Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

What is Logjam and how do I prevent it?

I heard there is a "new" TLS vulnerability named Logjam, what does it do and how do I prevent it?

tls diffie-hellman  
asked by Arperum 56 votes
answered by Thomas Pornin 67 votes

What is an n-day security attack?

There are several attacks types in computer security. For instance, zero-day attacks consist of attacks that use undisclosed exploits. In contrast, what is an n-day attack? Is it a security concern?

malware attacks disclosure zero-day  
asked by user76825 26 votes
answered by Steve DL 37 votes

Why do you need to close your browser window after logging out of a website?

Might be wrong, but believe the request to close the browser window after logging out is common, though it's completely unclear what the risks might be of failing to close a browser window (assuming ...

web-browser session-management safe-browsing  
asked by blunders 23 votes
answered by Steve DL 22 votes

Is full disk encryption on a server in a secure data center pointless?

I am having a debate with several people regarding how much protection full disk encryption provides. dm-crypt is being used to encrypt data which is required by my company to be encrypted at rest. ...

encryption linux disk-encryption dm-crypt  
asked by user4755220 22 votes
answered by Stephane 39 votes

Server for School Coding Assignments

An introductory C++ course is offered every year in our university. In order for students to code in C++ and submit their assignments, we give them shell access to a Linux server. They use ssh to log ...

access-control shared-hosting privilege-escalation  
asked by Soban 15 votes
answered by Steve DL 28 votes

PayPal encrypted with obsolete cryptography

My Chrome just complained from PayPal's security, similarly to this issue: Google Chrome "Your connection to website is encrypted with obsolete cryptography" The identity is verified, but ...

encryption tls certificates paypal  
asked by cburatto 13 votes
answered by Tom Leek 21 votes

How to Check if a server is not vulnerable to logjam?

In response to Logjam I want to prove I hardend my services. I know that the DH param has to be 2048 bits atleast and self generated. but I am unable to find a way to actually check this for something ...

tls openssl diffie-hellman  
asked by LvB 8 votes
answered by StackzOfZtuff 6 votes

Greatest hits from previous weeks:

"Optimal" Web Server SSL Cipher Suite Configuration

Over the last couple of years there have been a number of changes in what would be considered an optimal SSL cipher suite configuration (e.g. the BEAST and CRIME attacks, the weaknesses in RC4) My ...

tls webserver cipher-selection  
asked by Rоry McCune 53 votes
answered by that guy from over there 33 votes

GHOST bug: is there a simple way to test if my system is secure?

GHOST (CVE-2015-0235) just popped up. How can I quickly check if a system of mine is secure? Ideally with a one line shell command. According to the ZDNet article "you should then reboot the system". ...

ghost glibc  
asked by Kasper Souren 58 votes
answered by aaronfay 69 votes

Can you answer these?

How does JavaScript Injection work?

I was watching a DefCon talk and the speaker was saying he was able to infect JavaScript cache files, once the user visited his website/server. From there he was able to load scripts from other sites ...

javascript  
asked by Jake Cross 2 votes

CMS/PKCS#7: specifying signatureAlgorithm with digest?

I'm confused about algorithm selection for Cryptographic Message Syntax (a.k.a. CMS, PKCS#7) signed objects (RFC5652 Section 5.1). The SignerInfo structure (RFC5652 Section 5.3) has two separate ...

hash public-key-infrastructure digital-signature algorithm asn1  
asked by Richard Hansen 2 votes

What is a 'host identity' in the 'Host Identity Protocol' (HIP)

I'm a little confused about terminology in the Host Identity Protocol (HIP) The two distinct terms Host Identity and Host Identifier are described in https://tools.ietf.org/html/rfc4423#section-3 ...

authentication protocols  
asked by yyannecc 2 votes
Subscribe to more Stack Exchange newsletters


Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on stackexchange.com.

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all stackexchange.com emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3