schroeder
Moderator
  • Member for 10 years, 1 month
  • Last seen this week
  • United Kingdom
What is the purpose of confirming old password to create a new password?
Accepted answer
356 votes

If you are logged in and I sit down at your computer, I can lock you out of your account and transfer ownership to myself.

View answer
Why did I have to wave my hand in front of my ID card?
319 votes

Movement that blocks the view of the item under inspection helps to defeat someone trying to use an overlay image on the video as a replacement for the actual item. For instance, I could take a ...

View answer
Is it safe to pay bills over satellite internet?
219 votes

Satellite is not safe. Neither is cell data, wifi, or cable Internet. None of it is safe at the layer that you are talking. And that's not the layer that needs to be safe. It's the data that goes ...

View answer
Disadvantages of replacing TCP/IP with blockchain
Accepted answer
211 votes

Blockchain is a distributed ledger. Because everyone has a copy of the data, and those copies can be verified and protected by some very clever algorithms, it makes the data stored on them reliable ...

View answer
How can I argue against: "System is unhackable so why patch vulnerabilities?"
Accepted answer
181 votes

The trouble with the situation (as you are reporting it) is that there are a lot of assumptions being made with a lot of opinions. You have your opinions and you want them to share your opinions, but ...

View answer
Does an ISO27001 audit require users to reveal their passwords?
179 votes

Absolutely not! ISO 27001 requires management of passwords and requires having password policies. Someone in your company is interpreting this as needing to inspect all passwords in the clear to ...

View answer
How should I securely type a password in front of a lot of people?
179 votes

You could use Two Factor Authentication that uses your phone to log in along with your password. That way, even if they see your password, they would need your phone, too to log in.

View answer
Is password entry being recorded on camera a realistic concern?
Accepted answer
173 votes

Lots of examples. A high-profile and recent example is when Kanye was caught on camera entering his "00000" password to unlock his device. Shoulder-surfing is one reason why applications do not ...

View answer
Is it possible to detect 100% of SQLi with a simple regex?
Accepted answer
172 votes

Keyword filtering for SQLi is not a good technique. There are too many ways to bypass it. Crazy things like sel/**/ect might work, for instance. Or playing games with substr(). And then there's EXEC('...

View answer
Is there any actual security benefit to restricting foreign IP addresses?
Accepted answer
165 votes

The concept is "reducing the threat surface". If there is an expectation that no connections will be made from a certain geographic area, then it makes sense to block that area, because, by definition,...

View answer
Roles to play when tailgaiting into a residential building
162 votes

There are some basic social engineering approaches to use that work in most situations, not just tailgating: urgency authority curiosity pretexting Urgency Be someone with a specific task to ...

View answer
Is there a legitimate reason I should be required to use my company's computer? (BYOD prohibited)
152 votes

As a guy who writes and enforces these types of corporate policies, I can tell you this: it is perfectly normal, and a perfectly reasonable policy. I do NOT want your equipment on my network, ever. ...

View answer
Should I let my child's school have access to my kid's personal laptop?
Accepted answer
150 votes

Needing to install things is kind of the point of needing the laptop, so it makes perfect sense that they want to install Office, AV, and certificates. There are no surprises there. To do that, they ...

View answer
Got an email saying my password is weak, reason for concern?
Accepted answer
148 votes

They do not need to be able to read your password to test it against known weak and guessable passwords. All they need to do is to try all the guessable passwords against your password. It can be ...

View answer
Mac OS X terminal prompt displaying foreign hostname (or: What is Stacey's iPhone doing in my Terminal?)
Accepted answer
138 votes

At some point, your network assigned StaceysiPhone6s an IP address. Then, your laptop got that IP address. Your Mac then looked up the DHCP logs to find out who 'owned' that IP and found "...

View answer
Is browser history an important factor when considering security?
Accepted answer
120 votes

Yes, this is a vulnerability. You can point them to such august bodies as OWASP Top 10 https://www.owasp.org/index.php/Information_exposure_through_query_strings_in_url https://www.owasp.org/index....

View answer
Is it bad practice to prefix my hash with the algorithm used?
Accepted answer
118 votes

Many different password hashing systems do this. The type of hashing mechanism used should not be (and should not need to be) a secret. Kerckhoffs's principle says: A cryptosystem should be secure ...

View answer
Website returning plaintext password
Accepted answer
117 votes

Quite obviously, if they can display your password, then they are storing your password somehow. They might cache your password on the client-side when you log in (for unjustifiable reasons, like ...

View answer
Advised to block all traffic to/from specific IP addresses
117 votes

If you spoke to the FI on a separate channel, you actually spoke to the FI, and they know about this, then by definition, it is not a phish. What strikes me as odd is "but they can't (won't) provide ...

View answer
Why do "remote desktop" software (allegedly) commonly have a "blackout" feature?
115 votes

So that passers-by cannot see what you are doing on your computer. If you are connecting remotely to a computer in an office, then everyone could see everything you type and you would not know. It is ...

View answer
Is it really safe to use Signal or Telegram on untrusted phone hardware?
115 votes

The short answer is that if the hardware is compromised, then anything you can read, it can read.

View answer
Is this email asking me to sent them $100 for details on a security flaw in my website a scam?
113 votes

This certainly is not standard practice. Even if this person has found a legitimate problem on your site, it's a form of extortion. There is proper "responsible disclosure" and professional "...

View answer
I got an email threatening to DDOS me if I don't pay a ransom. What should I do?
107 votes

This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people ...

View answer
Employer makes me use what I believe to be an insecure website for HR functions. What to do?
105 votes

To start with the easy bit: you do not have to put real information as the answers to the questions. Random strings work best if you are really paranoid and store them in a password manager just like ...

View answer
Could keystroke timing improve security on a password?
Accepted answer
102 votes

The term you are looking for is "keystroke dynamics" or "keystroke biometrics" and is an interesting and growing field. The idea is that an individual types certain keys in a certain way that does ...

View answer
When is phishing education going too far?
101 votes

I think there is an underlying problem that you will need to address. Why do the users care that they are failing? Phishing simulations should, first and foremost, be an education tool not a testing ...

View answer
How do I inform a company I found a leaked database of theirs on the Internet?
Accepted answer
97 votes

Don't give security info to non-security people. Use whatever contact method is available to ask for the right security person. Don't give details about what you found until you get someone who will ...

View answer
Confused about using a password that "would take centuries to break"
Accepted answer
86 votes

The online calculators are basing their results on a particular set of assumptions, ones that might not apply in any one case. There is no basis for trusting the calculators to provide any insight ...

View answer
Are virtual keyboards not necessary anymore to protect against keyloggers?
Accepted answer
84 votes

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers. But the keylogger software developers quickly adjusted to this new ...

View answer
What attacks are made possible by public release of my web history?
Accepted answer
83 votes

Your question might be more undefined than you realise. Any kind of data can be passed using URL parameters. Usernames, passwords, authentication tokens, settings, form data, or anything the web ...

View answer
1
2 3 4 5
61