Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

How does a hacker know how many times a password was hashed?

I've been reading a lot of questions about security and hash functions on this site and others. I am not an expert, just a curious mind and in my understanding the more iterations used to hash a ...

passwords cryptography hash  
asked by NKD 31 votes
answered by SilverlightFox 34 votes

Is Ghostery safe to use?

I've heard about Ghostery, a browser extension/plugin that blocks web trackers. But according to this link it sells our data. Are add-ons and plugins open source in Firefox? Is there another ...

firefox plugins  
asked by Vesal75 28 votes
answered by Philipp 30 votes

Cloudflare's free SSL options require trusting them; what could they do to change that?

Cloudflare offers 3 free SSL options: Flexible SSL, Full SSL, and Full Strict SSL. The article “CloudFlare’s great new features and why I won’t use them” explores the shortcomings of the Flexible and ...

tls certificates public-key-infrastructure  
asked by Breakhty 20 votes
answered by Chris Murray 23 votes

How does DRM stop copying?

I've been doing some research into some DRM solutions, specifically "self-protecting containers". One example of this is DigiBox. Normally, the protected data is encrypted in some kind of container. ...

asked by Renren29 19 votes
answered by Nic Barker 22 votes

Is sha1sum still secure for downloadable software packages signature?

We use sha1sum to calculate SHA-1 hash value of our packages. Clarification about the usage: We distribute some software packages, and we want users to be able to check that what they downloaded is ...

sha sha256 future-proofing  
asked by Michael 14 votes
answered by Tom Leek 37 votes

What is the difference between http and https with a self-signed SSL certificate?

A colleague of mine has told me he doesn't see why there is a warning when visiting a HTTPS website with a self-signed certificate saying that the security may be compromised, but there is no warning ...

tls web-browser certificate-authority  
asked by cosmo0 14 votes
answered by schroeder 32 votes

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...

authentication mobile man-in-the-middle sslstrip fido  
asked by LamonteCristo 11 votes
answered by SilverlightFox 2 votes

Greatest hits from previous weeks:

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?

cryptography network tls ssh  
asked by Am1rr3zA 82 votes
answered by Thomas Pornin 90 votes

New Gmail login system—going against conventional wisdom?

I noticed that the new gmail login asks for username first, and then confirms if such username exists, before asking for password input. Does this not go against conventional security wisdom to not ...

passwords gmail user-enumeration  
asked by ataftoti 76 votes
answered by schroeder 57 votes

Can you answer these?

NX + ASLR bypass - troubles with return address of .bss

I have one problem, while doing NX + ASLR bypass. I'm going through this tutorial step-by-step. Everything is going well, I have prepared my exploit, just with another address and some small ...

asked by core2dump 2 votes

John the Ripper performance

I have two questions regarding performance of John the Ripper. Within the format files, there is a variable named MIN_KEYS_PER_CRYPT and MAX_KEYS_PER_CRYPT. How much do they influence the ...

asked by Thanathan 2 votes

How to explain BEAST attack to non-tech people

I'm looking for the best way to describe the Browser Exploit Against SSL/TLS (BEAST) attack to non-technical people, without being too general. So I am not looking for: "did you ever noticed the lock ...

tls beast  
asked by aentgood 1 vote
Subscribe to more Stack Exchange newsletters

Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3