Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

Why is "www." considered unsafe in this HTTPS URL?

I was doing some cross-origin requests to Soundcloud's oEmbed and I noticed some strange behaviour. When doing a request from my localhost, which is on a regular HTTP connection, everything worked …

asked by Jon Snow 22 votes
answered by David Houde 85 votes

Are there secure alternatives to single-use password reset links?

We currently have what I believe to be a pretty standard scheme for dealing with password resets. Our reset links are single-use links: They expire immediately after they've been visited, even if the …

asked by svidgen 22 votes
answered by Stephane 14 votes

Additional security benefits from Multi-Factor Authentication?

Does multi-factor authentication provide any additional security benefits on top of doing a better job at correctly identifying and authenticating users compared to single factor authentication? In …

authentication multi-factor  
asked by Cowlby 14 votes
answered by Cory 11 votes

Obfuscated php code found on the server

I found this piece of code hosted on my website I'm sure it's a malware. Any have an idea what this script does or how to deobfuscate? <?php …

asked by calculataur 9 votes
answered by Tokk 8 votes

Can ISP block HTTPS selectively?

Can ISP block HTTPS selectively i.e. certain websites cannot be accessed using HTTPS while others can be ?

asked by rintec 8 votes
answered by Eric G 7 votes

Does CSRF prevention also prevent reflected XSS attack?

What I understand about reflected XSS is ... When a web application is vulnerable to this type of attack, it will pass unvalidated input sent through requests back to the client... [1] …

xss attack-prevention csrf  
asked by mg007 7 votes
answered by SilverlightFox 9 votes

What is "c/s" in context of hash cracking?

I was reading hashcat's About page, and the stats are listed in terms of c/ that "Cracks per seconds"....the 'c' part seems wrong, I'm just guessing. What is 'c'?

asked by Aerovistae 6 votes
answered by Jeff Clayton 10 votes

Greatest hits from previous weeks:

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp …

smartphone instant-messaging  
asked by ilaz 21 votes
answered by Terry Chia 30 votes

Are there any reasonable TrueCrypt forks?

Unfortunately, TrueCrypt may have been discontinued yesterday. I use LUKS on Linux, but I liked the fact that with TrueCrypt I had a portable solution across Windows, Mac, & Linux. TrueCrypt …

disk-encryption truecrypt luks  
asked by Michał Šrajer 34 votes
answered by Philipp 37 votes

Can you answer these?

How can I protect my "try it with one click" service?

I have a service with "try it now" experience that currently offers a "one click" effort. This service has a pool of N resources (lets say 50). Each new resource takes about 1 hour to generate. …

authentication denial-of-service  
asked by guy mograbi 2 votes

Facebook drops SSL

I observed that sometimes my facebook https connection changes to http after using the site for a while. Is it possible for ISP or somebody in between to do such a thing by throttling the net speed ? …

asked by technic 2 votes

How can document.referrer be used for XSS?

A very simple example... <div id="cat"></div> <script> document.getElementById("cat").innerHTML = document.referrer; </script> or <script src="' + document.referrer + …

xss javascript dom  
asked by Michael Blake 1 vote
Subscribe to more Stack Exchange newsletters

Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3