Top new questions this week:

Do we need to logout of webapps?

Unfortunately a quick Google search didn't reveal, neither explanations nor claims, that it is important to logout of a webapp (online banking, Amazon, Facebook, etc. ), instead of just closing the …

web-application web-browser session

asked by Angelo.Hannes 56 votes answered by AviD 51 votes

How do I prevent copying my PDF files?

One time while I was printing my documents at the copy center and I saw they drag-and-drop my PDFs from my flash drive to their desktop. How do I protect files without using password? Is there a way …

encryption file-access

asked by Олег Кривцов 11 votes answered by Philipp 34 votes

How could malware like Stuxnet be detected?

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the …

malware ids detection

asked by pnp 6 votes answered by Ohad Cohen 4 votes

Ensure data doesn't linger after being deleted

I'm trying to make a service that keeps as little data on its users as possible. To that end, I want to make sure that someone using forensic tools won't gain any more information than I would by …

mysql deletion data-remanence

asked by Nick ODell 6 votes answered by peterph 0 votes

Encrypting something with multiple keys such that k out of n keys are needed; what's it called?

I am trying to find information on how to encrypt something in such a way that there are n keys, and k of them are needed for decryption. However, I have been searching Google for half an hour but …

encryption secret-sharing

asked by user31890 6 votes answered by Thomas Pornin 9 votes

How secure is Android's facial recognition?

Android supports using facial recognition for unlocking your phone. How secure is that mechanism? For instance, if someone has a good quality picture of your face, can they defeat the facial …

authentication mobile android biometrics smartphone

asked by D.W. 5 votes answered by GdD 4 votes

Forgot Password? - sends email with plaintext password

A "reputable" education company that my university utilizes for it's Physics course online materials sent my plaintext password in an email after using the Forgot Password? tool. I know that this is …

web-application passwords

asked by Brandon Kreisel 4 votes answered by David Houde 2 votes

Greatest hits from previous weeks:

Can I determine if my computer has a key logger installed?

A friend of mine just started a job at a security sensitive company. They've provided him with a laptop with Windows XP Professional installed. He's heard a rumor from other employees that the laptops …

windows keyloggers

asked by Plutor 26 votes answered by Iszi 37 votes

Can the Gmail password be recovered from the Android Gmail app?

I have an Android device with the Gmail app installed. This app can access the mailbox so there must be some kind of authentication data stored on the device (possibly an application specific …

authentication password-management android google

asked by buherator 3 votes answered by Thomas Pornin 8 votes

Can you answer these?

Oauth Consumer Secret?

Using OAuth you have a consumer key and consumer secret to identify your application and the user provides an OAuth access token and secret to authenticate your application access to their account, …

authentication oauth twitter

asked by sudo_O 3 votes

Memory Protection Unit/MMU in context of multiple cores and security issues

Hope you can help me here. There is a chipset I am working with that utilizes an ARM cortex -A7 as the Application processor and an ARM 9 Baseband processor. I had a major concern since the ARM …

access-control

asked by Dave Powell 2 votes

Why is the Access-Control-Allow-Origin header necessary?

I understand the purpose of the Access-Control-Allow-Credentials header, but can't see what problem the Access-Control-Allow-Origin header solves. More precisely, it's easy to see how, if …

http csrf same-origin-policy

asked by Mark Amery 4 votes