Skip to main content
bobince's user avatar
bobince's user avatar
bobince's user avatar
bobince
  • Member for 12 years, 6 months
  • Last seen more than a month ago
8 votes
Accepted

Is a forced rewrite from http to https secure? What does SSLRequireSSL add?

3 votes

PCI-DSS Scope with tokenisation

5 votes

How can I prevent reflected XSS in my JSON web services?

3 votes
Accepted

How to prevent the following clickjacking attack?

0 votes

Is not checking the src url a vulnerability?

33 votes
Accepted

Convince the company not to store credit card numbers in our webapp

19 votes
Accepted

When registering for most websites, why do you need to confirm your email address?

22 votes

Is it standard practice to ask a customer to send a photo of their credit card to confirm their identity?

5 votes
Accepted

How does a trojan like Trojan:JS/BlacoleRef.BV infect a website?

6 votes

Malicious Script

5 votes
Accepted

Risks of serving untrusted content under HTTP Content-Type: text/plain?

2 votes

Mass account lockout prevention using CSRF tokens

17 votes
Accepted

Why doesn't the same origin policy block get requests that contain arguments?

5 votes

Does setting the cookie-path protect me from XSS from another context?

16 votes

Why is passing the session id as url parameter insecure?

5 votes

Are Three attempts to block login a good idea?

3 votes

Does X-Content-Type-Options really prevent content sniffing attacks?

4 votes
Accepted

Why the servers stores hashed password instead of relaying on private/public key

3 votes

Why did secureserver.net (GoDaddy) access my Gmail account?

4 votes
Accepted

What servers or clients are immune to related-domain cookie attacks? (*.example.com)

5 votes
Accepted

Has my Mac been compromised?

1 vote
Accepted

Removing Google Analytics cookie string from URL - security hole?

4 votes
Accepted

Can a CSRF CAPTCHA be defeated?

1 vote

sha512 as no-login-necessary token

20 votes
Accepted

Exploits or other security risks with SVG upload?

3 votes
Accepted

Should I prevent user from operating with site during some first seconds?

3 votes
Accepted

What due diligence is required for HTTPModules that run within IIS?

9 votes

Clickjacking: can't browsers just forbid/reject placing transparent elements over frames?

6 votes
Accepted

Is this JSON encoding vulnerable to CDATA injection?

3 votes

Will htmlspecialchars (php) be enough for making secure PDF files with user entered data?