MS13-068 addresses a memory corruption vulnerability accessible by simply previewing a message in the Outlook Preview Pane. As such, we’ve rated this security vulnerability as Critical and we encourage customers to deploy the security update. However, …
Today we released thirteen security bulletins addressing 47 CVE’s. Four bulletins have a maximum severity rating of Critical while the other ten have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployme…
Two separate discussions have very recently opened my eyes to an issue I had not considered – how to confirm the Open Source binary that one uses is based on the published source code.
Zooko Wilcox-O’Hearn, founder and CEO of LeastAuthorit…
First of all, my objective is to avoid storing the salt in the database as plain text. As far as this question is concerned, the salt is not stored in the database.
After discussion in comments and in chat, I’ve come up with a theory:
It a…
I am a little confused on the contextual differences between permission and privilege from computer security perspective.Though I have read the definition of both the terms but it will be nice if someone can give me some practical example …
I’ve been studying how Tor works – including the great QA “Why can a Tor exit node decrypt data, but not the entry node?”.
I understand the concept of onion routing and multiple layers of encryption. My question is specifically how are t…
What is the difference between signing a user ID and a whole Key?
Which behavior is the best as to signing user IDs and Keys? How and when to use "Local signatures" (non-exportable)?
(I was told not to sign any keys except for pe…
You might remember that in June 2013 we released Security Advisory 2854544 announcing additional options for enterprise customers to manage their digital certificate handling configuration on the Windows platform. The particular functionality announced…
Today we released eight security bulletins addressing 23 CVE’s. Three bulletins have a maximum severity rating of Critical while the other five have a maximum severity rating of Important. We hope that the table below helps you prioritize the deploymen…
When users change their email addresses within a web application’s user account, I see the following problem:
An attacker (who has access to your session) could change your email address to a new one (the attacker’s one), logout and reque…
