usr-local-ΕΨΗΕΛΩΝ
  • Member for 7 years
  • Last seen this week
Security risks of fetching user-supplied URLs
31 votes

We store the URL instead of the image. In addition, this will add information and privacy risks. Let me show with a visual demo. If you try to upload any image to StackExchange, you will notice that ...

View answer
Does DNS allow third parties to register subdomains?
Accepted answer
29 votes

Welcome to Security! The case of educational/government intitutions is a particular case of subdomaining. Basically ICANN, who rules the Internet top names, delegated maangement of the .au TLD to ...

View answer
How to protect a <input type='password'/> from XSS?
25 votes

The only reasonable solution, as commented multiple times, is to protect against XSS on the very beginning. You don't want to focus on the password box. A successful XSS can do any possible harm to ...

View answer
Can someone read my E-Mail if I lose ownership of my domain?
24 votes

Assume someone will definitely buy your domain, as domain crawlers try to lock and resell, overpriced, domain names that people forget to renew. An MX record is not required in order to have mails ...

View answer
I received an "Undelivered Mail", is my email address used maliciously?
23 votes

In addition to @SteffenUllrich, you might also want to double check the headers of the attached mail. In particular, pay a lot of attention to the Received: from header (well.. the header is just ...

View answer
How can I protect my website against bitsquatting?
20 votes

I doubt about the article's dependability. While discussed at DEFCON and published as whitepaper, I have serious concerns about the experimental results. According to comment by @mootmoot, the author ...

View answer
How to use FDE without needing to share the encryption password
Accepted answer
19 votes

According to my previous answer, suggestion by @logneck and a bit of google-fu, I came to the conclusion that it is possible to implement the scheme requested in the question with available tools and ...

View answer
Exploiting the delay when a festival ticket is scanned
12 votes

This answer has already a great and cheap answer, however, I would add my own answer from both a software engineering and security point of view. This may serve helpful for future similar questions ...

View answer
How does "Somewhere you are" authentication add further security?
11 votes

Answer was posted as comment. I am claiming no reputation score From a fraud perspective it could help. For example your bank, if you always make payments from country X and all of a sudden they (the ...

View answer
Does the saying "physical access = game over" apply to smartphones, too?
11 votes

To simplify and exemplify, it is a major issue of resources and determination by the attacker, and availability of hacking tools. Historical fact: FBI hacked the "in"famous San Bernardino phone, as ...

View answer
Could governments and banks become CAs?
Accepted answer
10 votes

Case study: Italy Italy provides a well-known root CA list. The list is made mainly by banks or official professional associations. The official list is maintained at this address (no English version ...

View answer
HTTPS is widely adopted, why isn't encrypted e-mail as popular?
9 votes

The topic is very complex and is difficult to explain in a single answer. I understand that you disclosed your lack of CS education, so here we are to explain. Transport vs end to end There is a ...

View answer
Can I safely preview a short link?
8 votes

collect statistics about the usage of the short link There is no way to prevent that. In order to reveal the target link one must enquire the URL shortener service (e.g. bit.ly) in order for them to ...

View answer
If I send a plaintext e-mail using Gmail to somebody, including my PGP public key block, is that secure?
7 votes

This approach is very secure as soon as you can trust the email provider (namely, Google). All other answers on MITM attacks are true in general. In this particular case, when operating within the ...

View answer
How can WhatsApp do both targeted advertisement and end-to-end encryption?
7 votes

Added to the above answers. Whatsapp also knows your contacts network (namely the numbers of the people you speak to), because that information is necessary for routing text. That said, you may or ...

View answer
How to detect if employees are using Tor?
7 votes

Preventing the user from installing/using software that has not been approved by the company, by enforcing software policies on employees machine will suffice, combined to network authentication such ...

View answer
Search for military installed backdoors on laptop
6 votes

I need to make sure if they have added something to monitor my activities or steal my data or not Consider that they have all your data already. You surrended all your passwords, so even data that is ...

View answer
Secure Implementation of Password Database
5 votes

This is a software engineer here. I will answer from that point of view. My local network has many devices on it running simple web servers You should really try to see if you can use SSO (Single ...

View answer
How to decide whether an eshop is safe or compromised
5 votes

On eu-store.wacom.com, some images from their Amazon CDN are requested over http instead of https Let me continue from that. Firefox says it's not 100% secure because it's loading unprotected content....

View answer
Can a hashing function be implemented insecurely?
Accepted answer
5 votes

Unlikely First of all, the implementation of a hashing function could be faulty in terms of software engineering. That doesn't mean the implementation is insecure per se, but means that you are not ...

View answer
Why do we trust US Certificate Authorities?
5 votes

Still, a NSL would be enough for the government to gain the right to intercept the traffic legally. Not quite enough. And it's not a problem of US only. I think there is some background confusion in ...

View answer
Using SSO for a cryptocurrency app
Accepted answer
4 votes

You are basically asking if Google or Facebook will ever turn evil and command their IT team to steal your customer's account (i.e. initiate an SSO flow) to steal their money. That's something, ...

View answer
.Net dll encryption
4 votes

Going for obfuscation than encryption is the way to go. Encryption takes the easy-to-reverse-engineer DLL and adds a layer of encryption, for which one must know the key. Once the key is revealed/...

View answer
Is my Android phone camera hacked?
Accepted answer
4 votes

It's not hacked. It's just bloated by Samsung software. What you see is a log of com.samsung.android.smartface leaking (if I can say that) into your application log. This because logcat monitors logs ...

View answer
Are Whatsapp and Signal truly secure and user-privacy friendly?
4 votes

WhatsApp has a known security design loophole. The private keys are indeed stored on the user's device. When you install WA on device B, you will be taking ownership of your account again. At this ...

View answer
Is saving a dark web page locally and reloading it in another browser a security risk?
Accepted answer
3 votes

Likely That depends all on what scripts the page might be running. If the page contains malicious code that is trying to de-anonymize you, then it is a risk. If the page has <script src="//...

View answer
Why are mobile phones OS easily hackable (Pegaus & Co)
Accepted answer
3 votes

I think that the question starts from wrong or biased assumptions. You are observing a true phenomenon (mobile devices hacked systematically) and try to conclude that they are weaker than desktop ...

View answer
How are hardware wallets and other hardware-based security devices audited?
3 votes

This is exactly the common problem of root trust in computer science. You must trust someone/something to behave as advertised. It can be reworded "putting an anchor on trust", from which &...

View answer
How to protect against SIM swap scammers?
3 votes

First, the symptom of a SIM swap is that you lose signal on your phone. Using a primary number rather than a secondary, i.e., one your mum will usually call you on instead of a SIM card you put in the ...

View answer
Do multiple routers increase security?
3 votes

I have seen this design once in a slide, to protect from Government-level backdoors, but it was meant as a joke and had only 3 layers. More in general, it would be intuitively to use both a Huawei and ...

View answer