Skip to main content

Stack Exchange

Ja1024

Ex-developer, now security researcher. I'm primarily interested in web security and secure software engineering. I also love cats.

top accounts reputation activity subscriptions
Top Questions
No questions with score of 5 or more
Top Answers
77
Filter arbitrary code for blacklisted keywords except on commented lines
security.stackexchange.com

74
What stops a malicious user from hitting an endpoint with falsified data from the console of a webpage?
security.stackexchange.com

63
Does the recommendation to use password managers also apply to corporate environments?
security.stackexchange.com

58
What prevents a browser from saving and tracking passwords entered to a site?
security.stackexchange.com

52
Can trusted timestamping be faked by altering some bytes within the document?
security.stackexchange.com

45
Is it secure to block passwords that are too similar to other employees' old passwords?
security.stackexchange.com

44
Why don't we use HTML password inputfields for usernames and 2FA codes in the front-end of web applications?
security.stackexchange.com

43
What's the point of certificates in SSL/TLS?
security.stackexchange.com

43
Does public key cryptography provide any security advantages, or even just a different security model, over symmetric cryptography?
security.stackexchange.com

43
Why "Only send non-temporary passwords over an encrypted connection or as encrypted data"?
security.stackexchange.com

41
Is it acceptable to ignore potential XSS payloads if they are not executed on our side?
security.stackexchange.com

40
What prevents applications from misusing private keys?
security.stackexchange.com

39
Is SQL Injection possible if we're using only the IN keyword (no equals = operator) and we handle the single quote
security.stackexchange.com

39
Enabling a user to revert a hacked change in their email
security.stackexchange.com

39
Web application contains a link to a non-existing domain, is this a vulnerability?
security.stackexchange.com

38
Why do best practices recommend against adding your own pepper to passwords before hashing?
security.stackexchange.com

38
How to deal with monitoring software on a personal PC used for work?
security.stackexchange.com

33
How to receive large files guaranteeing authenticity, integrity and sending time
security.stackexchange.com

33
How many possible MD5 hashes are there, 16³²? Or do MD5 checksums have error correction (in which case <16³² possible hashes)?
security.stackexchange.com

32
Should the generation method of password-reset-tokens be kept secret?
security.stackexchange.com

32
Are there any security concerns with this authentication flow?
security.stackexchange.com

31
Why are TOTP seeds rarely leaked in data breaches?
security.stackexchange.com

30
Determining Entropy in PHP
security.stackexchange.com

30
Is my encryption format secure?
security.stackexchange.com

30
Securing Transactional Email: User Input Escaping for a email subject
security.stackexchange.com

29
What are the preferred ways to exchange public keys physically?
security.stackexchange.com

28
Why aren't passwords also hashed on client side on desktop applications?
security.stackexchange.com

28
Cryptographic strength of VeraCrypt
security.stackexchange.com

27
Securely storing a password for matching against its substrings
security.stackexchange.com

27
Security implications to removing delay on empty passwords?
security.stackexchange.com

1 2 3 4 5 … 7