User WoJ

80 votes

1 answer

9k views

What is this kind of low-intensity, non-hacking attack on a web service?

asked Jun 8, 2016 at 6:32

53 votes

4 answers

11k views

Why would a password be hashed before being used to encrypt something?

asked Feb 15, 2018 at 10:23

38 votes

6 answers

27k views

Is a standalone phone number considered Personally Identifiable Information?

asked Jul 3, 2018 at 8:22

34 votes

7 answers

6k views

What are the real physical risks of casual social media publishing?

asked Apr 20, 2018 at 11:53

9 votes

2 answers

55k views

Is it possible to crack a PIN / PUK code on a phone SIM card?

asked May 26, 2014 at 15:15

8 votes

2 answers

1k views

Is there an equivalent of an Apple cryptochip in Android devices?

asked Oct 28, 2015 at 16:19

7 votes

2 answers

979 views

How does Google store passwords for remote IMAP/POP services?

asked Mar 9, 2016 at 16:00

5 votes

1 answer

834 views

POC of a Java exploit using leftover JREs

asked May 22, 2013 at 9:10

4 votes

5 answers

2k views

passphrases - lowercase and dictionary words

asked Dec 12, 2011 at 16:18

4 votes

1 answer

407 views

What are the actions of Locky on the source files which lead to encrypting?

asked Mar 16, 2016 at 11:58

4 votes

1 answer

4k views

Bruteforcing an iOS PIN

asked Oct 14, 2015 at 8:06

4 votes

2 answers

1k views

Why are there questions about "media" in a PCI-DSS SAQ A?

asked Oct 21, 2015 at 7:09

3 votes

1 answer

745 views

What is "cardholder data" in PCI-DSS SAQ A context?

asked Oct 12, 2015 at 8:22

3 votes

2 answers

2k views

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

asked Jul 22, 2015 at 10:34

3 votes

2 answers

2k views

What are the security risks to have admin rights for a user account on Windows 10?

asked Nov 6, 2020 at 8:46

3 votes

4 answers

418 views

How to crack passwords without revealing them?

asked Sep 23, 2016 at 8:09

3 votes

2 answers

230 views

Is there a standard recommending physical destruction of a machine?

asked Mar 16, 2017 at 16:09

3 votes

1 answer

2k views

Is a non-authenticated CSRF still a CSRF?

asked Apr 22, 2017 at 11:01

3 votes

1 answer

572 views

How effective is Expect-CT against content inspection in an enterprise context?

asked Sep 24, 2019 at 11:11

2 votes

2 answers

360 views

Where are IDS useful today?

asked Mar 13, 2017 at 16:52

2 votes

1 answer

2k views

Should a PCI-DSS certification be renewed?

asked Sep 28, 2017 at 14:36

2 votes

2 answers

393 views

How is a DNS wildcard a security issue for GitHub Pages?

asked Feb 1, 2021 at 16:20

2 votes

3 answers

649 views

Is a HTTP Request Smuggling a concern when using load balancers?

asked Mar 25, 2022 at 12:11

2 votes

0 answers

137 views

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

asked May 23, 2016 at 11:10

2 votes

1 answer

445 views

Is a "standalone WPS server" possible?

asked Feb 12, 2016 at 8:24

1 vote

0 answers

123 views

Is there a "smart cache" device which provides cache if authorized?

asked Oct 27, 2015 at 19:17

1 vote

3 answers

1k views

How are private and public keys different?

asked Mar 23, 2016 at 16:20

1 vote

1 answer

254 views

Formal functional relationship between risk and CVSS

asked Jul 31, 2015 at 6:56

1 vote

1 answer

136 views

Does a Mailbox Export Request modify the mailbox data?

asked Sep 23, 2015 at 10:05

1 vote

2 answers

406 views

Are there standards for software disk image acquisition in forensics?

asked Apr 10, 2015 at 15:01

Stack Exchange Network

41 Questions

What is this kind of low-intensity, non-hacking attack on a web service?

Why would a password be hashed before being used to encrypt something?

Is a standalone phone number considered Personally Identifiable Information?

What are the real physical risks of casual social media publishing?

Is it possible to crack a PIN / PUK code on a phone SIM card?

Is there an equivalent of an Apple cryptochip in Android devices?

How does Google store passwords for remote IMAP/POP services?

POC of a Java exploit using leftover JREs

passphrases - lowercase and dictionary words

What are the actions of Locky on the source files which lead to encrypting?

Bruteforcing an iOS PIN

Why are there questions about "media" in a PCI-DSS SAQ A?

What is "cardholder data" in PCI-DSS SAQ A context?

Where to check if a specific OS / service is vulnerable despite being patched, because of a vendor's decision?

What are the security risks to have admin rights for a user account on Windows 10?

How to crack passwords without revealing them?

Is there a standard recommending physical destruction of a machine?

Is a non-authenticated CSRF still a CSRF?

How effective is Expect-CT against content inspection in an enterprise context?

Where are IDS useful today?

Should a PCI-DSS certification be renewed?

How is a DNS wildcard a security issue for GitHub Pages?

Is a HTTP Request Smuggling a concern when using load balancers?

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

Is a "standalone WPS server" possible?

Is there a "smart cache" device which provides cache if authorized?

How are private and public keys different?

Formal functional relationship between risk and CVSS

Does a Mailbox Export Request modify the mailbox data?

Are there standards for software disk image acquisition in forensics?