Ja1024's user avatar
Ja1024's user avatar
Ja1024's user avatar
Ja1024
  • Member for 1 year
  • Last seen this week
72 votes
Accepted

Filter arbitrary code for blacklisted keywords except on commented lines

71 votes
Accepted

What stops a malicious user from hitting an endpoint with falsified data from the console of a webpage?

42 votes
Accepted

What's the point of certificates in SSL/TLS?

41 votes
Accepted

Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?

39 votes

Enabling a user to revert a hacked change in their email

22 votes

Why are refresh tokens treated differently than access tokens

20 votes

Reasoning behind banning '#' from the start of passwords?

15 votes

Do subdomains of a TLD with mandatory HTTPS require a wildcard certificate?

14 votes
Accepted

Understanding ssh-rsa not in PubkeyAcceptedAlgorithms

10 votes
Accepted

What are the reasons for CORS failure errors to not be available to JS?

5 votes

Does CSP protect against XSS in url?

5 votes

Why does OWASP recommend to never return JSON arrays not wrapped in objects?

5 votes
Accepted

What are the threats of using hashing functions that are built into the DBMS? (besides man-in-the-middle attacks)

5 votes
Accepted

Using hashed trigrams to search over encrypted data

4 votes
Accepted

Using localStorage to keep the user logged in in PWA

4 votes

openssl aes-128-cbc can be decrypted using different IV from encryption

4 votes
Accepted

Is it possible to distinguish the binary content of a gpg-encrypted file from a random blob of data?

4 votes

What is the impact of disabled TLS hostname verification?

4 votes
Accepted

Can I use SELinux to add an extra layer of protection against 0-day VM escape exploits in KVM/QEMU?

4 votes

Is hiding passwords in an image file a safe place to store them?

4 votes

XKCD #936 Why not both?

4 votes
Accepted

Is backing up the seed used to generate an RSA key pair a secure practice?

3 votes
Accepted

Are certificates persistent outside of where it's created?

3 votes

Derive a key (and not store it) from a passphrase, to be used with AES

3 votes

HTTPonly token without CSRF is safe?

3 votes

Algorithms when using client side hashing plus server side hashing

3 votes
Accepted

How to sanitize $_SERVER url variables?

3 votes
Accepted

Fake access-point + custom DNS-server to intercept mobile app credentials?

3 votes

Preventing HTTP requests containing XSS in nodeJS

3 votes
Accepted

How can I decrypt a text file with gpg?

1
2 3 4 5