Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

Technology that can survive a "Rubber-Hose attack"

In the documentary film Citizenfour, Edward Snowden says about documents: I'm comfortable in my technical ability to protect [documents]. I mean you could literally shoot me or torture me and ...

passwords file-encryption  
asked by QBR8ZIKvyJ 42 votes
answered by Jeff Ferland 36 votes

How does Android L achieve strong encryption with a low entropy passphrase?

After upgrading to Android L on my Nexus 5, I was pleased to find that I can enable encryption using a pattern as the passphrase. However, it soon got me thinking. I'm guessing the encryption key is ...

android disk-encryption  
asked by tangrs 37 votes
answered by Gilles 45 votes

Possibility to sniff HTTPS traffic on devices without installing a certificate

My goal is to sniff the HTTPS traffic of some digital devices (AppleTV, game consoles, etc.), and decrypt the HTTPS packets in my local network. I cannot figure out a way by using some HTTPS ...

tls certificates man-in-the-middle sniffer  
asked by Yifei 19 votes
answered by apsillers 37 votes

VeraCrypt/TruCrypt - I can't understand why you'd want to create a "hidden" volume...?

I can't think of a reason as to why you'd want to create a hidden volume in VeraCrypt. It says because "you may be asked to hand the information," but why would I need to hand it over? Nobody has any ...

disk-encryption file-encryption tools truecrypt  
asked by Jack 13 votes
answered by user54791 27 votes

In light of the FREAK TLS vulnerability, why do so many servers still offer RSA-EXPORT keys?

Ars Technica is reporting on a new attack against HTTPS. Called FREAK, the devices reported as vulnerable include iPhones, Android devices, and Macs running OS X. The attack (as has been clarified ...

tls attacks man-in-the-middle brute-force  
asked by JoltColaOfEvil 9 votes
answered by bonsaiviking 7 votes

"Secure" third-party inbox

My business sometimes receives emails from our clients that are sent through a "secure" third-party inbox. The client send the message through this third-party service. The third party creates an ...

asked by browly 8 votes
answered by boggart 8 votes

Why is my debugger detected as a Trojan by anti-virus software?

I'm trying to use a deugger (namely OllyDbg) to analyze some exe files. However, all the versions I downloaded from the Internet are considered as Trojans by some anti-virus software. (I use ...

malware debugging trojan  
asked by lyenliang 6 votes
answered by M'vy 16 votes

Greatest hits from previous weeks:

How do I secure Apache against the Bash Shellshock vulnerability?

I have an Apache webserver running, and with the recent news of the Shellsock exploit against bash I was wondering if my webserver is vulnerable. I don't think it is, but I want to make sure I'm not ...

apache shellshock bash  
asked by user56147 40 votes
answered by mr.spuratic 25 votes

XKCD #936: Short complex password, or long dictionary passphrase?

How accurate is this XKCD comic from August 10, 2011? I've always been an advocate of long rather than complex passwords, but most security people (at least the ones that I've talked to) are ...

cryptography passwords entropy  
asked by Billy ONeal 604 votes
answered by AviD 552 votes

Can you answer these?

what security features a good Email Service Provider (for marketing) should have?

To choose the right Email Service Provider (ESP) for e-mail marketing processes, what are security requirements and checklists that we should pay attention to and ask for from vendors? In other ...

email vendor-selection requirements  
asked by Goli E 1 vote

What sort of attack can reset MySQL Privileges and unmount remote drives without root or shell?

ATTACK VECTOR Monthly hits via a globally DDoS attack. Resolved with Cloudflare. Attacker can now somehow unmount network drive links and reset MySQL user permissions for applications. Attack is ...

attacks attack-vector  
asked by 2 votes

Can a Radius server mitigate an ARP spoofing attack?

I'm helping my school network administrator to try to find a way to mitigate a current ARP spoofing attack on our wifi network. We detected an unknown host (MAC address seem to change, he is probably ...

attack-prevention threat-mitigation arp-spoofing radius  
asked by Dremor 1 vote
Subscribe to more Stack Exchange newsletters

Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3