Aug
1
comment How can Paypal know my card is being used in another account?
Mastercard does something similar too: masterpass.com/en-us.html
Jun
26
comment What's the safest way to inform a new user of their password on an invite-only website?
Not the same thing, but what we do on our site that is between invite only and public is: user registers with username, password and email, we manually approve user's account (or delete it), user gets an email to verify their email, and when they verify their email, they can immediately access their account with the password they set.
Jun
26
comment What's the safest way to inform a new user of their password on an invite-only website?
"This will prevent the situation where users who do not set their password can have their token guessed and their account hijacked." so use a long, long token. putting a time limit doesn't really add any security value IMO.
Jun
26
comment What's the safest way to inform a new user of their password on an invite-only website?
As someone who has to develop a gatekeeper for a community of people who are expected have a certain level of technical knowledge, I can assure you that the UX on this would confuse a lot of people who aren't great with computers or with English (and therefore would cause a lot of users to not register), would be seen as phishing.
May
9
awarded  Editor
May
9
revised How safe is Two Factor Authentication (TOTP)?
better wording, proper gender neutral
Apr
7
comment How can I make payments on the Internet without leaving a money trail?
Some stores also offer prepaid debit cards that you can buy with cash and use anywhere online, I believe.
Apr
5
comment Alternative to sending password over mail?
Why do this when you can just use PGP, which is actually intended for things like this?
Mar
6
comment How can I be pwned if I'm not registered on the compromised site?
I doubt that it's just a mistake on HIBP's end.
Feb
13
awarded  Popular Question
Feb
4
comment Can I trust public code versioning platforms when building a social platform?
@Bergi obviously the secrets CI would use for tests and such wouldn't be the same as production secrets. If you're talking about Gitlab CD (continuous deployment), this is a valid argument, though, but if you don't trust Gitlab with it, you can simply not use that feature.
2018
Oct
28
awarded  Popular Question
Jan
4
comment What are the risks of not patching a server or hypervisor for Meltdown?
@AlexanderO'Mara "a Linux developer measured it to be roughly 5% for most workloads and up to 30% in some cases, even with the PCID optimization"
2017
Dec
6
comment Is public Wi-Fi a threat nowadays?
@jonna_983 1) you're assuming that users are tech savvy enough to understand and patch all devices 2) you're ignoring my point of "some if not most devices don't get security patches, especially routers". 3) I've never seen such a notification. I do keep my system updated, but still, I've seen none, even on devices of people that don't update their systems.
Dec
6
comment Is public Wi-Fi a threat nowadays?
@jonna_983 krack is nowhere near "taken care of". Many phone or router manifacturers simply don't release updates, many people don't update, many people use old OSes. Krack will probably only be near "taken care of" in a decade or so.
Oct
27
comment Are virtual keyboards not necessary anymore to protect against keyloggers?
Again, the virtual keyboards of banks are implemented on web stack, and just listening for keystrokes won't give you the password. Taking screenshot doesn't work with my bank for example, as they change all characters to * when a key is pressed, and they scramble key positions after each keypress. Surely some keyloggers might adapt to that but not most. I personally don't use the virtual keyboard but it's probably at least OK when fighting against keyloggers.
Oct
27
comment Are virtual keyboards not necessary anymore to protect against keyloggers?
@Viezevingertjes we're talking about virtual keyboards on bank sites, implemented with html/css/js, which are not capable of emulating a keystroke a regular keylogger would be able to pick up.
Jul
22
comment Why is Firefox (and only Firefox) reporting that my connection is insecure on multiple sites?
Can you check certificate info on IE and/or Chrome? Specifically CA.
Jul
15
awarded  Talkative
May
14
comment Does WannaCry infect Linux?
Well, if you ignore the "No wine" requirement, it does run on linux and it does encrypt files