User Buffalo5ix

80 votes

Accepted

The most secure way to handle someone forgetting to verify their account?

answered Jul 18, 2019 at 16:29

69 votes

Is it ok to send plain-text password over HTTPS?

answered Jan 12, 2016 at 21:06

65 votes

Accepted

How to proceed with a white-hat hacker claiming a vulnerability?

answered Feb 13, 2019 at 21:19

8 votes

Username Enumeration in 2018 - How serious is this

answered Feb 14, 2019 at 1:39

7 votes

Accepted

How easy it is to actually perform MITM attack these days

answered Mar 6, 2017 at 21:50

7 votes

Why are phishing attempts so obvious?

answered May 2, 2017 at 21:25

6 votes

IoCs of Pegasus spyware penetration

answered Jul 20, 2021 at 22:34

4 votes

Is it ok to let someone unlock their own account with their admin account?

answered Aug 14, 2019 at 17:01

3 votes

Accepted

Unauthorized access to a page - when or if you should return 401 HTTP status code

answered Jan 15, 2016 at 18:57

2 votes

Accepted

Value of Physical Security Vulnerabilities to an Attacker

answered May 9, 2017 at 21:11

2 votes

Accepted

Is open RDP really dangerous?

answered Apr 16, 2018 at 20:46

2 votes

How to reset passwords without emailed reset link?

answered Feb 20, 2019 at 20:51

2 votes

Accepted

Secure password reset before authentication?

answered Feb 22, 2019 at 17:26

2 votes

Accepted

Anti-CSRF mechanism in a form changing password with an old password input is it required?

answered Apr 9, 2019 at 21:11

2 votes

Accepted

Sending a token with a request from one app to another

answered Jan 14, 2016 at 0:19

1 vote

Accepted

Understanding POST based XSS

answered Aug 13, 2019 at 16:39

1 vote

Can a school monitor my school laptop?

answered Apr 12, 2019 at 16:35

1 vote

Will SIM‐like PIN on website as second password increase security

answered Apr 16, 2019 at 20:53

1 vote

Blind XSS Payload for xml file?

answered Jun 6, 2019 at 18:02

1 vote

What security settings are likely used in Obama's Blackberry?

answered Feb 22, 2019 at 19:59

1 vote

Using a single application for user and admin (with different auth methods) vs separating them into two applications

answered Jan 25, 2016 at 18:25

1 vote

metasploit exploits and payloads documentation

answered Jan 28, 2016 at 17:20

1 vote

What are some important concepts to teach developers about cross-site scripting (XSS)?

answered Aug 31, 2016 at 19:30

1 vote

Is there an added risk in passing session token in message body?

answered Oct 21, 2016 at 22:19

0 votes

What full-disk secure erase solutions exist for SSDs (OS X)?

answered Jan 13, 2016 at 17:40

0 votes

Dynamic Application Security Testing (DAST) Scanner for Post Authentication

answered Jul 26, 2019 at 18:19

Stack Exchange Network

26 Answers

The most secure way to handle someone forgetting to verify their account?

Is it ok to send plain-text password over HTTPS?

How to proceed with a white-hat hacker claiming a vulnerability?

Username Enumeration in 2018 - How serious is this

How easy it is to actually perform MITM attack these days

Why are phishing attempts so obvious?

IoCs of Pegasus spyware penetration

Is it ok to let someone unlock their own account with their admin account?

Unauthorized access to a page - when or if you should return 401 HTTP status code

Value of Physical Security Vulnerabilities to an Attacker

Is open RDP really dangerous?

How to reset passwords without emailed reset link?

Secure password reset before authentication?

Anti-CSRF mechanism in a form changing password with an old password input is it required?

Sending a token with a request from one app to another

Understanding POST based XSS

Can a school monitor my school laptop?

Will SIM‐like PIN on website as second password increase security

Blind XSS Payload for xml file?

What security settings are likely used in Obama's Blackberry?

Using a single application for user and admin (with different auth methods) vs separating them into two applications

metasploit exploits and payloads documentation

What are some important concepts to teach developers about cross-site scripting (XSS)?

Is there an added risk in passing session token in message body?

What full-disk secure erase solutions exist for SSDs (OS X)?

Dynamic Application Security Testing (DAST) Scanner for Post Authentication