Gudradain
  • Member for 7 years, 5 months
  • Last seen more than a month ago
9 answers
91 votes
17k views
Does anybody not store salts?
Accepted answer
177 votes

Not storing the salt is bad advice. The main purpose of a salt is that each user password has to be attacked individually. If you do not store the salt then, as you said, you need to try every ...

View answer
10 answers
76 votes
18k views
If I enter a password on the wrong site, should I consider it compromised?
Accepted answer
49 votes

Just to play the devil advocate... You are as likely to be compromised as if you were using the same password on both site*. As most people have pointed, you probably don't have to worry. Not so ...

View answer
3 answers
25 votes
8k views
How is Google Chrome managing authentication to sites?
Accepted answer
37 votes

With a cookie! Chrome, like any other browser, is storing a cookie in your file system. Those cookies are what enable you to reconnect automatically to some site. Since it's in your file system, even ...

View answer
5 answers
13 votes
3k views
What is the best way to transmit password hash over unreliable TLS?
27 votes

You can't. There is no secure way to transmit it if you can't authenticate the server and establish a secure channel. If you can't authenticate the server then you can't be sure if you are talking ...

View answer
4 answers
22 votes
6k views
Suspicious JavaScript in website header
Accepted answer
21 votes

It seems that the "actual code" you posted is packed using http://matthewfl.com/unPacker.html. When you unpacked it you obtain var jxPogLroeXQvpXkmguljZoGSNnIQKQUt=setInterval(function() { if(...

View answer
4 answers
48 votes
8k views
Why is key exchange necessary at all?
17 votes

There are many steps needed to understand the reasons and I will try to guide you through each. 1) Use encryption correctly... With RSA algorithm, Alice and Bob can just share their public keys (...

View answer
6 answers
1 votes
2k views
Downloading a file from a server with a secret: in text or binary?
12 votes

No, If the type of file is specified then there is no added security at all. For example, unzipping a file is so trivial that it doesn't add any security. If you ask whether it's more secure to ...

View answer
7 answers
15 votes
4k views
Mitigate timing attack threat against password recovery page
12 votes

Let's ask the real question here : Is the list of usernames associated with your application secret? Kind of but mostly NO. Usually, each username is unique in an application so it's very hard if ...

View answer
5 answers
-1 votes
320 views
Is there a name for this flawed way of thinking about security?
9 votes

What about : Security Theater? Security theater is the practice of investing in countermeasures intended to provide the feeling of improved security while doing little or nothing to actually ...

View answer
1 answers
15 votes
48k views
Web app with iframe and user - how to deal with session?
9 votes

First, it's not a good idea as far as I know to put a secure application in an iframe because that expose you to security issue. The biggest one is probably clickjacking if all else is done correctly. ...

View answer
1 answers
6 votes
1k views
Are there any risks associated with using a single U2F/FIDO key with multiple sets of credentials?
Accepted answer
8 votes

No, you are safe Even if you entered it inside a malicious computer, your key could not be compromised. It uses the same security as a credit card; meaning a smart card. This smart card contains a ...

View answer
9 answers
40 votes
24k views
Is it bad to have cameras using a static IP address?
7 votes

Not really... Dynamic and static address have different advantages/inconvenients. Static Vulnerable to data mining as you always use the same address. Great to host a server (like viewing the ...

View answer
2 answers
9 votes
9k views
password grant without client secret?
6 votes

There are multiple problems with what you are trying to do... General Information OAuth2 in the "traditional" way is not meant to be used on anything other than a webbrowser. This means that if you ...

View answer
3 answers
13 votes
4k views
Why are drives overwritten three times when being disposed of?
6 votes

It's to remove any trace of the previous memory. Not an expert but here is what I understand. Memory is stored in binary format : 0 and 1. So you can see your memory as a big array of 0 and 1 that we ...

View answer
2 answers
18 votes
5k views
OAuth2 and Authentication
5 votes

@RaptisDimos gave a good answer but I think I will expend on point #3. Why is OAuth2 implicit flow insecure for authentication while still secure for authorization? The problem with the implicit ...

