Ajedi32
  • Member for 8 years, 5 months
  • Last seen this week
Implementation of diceware: do I have to simulate dice roll?
29 votes

The reason Diceware advocates using dice to select a password is that it ensures the password the user gets is generated randomly. So no, as long as you are certain your program is selecting the ...

View answer
How will biometrics be a safe way to authenticate users across the internet?
23 votes

When people talk about biometric authentication for the web, usually they are referring to the Web Authentication standard; a new, standardized method of user authentication which has been implemented ...

View answer
Could SQRL really be as secure as they say?
20 votes

SQRL certainly is not without flaws, but it's certainly superior to most primary authentication solutions widely used on the web today in terms of security and (and this is important) usability. Allow ...

View answer
How can I be sure that I am using the real Facebook?
19 votes

This is exactly the problem that HTTPS is designed to solve. If you visit Facebook (or any other site for that matter) using a URL that starts with https:// (not http://), then there are a number of ...

View answer
How do I safely host third-party Javascript code in an iframe?
Accepted answer
18 votes

If the content you're embedding will contain untrusted scripts, it must either be loaded in an iframe from an untrusted domain, or be loaded from srcdoc in a sandboxed iframe with the allow-same-...

View answer
Is this idea for a password manager secure? If so, why doesn't anybody use it?
17 votes

In short, this method provides little to no additional security over a regular password manager (possibly even reducing security, depending on implementation), and has several usability issues that ...

View answer
What role do hashes play in TLS/SSL certificate validation?
Accepted answer
15 votes

Basically, hash functions are a necessary part of the process of creating a digital signature. Most signature algorithms are not designed to be able to securely and/or efficiently sign long messages ...

View answer
Why is it insecure to store the session ID in a cookie directly?
14 votes

Eran Hammer, one of the maintainers of the yar session management module for NodeJS, had this to say on the matter: Disclaimer: like any security advice from someone who doesn't know the specifics of ...

View answer
Is it safe to store 2FA tokens together with passwords in 1password?
13 votes

The entire point of having a second factor for authentication is to protect you in cases where the first factor (passwords) already failed. Therefore, storing your 2FA tokens in the same place you ...

View answer
Is this code vulnerable to Reflected XSS?
Accepted answer
11 votes

Yes, this code is vulnerable, but not to XSS. The subdomain variable's value can indeed be controlled by an attacker, but that variable is only used to set the href parameter of a CSS stylesheet; ...

View answer
What’s wrong with in-browser cryptography in 2017?
Accepted answer
10 votes

The main issue with cryptography in web pages is that, because the code you're executing is loaded from a web server, that server has full control over what that code is and can change it every time ...

View answer
What is the status of Certificate Transparency?
Accepted answer
7 votes

As of today (January 25, 2018), adoption of Certificate Transparency is not ubiquitous, but it is starting to gain momentum. Let's Encrypt logs all their certificates to CT logs, and several major CAs ...

View answer
What can I do to rely less on certificate authorities?
Accepted answer
7 votes

Unfortunately, this won't do anything to fix the problem, and might even make things worse for you if you don't set things up properly. Certificates are designed to provide assurance that the public ...

View answer
Why can't bypass SOP using "src" attribut in script tag?
Accepted answer
5 votes

Because step 4 is impossible. Not just because of the same-origin policy, but because there's simply no way to retrieve the content of a script tag via JavaScript. There's HTMLScriptElement.text, but ...

View answer
Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
5 votes

Yes, but this would be difficult to do without it being discovered. From a purely technical standpoint you're correct, there's nothing stopping a nation-state from compelling a Certificate Authority ...

View answer
Is there greater risk to browsing websites with invalid certificates than websites with no certificate at all?
Accepted answer
5 votes

Yes, sites with invalid certificates do expose you to more risk than regular HTTP sites with no certificate, though only slightly more. In terms of the security of the connection itself your ...

View answer
How bad is to render html from cookies?
Accepted answer
5 votes

Assuming there are no other vulnerabilities in the website I don't believe this is exploitable, as in order to exploit this the attacker would first need to be able to control the contents of that ...

View answer
Roll your own encryption - with a twist
5 votes

The algorithm in your example is basically a really simple Caesar Cipher with a fixed key (1), and no, that's definitely not secure. An attacker could determine what algorithm you used rather easily ...

View answer
How does Google Maps know where I am, when I'm using a VPN?
5 votes

From Google's support pages: How Maps gets location info When you click Location on your computer, Maps uses different sources to try to get an accurate read on your location. This info ...

View answer
What are the risks of installing a CA on the same machine as OpenVPN server?
Accepted answer
4 votes

The OpenVPN documentation being referred to is the Getting started How-To on the OpenVPN Wiki. Specifically, this paragraph: BEWARE: One common mistake when setting up a new CA is to place all the ...

View answer
Does the length of each word of a passphrase matter?
Accepted answer
4 votes

No. If you're using multi-word (diceware-style) passphrases composed of actual words, the length of each word doesn't matter. If you assume the attacker is aware of the method you used for generating ...

View answer
Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?
Accepted answer
4 votes

No, cache-control: no-cache will not prevent a browser cache from storing response data. Use cache-control: no-store instead. According to RFC 7234, section 5.2.2.2: The "no-cache" response ...

View answer
standards for regulation of intermediate Certificate authority
4 votes

CABForum "Baseline Requirements" TLS certificates on The Web are governed primarily by the CA-Browser Forum Baseline Requirements, which all publicly-trusted CAs are required (by browser ...

View answer
With HTTPS-only mode in Firefox, may I still need HTTPS Eveywhere addon?
Accepted answer
3 votes

No. Firefox's HTTPS-only mode blocks all unencrypted requests by default. The HTTPS Everywhere plugin blocks some unencrypted requests by default. Therefore if you're using HTTPS-only mode (and not ...

View answer
Why does Chrome require Secure for SameSite=None cookies?
Accepted answer
3 votes

This is a privacy measure intended to mitigate pervasive monitoring of network traffic by ISPs, governments, and other network actors. The motivation is explained in detail in section 3.2 of the IETF ...

View answer
Is it OK to not update devdependencies?
3 votes

That depends on what the dependencies are and what they're used for. Even if a dependency isn't used in production, if it's used as part of your build process, for example, then its possible that it ...

View answer
Why bother with certain types of 2fa if they can be easily bypassed?
3 votes

Because 2FA protects against more than just phishing. One major threat 2FA protects against is credential stuffing, where attackers take passwords stolen from other services in data breaches and try ...

View answer
Chrome SSL Warning: "You cannot proceed because the website operator has requested heightened security for this domain. "
3 votes

This error message triggered by a feature of the web called "HTTP Strict Transport Security" which allows website operators to tell browsers that their site must only be contacted over a ...

View answer
What is Security Theater?
3 votes

Security Theater is any process or mechanism which makes users, developers, managers, or other stakeholders perceive a system as "more secure" without actually providing significant protection against ...

View answer
CSP: upgrade-insecure-requests - what happens with https-incompatible ressources?
Accepted answer
3 votes

What happens to ressources which can't be upgraded to https (e.g. invalid certificate)? Will they be blocked? The request will be made over HTTPS. If the request fails, then it fails. To do otherwise ...

View answer