Hot answers tagged

199

Steam has about 100 million users (random link saying they had 75 million almost 2 years ago). If they spend on average $10 per year, we're talking $1,000,000,000 per year - and I'd say that's a conservative estimate (random link saying they had 1 billion in revenue back in 2010). That's the same kind of money small banks deal with. Then there is almost ...


116

I think it's very understandable, especially why they feel the need to force security measures on user: A Steam account can be a very valuable asset, many Steam libraries would easily cost hundreds, if not thousands to replace People often don't treat their steam account as carefully as other accounts, eg email or a bank account Once stolen it's very ...


66

The important thing is maintenance. Regardless of whether you reused existing code or wrote your own, you will achieve decent security only if there is someone, somewhere, who understands the code and is able to keep it afloat with regards to, say, evolution of compilers and platforms. Having code without bugs is best, but in practice you must rely on the ...


52

MD5 for passwords Using salted md5 for passwords is a bad idea. Not because of MD5's cryptographic weaknesses, but because it's fast. This means that an attacker can try billions of candidate passwords per second on a single GPU. What you should use are deliberately slow hash constructions, such as scrypt, bcrypt and PBKDF2. Simple salted SHA-2 is not good ...


42

I used to be a Command Controller (CC) at the Laboratory for Atmospheric and Space Physics (LASP) (http://lasp.colorado.edu/). I was one of the people who would sit in front of the console during the times when spacecraft were visible to the ground stations. I would read/record telemetry to ensure spacecraft health and often send up new commands that would ...


41

Using obscure applications is, as my phrasing suggests, a form of security through obscurity. Such reasoning is false, and only leads to a false sense of security. Obscurity is not security. Don't select your security-critical software based on how popular it is or isn't; select it based on the amount of analysis that has gone into the software, how quick ...


38

Even more so. Security code is tricky. Cryptography code is downright hard, even if you are a trained cryptographer - and impossible to get right, if you are not. If there are so many critical bugs in so many big important software packages and companies - what makes you think* you would be able to do a better job? * Unless of course this is your ...


35

From what I can tell, there have only been two serious public vulnerabilities in Steam. Markup injection (XSS) from steam:// links HTTPS man-in-the-middle attack Neither are current. I can't see any real risk. However, since Steam is completely unnecessary at work, it's a minor potential risk that could be avoided. Most likely, he's nit-picking because ...


29

The real reason is fraud. A typical scam looks like this: The scammer buys a game off the Steam store, or an item off the Steam Market using a stolen credit card or stolen account. Many CS:GO, TF2, and Dota 2 items are worth $100's or even $1000's of dollars, so these aren't penny scams we're talking about. The scammer then sells the item to an ...


25

Steam should be treated just like any other application installed on a business computer. Ask yourself if it is needed to perform your job correctly. When your computer has more software install, it has more areas it can be attacked. Steam may not have a vulnerability now, but they may accidental release an update that will have a vulnerability in it. ...


21

Another thing that is not mentioned in the other answers is the impact of Valve's structure as a company and their philosophies for scalable solutions. Most Valve employees (if not all) are hired into Valve's culture where each person works on the project of their choice, especially if they feel it is the most valuable contribution they can make to the ...


18

It's an affiliate thing. Adobe get paid to promote McAfee's anti-malware software. You have nothing to worry about in terms of security, it's just a marketing trick to get you to buy an AV.


18

Firewall and antivirus software are two fundamentally different and complementary kinds of security applications. Firewall : Also known as a 'packet filter'. Basically, software which monitors network traffic and connection attempts into and out of a network or computer and determines whether or not to allow it to pass. Depending on the sophistication, ...


18

Trust is not a boolean variable, "trusted = true / false", you should better think about trust level. A few example of questions which may help you to evaluate the trust level you can grant to this software: How much do you trust the editor of this software? Could the software have been modified by a malicious 3rd-party between being created and being ...


16

2 - the original BCrypt, which has been deprecated because of a security issue a long time before BCrypt became popular. 2a - the official BCrypt algorithm and a insecure implementation in crypt_blowfish 2x - suggested for hashes created by the insecure algorithm for compatibility 2y - suggested new marker for the fixed crypt_blowfish So 2a hashes created ...


