votes

Two passwords provide better security than two-factor authentication?

passwords multi-factor

answered Nov 18, 2015 at 1:53

11 votes

Accepted

How does external authentication work?

appsec web-application authentication federation

answered Jun 17, 2011 at 15:54

10 votes

Should I bother teaching buffer overflows any more?

appsec attacks source-code user-education buffer-overflow

answered Mar 1, 2011 at 5:11

10 votes

Windows hardening

operating-systems windows hardening

answered Feb 3, 2011 at 20:40

10 votes

Is BASIC-Auth secure if done over HTTPS?

tls authentication web-application http http-basic-auth

answered Dec 5, 2010 at 22:59

10 votes

How does XSS work?

web-application attacks xss appsec

answered Dec 28, 2010 at 17:45

10 votes

Accepted

Secure Internet Polling

anonymity identity electronic-voting

answered Jul 28, 2011 at 19:00

10 votes

Accepted

Why not use same certificate for webserver TLS and Signing in SAML?

tls certificates saml

answered Aug 19, 2015 at 15:11

9 votes

Accepted

What is the difference between claims, attributes, and roles?

authentication authorization rbac

answered Mar 4, 2014 at 17:44

9 votes

Accepted

Is it possible to catch a virus on my LAN without clicking on anything?

network windows virus

answered Apr 14, 2013 at 20:23

9 votes

Any good free SSL proxy on windows?

tls windows certificates proxy

answered Dec 29, 2010 at 23:04

9 votes

Accepted

Keyboards immune to signal monitoring?

hardware side-channel van-eck-phreaking

answered Mar 9, 2011 at 20:56

8 votes

How is PowerShell's RemoteSigned execution policy different from AllSigned?

powershell

answered Jan 21, 2011 at 17:40

8 votes

What is your way to create good passwords that can actually be remembered?

passwords entropy

answered Nov 25, 2010 at 17:54

8 votes

Is it insecure to have an SSH server on a workstation?

ssh unix remote-desktop operations

answered Jul 14, 2011 at 2:59

8 votes

Is changing image's extension prone to error for browsers?

web-browser file-upload

answered Dec 25, 2011 at 18:37

8 votes

Difference between authentication and identification [Crypto and Security perspective]

authentication identification

answered Jan 23, 2012 at 11:28

Stack Exchange Network

current community

your communities

more stack exchange communities

309 Answers

What is the difference between an X.509 "client certificate" and a normal SSL certificate?

XSS cookie stealing without redirecting to another page

Why does Windows not always force me to confirm my password when changing it?

Role Based Authorization vs. Claim Based Authorization

Why is it difficult to catch "Anonymous" or "Lulzsec" (groups)?

Is my JWT refresh plan secure?

Does Windows really still use unsalted MD4 for password storage?

How to inject executable, malicious code into PDF, JPEG, MP3, etc.?

Is it possible to have a key for encryption, that cannot be used for decryption?

How does the Windows "Secure Desktop" mode work?

Claims based vs Permission based authorization

What are the biggest unsolved problems in IT Security?

Are there any reasons for Kerberos being based on symmetric cryptography?

Two passwords provide better security than two-factor authentication?

How does external authentication work?

Should I bother teaching buffer overflows any more?

Windows hardening

Is BASIC-Auth secure if done over HTTPS?

How does XSS work?

Secure Internet Polling

Why not use same certificate for webserver TLS and Signing in SAML?

What is the difference between claims, attributes, and roles?

Is it possible to catch a virus on my LAN without clicking on anything?

Any good free SSL proxy on windows?

Keyboards immune to signal monitoring?

How is PowerShell's RemoteSigned execution policy different from AllSigned?

What is your way to create good passwords that can actually be remembered?

Is it insecure to have an SSH server on a workstation?

Is changing image's extension prone to error for browsers?

Difference between authentication and identification [Crypto and Security perspective]