Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Just recently I thought about all the solved problems in IT security, like XSS (which one can mitigate with input validation), SQL Injection (mitigated with prepared statements), etc.

Now I'm wondering, what are the biggest unsolved security problems of the year 2010? I'm wondering here if there are vulnerabilities out there for which we don't know yet a good way to mitigate them. Except how we can get everyone to use the solutions to the solved problems.


locked by Jeff Ferland May 29 '13 at 23:27

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as too localized by Jeff Ferland May 29 '13 at 23:27

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

No vulnerability will disappear just one day. And every mitigation that is introduced, every time is bypassed. It is eternal fight. So, it is better to define in your question what does it means "solved" and not, otherwise it has no sense. – anonymous Nov 22 '10 at 13:54
What I meant with solved is that we have some way to mitigate the risk. For example for SQL Injection we have prepared statements, for XSS we have input validation. I'm wondering if there is a vulnerability for which we don't know a good way to mitigate it. – Andreas Arnold Nov 22 '10 at 13:59
Well, then this is duplicate question -… – anonymous Nov 22 '10 at 14:11
prepared statements do not protect against XSS, I'm wondering if you're confused, or is this just a typo? – AviD Nov 22 '10 at 14:18
@Ams - There are valid unsolved problems that don't count as "zero day". One example is the Home Realm Discovery which I just upvoted – LamonteCristo Nov 22 '10 at 19:59

21 Answers 21

up vote 13 down vote accepted

You can't really solve the end user problem. Well, legally or ethically anyway. My vote goes toward the Home Realm Discovery problem.

EDIT: The end user problem was in reference to previously posted answers. Home Realm discovery is part of a claims based authentication model, where you can select between multiple services/organizations to provide an identity for a user, much like OpenID/OpenAuth. The problem arises when you need to figure out which provider to get info from since you don't know anything about the user yet. It's a Chicken/egg thing: how do you figure out who to have authenticate the user when you don't know who the user uses to provide their identity.

The first obvious answer is to use only one provider, but that sort of negates the benefit of the model.

The second obvious answer is to ask the user. However, this is openID's downfall. Most people have no idea who their provider is. And what happens when you can authenticate against Google and Facebook, but you don't know which one is tied to the profile of the calling application?

This is affectionately referred to as the NASCAR problem with OpenID -- the launching page for OpenID usually has a bajillion logos for providers, so you need to select which provider to use. Which breaks when you have a custom provider.

Remember CardSpace/InfoCard/Information Cards? That attempts to solve the problem. It actually does a pretty good job theoretically. Practically notsomuch.

+1 for mentioning Home Realm Security, and putting this Q&A in the right direction – LamonteCristo Nov 23 '10 at 6:00
The "Home Realm Discovery" problem, as you have phrased it, is only one small piece of a larger unsolved problem: usable and secure authentication. – D.W. Aug 1 '11 at 4:12
"Which breaks when you have a custom provider." I sort of happen to be logged into this site, despite having a custom provider. It's not entirely convenient, I'd admit - but I'd have gone to Google if I wanted convenience. – Piskvor Aug 12 '11 at 11:02
This isn't much of a problem in practice really. Many people have an account with major providers like Google or Facebook. For the others, let them enter their OpenID URL. Most people will click on the Facebook logo anyway. – Mircea Chirea Jul 5 '12 at 12:28

Social Engineering by far.

Humans will remain vulnerable to social engineering for a long time to come and as the saying goes, "Security is only as good as the weakest link."

and will always be Social Engineering! It does work even on security experts as it is usually impersonating a manager, so authority... – Phoenician-Eagle Nov 23 '10 at 12:04

So many of the answers here say that the unsolved problem is "the user" or some variant, that I'm forced to conclude the biggest unsolved problem is security practitioners who believe that the user is the enemy.

The underlying cause is security policy or procedure that has no visible benefit, i.e. it takes up user time and effort without the users being able to see what it's doing for them. Solving this problem will require combining infosec expertise with usability engineering and social science to invent new security experiences that are enabling, and allow the users to perceive their benefit.

+1, absolutely agree. However, both viewpoints are actually correct: having rational policies and convincing users of the benefit probably wont have much effect on most users, since they're mostly irrational (see Dogbert's principle). And yet, that does not absolve us security practitioners from doing it anyway, until we (optimistically) get it right. – AviD Nov 23 '10 at 10:08
@AviD: I agree with you regarding the irrationality - that includes the irrationality of the attacker. That's where social science comes in - we need to work not only to make security a cultural norm, but to make sure that what we get users to do is compatible with their existing expectations and models of how their interactions with each other work. – user185 Nov 23 '10 at 10:18
Yes, exactly. Of course, at that point "the user is the problem" will still undoubtedly kick in - never forget the dancing pigs :) – AviD Nov 23 '10 at 10:29

Internet Voting from home or office computers for high-stakes elections is pretty far off the scale of "unsolved problems". It is particularly important to voters who are overseas and/or in the armed forces and have no fast, reliable way to return a voter-verified paper ballot (think submarines :). It was nominated as worthy of an X-PRIZE at DESSEC: DEsigning a Secure Systems Engineering Competition

Ron Rivest, the "R" in "RSA", gave one of several convincing talks on that in 2010 at the UOCAVA Remote Voting Systems Workshop. You can see the presentations on the "Agenda and Presentations" page here

The problem is much harder than the secure e-commerce problem since votes must be anonymous, selling votes is forbidden, and the system must be highly transparent. It also involves:

  1. the intractability of securing servers in a world with attacks like stuxnet from well-funded attackers
  2. the intractability of securing clients in a world of viruses and inexperienced users
  3. the ease of DDoS attacks on servers that have to be up during a particularly crucial day and hour.

