484
votes
SQL injection is 17 years old. Why is it still around?
There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one ...
- 198k
354
votes
Accepted
How can I explain to non-techie friends that "cryptography is good"?
"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account."
The rational point here is that technology is ...
- 172k
284
votes
SQL injection is 17 years old. Why is it still around?
Because it's not a problem.
When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the ...
- 2,757
227
votes
Accepted
How secure is 'blacking out' sensitive information using MS Paint?
As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the ...
- 2,501
121
votes
SQL injection is 17 years old. Why is it still around?
SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax ...
- 10.6k
109
votes
Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?
There's a number of reasons:
If it has happened to one person, it might have happened to more. These other people might not be as kind.
Who knows, this person might change their mind. When they made ...
- 65.4k
107
votes
Accepted
Why is credit card information not stolen more often?
PCI DSS
The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
- 8,429
96
votes
Accepted
How do I inform a company I found a leaked database of theirs on the Internet?
Don't give security info to non-security people. Use whatever contact method is available to ask for the right security person. Don't give details about what you found until you get someone who will ...
- 128k
82
votes
How can I explain to non-techie friends that "cryptography is good"?
I would take their argument and replace "cryptography" with "locks and keys on our houses" and see if they still agree:
If more terrorists and criminals would be caught by not having locks and keys ...
- 920
82
votes
Ex-contractor published company source code and secrets online
First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data ...
- 1,199
72
votes
How can I explain to non-techie friends that "cryptography is good"?
Explain it with questions: Do you close the door when you poop? Why? Everybody poops, you aren't doing anything special in there, so what do you have to hide?
If someone leaves a pile of poop ...
- 851
69
votes
Alternative to sending password over mail?
I commonly use a Password manager to store and share passwords. There are many password managers that have this functionality.
A password is shared from one account to the other, with the ...
- 607
68
votes
Accepted
Does Windows 10's telemetry include sending *.doc files if Word crashed?
Here is what they spy on, finally officially admitted after being proved again and again by different independent sources. That should make a pretty good idea on what actually is transmitted.
To ...
- 8,879
64
votes
How secure is 'blacking out' sensitive information using MS Paint?
Ditto Ben N, but let me add a couple of points that are too long to fit as comments.
I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a ...
- 859
63
votes
SQL injection is 17 years old. Why is it still around?
When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe"....
- 1,217
63
votes
Accepted
Alternative to sending password over mail?
A common practice is to send the user an initial password via email which is only valid for a very short time and needs to be changed immediately during the first login.
This is not perfect either. ...
- 49.3k
58
votes
How can I explain to non-techie friends that "cryptography is good"?
The thing I haven't yet seen anyone mention is:
Ordinary criminals are far more common than terrorists.
While crypto might help a terrorist evade the FBI (for a while, anyway) it also helps protect ...
- 3,887
58
votes
Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?
While it's impossible to read the minds of the people at play - I'd think that the independent programmer
A) Doesn't want to be accused of impropriety - It's much harder to be accused of IP theft if ...
54
votes
Accepted
Is disallowing write to USB actually an efficient way to prevent data leakage?
One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do ...
- 22.8k
47
votes
How can I explain to non-techie friends that "cryptography is good"?
Imagine if, during the civil rights era, people had access to things like email and smartphones. People like the organizers of the Montgomery bus boycotts would have a little pocket computer that ...
- 607
44
votes
Accepted
Should we keep logs forever to investigate past data breaches?
There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
- 769
39
votes
As a contractor how do I work on multiple client networks without data leakage?
You could use a very small VM for each one, but keep the IDE on the host, not on the guests. Share a folder from the VM to the host, so you use the host and its resources to develop, and use the VM ...
- 53.5k
38
votes
Does Windows 10's telemetry include sending *.doc files if Word crashed?
Memory dumps often have document contents
It's worth noting that if you're sending a memory dump of a crashed application at the moment of its crash (which is a reasonable way of analyzing crashes) ...
- 8,429
38
votes
How do I inform a company I found a leaked database of theirs on the Internet?
One option if you're not having luck finding contact details is to contact the CERT (Computer/Cyber Emergency Response Team) in your's or the entity's country List of global CERTs. These organisations ...
- 559
36
votes
Accepted
Pwned by a website I never subscribed to - How do they have my e-mail address?
Web scraping is indeed a possibility, as mentioned in this Wired article:
As Apollo noted in its letter to customers, it draws a lot of its information from public sources around the web, including ...
- 2,265
33
votes
Accepted
Will this Account Lockout mechanism increase the severity of a information leakage vulnerability that leaks usernames?
I would consider this a serious vulnerability. This can lead to an attack where the attacker can lock out every single user for 30 minutes.
Unless the company have a VPN in place, or other protection ...
- 53.5k
31
votes
How can I explain to non-techie friends that "cryptography is good"?
My response here is likely many in a sea of answers, but here's the breakdown of why encryption is good, why it's vital, and why breaking it is pointless.
-
Congress investigation found not a single ...
- 423
30
votes
SQL injection is 17 years old. Why is it still around?
Steffen makes good points in his answer, but I'd like to add to it. The why, I think, can be broken in to the following topics:
Lack of knowledge or education of developers
Churn in an enterprise ...
- 3,036
27
votes
Alternative to sending password over mail?
Two factors
Perhaps it's not literally appropriate for your situation, but one reasonable way to send sensitive data over channels that aren't entirely secure is to ensure that two separate factors ...
- 8,429
26
votes
Accepted
Is there a secure way to transfer data outside the Internet?
It really depends upon the specific threats you may be facing, the direction of your data transfers, etc.
USB specific dangers
You mention the dangers of USB. The main one is indeed related to its ...
- 19.2k
Only top scored, non community-wiki answers of a minimum length are eligible