Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

Is it possible the person sitting across from me at Starbucks was trying to hack my laptop?

I was using my laptop at a Starbucks on a table, and a person was using a laptop on the same table across from me, a couple seats to my side. He flicked some plastic thing across the table towards my ...

wifi hardware system-compromise  
asked by Murvin 46 votes
answered by PiTheNumber 66 votes

Does injecting querystring values directly into HTML pose a security risk?

Someone reported a bug on my site that I don't really consider an issue. My site has an URL akin to this:[text injection] So filetype is application/json, and I ...

xss javascript ajax crossdomain  
asked by user1203028 45 votes
answered by Lie Ryan 48 votes

Why does Windows Ship with Expired SSL Certificates?

I am cleaning up the certificate stores on my Windows machines, and considering which certificates I should keep, and which ones I should delete. Why does a fresh install of Windows Server 2012 R2 ...

certificates windows public-key-infrastructure certificate-authority  
asked by Ryan Ries 39 votes
answered by BigHomie 43 votes

Is Git crowdsourcing cryptographic attacks?

A strong cryptographic hash makes collisions unlikely. Many cryptographic protocols build on that fact. But Git is using SHA-1 hashes as object identifiers. So there are a lot of already computed ...

cryptography protocols sha  
asked by MvG 38 votes
answered by Mark 47 votes

Can a neighbour who installed my router access it?

I have a bit of a security concern. I'm concerned that my neighbor sees everything on my computer, web sites I have visited, my passwords, etc. Background: He installed a Linksys router in my house ...

network router  
asked by Kenny 35 votes
answered by GroundZero 36 votes

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...

tls passwords databases sql-server  
asked by Craig Curtis 16 votes
answered by Philipp 12 votes

Distance between two passwords

It is known that people reuse their passwords across different sites. The reuse can be done in two ways: using exactly same password for two different sites, slight modifying the password of one ...

passwords attacks  
asked by Curious 14 votes
answered by Peter Horvath 11 votes

Greatest hits from previous weeks:

How does SSL/TLS work?

How does SSL work? I just realised we don't actually have a definitive answer here, and it's something worth covering. I'd like to see details in terms of: A high level description of the protocol. ...

tls certificates public-key-infrastructure  
asked by Polynomial 408 votes
answered by Luc 362 votes

I found that the company I work for is putting a backdoor into mobile phones

I have found out recently that the remote assistant software that we put in a smartphone we sell can be activated by us without user approval. We are not using this option, and it is probably there ...

disclosure ethics backdoor  
asked by anonymousquery 249 votes
answered by Oleksi 230 votes

Can you answer these?

DIsk imaging on virtual environment

Every forensics material you read, tell you to get an image of the disk and work with this image. However, it seems they always refer to a single computer. What if the compromise is on a VMWare ...

asked by yzT 1 vote

Anatomy of a Cyber exercise and SOC

What exactly entails an incident response exercise (like a Red/Tiger team excercise)? How does it add value to a security operations center? Is there any good resource I can read up on how to set up a ...

cyber-warfare soc  
asked by dorothy 1 vote

Use of RSA in Yaksha Security System

So I'm reading over the Yaksha Security System and see it is based on the RSA cryptosystem and a centralized server, easy enough. What I'm slightly confused on is the math behind the related keys. It ...

public-key-infrastructure rsa  
asked by sealsix 1 vote

New blog post:

QoTW #51 Would it be good secure programming practice to overwrite a “sensitive” variable before deleting it?

by Xander on Dec 12

Jonathan recently asked this question about secure development practices, specifically, whether it makes a difference to your application’s security if you overwrite the values of sensitive ...

Subscribe to more Stack Exchange newsletters

Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3