View answer
1 answers
6 votes
2k views
AES-ECB chosen plaintext attack with long secret
Accepted answer
5 votes

I think you already said the solution in your post but let's repoint it. AES work with block size of 16 bytes (128 bits) The secret is appended to a text that you choose. ??? Find out the characters ...

View answer
2 answers
4 votes
957 views
I store my passwordstore.org data in the cloud. Are my passwords safe?
Accepted answer
5 votes

Am I at risk doing this? No If "pass" is safe, meaning it is doing encryption correctly, you could send your encrypted passwords to anyone you want and you would still be fine. As long as they are ...

View answer
1 answers
2 votes
1k views
How does the "post/redirect/get pattern" improve security?
Accepted answer
4 votes

It's mostly a usability issue and not a security issue. POST-REDIRECT-GET (RPG) is there to stop the client from submitting the same form 2 times by error when he tries to reload the page for example....

View answer
1 answers
7 votes
610 views
If I obtained a username and the salted password pairs from a server, can I login?
Accepted answer
4 votes

Disclaimer: I'm no expert in cryptography so this answer come from my limited understanding of the protocol. Let's look at the protocol SaltedPassword := Hi(Normalize(password), salt, i) ClientKey ...

View answer
1 answers
3 votes
2k views
How does the same-origin policy apply between browser tabs?
Accepted answer
4 votes

Can A.js call a function from B.js? No, the javascript need to be defined on your current page Can A.js modify the DOM of page B.html? Yes, but you need a reference AND have the same origin. If ...

View answer
3 answers
2 votes
384 views
Are there any flaws in this two way cryptographic function?
Accepted answer
4 votes

First don't roll your own crypto and read DTK answer. But, I do believe that we learn by experimenting so I will answer your questions Does there already exist a similar two-way function? Yes. ...

View answer
1 answers
5 votes
1k views
Session renewal how often is necessary?
3 votes

You are right that it doesn't really provide more security. Except usability problems and increased complexity, I'm not sure what it brings. For example, if you change the session_id and invalidate ...

View answer
1 answers
3 votes
137 views
Computer identity still recognised after reinstall
3 votes

Because of the MAC address. The MAC address is stored on your internet card and is shared with the router to route the internet packets. Since, you connected with the cafe wifi, it gave your MAC ...

View answer
2 answers
6 votes
490 views
Secure Software: How to ensure caller is authentic?
Accepted answer
3 votes

Basically, you can't... Anything on the client side needs to be considered as public. Sure, you can try to obfuscate the API with various technique but there is always a way to reverse engineer it ...

View answer
1 answers
8 votes
2k views
Including a OAuth client_secret file in a Java application
3 votes

You should not include the client secret in a javascript/desktop/mobile application The reason is, like you said, it's very easy to access. You cannot protect it if you embedded it into your ...

View answer
2 answers
7 votes
8k views
What to use as 'state' in OAuth2 Authorization Code Grant workflow
3 votes

Disclaimer : Couldn't find any reference on the subject so I will use a questionable tool called "logic". If someone find any good reference, please add them. CSRF is dangereous There is no ...

View answer
2 answers
4 votes
1k views
Password generation based on hash of master password + suffix?
Accepted answer
3 votes

Yes and no. It depends on the strength of your master password. Since you are using a fast hashing function your master password needs to be even stronger. The main threat of this scheme is that ...

View answer
1 answers
5 votes
3k views
Would this work to protect a cookie with an OAuth token?
Accepted answer
3 votes

You are not worrying about the right things Protecting information located on the client? You don't need to do anything once the information has reached your client (ex.: your browser) in order to ...

View answer
1 answers
0 votes
1k views
SQL Injection via table name?
Accepted answer
3 votes

Yes. I'm assuming that you are building your query with string concatenation. Let's take SELECT * FROM [Database].[dbo].[#tableName#] If you replace #tableName# by employee]; DELETE FROM [Database]...

View answer
1 answers
4 votes
8k views
What are the security implications of having login dialog inside of an iframe
Accepted answer
3 votes

If you care about security, don't use iframe. How can your user trust your iframe to enter their precious login information when the other site can use some simple css to put other elements above ...

View answer