Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

Can a lock picker slowly undermine the security of a deadbolt door?

I have a space for computers secured with a simple deadbolt. Someone keeps coming to pick the lock. While working there, I have scared them away three times. There are cameras, but not in useful ...

physical locks doors  
asked by Village 38 votes
answered by R15 37 votes

What makes it difficult to have a hardware antivirus

MS Windows is always vulnerable to virus and worms and having an antivirus is almost necessary. How is it possible that hardware antiviruses don't exist? The idea sounds pretty good, if the antivirus ...

asked by Ulkoma 20 votes
answered by Filip Haglund 19 votes

Is it possible to get the salt if I have the hash and original password?

Is it possible to get the salt if I have the hash and original password? My gut feeling is no, but would it be impossible or will it just take very long?

asked by Jake 15 votes
answered by OJW 40 votes

Does too long a salt reduce the security of a stored password hash?

Suppose we have passwords that are statistically 7-8 characters long. Is appending a 200 character long salt less secure than a 5 character salt, because of the similar hash function inputs? I was ...

passwords hash password-policy salt  
asked by killer_PL 14 votes
answered by Iszi 31 votes

Can JavaScript be used to capture the user's screen?

Can JavaScript be used to capture the user’s screen? If so, is this functionality available in any JS framework? (I do not need code examples: I am mainly asking to form an opinion about the security ...

asked by x457812 12 votes
answered by Bob Brown 16 votes

Are photographs of fingerprints a security risk?

It should be trivial to get fingerprint patterns for many of the most important people in the world, as they frequently (enough) wave their hand, palms forward, to many HD cameras. Is it possible to ...

exploit fingerprinting  
asked by raindrop 8 votes
answered by GdD 10 votes

Can virtual machines be used to isolate vulnerable software?

I have had a look at most of the previous questions about virtual machines (VMs) and they all appear to be focused on hosting malware in the VM and preventing it breaking out of the VM. What I can’t ...

malware virtualization  
asked by R15 7 votes
answered by Paul 3 votes

Greatest hits from previous weeks:

What technical reasons are there to have low maximum password lengths?

I have always wondered why so many websites have very firm restrictions on password length (exactly 8 characters, up to 8 characters, etc). These tend to be banks or other sites I actually care about ...

passwords password-policy  
asked by enderland 319 votes
answered by Tom Leek 706 votes

Token-based authentication - Securing the token

I have developed a backend REST API for a mobile app and I am now looking to implement token-based authentication for it to avoid having to prompt the user to login on every run of the app. What I ...

asked by James 37 votes
answered by Thomas Pornin 32 votes

Can you answer these?

Mcafee endpoint encryption doesn't see previously encrypted partition after Windows 7 reinstallation

My partitions C and D were encrypted and Windows 7 was installed on C. I copied all important files to D and then changed harddrive controller from IDE to AHCI, removed C and created it again and then ...

windows disk-encryption  
asked by alcohol is evil 1 vote

Is there an extension/command line for OSX Chromium to save website passwords in LOCALSTORAGE instead of the system's keychain?

My situation: I want to use a portable-app implementation of Chromium running on a removable drive, so I never leave any passwords stored on the kaychain of any computer I use. Portable Chromium is ...

password-management macosx chrome  
asked by pinhead 1 vote

should I encrypt a certificate used only for automation?

I have a PEM file used only for automatic builds and tests on amazon. My project is open source and I am keeping all information on github. If the information is sensitive, I encrypt it and still ...

asked by guy mograbi 1 vote
Subscribe to more Stack Exchange newsletters

Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3