Questions tagged [security-theater]

DO NOT USE THIS TAG AS A GENERIC SECURITY TAG!! Security theater is a term that describes security countermeasures intended to provide the feeling of improved security while doing little or nothing to actually improve security. The term was coined by computer security specialist and writer Bruce Schneier for his book Beyond Fear.

Filter by
Sorted by
Tagged with
54
votes
4answers
10k views

Effectiveness of Security Images

Do security images such as those presented upon logging into banks provide any tangible security benefits, or are they mostly theater? Per my understanding, if somebody is phishing your users, it's ...
36
votes
7answers
19k views

Could SQRL really be as secure as they say?

I just came across https://www.grc.com/sqrl/sqrl.htm With Secure QR Login, your phone snaps the QR code displayed on a website's login page . . . . and YOU are securely logged in. This seems ...
10
votes
1answer
414 views

What would happen if some random webpage made an Ajax request for http://127.0.0.1/private.txt?

I run a localhost-only webserver (PHP's built-in one) for all my admin panels and whatnot on my machine. I'm worried that, if any random webpage has a JavaScript snippet which makes an Ajax call to ...
64
votes
8answers
4k views

Popular Security “Cargo Cults”

In Information and IT Security there is a nasty tendency for specific "best practices" to become inviolable golden rules, which then leads to people recommending that they are applied regardless of ...
86
votes
6answers
20k views

How am I ever going to be able to “vet” 120,000+ lines of Composer PHP code not written by me? [duplicate]

I depend on PHP CLI for all kinds of personal and (hopefully, soon) professional/mission-critical "business logic". (This could be any other language and the exact same problem would still stand; I'm ...
0
votes
1answer
563 views

Can we identify if someone is keeping an eye on our computer usage?

For some reason I had been using public network for a small time, and I suspect that someone was actually watching/recording my online/offline activities. At some time I suspected that someone was ...
233
votes
3answers
34k views

Why did I have to wave my hand in front of my ID card?

I recently had to authenticate myself online to use an internet-based service. The authentication process was done via video call with me holding my ID card in front of my laptop camera beside my face....
17
votes
8answers
14k views

Are 7-Zip password-protected split archives safe against hackers when they are password-protected a couple of times?

Imagine I wish to upload my sensitive personal information (photos, document scans, list of passwords, email backups, credit card information, etc.) on Google Drive (or any other cloud service). I ...
77
votes
8answers
14k views

If we should encrypt the message rather than the method of transfer, why do we care about wifi security? Is this just security theatre?

Most answers to this question about the security of satellite internet boil down to: encrypting the message is more important than encrypting the method of transfer. However, there seems to be a lot ...
26
votes
8answers
6k views

Why don't banks get hacked?

From reading a lot of info on this website I came to the conclusion that if someone with enough skill really badly wants to gain access somewhere, then there is absolutely nothing stopping them from ...
20
votes
7answers
4k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
25
votes
4answers
1k views

Security seals and the “perception of safety”?

I clearly understand that the security seals (verisign or norton secure etc.) shown on banking and other websites are generated using a script and available only after an ssl certificate is purchased ...
13
votes
3answers
2k views

Security of pronounceable passwords

Some random password generators support the generation of pronounceable words of any given length n. Assuming that words are derived using 26 lowercase letters, the number of possible words of length ...
4
votes
2answers
7k views

Checking SSL/TLS servers for NULL encryption support

I have a web server supporting SSL 3 and TLS protocols, the following are the supported cipher suites: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can I check ...
17
votes
7answers
480 views

Is a “security measure” that doesn't provide a security benefit actually harmful?

If a security measure is implemented that doesn't provide any additional security benefit, can it be considered harmful? As an example, consider a login page where the user is asked to enter their ...
4
votes
2answers
120 views

How much security information to publicise?

Apologies if this in the wrong section, not sure if it should go in Server Fault or not. I am preparing to launch a new web app. We have put a lot of effort into offering good security. From a PR ...
3
votes
2answers
1k views

Firewall egress filtering / quick whitelisting

Suppose your Aunt or Uncle is easily fooled by phishing attempts and their computer has multiple root kits and key loggers running. Assume their computing habits will never change. Looking at his ...
2
votes
3answers
392 views

What is Security Theater?

Security Theater, or Security Theatre in British English, has been mentioned in many posts on this site. What does Security Theater mean? What are some examples? Is it the greatest threat to ...
0
votes
2answers
289 views

Is the common recommendation to obscure the existance of a username on login just security theater? [duplicate]

It is a common recommendation to return "Username or password is incorrect" instead of "Username does not exist" when the given username does not exist and "Password is incorrect" when username exists ...