Questions tagged [security-theater]

DO NOT USE THIS TAG AS A GENERIC SECURITY TAG!! Security theater is a term that describes security countermeasures intended to provide the feeling of improved security while doing little or nothing to actually improve security. The term was coined by computer security specialist and writer Bruce Schneier for his book Beyond Fear.

Filter by
Sorted by
Tagged with
2
votes
3answers
1k views

Does Disabling Right Click In Windows Explorer Do Anything?

I am at a student at a school which blocks the right click in Windows Explorer and the desktop, as well as on the taskbar. I don't exactly understand why they do this, since most of the commands on ...
2
votes
1answer
81 views

Over-the-top (?) security practices for CVV inputs

On some internet banking websites, I've seen some CVV input fields that seem strange to me. Here is an example: The field works as such: You can not input a CVV code using a keyboard. The numbers ...
-1
votes
1answer
125 views

Why do people, even programmers and geeks, seem to almost feel the urge to “give hackers a fair chance” at stealing their data? [closed]

I once heard that the author of the early NES emulator "Nesticle", clearly a very intelligent person, baffingly used some kind of exploitable "Samba" or "SMB" server ...
35
votes
3answers
3k views

Changing picture as characters entered into password

When Lotus Notes asks for the password, it displays a screen with a picture that appears to change after a new character is entered after the fifth character. I have noticed the sequence of pictures ...
1
vote
0answers
54 views

Does Snowflake Data Sharing add any real security?

Snowflake is a cloud database like Google BigQuery or Amazon Redshift. Unlike them, however, it markets a "Secure Data Sharing" feature. They go to some effort (including a full "Data ...
0
votes
0answers
52 views

Why developers put the installer/executable and the file checksum on the same server? [duplicate]

On https://exiftool.org/ , there is a link to https://exiftool.org/exiftool-12.01.zip and https://exiftool.org/checksums.txt . Both the ZIP archive and the checksum hash are hosted on the same machine....
3
votes
1answer
392 views

How exactly does Windows Defender in Windows 10 determine when to upload your local files to Microsoft?

Every time I install Windows 10, I painstakingly go through every setting that can be found in any GUI setting for the OS, disabling everything that sounds creepy. One of the most disturbing things I'...
3
votes
1answer
722 views

What attacks are prevented using Session Timeout or Expiry?

OWASP recommends setting session timeouts to minimal value possible, to minimize the time an attacker has to hijack the session: Session timeout define action window time for a user thus this window ...
2
votes
0answers
61 views

Benefit of authentication with a gateway

Given... a public web service with enabled SSL/TLS the web service enforces authentication using JSON Web Tokens a client on a LAN without an Internet connection a proxy on the LAN that grants point-...
86
votes
6answers
20k views

How am I ever going to be able to “vet” 120,000+ lines of Composer PHP code not written by me? [duplicate]

I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
2
votes
2answers
983 views

Forcepoint secure email

I just got an email from a financial institution in answer to a question I raised with them. It came in the form of a "secure email" from Forcepoint, which requires you to open an HTML document and ...
36
votes
7answers
19k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems ...
10
votes
1answer
414 views

What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

I run a localhost-only webserver (PHP's built-in one) for all my admin panels and whatnot on my machine. I'm worried that, if any random webpage has a JavaScript snippet which makes an Ajax call to ...
77
votes
8answers
14k views

If we should encrypt the message rather than the method of transfer, why do we care about wifi security? Is this just security theatre?

Most answers to this question about the security of satellite internet boil down to: encrypting the message is more important than encrypting the method of transfer. However, there seems to be a lot ...
3
votes
1answer
140 views

When a closed-source company hires somebody to audit their code, is the auditor forced to do it in the company's office?

Let's say that ACME, Inc. is making closed-source software. It's closed for a reason (they don't want it leaving their building other than in compiled form). Now, they are hiring some company/person ...
26
votes
8answers
6k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
3
votes
2answers
142 views

What is the difference between exploitable security measures and security theater?

As an example, the US no-fly list is commonly referred to as a security theater given that it is easy to work around. However blurring license plates when posting a picture online is not considered a ...
2
votes
4answers
185 views

Does allowing a user to know their own authorized capabilities decrease security?

In a system with a complex set of computed authorizations, does conveniently allowing a given user access to view all of their own authorizations decrease security? In a "Policy as Code" system ...
233
votes
3answers
34k views

Why did I have to wave my hand in front of my ID card?

I recently had to authenticate myself online to use an internet-based service. The authentication process was done via video call with me holding my ID card in front of my laptop camera beside my face....
4
votes
3answers
484 views

How much of a visible deterrent is IT security?

While looking at this question, one of the comments made me think. In the comment, the user asserted that "one must invest a lock that cost $40, the insurance company just want to make sure that it ...
10
votes
1answer
905 views

Implications of prominent *secure messaging apps* requiring phone number identifiers

More specifically and also generally than this related question, I'm curious about the privacy implications of prominent secure messaging apps (marketing themselves as protecting users' privacy) ...
0
votes
1answer
82 views

how does your standard security system work? [closed]

Do they have lasers motion sensors etc.. more looking for the type of security system you would see in a basic house not rich / well endowed one.
0
votes
2answers
289 views

Is the common recommendation to obscure the existance of a username on login just security theater? [duplicate]

It is a common recommendation to return "Username or password is incorrect" instead of "Username does not exist" when the given username does not exist and "Password is incorrect" when username exists ...
2
votes
2answers
90 views

Does storing two components of a secret in two places increase safety?

Let's say I have a secret integer X, and so I don't risk losing it, I store it encrypted on some cloud service. But I think there's a small probability that it gets hacked. So to help allay those ...
16
votes
2answers
394 views

Is adding a supplementary credit transaction something that could improve online payment security?

