Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

Should I be concerned if my website throws stack information?

I have a simple login form on my web page and the URL looks like this: example.com/signup/signup.php?q=1 If I try something like this: example.com/signup/signup.php?q=1&() I'm redirected to ...

web-application php vulnerability error-handling  
asked by Kevin 41 votes
answered by Alasjo 62 votes

Is Clickjacking a real security vulnerability?

As I understand it, this is how an attacker would exploit clickjacking: Create a new website malicioussite.com which includes my site in a frame, but overlays malicious input fields or buttons over ...

clickjacking  
asked by Nathan 25 votes
answered by Adi 39 votes

What is a "spam seed"?

Here I found a new terminology first time. Looks like a spam seed is a post, which "is designed to allow spammers to post questions so it looks legitimate". What means this exactly? Maybe it ...

spam terminology  
asked by peterh 23 votes
answered by Unihedro 27 votes

What does "random" mean in the context of password creation?

Disclaimer: as you will see from my question I'm a total outsider in this subject, just very curious. I was wondering how easy it would be to crack a password-protected RAR5 file, and I found many ...

passwords random  
asked by SantiBailors 16 votes
answered by Thomas Pornin 18 votes

Can 'cracked' product keys harm the user in any way?

If a user download commercial software through the official, corresponding website, but use a product key which you did not legitimately purchase (e.g. websites that offer a list of product keys for ...

privacy license-enforcement  
asked by Ben 15 votes
answered by Mast 9 votes

Hide the fact of e-mail communication

Bob has a mistress. Her name is Alice. Bob`s wife Eve knows Bob is unfaithful, but she does not know who the mistress is. Alice does not know Bob is married. Bob needs to communicate with Alice over ...

encryption email  
asked by vojta 15 votes
answered by Fab 15 votes

Why is the truncate function for HMAC one time passwords so complicated?

I've been reading through RFC4226 as part of some research and I was wondering why the function to truncate the HMAC was so complicated. As far as I understand it, the last 4 bits of the HMAC define ...

authentication one-time-password  
asked by Miles 12 votes
answered by Thomas Pornin 17 votes

Greatest hits from previous weeks:

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...

passwords cryptography hash bcrypt  
asked by Sam Saffron 301 votes
answered by Thomas Pornin 303 votes

What is certificate pinning?

I'm superficially familiar with SSL and what certs do. Recently I saw some discussion on cert pinning but there wasn't a definition. A DDG search didn't turn up anything useful. What is certificate ...

tls certificates public-key-infrastructure  
asked by Avery 75 votes
answered by tylerl 56 votes

Can you answer these?

Lighteater - BIOS/UEFI vulnerable

I am currently a bit confused, I have read today an article about the BIOS-rootkit Lighteater made by John Loucaides and Andrew Furtaki. In their presentation 'How many million BIOSes would you like ...

research bios boot flash-memory uefi  
asked by user3852496 2 votes

I just deployed DNSSec. Is there any benefit in DANE for a CA- issued Cert?

I just deployed DNSSec at https://val-id.com and https://getvalid.com Since DNSSec is a requirement of DANE, and I have a CA-based certificate, can I show my support for DANE-based deployments by ...

dns dnssec dns-spoofing dane  
asked by makerofthings7-C.Lamont 4 votes

How do nested vpns through VM work?

Let's say I have 2 different VPN services (vpn1 and vpn2) both using OpenVPN and a Linux host running a guest VM. Now let's suppose I connect from the Linux host to vpn1. Then I connect from the ...

vpn  
asked by uname333341 1 vote
Subscribe to more Stack Exchange newsletters


Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on stackexchange.com.

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all stackexchange.com emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3