Ángel
  • Member for 7 years, 7 months
  • Last seen more than a week ago
What should you do if you catch encryption ransomware mid-operation?
Accepted answer
188 votes

Hibernate the computer If the ransomware is encrypting the files, the key it is using for encryption is somewhere in memory. It would be preferable to get a memory dump, but you are unlikely to have ...

View answer
Why can I log in to my Facebook account with a misspelled email/password?
83 votes

It is long know that Facebook allows you on purpose to log in with the password case reversed or the first character capitalized (see this article). They do this while storing only a hashed password. ...

View answer
Redacting URLs as an email-phishing preventative?
59 votes

First of all, it would be a usability nightmare. Second, it wouldn't even fix the problem it purports to. While it could be effective to phishing mails designed for 'normal' clients, attacks designed ...

View answer
How can I secure MySQL against bruteforce attacks?
48 votes

The most simple solution would be not to expose MySQL. Usually, MySQL server is accessed only from the same machine, in which case you can set it to listen only on a Unix socket, or on a loopback ...

View answer
SSH from a shared workplace computer
Accepted answer
46 votes

Given that you have a stable computer, I would go ahead and do use ssh keys instead of a password for ssh access (even if you were using a different lab computer each time, a ssh key in a portable usb ...

View answer
Does putting salt first make it easier for attacker to bruteforce the hash?
34 votes

Actually, you are tackling it the opposite way. It is true that doing hash(salt + password) would allow you to precompute the salt (but see note below) and only hash each password candidate for all ...

View answer
A government agency sent our website admin an email that our website had been defaced
31 votes

A CERT (Computer Emergency Response Team) task is precisely to watch over the security problems on the actives under their constituency. In the case of national CERTs like CERT-AU, they often care ...

View answer
Sequential identifying string that can't be reverse engineered (the "invoice number" problem)
30 votes

I would simply use the picture hash. What's the problem with someone figuring out the hash you used? If I think "this part of the url looks like a sha1", download the file and it has that sha1, I was ...

View answer
Are URL parameters of GET and POST requests over HTTPS secure?
28 votes

No, no, no. HTTPS protects the whole HTTP request. The url path, the parameters, cookies, http headers, the body... The only thing it doesn't protect (other than tcp parameters like ip addresses and ...

View answer
I almost searched my password, but didn't press enter. Is my password at risk, because of autocomplete or anything else?
25 votes

It has been sent (encrypted) to Google. Change your password It has probably been logged somewhere, along with many search terms and other junk people have typed there. While it's unlikely it will be ...

View answer
Is it possible to read a text file inside a password-protected zip file without the password?
Accepted answer
24 votes

No. There are two ways of zip encryption, a classic one, which is weaker, and a newer one based on AES. In both cases the password is needed in order to decrypt the contents (i.e. it's not just UI, ...

View answer
What stops Google from saving all the information on my computer through Google Chrome?
23 votes

Lawyers. You have a contract with Google stating what they will do / you allow them to do. This is called the Google Chrome Terms of Service . And obviously, you have carefully read it before ...

View answer
HTTPS web service switched to HTTP. What can go wrong?
23 votes

I would raise the following question: What's the point in having authentication in the application? If all the page contains is public content and verifiable in an outside way (eg. a debian mirror, ...

View answer
How should source code security be checked?
20 votes

You either do it yourself or trust someone else As with most things in life, you must either do it yourself or trust someone else with it. Here trusting covers both having no malicious intent and ...

View answer
Received email from ISP saying one of my devices has malware
19 votes

This looks like a legitimate email. Someone detected that a computer with an Indian IP address was part of a botnet. This was shared with your National CERT (CERT-In). In turn, as they didn't know ...

View answer
Getting files back by paying Ransomware
19 votes

There are some reports of people getting their files back, however other people have reported being requested a second -unexpected- payment after that (not that surprising, given this is an extortion)...

View answer
Why do email server/clients block executable attachments?
18 votes

Put bluntly Users are stupid Not all of them, of course. But when you are handling the email for hundreds or even thousands of users, you will have some of those users that will open anything, ...

View answer
Trying to understand why signatures in root certs "are not used"?
18 votes

The browser already contains a copy of the root cert. Thus, it doesn't need to verify it through its signature. Even if you broke SHA-1, you couldn't replace the root certificate that is already ...

View answer
Eduroam requires installation of a CA Certificate - can they decrypt TLS traffic?
15 votes

is "Installed for Wi-Fi" which I assume means that the credential is applied to all WiFi traffic. No. It doesn't mean this. There are several ways in which a WiFi network may authenticate a user. ...

View answer
Should a bank/financial service use external URL shortener services?
14 votes

In addition to the other answers, I would like to stress that communications from a financial shall be easily verifiable for the user. Say a customer receives an sms/email: YOURBANK: Your purchase ...

View answer
Is storing sensitive data in files instead of a database safe?
Accepted answer
14 votes

The best measure to do this is to store such file on a directory outside the web root. Basically, all of the solutions 'solve' the problem, in making the password file not available. Their ...

View answer
Find matching phone numbers without actually knowing them
12 votes

Yes, it is (a bit) flawed. The problem is that the space is too small, so even with the multiple rounds and salts, it's relatively easy to bruteforce. Open Whisper Systems had a witty system where ...

View answer
New Hires get phishing emails very quickly - Reasoning and how to stop
11 votes

First of all, if the SPF and DKIM do show that the email was indeed sent from gmail (note that gmail only has a SOFTFAIL spf), you want to outright block this address. Or better yet, have any email ...

View answer
Do the most common ransomware programs delete the original files as they go, or in a big bulk delete at the very end?
11 votes

They will mostly be file-by-file. Thus, if you are “lucky”, you may find yourself with only some folders infected. There are several reasons for this: Easy to code. Just iterate through every file ...

View answer
What does a website see if I am connected on my native IP and then enable my VPN?
10 votes

They see that the user Matt (identified by cookie 1234…) two seconds ago had IP address 1.1.1.2 but now has IP 8.8.8.9 (I am assuming you are streaming via http(s), and the streaming happens by ...

View answer
Free EV on localhost
Accepted answer
9 votes

No. They do not have and they will not issue such certificate. The CA/Browser Forum Baseline Requirements forbid to issue a certificate for a shared resource, such as localhost or a rfc 1918 IP. Not ...

View answer
How to protect and detect DNS manipulations from browser side?
Accepted answer
9 votes

I'm afraid we won't have a proper solution until we get everyone to use DNSSEC. However, I predict that unless someone discovers a really critical flaw in DNS protocol forcing everyone to implement ...

View answer
How does Firefox's "first-party isolation" feature function?
9 votes

From a cursory look, they isolate the cookies (and other data) on silos based on the domain you navigated to. So eg. a load to facebook.com when visiting www.stackexchange.com, would put facebook ...

View answer
Does the use of an on-screen keyboard give a false sense of security or protect against all types of keyloggers?
Accepted answer
9 votes

Yes, it is most often just a useless "security measure". We need to define the threat model and then if an on screen keyboard provides a proper mitigation. A OSK will protect against two threats: A ...

View answer
Google DNS query pointing at ISP instead of Google
Accepted answer
9 votes

Google has some servers (Edge Nodes) located into ISPs for quicker response, this is what they call the Google Global Cache. They are basically big proxy caches for serving static content (such as ...

View answer
1
2 3 4 5
15