User curiousguy

117 votes

Accepted

What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?

answered Jun 22, 2012 at 2:07

29 votes

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

answered Aug 15, 2012 at 1:21

24 votes

Accepted

What risks do Cookieless sessions have? What are the mitigations?

answered Jul 27, 2012 at 7:09

23 votes

Accepted

Google Account: implications of using application-specific passwords

answered Aug 13, 2012 at 3:28

18 votes

Why are passwords limited to 16 characters?

answered Jul 31, 2012 at 21:49

16 votes

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

answered Nov 9, 2011 at 18:11

13 votes

Lessons learned and misconceptions regarding encryption and cryptology

answered Sep 28, 2011 at 4:03

12 votes

Accepted

Recompute Rainbow table with salt?

answered Jun 29, 2012 at 23:45

11 votes

Is the Web browser status bar always trustable?

answered Sep 3, 2013 at 5:44

10 votes

Accepted

Are there vunerabilities with this authentication mechanism?

answered Jul 4, 2012 at 23:58

9 votes

Accepted

Distinguish between Wi-Fi Captive portal and MitM attack

answered May 2, 2015 at 3:22

8 votes

Accepted

What do the various browser "private modes" do?

answered Jun 27, 2012 at 22:53

8 votes

Accepted

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

answered Jun 17, 2012 at 22:52

6 votes

Reject IP packets with an ICMP error, or just drop them?

answered Sep 25, 2011 at 5:56

6 votes

Why do browsers warn about mixed content for images?

answered Jul 13, 2012 at 0:58

6 votes

Why users want to disable cookies?

answered Aug 11, 2012 at 3:41

6 votes

How "enforcable" are email disclaimers

answered Aug 12, 2012 at 17:48

6 votes

When changing a password, does it have to be completely different?

answered Jul 25, 2012 at 18:06

6 votes

Can the USB standard be altered to prevent the "firmware attack"?

answered Aug 1, 2014 at 0:39

5 votes

Effectiveness of Security Images

answered Aug 24, 2012 at 6:35

4 votes

How to verify correct, secure and test setuid?

answered Sep 7, 2012 at 16:41

4 votes

Could browsers improve security of stored passwords by using setuid?

answered Sep 9, 2012 at 15:33

4 votes

Accepted

HTTPS Sensitive Information and Caching

answered Sep 10, 2012 at 19:26

4 votes

Accepted

How do you properly setup Tor on Windows 7?

answered Jul 11, 2012 at 2:55

4 votes

Accepted

Secure SSL Session from losing itself into unsecure http

answered Nov 17, 2011 at 10:49

4 votes

Risks of serving untrusted content under HTTP Content-Type: text/plain?

answered Jun 21, 2012 at 19:15

4 votes

Are CSRF tokens useful outside of web APIs?

answered Feb 13, 2015 at 18:29

3 votes

Does a CSRF cookie need to be HttpOnly?

answered Jun 16, 2018 at 10:59

3 votes

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

answered Jun 19, 2012 at 19:37

3 votes

Configure Linux to allow network activity based on binary?

answered May 30, 2012 at 21:39

Stack Exchange Network

56 Answers

What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

What risks do Cookieless sessions have? What are the mitigations?

Google Account: implications of using application-specific passwords

Why are passwords limited to 16 characters?

Is it possible to easily retrieve Thunderbird's passwords with access to HDD?

Lessons learned and misconceptions regarding encryption and cryptology

Recompute Rainbow table with salt?

Is the Web browser status bar always trustable?

Are there vunerabilities with this authentication mechanism?

Distinguish between Wi-Fi Captive portal and MitM attack

What do the various browser "private modes" do?

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

Reject IP packets with an ICMP error, or just drop them?

Why do browsers warn about mixed content for images?

Why users want to disable cookies?

How "enforcable" are email disclaimers

When changing a password, does it have to be completely different?

Can the USB standard be altered to prevent the "firmware attack"?

Effectiveness of Security Images

How to verify correct, secure and test setuid?

Could browsers improve security of stored passwords by using setuid?

HTTPS Sensitive Information and Caching

How do you properly setup Tor on Windows 7?

Secure SSL Session from losing itself into unsecure http

Risks of serving untrusted content under HTTP Content-Type: text/plain?

Are CSRF tokens useful outside of web APIs?

Does a CSRF cookie need to be HttpOnly?

Is a company website secure against sslstrip if it doesn't use ssl on homepage but ssl everywhere else?

Configure Linux to allow network activity based on binary?