New answers tagged

2

The only time I've ever seen anything similar to this is in Dovecot (IMAP email server) where you can optionally configure it to log a hash of the password attempted for troubleshooting/debugging purposes. However, even with Dovecot (which is an implementation I would trust more than what yours appears to be), it is only something I would enable temporarily ...


2

I can't see any security claims to the application to store the clients inputs. Also, the "ciphertext" seems to be reversible (instead of a hash). It's a bad practice.


0

Ignore is a pretty strong word, but I can tell you it is standard procedure in a lot of companies to avoid doing anything that would bring to light a threat that would be difficult to deal with. The general policy in nearly all IT shops is to do "due diligence", which basically means to do the stuff you are supposed to be doing. Since very advanced attacks ...


1

Rather than ignore, I'd suggest you evaluate the threat, determine the losses, and determine the cost to defend against the threat. If the cost to defend is higher than the losses, it's valid to choose to accept the threat's losses without developing a strategy to deal with the threat. As others point out, though, there are many ways to manage threats that ...


1

You should not "ignore" a threat just because you cannot prevent it. Threats have two sides: the before, and the after. "After" still exists if you cannot do anything about "before". For example, Denial of Service is very difficult to prevent. If a determined attacker with enough resources (or a stupid determined attacker with some resources) decides to get ...


10

There are four basic strategies to control risks: Avoidance: Applying safeguards that eliminate or reduce the remaining uncontrolled risks for the vulnerability Transference: Shifting the risk to other areas or to outside entities Mitigation: Reducing the impact if the vulnerability is exploited Acceptance: Understanding the consequences and accepting the ...


13

TL;DR: NO (but we should define what "ignoring" means; from the text of the question I suspect we're actually of the same opinion). You do not "ignore" a threat. The ancient saw says that you do not fear a threat that you cannot avoid - stultum est timere quod vitare non potes, since fear will avail you nothing. But few threats are completely unavoidable ...


40

You would never ignore a threat, and perhaps that is semantics over your wording. You either accept, mitigate, or outsource the risk for the given threat. In this case, that would be: accept that there will be a $X loss, mitigate fix DRM or find DRM alternate to protect the product, or outsource using insurance or place the risk on someone else in the ...


3

If there is a risk it will not simply vanish if you ignore it. If the risk is small enough it is unlikely that it will happen and you can probably ignore it. This is part of the usual risk management, i.e. there is no fully secure system. But if the risk is large enough ignoring it will be a bad idea. So while ignorance is in this case still a valid ...


2

Unfortunately, what is commonly done is simply to share account credentials. When possible, it is advised to have a super admin account with a manager who is not responsible for using the service directly (separation of duties) so that the active admins can come and go while management of the admins is done through a separate account. When not possible, a ...



Top 50 recent answers are included