An online company from which I regularly buy goods apparently recently upgraded their security policy. Let's say I bought something for 73,31€. As usual this company uses 3D-Secure for the checkout ...
2
votes
3answers
392 views

What is Security Theater?

Security Theater, or Security Theatre in British English, has been mentioned in many posts on this site. What does Security Theater mean? What are some examples? Is it the greatest threat to ...
1
vote
0answers
51 views

Electronic store security [closed]

Iam not sure if this is the right place to ask this question. I would like to know what security features an electronic store should have besides the general alarm system monitored by a security ...
0
votes
3answers
443 views

Should we use Microsoft security or defender for securing our WAN network [closed]

I would like to understand much about Microsoft Security Essentials or another antivirus which build in or developed by Microsoft. I'm planning to set up the network for my company and use Microsoft ...
64
votes
8answers
4k views

Popular Security “Cargo Cults”

In Information and IT Security there is a nasty tendency for specific "best practices" to become inviolable golden rules, which then leads to people recommending that they are applied regardless of ...
5
votes
1answer
964 views

Why does oAuth and oAuth 2 have access tokens at all?

I am trying to implement a system for third-party apps to access data that a user stores on a provider. We have a robust access control system, with separate read/write/etc. levels for each "stream" ...
4
votes
1answer
308 views

Cleanware. What does it do and are there security risks involved?

So I get these questions quite a lot recently from friends or family. And I thought this could be a good question for Security Exchange, because I couldn't find this kind of question here. I recieved ...
17
votes
8answers
14k views

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

Imagine I wish to upload my sensitive personal information (photos, document scans, list of passwords, email backups, credit card information, etc.) on Google Drive (or any other cloud service). I ...
1
vote
1answer
2k views

Does my host machine stay completely safe if I'm browsing the dark web using virtual box or vmware on bridge network connection? [duplicate]

I'm just asking if my host machine stays safe when browsing the dark web darknet using Tor on a virtual machine with bridge connection through the host machine ? Since the virtual machine will be ...
8
votes
2answers
11k views

Android Kitkat reports: “Network May Be Monitored by an Unknown Third Party” when using non-default root CA

My company uses a private PKI to handle such scenarios such as Mutual auth (TLS) to a website using client certificates SSL web server certificates on an Intranet (once a VPN session is established.) ...
25
votes
4answers
1k views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
3
votes
3answers
1k views

Does mixing in keystrokes of Backspace, Arrows and Delete add any security to password typing?

It is well known that the analysis of the keyboard sound can reveal/hint at what keys were pressed when a password is typed. One could mix in wrong characters (not belonging to the password) with ...
3
votes
1answer
90 views

NFC Security for Payment

During an offline transaction, the Point-of-Sale has no internet connection, and so the payment terminal cannot verify if the client’s payment device has been revoked. A malicious person can use a ...
3
votes
1answer
182 views

Handwriting/cursive education is on the decline. How does this affect signature-based authentication?

More and more schools are not teaching cursive handwriting, and many are considering it more of an art, or optional in the curriculum. I assume this will have an impact on the ability to forge a ...
1
vote
1answer
168 views

Notification or report for security problem of unix systems? [duplicate]

I have Unix systems (Solaris, Oracle,.Redhat etc.). I have to control all systems for security problem,bugs,patch,vulnerabilities. I'm looking for security information for all security issues. After ...
0
votes
2answers
504 views

CMS security issues

I have a desire to make my own CMS , to improve my programming skills. I would use PHP as a server side programming language. So my question is, on what security issues I must pay attention when ...
14
votes
3answers
34k views

Is it safe to auto-fill credit card numbers using Chrome?

Is it safe to auto fill credit card numbers using Chrome? Does it safely store the credit card information? As far as my understanding goes, it just shows asterisk values but on click it reveals the ...
4
votes
0answers
120 views

Is there any way a website can show it hasn't been “hijacked” by the authorities? [closed]

I heard about warrant canaries and thought the idea was interesting. My understanding of what they are is a website or online service publishes a statement periodically that they have not been served ...
-4
votes
1answer
57 views

Tendency towards security-is-binary in cryptography [closed]

In the real (physical) world, we seem to feel secure with just enough security, e.g.: Our door lock isn't the most secure. Anyone can lock-pick / break with force. Our car isn't the most robust. ...
4
votes
1answer
3k views

Capturing text messages on the fly

Suppose your phone is not connected to any network. You are sitting in a cafeteria with 50 other people, everyone is communicating to each other via text messages. Is it possible through any device or ...
13
votes
2answers
10k views

Is LastPass secure enough? [closed]

They said: Private Master Password: The user’s master password, and the keys used to encrypt and decrypt user data, are never sent to LastPass’ servers, and are never accessible by LastPass. ...
8
votes
1answer
1k views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
14
votes
3answers
3k views

How can I explain to the client that rfc2385 TCP MD5 Checksums can't be turned on for linux webservers?

I've had a long running conversation with a client where they perform a Rapid7 security scan which then warns about TCP MD5 checksums missing on port 80. This is what I think I know: RFC 2385 was ...
4
votes
3answers
1k views

How to choose a linux for learning? [closed]

I am beginner in Security. My first assignment is about "Linux firewall using IPTABLES" . I know about Ubuntu, backtrack and kali Linux. How to choose a Linux distribution to learn about security?
1
vote
3answers
1k views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
4
votes
2answers
7k views

Checking SSL/TLS servers for NULL encryption support

I have a web server supporting SSL 3 and TLS protocols, the following are the supported cipher suites: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can I check ...