Questions tagged [security-theater]

DO NOT USE THIS TAG AS A GENERIC SECURITY TAG!! Security theater is a term that describes security countermeasures intended to provide the feeling of improved security while doing little or nothing to actually improve security. The term was coined by computer security specialist and writer Bruce Schneier for his book Beyond Fear.

Filter by
Sorted by
Tagged with
0
votes
0answers
47 views

Do any studies of Government Cybersecurity Agencies effictivness against preventing terrorism attacks exist?

Government Cybersecurity Agencies(GSA) blatantly spy on their own citizens. They justify all the data collection by claiming to being able to identify terrorist threats. So, is there some non-GSA ...
2
votes
2answers
122 views

What is the difference between exploitable security measures and security theater?

As an example, the US no-fly list is commonly referred to as a security theater given that it is easy to work around. However blurring license plates when posting a picture online is not considered a ...
1
vote
2answers
132 views

Forcepoint secure email

I just got an email from a financial institution in answer to a question I raised with them. It came in the form of a "secure email" from Forcepoint, which requires you to open an HTML document and ...
3
votes
4answers
162 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
231
votes
3answers
33k views

Why did I have to wave my hand in front of my ID card?

I recently had to authenticate myself online to use an internet-based service. The authentication process was done via video call with me holding my ID card in front of my laptop camera beside my face....
4
votes
3answers
451 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
0
votes
1answer
74 views

how does your standard security system work? [closed]

Do they have lasers motion sensors etc.. more looking for the type of security system you would see in a basic house not rich / well endowed one.
0
votes
2answers
213 views

Is the common recommendation to obscure the existance of a username on login just security theater? [duplicate]

It is a common recommendation to return "Username or password is incorrect" instead of "Username does not exist" when the given username does not exist and "Password is incorrect" when username exists ...
2
votes
2answers
85 views

Does storing two components of a secret in two places increase safety?

Let's say I have a secret integer X, and so I don't risk losing it, I store it encrypted on some cloud service. But I think there's a small probability that it gets hacked. So to help allay those ...
2
votes
3answers
289 views

What is Security Theater?

Security Theater, or Security Theatre in British English, has been mentioned in many posts on this site. What does Security Theater mean? What are some examples? Is it the greatest threat to ...
1
vote
0answers
42 views

Electronic store security [closed]

Iam not sure if this is the right place to ask this question. I would like to know what security features an electronic store should have besides the general alarm system monitored by a security ...
0
votes
3answers
345 views

Should we use Microsoft security or defender for securing our WAN network [closed]

I would like to understand much about Microsoft Security Essentials or another antivirus which build in or developed by Microsoft. I'm planning to set up the network for my company and use Microsoft ...
10
votes
1answer
826 views

Implications of prominent *secure messaging apps* requiring phone number identifiers

More specifically and also generally than this related question, I'm curious about the privacy implications of prominent secure messaging apps (marketing themselves as protecting users' privacy) ...
4
votes
1answer
891 views

Why does oAuth and oAuth 2 have access tokens at all?

I am trying to implement a system for third-party apps to access data that a user stores on a provider. We have a robust access control system, with separate read/write/etc. levels for each "stream" ...
4
votes
1answer
246 views

Cleanware. What does it do and are there security risks involved?

So I get these questions quite a lot recently from friends or family. And I thought this could be a good question for Security Exchange, because I couldn't find this kind of question here. I recieved ...
15
votes
8answers
12k views

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

Imagine I wish to upload my sensitive personal information (photos, document scans, list of passwords, email backups, credit card information, etc.) on Google Drive (or any other cloud service). I ...
1
vote
1answer
945 views

Does my host machine stay completely safe if I'm browsing the dark web using virtual box or vmware on bridge network connection? [duplicate]

I'm just asking if my host machine stays safe when browsing the dark web darknet using Tor on a virtual machine with bridge connection through the host machine ? Since the virtual machine will be ...
3
votes
3answers
698 views

Does mixing in keystrokes of Backspace, Arrows and Delete add any security to password typing?

It is well known that the analysis of the keyboard sound can reveal/hint at what keys were pressed when a password is typed. One could mix in wrong characters (not belonging to the password) with ...
3
votes
1answer
89 views

NFC Security for Payment

During an offline transaction, the Point-of-Sale has no internet connection, and so the payment terminal cannot verify if the client’s payment device has been revoked. A malicious person can use a ...
2
votes
1answer
153 views

Handwriting/cursive education is on the decline. How does this affect signature-based authentication?

