User SilverlightFox

248 votes

Why didn't OSes securely delete files right from the beginning? And why do they still not do this?

answered Jan 15, 2016 at 14:29

83 votes

Is CORS helping in anyway against Cross-Site Forgery?

answered Aug 27, 2015 at 17:00

82 votes

On two-step login forms, why is it the login name and not the password that's asked first?

answered Sep 9, 2015 at 14:37

78 votes

Accepted

How to implement “forgot password” functionality?

answered Mar 18, 2016 at 12:14

55 votes

Accepted

What are requirements for HMAC secret key?

answered Aug 7, 2015 at 10:05

45 votes

Why should you redirect the user to a login page after a password reset?

answered Nov 10, 2015 at 14:16

40 votes

Accepted

Why does the SSL/TLS handshake have a client and server random?

answered May 16, 2015 at 15:03

39 votes

Accepted

How does a hacker know how many times a password was hashed?

answered Aug 28, 2015 at 10:13

38 votes

Accepted

How do I purge Windows of my private data when formatting the drive is not an option?

answered Sep 29, 2015 at 8:43

36 votes

New Gmail login system—going against conventional wisdom?

answered May 9, 2015 at 9:21

36 votes

How secure is RDP?

answered Aug 10, 2016 at 9:34

35 votes

Accepted

Should login and logout action have CSRF protection?

answered Jul 9, 2014 at 15:05

29 votes

Accepted

Why is the Access-Control-Allow-Origin header necessary?

answered Oct 18, 2013 at 15:00

29 votes

Should I use CSRF protection for GET requests?

answered Feb 26, 2016 at 10:24

28 votes

Accepted

Does it add anything to restrict IP address?

answered Jan 19, 2015 at 18:57

28 votes

Accepted

Is "mini-httpd" a secure web server?

answered Sep 29, 2015 at 10:27

28 votes

Why is leaving a passworded SSH over the internet so bad?

answered Feb 2, 2016 at 16:23

27 votes

Accepted

What is the best way to transmit password hash over unreliable TLS?

answered Jan 27, 2015 at 15:54

25 votes

Accepted

How to protect against login CSRF?

answered Jun 6, 2014 at 17:56

21 votes

Is a secure cookie without the HttpOnly flag a problem?

answered Apr 11, 2017 at 11:33

20 votes

Accepted

How secure are expiring tokens and refresh tokens?

answered May 6, 2015 at 11:01

19 votes

Accepted

Would making an IIS web server appear to be running Apache instead improve security?

answered Jul 16, 2015 at 9:33

18 votes

Accepted

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

answered Jun 9, 2015 at 13:30

18 votes

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

answered May 27, 2014 at 9:32

17 votes

Accepted

How to stop other websites from sending cross domain AJAX requests?

answered Nov 10, 2013 at 20:52

17 votes

Accepted

How to prevent email discovery in forms?

answered Dec 28, 2013 at 15:41

16 votes

Accepted

Security of LastPass' password generator

answered Jan 4, 2015 at 13:06

16 votes

How does this HTML5-based "Mass Router Infection" scheme work?

answered Jul 27, 2015 at 12:45

16 votes

Accepted

How can CloudFlare provide a valid SSL certificate for domains not under its control?

answered Sep 30, 2015 at 13:08

16 votes

Accepted

Access-control-allow-origin: * with a bearer token

answered Jul 1, 2016 at 8:09

Stack Exchange Network

653 Answers

Why didn't OSes securely delete files right from the beginning? And why do they still not do this?

Is CORS helping in anyway against Cross-Site Forgery?

On two-step login forms, why is it the login name and not the password that's asked first?

How to implement “forgot password” functionality?

What are requirements for HMAC secret key?

Why should you redirect the user to a login page after a password reset?

Why does the SSL/TLS handshake have a client and server random?

How does a hacker know how many times a password was hashed?

How do I purge Windows of my private data when formatting the drive is not an option?

New Gmail login system—going against conventional wisdom?

How secure is RDP?

Should login and logout action have CSRF protection?

Why is the Access-Control-Allow-Origin header necessary?

Should I use CSRF protection for GET requests?

Does it add anything to restrict IP address?

Is "mini-httpd" a secure web server?

Why is leaving a passworded SSH over the internet so bad?

What is the best way to transmit password hash over unreliable TLS?

How to protect against login CSRF?

Is a secure cookie without the HttpOnly flag a problem?

How secure are expiring tokens and refresh tokens?

Would making an IIS web server appear to be running Apache instead improve security?

Why is the synchronizer token pattern preferred over the origin header check to prevent CSRF

How are Ajax requests vulnerable to CSRF attacks if the Same-origin policy is applied?

How to stop other websites from sending cross domain AJAX requests?

How to prevent email discovery in forms?

Security of LastPass' password generator

How does this HTML5-based "Mass Router Infection" scheme work?

How can CloudFlare provide a valid SSL certificate for domains not under its control?

Access-control-allow-origin: * with a bearer token