Kjartan
  • Member for 7 years, 8 months
  • Last seen more than a month ago
7 answers
68 votes
5k views
Which topics should a security training for non-IT persons contain?
Accepted answer
42 votes

I actually did a presentation similar to this a little over a year ago, and spent quite a bit of time deciding how to structure it. My target audience did include developers and other people quite ...

View answer
16 answers
88 votes
16k views
How to tell users that they shouldn't disclose their password over the phone to our help desk?
8 votes

Update with a new proposal for a solution: What if you started each conversation by asking a customer for the answer to some pass-phrase that only he or she should know? A similar option has been ...

View answer
4 answers
1 votes
365 views
My email hacked
4 votes

First of all, I would change my password. Secondly, if at all possible, turn on two-factor authentication of some kind, so that you will be able to reset your password if someone should get access ...

View answer
2 answers
13 votes
2k views
Google Chrome says "Your connection to example.com is encrypted using an obsolete cipher suite."
3 votes

I'm no cryptography expert, but if my understanding is correct, the consequences of what you are seeing are in short, as follows: Your connection is in fact, encrypted, and as such, should be safer ...

View answer
2 answers
1 votes
4k views
Difference between antivirus and sandbox?
3 votes

These are two quite different things. A little simplified: An AV is a piece of software that can (among other things?) scan your system to identify and attempt to isolate and remove threats like ...

View answer
2 answers
-1 votes
87 views
Is there any way to formally ensure privacy to my clients by technical means?
3 votes

From how I understand what you are asking, the short answer is: Sorry, you can`t do that. If you are at any point handling any data from a client (i.e. an email), then there is simply no way you can ...

View answer
3 answers
4 votes
202 views
Doesn't persisting previous passwords pose a vulnerability?
2 votes

I can see a couple of potential issues with a solution like this: If a users (old) password is compromised, then an attempt to log in with it can be used to confirm that the user exists, and has an ...

View answer
2 answers
1 votes
4k views
Is there a way to fool google with wrong location information
2 votes

Your question could be split into several parts; if you use Google through a browser, and that browser is not controlled by Google (say for instance, you're using a private window in Firefox on a ...

View answer
3 answers
0 votes
751 views
Sending database name in request headers
2 votes

If all you are passing over is a simple name which identifies a database to use, then I can't see any immediate problems (provided you do some server side validation). I would try to avoid using ...

View answer
2 answers
2 votes
411 views
Wordpress blog hacked?
Accepted answer
2 votes

I'm assuming there is no relation between these mails and any actual new posts to be reviewed, right? I.e., just be cause you receive one of these mails, there does not need to actually be a new blog ...

View answer
2 answers
0 votes
2k views
"1234 1234 XXXX 1234" in a statement from an ATM
1 votes

freeformatter.com has a nice overview of how credit cards are built up, and lets you easily verify if a given number is valid or not. Combining this with the fact that you only lack 4 digits, guessing ...

View answer
4 answers
2 votes
134 views
Prove a client sent a request - voting system
1 votes

Short answer to your question, as it currently stands: No. The reason: Each IP would allow a single vote Due to NAT-translation, a single IP address may represent a lot more than a single user (...

View answer
3 answers
2 votes
268 views
What is probability of a user picking a published password?
1 votes

10 million is a pretty big sample, so if your source for that sample is realiable (i.e. the number of fake, duplicate or robot-accounts, etc is low), then you should be able to draw some kind of ...

View answer
2 answers
1 votes
166 views
Can an ISP limit what security software (firewall) that will work?
1 votes

No, that is an unreasonable claim. A firewall is in essence just another computer, which you happen to filter your traffic through. Unless JCOM has some way of identifying what system you are using ...

View answer
2 answers
1 votes
2k views
Trip to China - safeguarding phone and laptop
1 votes

Your phone is basically a pocket computer that communicates with the world around it in a myriad of ways (wireless networks, blue tooth and cellular network, others?). It communicates using certain ...

View answer
6 answers
0 votes
322 views
Switching operating systems for security
1 votes

Others have pointed out the risks of increasing the attack surface due to increasing the number of possible exploits when switching between systems. On the other hand, assuming you have a certain set ...

View answer
2 answers
0 votes
2k views
Wipe out or dissapear and start over again in internet for personal security?
Accepted answer
1 votes

I would think your "friend" could go through all his various accounts and disable them, one by one. That would probably not delete his data, but it would likely reduce his visibility by a great deal. ...

View answer
3 answers
0 votes
2k views
How secure is a server's .htaccess file?
1 votes

It's not entirely clear what you mean here. An .htaccess file is in essence, just a config file on the server. Assuming the server is reasonably well configured and hardened, so no unauthorized user ...

View answer
3 answers
4 votes
130 views
Correctly disclosing Private API security shortcomings
1 votes

Based solely on how you've written question here, it seems obvious that you have the best intentions in doing this, and that you are quite capable of making these intentions clear in written form. ...

View answer
11 answers
33 votes
53k views
Can 'cracked' product keys harm the user in any way?
1 votes

This obviously depends on what type of software you are talking about, and what position the persons who cracked it are in. If the system connects to some central server on a regular basis to verify ...

View answer
4 answers
0 votes
187 views
Anything particularly wrong with putting an auth code in marketing emails?
0 votes

Proposal: What if you create a separate page and service which displays the message to a user following that link, but then simultaneously invalidates that authCode, so that it can only be used a ...

View answer
3 answers
2 votes
163 views
LastPass - maintaining security on foreign devices
0 votes

As others have mentioned, you can access Last Pass either via their website, or on your mobile phone using their app. If you'd like to simplify the process on a PC, you can install the LastPass ...

View answer