More and more schools are not teaching cursive handwriting, and many are considering it more of an art, or optional in the curriculum. I assume this will have an impact on the ability to forge a ...
-4
votes
1answer
53 views

Tendency towards security-is-binary in cryptography [closed]

In the real (physical) world, we seem to feel secure with just enough security, e.g.: Our door lock isn't the most secure. Anyone can lock-pick / break with force. Our car isn't the most robust. ...
3
votes
1answer
2k views

Capturing text messages on the fly

Suppose your phone is not connected to any network. You are sitting in a cafeteria with 50 other people, everyone is communicating to each other via text messages. Is it possible through any device or ...
12
votes
2answers
9k views

Is LastPass secure enough? [closed]

They said: Private Master Password: The user’s master password, and the keys used to encrypt and decrypt user data, are never sent to LastPass’ servers, and are never accessible by LastPass. ...
4
votes
0answers
117 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
8
votes
1answer
1k views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
16
votes
2answers
379 views

Is adding a supplementary credit transaction something that could improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
4
votes
3answers
1k views

How to choose a linux for learning? [closed]

I am beginner in Security. My first assignment is about "Linux firewall using IPTABLES" . I know about Ubuntu, backtrack and kali Linux. How to choose a Linux distribution to learn about security?
1
vote
3answers
1k views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
12
votes
4answers
5k views

Would making an IIS web server appear to be running Apache instead improve security?

As you can see from the tag, I know that security by obscurity is not true security. So consider a server available to the Internet on port 443 (SSL) of a fixed IP address in the dialup range of a ...
1
vote
0answers
850 views

Vulnerability NTP:Traffic amplification in clrtrap feature of ntpd affect or not affect to Cisco device?

I am using CCSVM tool SCAN for Network devices (Cisco). Below you can find the scan result: Title vulnerability: NTP: Traffic amplification in clrtrap feature of ntpd Solution fix: Disable NTP ...
14
votes
3answers
29k views

Is it safe to auto-fill credit card numbers using Chrome?

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the ...
4
votes
5answers
369 views

Do I need to secure a computer from physical attacks when attackers can already harm in many other ways?

Recently, I was working on a computer system for a model railroad club. This computer system is capable of monitoring and controlling the positions of all the (physical) trains which could be ...
2
votes
4answers
123 views

Preventing phishing of few critical websites

Suppose $S$ is a set of known websites which are very important. Assume there is an anti-phishing tool company $A$ which is aware of such websites. Can the company A reliably develop an anti-phishing ...
-5
votes
1answer
4k views

How to disable a trail camera with a laser [closed]

My neighbor presently has a version of a Stealth Cam P12 6 MP Trail Camera 9 (see link below) pointed directly into my windows. Rather than get into a legal argument (the authorities where I live won'...
2
votes
1answer
250 views

What question(s) can someone ask an individual to quickly determine their 'hacking ability'?

Scenario: You are on Craigslist searching for cheap electronics and come across an add for cheap E-reader. It's a bit of a deal with about 20-40% off the retail price so you contact the seller and all ...
3
votes
2answers
1k views

Firewall egress filtering / quick whitelisting

Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change. Looking at his ...
0
votes
2answers
114 views

What is the severity if someone read the ConnectionStrings_Prod.config?

I was doing an pen test in a website and the programmer did a big mistake and I was able to read any file. So I read the web.config and see the password for database was in ConnectionStrings_Prod....
1
vote
2answers
155 views

Separate normal traffic [closed]

Is there any tool or method to separate normal traffic and malicious traffic from pcap? For example : if malicious traffic detected with snort i need to store those packets .only if malicious traffic ...
12
votes
3answers
1k views

Security of pronounceable passwords

Some random password generators support the generation of pronounceable words of any given length n. Assuming that words are derived using 26 lowercase letters, the number of possible words of length ...
12
votes
3answers
3k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
0
votes
3answers
181 views

One Less Password

I just came across this: https://blog.webmaker.org/one-less-password Basically a technique for eliminating passwords as the primary authentication mechanism for connecting to a website by replacing ...
11
votes
2answers
3k views

What is the purpose of yubikey

I've been doing some reading about YubiKey (for example What is a Yubi key and how does it work?) and found the information to be incomplete. It's my understanding, that when the user is prompted to ...
1
vote
0answers
65 views

Transaction without 3DS in some online websites is Fraud prone? [duplicate]

I use my MasterCard credit card for online transactions which uses SecureCode for preventing online frauds even though hackers knows our credit card details. I have come across many sites which is ...
1
vote
2answers
421 views

So, how dead is antivirus exactly? [closed]

Symantec recently made a loud statement that antivirus is dead (http://online.wsj.com/news/article_email/SB10001424052702303417104579542140235850578-lMyQjAxMTA0MDAwNTEwNDUyWj ) and that they don’t ...
8
votes
2answers
11k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is established.) ...
1
vote
0answers
61 views

Key Distribution using multicast

I am trying to come up with a solution for a system where i need to generate a key (Kn) from time to time and distribute it to a large number of servers in a private network. Since it has to be a ...
3
votes
2answers
715 views

Does having a separate e-mail account only for security, increase security?

In this article about increasing the security of LastPass the author suggests: For additional security, you can have LastPass send security-related emails to a special security email address ...
1
vote
4answers
3k views

Someone knows about online labs? [closed]

I'm looking for an online training lab for pentesting/hacking and security. I've found one at hacking-lab but it's seems troublesome to work with and it has some issues on VPN server authentication. ...
0
votes
4answers
313 views

How to secure my website's FTP?

When I opened ftp command prompt and typed open mydomain.com, it gave me the following and I think that this is a security vulnerable. connected to mydomain.com. 220----- Welcome to Pure-FTPd [...