Steffen Ullrich
  • Member for 8 years
  • Last seen this week
SQL injection is 17 years old. Why is it still around?
477 votes

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one ...

View answer
Why do phishing e-mails use faked e-mail addresses instead of the real one?
Accepted answer
184 votes

While one could create a mail with @amazon.com as SMTP envelope and/or From field of the mail header, the mail would likely be blocked since this domain is protected with Sender Policy Framework (SPF),...

View answer
Should I be worried of tracking domains on a banking website?
160 votes

It looks like the main site is embedding script from Adobe Marketing Cloud directly into the page. While these scripts are loaded from the same server as the main site it looks like that these scripts ...

View answer
Why should browser security be prioritized?
Accepted answer
138 votes

Can you explain why browser security should be placed on the top priority ... Because the browser is processing lots of untrusted content from the internet. Of course, if you use any other programs ...

View answer
If malware does not run in a VM why not make everything a VM?
Accepted answer
133 votes

One has to take into account why the malware is doing this distinction in the first place. Some malware does not run in the VM because the chance is high that this VM is used for inspecting the ...

View answer
Is it a security vulnerability to tell a user what input characters are valid/invalid?
Accepted answer
127 votes

... that could be useful in an attack but is normally not available to the attacker Knowledge of invalid input characters are useful but can easily be found by the attacker with just a few tries. ...

View answer
Why do I hear about so many Java insecurities? Are other languages more secure?
124 votes

If you use Java like most other programming languages, e.g. to write standalone applications, it is no less secure than other languages and more secure than C or C++ because of no buffer overflows etc....

View answer
How resistant are barcodes and QR-codes against attempts to change stored data?
Accepted answer
113 votes

... how secure is a QR-code? Data in a QR code are kind of protected against accidental damage by having some error correction but they are not protected against deliberate manipulation. Also, an ...

View answer
What is the relationship between "SHA-2" and "SHA-256"
Accepted answer
112 votes

Just to cite wikipedia: http://en.wikipedia.org/wiki/SHA-2: The SHA-2 family consists of six hash functions with digests (hash values) that are 224, 256, 384 or 512 bits: SHA-224, SHA-256, SHA-384, ...

View answer
Known strings to have the same MD5 hash, not colliding in real life?
Accepted answer
108 votes

... in which it clearly states that these two strings ... No. It clearly states "... two different sequences of 128 bytes ...". There is a huge difference in these statements. In the first ...

View answer
How can a company ensure cybercriminals destroy hacked data after payment?
Accepted answer
108 votes

How can the company be certain that the data is destroyed, It cannot be certain. The only hope that it is part of the criminals business model to maintain a good reputation in that one gets what is ...

View answer
Possible reason for displaying two different websites on single domain?
102 votes

This is obviously a spamming or scamming site, either setup on purpose or a hacked legitimate site. If visited without Referer header it will show some seemingly innocent site: $ curl http://www....

View answer
Why is a link in an email more dangerous than a link from a web search?
Accepted answer
101 votes

The results of a search engine are based on previously collected data, i.e. the engine does not starts to scanning the whole internet when doing a search but it looks through an index of seen and ...

View answer
What are the security risks of logging the hash of rejected passwords?
Accepted answer
101 votes

If properly hashed (i.e. with random salt and strong hash) a hashed password is not reversible and hashed passwords for different accounts differ even if the passwords are the same. This means that ...

View answer
Security implication if android app can be installed on emulator
Accepted answer
94 votes

It is unclear what kind of security requirements you have in the first place and thus it is unclear if your security measures are sufficient or not. Fully protecting against a malicious user using ...

View answer
Unusual mail headers show evidence of MTA attack. Have I been pwned?
Accepted answer
92 votes

This is an attempt to exploit the current remote code execution issue in the EXIM mail server, i.e. CVE-2019-10149. See The Return of the WIZard: RCE in Exim for details and also the kind of exploit ...

View answer
What does "in-house hash function" mean?
Accepted answer
92 votes

From the explanation of in-house in the Cambridge Directory: "Something that is done in-house is done within an organization or business by its employees rather than by other people". Here it means ...

View answer
How to mitigate Meltdown in Docker images?
Accepted answer
85 votes

The patch against Meltdown is kernel only. Docker containers run within the kernel of the host system. This means the resistance against Meltdown depends on the host kernel only. In other words: you ...

View answer
Is it safe to use Dropbox in its present state?
85 votes

It does not matter much how the data are encrypted as long as the owner of the data is not the only one in control of the encryption key. This in effect means that data encryption and decryption ...

View answer
How does the log4shell vulnerability work?
83 votes

In short - from my understanding the vulnerability is caused by: treating data for logging as trusted, even though they might come from an untrusted source (like logging the user agent of a HTTP ...

View answer
Why is iPhone's internal storage so hard to crack/decrypt?
Accepted answer
82 votes

I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that ...

View answer
Does FTPS (FTP+S) offer better security than SFTP on the server side?
Accepted answer
78 votes

From the security they provide in theory FTPS and SFTP are similar. In practice you have the following advantages and disadvantages: With FTPS client applications often fail to validate the ...

View answer
How can we secure communication of an unchangeable app (Zoom)?
Accepted answer
74 votes

You cannot magically secure applications like Zoom without changing the application and the infrastructure it relies on. The missing end-to-end encryption you want to have fixed is due to the basic ...

View answer
Why do HTTPS requests include the host name in clear text?
74 votes

The hostname is included in the initial SSL handshake to support servers which have multiple host names (with different certificates) on the same IP address (SNI: Server Name Indication). This is ...

View answer
Is it safe to upload & scan personal files on VirusTotal?
Accepted answer
73 votes

Paid subscribes to virustotal can download files uploaded by others. If you consider this still safe for your users depends on what you consider safe. See also their Privacy Policy which clearly ...

View answer
Why do security experts like Snowden use email services like Lavabit and Hushmail rather than self-hosted email?
73 votes

Rent VPS (even better: home server) & Domain (May take up to 2 days, who cares..) How many ISPs do not provide law enforcement access to their sites and to the systems they provide for their ...

View answer
Why wasn't the KRACK exploit discovered sooner?
72 votes

In some sense, it feels like this should have been obvious. Remember Heartbleed, Shellshock, POODLE, TLS Triple Handshake attack, "goto fail", ... ? In hindsight, most of these problems seem to be ...

View answer
Can I get a public key from an RSA private key?
71 votes

can I get a public key? It's easy using openssl rsa: $ openssl rsa -in the-private-key-from-your-question.pem -pubout writing RSA key -----BEGIN PUBLIC KEY----- ...

View answer
False 'Security alert' from Google - every login generates mails from 'no-reply@accounts.google.com'
Accepted answer
69 votes

I guess I receive those mails because I use a VPN (always same public IP) and some privacy plugins in Firefox. Yes, this is likely the reason. You use these plugins in order to prevent that the other ...

View answer
Is (safe) encryption over compromised line impossible?
Accepted answer
69 votes

If the attacker is only passively listening to the connection then Diffie Hellman Key Exchange can be done to create a common key known only to the communication peers. But, if the attacker can not ...

View answer
1
2 3 4 5
109