User paj28

51 votes

9 answers

11k views

Can users make use of a password manager when banks tell them never to write passwords down?

asked Jun 3, 2014 at 20:15

32 votes

2 answers

4k views

Can client-side hashing reduce the denial-of-service risk with slow hashes?

asked May 25, 2014 at 18:31

26 votes

5 answers

4k views

Is unauthorised deletion an integrity or availability issue?

asked Dec 15, 2016 at 13:18

20 votes

2 answers

17k views

Access-control-allow-origin: * with a bearer token

asked Jun 23, 2016 at 14:47

17 votes

2 answers

3k views

What is the impact of the reported weak IV in 7 Zip?

asked Jan 25, 2019 at 10:41

16 votes

1 answer

17k views

Preventing Server-Side Request Forgeries in Java

asked May 18, 2016 at 17:45

15 votes

4 answers

8k views

How to build a hacking challenge that uses XSS?

asked Dec 22, 2016 at 14:56

12 votes

1 answer

9k views

In what situations can element.setAttribute allow XSS?

asked Oct 14, 2016 at 9:30

11 votes

4 answers

15k views

A company has requested scans of identity documents. What should I do?

asked Jan 22, 2017 at 11:38

11 votes

4 answers

2k views

Defending against DoS via product reservation

asked Jul 9, 2020 at 12:42

8 votes

3 answers

6k views

Pros & cons of including requesting IP address in password reset emails?

asked Oct 24 at 11:15

8 votes

2 answers

709 views

Does randomness prevent collision attacks?

asked Feb 23, 2017 at 14:05

8 votes

3 answers

28k views

How to bypass .Net 4.5 request validation, for an XSS attack?

asked Jan 26, 2015 at 12:44

8 votes

2 answers

1k views

What are the new security features in Windows 10?

asked May 19, 2015 at 11:14

7 votes

2 answers

839 views

Vulnerable web sockets application for training

asked Sep 29, 2016 at 12:44

7 votes

3 answers

6k views

How to avoid referer information leakage during password reset

asked Dec 15, 2014 at 17:20

7 votes

2 answers

172 views

Have there been successful class action lawsuits due to infosec breaches?

asked Nov 16, 2015 at 12:05

7 votes

4 answers

9k views

How to securely set a cookie on another subdomain?

asked Apr 20, 2020 at 16:51

6 votes

2 answers

600 views

Can Silicon Secured Memory prevent buffer overruns?

asked Oct 28, 2015 at 4:48

6 votes

5 answers

2k views

How can two-man control be implemented efficiently?

asked Jul 29, 2016 at 15:23

6 votes

3 answers

9k views

Should anti-virus detect metasploit payloads?

asked Jan 30, 2015 at 11:29

5 votes

5 answers

1k views

Is there a simple and highly secure office suite?

asked Oct 9, 2013 at 14:16

5 votes

4 answers

1k views

Could technical controls prevent vehicle ramming attacks?

asked Jul 15, 2016 at 19:27

5 votes

2 answers

1k views

How to configure Chrome to stop external websites accessing my router?

asked Dec 12, 2016 at 11:22

5 votes

1 answer

691 views

What questions are useful to scope a mobile app pen test?

asked Jul 14, 2020 at 17:17

5 votes

1 answer

395 views

Are there any proposals for email verification without a confirmation email?

asked Jan 29, 2018 at 20:41

4 votes

2 answers

1k views

Do browsers have a defence against CORS from internet to intranet sites?

asked Sep 11 at 14:29

4 votes

1 answer

347 views

Does SSH authorized_keys violate the principle of "re-authenticate before password change"?

asked Jun 6, 2014 at 11:17

3 votes

1 answer

232 views

Helping developers find logic and authorisation flaws

asked Oct 29, 2013 at 14:59

3 votes

1 answer

2k views

How to exfiltrate data over remote desktop

asked Dec 15, 2014 at 17:14

Stack Exchange Network

46 Questions

Can users make use of a password manager when banks tell them never to write passwords down?

Can client-side hashing reduce the denial-of-service risk with slow hashes?

Is unauthorised deletion an integrity or availability issue?

Access-control-allow-origin: * with a bearer token

What is the impact of the reported weak IV in 7 Zip?

Preventing Server-Side Request Forgeries in Java

How to build a hacking challenge that uses XSS?

In what situations can element.setAttribute allow XSS?

A company has requested scans of identity documents. What should I do?

Defending against DoS via product reservation

Pros & cons of including requesting IP address in password reset emails?

Does randomness prevent collision attacks?

How to bypass .Net 4.5 request validation, for an XSS attack?

What are the new security features in Windows 10?

Vulnerable web sockets application for training

How to avoid referer information leakage during password reset

Have there been successful class action lawsuits due to infosec breaches?

How to securely set a cookie on another subdomain?

Can Silicon Secured Memory prevent buffer overruns?

How can two-man control be implemented efficiently?

Should anti-virus detect metasploit payloads?

Is there a simple and highly secure office suite?

Could technical controls prevent vehicle ramming attacks?

How to configure Chrome to stop external websites accessing my router?

What questions are useful to scope a mobile app pen test?

Are there any proposals for email verification without a confirmation email?

Do browsers have a defence against CORS from internet to intranet sites?

Does SSH authorized_keys violate the principle of "re-authenticate before password change"?

Helping developers find logic and authorisation flaws

How to exfiltrate data over remote desktop