Most Popular
1500 questions
41
votes
2 answers
Did a Huawei modem just try to do a Man-In-The-Middle attack on me?
I have a replica of Huawei B535-333 LTE modem. While I was working from home on my computer I randomly got a security alert saying that certificate for connection with outlook.office365.com was issued by untrusted company and the certificate name…
gtu
- 513
- 1
- 2
- 6
41
votes
5 answers
How can you trust that there is no backdoor in your hardware?
We know that Intel processors have one (ME) so it is definitely possible.
In general, how could you even trust a piece of hardware like a CPU or network card, even if the manufacturer says there is no backdoor?
For software, it is easy since you can…
MasterYi
- 413
- 4
- 4
41
votes
14 answers
How to safely save passwords for a future administrator?
I am the volunteer IT administrator for a local non-profit organization. The organization has a few systems - specifically security cameras, network hardware, and telephones - that have local administrator accounts to manage them. Right now, I am…
Moshe Katz
- 1,360
- 1
- 11
- 17
41
votes
4 answers
why a client authentication is not commonly performed in the TLS protocol?
Is there any reason for this other than key/certificate management on the client-side?
naresh
- 645
- 1
- 7
- 7
41
votes
4 answers
What alternatives are there to the existing Certificate Authority system for SSL?
Whilst the current CA system works very well for a lot of people, it does put a lot of power into individual CAs' hands, and makes a CA hack potentially devastating for customers and business. What alternatives are there to certificate authorities,…
Polynomial
- 135,049
- 43
- 306
- 382
41
votes
9 answers
What are the potential risks of leaving a device in public, but locked?
Let's say you're in a public café, or conference, where you trust your device won't be stolen if you go to the bathroom for 5 minutes, but you don't trust it might not be tampered with.
What are the potential security risks I might run into here,…
Zee
- 529
- 1
- 4
- 7
41
votes
7 answers
Security risks of user generated HTML?
I am creating a website that allows people to upload HTML content.
Currently these are the tags that are banned:
Jevon
- 511
- 4
- 4
41
votes
1 answer
Why do I need two parameters in an HTTP parameter pollution attack?
I'm reading about HTTP parameter pollution and I'm confused about one thing. If there is an endpoint like this,
https://security.stackexchange.com/editpost/?postuid=19348
and you tried a HPP attack, that looked…
Kevin Lance
- 519
- 4
- 6
41
votes
3 answers
What is the meaning of Triage in Cybersec world?
I searched Google about this term, but the definitions that I found was related to the medical world, and nothing related to IT. I think that is some kind of procedure of documenting something maybe? Note that I heard this word for the first time in…
victor26567
- 523
- 5
- 6
41
votes
4 answers
How to protect printers from being hacked
Recently it got to my attention that someone has hacked around 50,000 printers and used them to print the message they wanted to. (link)
As someone who doesn't have a lot of knowledge about networks or hacking, what would be the steps to take to…
aMJay
- 3,675
- 5
- 12
- 20
41
votes
14 answers
How can I make a strong password that's easy to remember? Is the 4 Word method safe?
I have heard of the method of using 4 random dictionary words, it gives you lots of characters and is easy to remember.
But that seems to be open to dictionary attacks, especially if the attacker has heard of the method as well, and brute force…
Lichtbringer
- 569
- 1
- 4
- 7
41
votes
4 answers
How could a public DNS server return bad results?
I live in a country which is under many sanctions. Both internal sanctions (government on people) and external sanctions (US on our people).
In our country, YouTube, Twitter, Facebook and many other sites are blocked by default and we can only…
AlwaysLearner
- 499
- 4
- 6
41
votes
8 answers
Does password-protecting a database living next to the application add any security?
I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text.
What are the benefits of such a setup over a simply unprotected database?
Apart of some…
Cedric Reichenbach
- 542
- 4
- 8
41
votes
4 answers
What's the point in hashing phone numbers?
Some services (for instance ProtonMail) claim to store hashes of phone numbers, instead of phone numbers themselves (while they don't say how they hash it). Now, given that the number of potentially valid phone numbers is very small (about 26 bits…
BlenderBender
- 539
- 1
- 4
- 7
41
votes
4 answers
What does the tilde (~) mean at the end of a file extension?
While I was playing some Capture the Flag (CTF), I couldn't solve a challenge because of this tilde ~. I'm playing on www.example.com/index.php but when I added (~) at the end: www.example.com/index.php~ , a file with name index.php started…
brb
- 563
- 1
- 4
- 12