Information Security Weekly Newsletter
Information Security Weekly Newsletter

Top new questions this week:

What ways are there to verify a self written protocol?

Before everyone goes yelling: "NEVER DO YOUR OWN CRYPTO." I haven't, technically. (I'm still half way), but apart from that I am making a TLS-like protocol but way lighter. I needed to secure ...

code-review  
asked by Vincent Advocaat 18 votes
answered by GZBK 14 votes

Why do some bank websites use passwords that are not case sensitive?

It was recently brought to my attention that a certain big bank website allows users to log in with passwords that are not case sensitive. After confirming this, I checked other websites I bank with ...

passwords password-policy banks  
asked by BigHomie 13 votes
answered by gowenfawr 27 votes

Should I use a Certificate Revocation List?

I've been trying to provide security to my API. I will issue certificates to my clients to access my API through a TLS channel. So it'll be a SSL-Client Authentication. I'm wondering, should I use ...

authentication certificates certificate-authority certificate-revocation crl  
asked by user3765109 7 votes
answered by Thomas Pornin 9 votes

Is there any evidence misusing the HTTP Pragma header in responses has any effect?

I've been investigating the Pragma header, since there are already two other cache-busting HTTP response headers (Cache-Control & Expires), and I was interested in which browsers use(d) the old ...

http caching  
asked by brianary 6 votes

How does combining SHA256 with RIPE-MD160 compare to SHA256 + SHA-3?

Bitcoin stores its addresses as a combined SHA256 + RIPE-MD160 hash. Is it correct to assume this is done to prevent a failure in the algorithm? Since SHA3 was designed to be an alternative to ...

cryptography hash sha256 bitcoin sha-3  
asked by LamonteCristo 5 votes
answered by GZBK 0 votes

Does http.sys vulnerability affect Windows not running any webservers?

Windows kernel level HTTP driver http.sys is affected by remote code execution vulnerability (MS15-034). This security update resolves a vulnerability in Microsoft Windows. The vulnerability ...

windows exploit vulnerability exposure  
asked by vartec 5 votes
answered by phiz 2 votes

Linux random number compliance

Not sure if this is the right forum, and I am pretty sure that his must have been answered before (I searched a lot but I haven't found a definitive answer). Do the Linux random number generators ...

linux compliance random prng  
asked by arnuschky 5 votes
answered by raz 3 votes

Greatest hits from previous weeks:

How does changing your password every 90 days increase security?

Where I work I'm forced to change my password every 90 days. This security measure has been in place in many organizations for as long as I can remember. Is there a specific security vulnerability ...

authentication passwords password-management  
asked by Bill the Lizard 333 votes
answered by Justin Cave 209 votes

How can someone go off-web, and anonymise themselves after a life online?

With data mining tools like Maltego and other correlation tools for large data sets, if we conduct any transactions online assume that these can all be collated to build a good picture of what we do, ...

anonymity  
asked by Rory Alsop 203 votes
answered by Lucas Kauffman 128 votes

Can you answer these?

Reference Implementation for Shoup's ECIES?

ECIES is part of both ISO/IEC and IEEE. There's a interop bug between Crypto++'s ECIES and Bouncy Castle's ECIES. I know where the bug lies, and I've been trying to determine who is "right" (for some ...

cryptography ecies  
asked by jww 2 votes

Pawn in a nefarious porn marketing campaign?

About a month ago we upgraded (maybe not the right term) our site to WordPress. In that time we went from about 3800 inbound links (according to Google WebMaster) to about 5000. We exported our list ...

web-application spam wordpress  
asked by Abe Miessler 3 votes

Can source javascript files be infected from a developer's machine?

First a little bit of background, About two weeks back one of the developers in my team said they were seeing advertisement popups and links appearing all over the web app we were developing, when ...

web-application malware javascript  
asked by Thihara 2 votes
Subscribe to more Stack Exchange newsletters


Unsubscribe from this newsletter or change your email preferences by visiting your subscriptions page on stackexchange.com.

Questions? Comments? Let us know on our feedback site. If you no longer want to receive mail from Stack Exchange, unsubscribe from all stackexchange.com emails.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038 <3