15

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download. In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one ...


15

To complete @CodesInChaos' answer, MD5 is often used because of Tradition, not because of performance. People who deal with databases are not the same people as those who deal with security. They often see no problem in using weak algorithms (e.g. see the joke of an algorithm that MySQL was using for hashing passwords). They use MD5 because they used to use ...


15

There are a lot of free tools out there. You may not find a free tool with the exact same functionality as Burp, but you could use several tools to compensate for the limitations of Burp's free version. use Owasp ZAP or Webscarab for their proxy functionality. use Nikto and W3AF to scan web applications. use SQLMap to exploit SQL injections ...


15

Interesting question! I'd like to answer it more from probability standpoint, than from Best Current Practices standpoint. While Thomas and others provide great answers, I do not think they touch on the core question - which is "is unique (or less used) code more resilient in practice than popular code". Note that I've deliberately not used "more secure ...


14

Apparently, NASA is taking communication security very seriously (and I would, too, if I had 2G$+ toys to manage !). I think they've done so for a long time, because in the early times of space exploration (in the 1960s) they feared malicious interference from their arch-enemies, the Soviets. (I do not have a reference handy, but my brain cells tell me that ...


13

@Polynomial makes very good points regarding "security through obscurity" and you definitely shouldn't secure yourself based on "obscurity" because it has proven not to work. However, I don't believe that the answer to your question is that simple - I think your question is more of a "risk reduction" question but could be wrong. Quite often in the security ...


13

I agree with @polynomial, this sounds like a scam. Facebook would never call you, there's no such thing as a Facebook tech. Do not pay them any money! It could be that your computer has been infected and that you are getting pop-ups telling you that your computer is infected and you need to call a number to get it fixed, this is also a scam where they sell ...


12

It depends. If all reasonably functional alternatives are fundamentally prone to programming errors, like it is the case with browsers, it is probably a good idea to use a not-so-popular one. In particular, if your threat model does not include sophisticated adversaries that wait, observe and develop attacks specifically for your setup, using the ...


12

The simple answer is: don't roll your own security. There are two parts to this. Algorithm and implementation. As for the algorithm, creating your own encryption algorithm is horrendous. Even if you are versed in the field of cryptography, you still aren't in a position to create a new algorithm. Unless you have a team of experts in the field working on ...


11

File ≠ network An antivirus is working at the file level where a firewall is working at the network protocol level. An antivirus will analyze web pages downloaded (which are local files), and E-mail attachments (which are also local files) to detect if they contain known signatures. A firewall will decide how the protocols 80/tcp or 161/udp (for example) ...


11

At this point, some people have thousands of dollars' worth of games in their account. To be sure, Steam accounts are not exactly liquid, and you can't easily convert them to cash (though I guess you could ransom them), but the potential loss is still there. On top of this, many people have game accounts linked to their Steam account, such that if you ...


10

Bypassing the activation key checker on any software usually isn't a problem. It's a relatively simple task of reverse engineering the binary and making the necessary modifications. Can a cracked antivirus perform it's job? Yes, most definitely. The problem is that you have no idea what other modifications have been made to the binary in the process of ...


10

The point of keepass is not to prevent keyloggers. (Granted incidentally it will almost prevent hardware keyloggers; someone inserting a keylogging device between your keyboard and computer will not be able to observe a password you used once via cutting and pasting. It doesn't really succeed in this task though, as an attacker could trivially record your ...


9

Hardware security modules Running code in a physically-protected chip such as a HSM or a smartcard is not about protecting from software bugs. If there's a software bug in a HSM, it can be exploited just as any webserver, laptop, smartphone, whatever. The difference between a HSM and a PC is that with physical access to a PC, you can just boot from a USB ...


9

As other answers mentioned, many reasons for Valve's security measures are fraud, your account could have hundreds or thousands of dollars worth of games and tradable items, payment information is linked to the account, and you can essentially use that account to buy anyone else games and tradable items. But another reason everyone overlooked is your Steam ...



Only top voted, non community-wiki answers of a minimum length are eligible