User Gudradain

178 votes

Accepted

Does anybody not store salts?

answered Jul 15, 2016 at 12:29

50 votes

Accepted

If I enter a password on the wrong site, should I consider it compromised?

answered Nov 12, 2015 at 16:34

37 votes

Accepted

How is Google Chrome managing authentication to sites?

answered Jul 23, 2014 at 18:03

27 votes

What is the best way to transmit password hash over unreliable TLS?

answered Jan 27, 2015 at 14:10

21 votes

Accepted

Suspicious JavaScript in website header

answered Oct 15, 2015 at 13:41

16 votes

Why is key exchange necessary at all?

answered Nov 17, 2015 at 16:19

12 votes

Downloading a file from a server with a secret: in text or binary?

answered May 26, 2017 at 17:13

12 votes

Mitigate timing attack threat against password recovery page

answered Oct 9, 2015 at 14:34

9 votes

Web app with iframe and user - how to deal with session?

answered Jul 22, 2014 at 14:36

9 votes

Is there a name for this flawed way of thinking about security?

answered Nov 17, 2015 at 20:16

9 votes

Accepted

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

answered Oct 30, 2015 at 17:59

7 votes

Is it bad to have cameras using a static IP address?

answered Jan 20, 2015 at 19:02

6 votes

Why are drives overwritten three times when being disposed of?

answered Oct 30, 2014 at 13:32

6 votes

password grant without client secret?

answered Oct 6, 2015 at 19:18

5 votes

Accepted

AES-ECB chosen plaintext attack with long secret

answered Oct 7, 2015 at 13:14

5 votes

Accepted

I store my passwordstore.org data in the cloud. Are my passwords safe?

answered Jul 23, 2014 at 12:34

5 votes

OAuth2 and Authentication

answered Apr 1, 2016 at 20:34

5 votes

Accepted

How does the "post/redirect/get pattern" improve security?

answered May 19, 2017 at 20:16

4 votes

Including a OAuth client_secret file in a Java application

answered Nov 5, 2015 at 18:38

4 votes

Accepted

If I obtained a username and the salted password pairs from a server, can I login?

answered Oct 29, 2015 at 15:07

4 votes

Accepted

SQL Injection via table name?

answered Oct 7, 2015 at 13:04

4 votes

Accepted

How does the same-origin policy apply between browser tabs?

answered Jan 28, 2015 at 20:06

4 votes

Accepted

What are the security implications of having login dialog inside of an iframe

answered Sep 24, 2015 at 22:00

4 votes

Accepted

Are there any flaws in this two way cryptographic function?

answered Dec 2, 2014 at 18:56

3 votes

Accepted

Securing an OAuth / OpenID Connect identity in a cookie for easy login

answered Oct 9, 2014 at 13:41

3 votes

Accepted

When visiting an HTTPS page for the first time, why isn't there a prompt for the certificate?

answered Jul 25, 2014 at 14:06

3 votes

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

answered Aug 20, 2014 at 13:26

3 votes

Accepted

Password generation based on hash of master password + suffix?

answered Oct 29, 2015 at 20:13

3 votes

Accepted

Would this work to protect a cookie with an OAuth token?

answered Oct 15, 2015 at 18:01

3 votes

Accepted

Secure Software: How to ensure caller is authentic?

answered Oct 30, 2015 at 15:02

Stack Exchange Network

67 Answers

Does anybody not store salts?

If I enter a password on the wrong site, should I consider it compromised?

How is Google Chrome managing authentication to sites?

What is the best way to transmit password hash over unreliable TLS?

Suspicious JavaScript in website header

Why is key exchange necessary at all?

Downloading a file from a server with a secret: in text or binary?

Mitigate timing attack threat against password recovery page

Web app with iframe and user - how to deal with session?

Is there a name for this flawed way of thinking about security?

Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?

Is it bad to have cameras using a static IP address?

Why are drives overwritten three times when being disposed of?

password grant without client secret?

AES-ECB chosen plaintext attack with long secret

I store my passwordstore.org data in the cloud. Are my passwords safe?

OAuth2 and Authentication

How does the "post/redirect/get pattern" improve security?

Including a OAuth client_secret file in a Java application

If I obtained a username and the salted password pairs from a server, can I login?

SQL Injection via table name?

How does the same-origin policy apply between browser tabs?

What are the security implications of having login dialog inside of an iframe

Are there any flaws in this two way cryptographic function?

Securing an OAuth / OpenID Connect identity in a cookie for easy login

When visiting an HTTPS page for the first time, why isn't there a prompt for the certificate?

It is possible to decrypt HTTPS traffic when a man in the middle proxy is already in place?

Password generation based on hash of master password + suffix?

Would this work to protect a cookie with an OAuth token?

Secure Software: How to ensure caller is authentic?