In reviewing the recent crash-and-burn of an Internet Voting public test by the District of Columbia, the Washington Post got it right.

See more at


Smartphone Security

There are a wide number of smartphones that are targets for viruses and leaking corporate information. It's tough to find a uniform way to address these security vulnerabilities, and still provide a flexible user environment.

Currently I'm looking at Goodlink to provide email security across multiple devices. Please comment if you know of anything else

+1; I think the risk of data leakage far outweighs the virus threat (particularly on curated platforms like iOS). Those devices are just so damn losable. – user185 Nov 23 '10 at 10:24
+1 Besides being easy to steal, the smart phone platforms are bound to have critical security flaws that future viruses will exploit. So far I have not heard of iOS, Android, Windows 7 phone, Meego, Snap, etc. viruses, but with the range of activities being performed on these devices (including online banking), I imagine that virus writers are hard at work on cracking them. – Daniel Trebbien Nov 26 '10 at 0:55
I don't know. Personally, I'd say that smartphones are actually doing pretty well in terms of security, so far. (As far as your question about alternatives to Goodlink, that should probably be asked in a separate question.) – D.W. Aug 1 '11 at 4:14
This could be total B.S., but is still interesting reading: – Van Gale Aug 10 '11 at 19:26

People that do not think with security in mind.

or the shorter version: People that do not think. ;) – Marcin Nov 22 '10 at 19:05

Deploy HTTPS Correctly

Always have a SSL/TLS session after authentication... for the remainder of the web session.

On a similar note, can someone tell Google AdSense/AdWords to support HTTPS?!?! Every site that requires you to login usually reverts back to HTTP because they don't want users to get the "Mixed Content" warning.


Slightly off topic, but no-one has solved the last line of the Kryptos sculpture in front of the CIA.


I believe a big problem currently is password reuse.

XKCD #792 illustrates the problem with a "bit" of humour.

Password reuse

+1 for the answer and mentioning a good source for it! – woliveirajr Aug 23 '11 at 12:16

Email Sender Verification

Many solutions and 3rd parties try to address the issue of "did user x actually send an email message?" or was it spoofed?

DMARC ,DomainKeys, SenderID, and SPF are all examples of technologies that address the issue in one way or another, but the adoption rate isn't close to where it needs to be. In addition, I don't think there is a complete solution when dealing with ListSrv's in this area either.

You could go as far as to say that "email" is an unsolved security problem ;) – user185 Nov 25 '10 at 11:57

One cannot solve XSS with input validation. You are incorrect.

SQL injection is more than prepared statements. It includes topics such as SQL statements and variable binding. Hibernate has HQL injection, offset by named parameters with proper variable binding.

Not really an answer to his question, but correct nonetheless - and important enough to correct this misperception that I +1'd you anyway – AviD Nov 22 '10 at 22:30

Passwords and how people think about them. Passwords should be renamed to pass phrases in my opinion. Too many accounts get hacked today because of users having a bad password policy.

For example: user picks a password less than 10 characters. It gets bruteforced easily once a site hes registered on gets hijacked and the DB drained. Unfortunately he also uses the same password for his email (ofcourse?? who doesnt?! not... stupid!). This results in him losing all his credentials and basicly his online identity. Anyone can now easily exploit this victim without him knowing much about it.

the word is losing btw – Woot4Moo Nov 22 '10 at 21:10

Huge unsolved problem - getting senior (CEO, FD etc) buy in and understanding of information security. IT management tend to understand IT security (pretty much) but senior management don't. They are focused on business, operational and financial risk so translating IS risks into an equivalent, along with relative impact so they can be discussed on a level playing field is the only consistent way to get change budgeted for, sponsored and opposed to the current drivers for revolutionary change in information security - usually a response to a major incident, so high budget and urgency for a short while until the tabloids go onto the next target.

You could call this the "Sony Syndrome". heh – Brian M. Hunt Aug 15 '11 at 16:32

The biggest problem in IT security is the end user.


Cloud Security is Unproven

The security of SaaS, PaaS, and IaaS solutions are not time tested, and trusted. I believe this is a problem when we have the business, and salespeople selling untrusted, unproven solutions.

With time, perhaps this will change.

Perhaps not unsolvable, but IMHO certainly unsolved... – Georgios Jul 24 '12 at 7:43

As far as I'm aware, there's no real solution to prevent clickjacking or scraping. For the latter, the best solutions are IP-based monitoring or a CAPTCHA on every page load. None of which are perfect.


Widespread adoption and use of DNSSec

Although there is the controversy regarding it exposes all your zones, and legal issues regarding it's use in some countries; overall it is a needed technology that needs to overcome the chicken and egg syndrome.

Personally, I would like to use DNSSec on all my sites. But the problem is that it cost me money (annual fees), as with https. – Jonas Nov 23 '10 at 21:33

Addressing increased threats with fewer staff.

Since you asked about problems learned during 2010, I'll say that layoffs increase the risk of information theft, and unauthorized disclosure from internal staff.

If the layoffs affect the security department, then many of those previously mentioned issues may go unchecked, leaving the company at risk.


Safely connecting to the public internet?


The most popular attacks are XSS and clickjacking as far as I know.


P = NP

The P versus NP problem is a major unsolved problem in computer science


Not the answer you're looking for? Browse other questions tagged or ask your own question.