Gudradain's user avatar
Gudradain's user avatar
Gudradain's user avatar
Gudradain
  • Member for 9 years, 8 months
  • Last seen more than 2 years ago
180 votes
Accepted

Does anybody not store salts?

50 votes
Accepted

If I enter a password on the wrong site, should I consider it compromised?

37 votes
Accepted

How is Google Chrome managing authentication to sites?

27 votes

What is the best way to transmit password hash over unreliable TLS?

21 votes
Accepted

Suspicious JavaScript in website header

16 votes

Why is key exchange necessary at all?

12 votes

Downloading a file from a server with a secret: in text or binary?

12 votes

Mitigate timing attack threat against password recovery page

9 votes

Web app with iframe and user - how to deal with session?

9 votes

Is there a name for this flawed way of thinking about security?

9 votes
Accepted

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

7 votes

Is it bad to have cameras using a static IP address?

6 votes

Why are drives overwritten three times when being disposed of?

6 votes

password grant without client secret?

5 votes
Accepted

AES-ECB chosen plaintext attack with long secret

5 votes
Accepted

I store my passwordstore.org data in the cloud. Are my passwords safe?

5 votes
Accepted

If I obtained a username and the salted password pairs from a server, can I login?

5 votes

OAuth2 and Authentication

5 votes
Accepted

How does the "post/redirect/get pattern" improve security?

4 votes
Accepted

Would this work to protect a cookie with an OAuth token?

4 votes

Including a OAuth client_secret file in a Java application

4 votes
Accepted

SQL Injection via table name?

4 votes
Accepted

How does the same-origin policy apply between browser tabs?

4 votes
Accepted

What are the security implications of having login dialog inside of an iframe

4 votes
Accepted

Are there any flaws in this two way cryptographic function?

3 votes
Accepted

Securing an OAuth / OpenID Connect identity in a cookie for easy login

3 votes
Accepted

When visiting an HTTPS page for the first time, why isn't there a prompt for the certificate?

3 votes

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

3 votes
Accepted

Secure Software: How to ensure caller is authentic?

3 votes

What to use as 'state' in OAuth2 Authorization Code Grant workflow