Skip to main content
485 votes

SQL injection is 17 years old. Why is it still around?

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one ...
Steffen Ullrich's user avatar
352 votes
Accepted

How can I explain to non-techie friends that "cryptography is good"?

"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account." The rational point here is that technology is ...
Tom Leek's user avatar
  • 173k
285 votes

SQL injection is 17 years old. Why is it still around?

Because it's not a problem. When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the ...
TessellatingHeckler's user avatar
226 votes
Accepted

How secure is 'blacking out' sensitive information using MS Paint?

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the ...
Ben N's user avatar
  • 2,501
123 votes

SQL injection is 17 years old. Why is it still around?

SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax ...
Luis Casillas's user avatar
109 votes

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

There's a number of reasons: If it has happened to one person, it might have happened to more. These other people might not be as kind. Who knows, this person might change their mind. When they made ...
Anders's user avatar
  • 65.7k
107 votes
Accepted

Why is credit card information not stolen more often?

PCI DSS The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
Peteris's user avatar
  • 8,429
95 votes
Accepted

How do I inform a company I found a leaked database of theirs on the Internet?

Don't give security info to non-security people. Use whatever contact method is available to ask for the right security person. Don't give details about what you found until you get someone who will ...
schroeder's user avatar
  • 131k
82 votes

Ex-contractor published company source code and secrets online

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data ...
Unicorn Tears's user avatar
80 votes

How can I explain to non-techie friends that "cryptography is good"?

I would take their argument and replace "cryptography" with "locks and keys on our houses" and see if they still agree: If more terrorists and criminals would be caught by not having locks and keys ...
PseudoSu's user avatar
  • 900
72 votes

How can I explain to non-techie friends that "cryptography is good"?

Explain it with questions: Do you close the door when you poop? Why? Everybody poops, you aren't doing anything special in there, so what do you have to hide? If someone leaves a pile of poop ...
zoplonix's user avatar
  • 851
69 votes

Alternative to sending password over mail?

I commonly use a Password manager to store and share passwords. There are many password managers that have this functionality. A password is shared from one account to the other, with the ...
Kent's user avatar
  • 607
68 votes
Accepted

Does Windows 10's telemetry include sending *.doc files if Word crashed?

Here is what they spy on, finally officially admitted after being proved again and again by different independent sources. That should make a pretty good idea on what actually is transmitted. To ...
Overmind's user avatar
  • 8,899
64 votes

How secure is 'blacking out' sensitive information using MS Paint?

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a ...
Jay's user avatar
  • 859
64 votes

SQL injection is 17 years old. Why is it still around?

When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe"....
Nick Gammon's user avatar
  • 1,227
63 votes
Accepted

Alternative to sending password over mail?

A common practice is to send the user an initial password via email which is only valid for a very short time and needs to be changed immediately during the first login. This is not perfect either. ...
Philipp's user avatar
  • 49.4k
58 votes

How can I explain to non-techie friends that "cryptography is good"?

The thing I haven't yet seen anyone mention is: Ordinary criminals are far more common than terrorists. While crypto might help a terrorist evade the FBI (for a while, anyway) it also helps protect ...
Michael Hampton's user avatar
58 votes

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

While it's impossible to read the minds of the people at play - I'd think that the independent programmer A) Doesn't want to be accused of impropriety - It's much harder to be accused of IP theft if ...
Monica Apologists Get Out's user avatar
54 votes
Accepted

Is disallowing write to USB actually an efficient way to prevent data leakage?

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do ...
LSerni's user avatar
  • 22.9k
47 votes

How can I explain to non-techie friends that "cryptography is good"?

Imagine if, during the civil rights era, people had access to things like email and smartphones. People like the organizers of the Montgomery bus boycotts would have a little pocket computer that ...
Cedrus's user avatar
  • 607
44 votes
Accepted

Should we keep logs forever to investigate past data breaches?

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
John's user avatar
  • 769
39 votes

Does Windows 10's telemetry include sending *.doc files if Word crashed?

Memory dumps often have document contents It's worth noting that if you're sending a memory dump of a crashed application at the moment of its crash (which is a reasonable way of analyzing crashes) ...
Peteris's user avatar
  • 8,429
39 votes

As a contractor how do I work on multiple client networks without data leakage?

You could use a very small VM for each one, but keep the IDE on the host, not on the guests. Share a folder from the VM to the host, so you use the host and its resources to develop, and use the VM ...
ThoriumBR's user avatar
  • 54.6k
38 votes

How do I inform a company I found a leaked database of theirs on the Internet?

One option if you're not having luck finding contact details is to contact the CERT (Computer/Cyber Emergency Response Team) in your's or the entity's country List of global CERTs. These organisations ...
Aaron's user avatar
  • 559
36 votes
Accepted

Pwned by a website I never subscribed to - How do they have my e-mail address?

Web scraping is indeed a possibility, as mentioned in this Wired article: As Apollo noted in its letter to customers, it draws a lot of its information from public sources around the web, including ...
Glorfindel's user avatar
  • 2,275
33 votes
Accepted

Will this Account Lockout mechanism increase the severity of a information leakage vulnerability that leaks usernames?

I would consider this a serious vulnerability. This can lead to an attack where the attacker can lock out every single user for 30 minutes. Unless the company have a VPN in place, or other protection ...
ThoriumBR's user avatar
  • 54.6k
31 votes

How can I explain to non-techie friends that "cryptography is good"?

My response here is likely many in a sea of answers, but here's the breakdown of why encryption is good, why it's vital, and why breaking it is pointless. - Congress investigation found not a single ...
c1646091's user avatar
  • 423
30 votes

SQL injection is 17 years old. Why is it still around?

Steffen makes good points in his answer, but I'd like to add to it. The why, I think, can be broken in to the following topics: Lack of knowledge or education of developers Churn in an enterprise ...
h4ckNinja's user avatar
  • 3,066
27 votes

Alternative to sending password over mail?

Two factors Perhaps it's not literally appropriate for your situation, but one reasonable way to send sensitive data over channels that aren't entirely secure is to ensure that two separate factors ...
Peteris's user avatar
  • 8,429
26 votes

How can I explain to non-techie friends that "cryptography is good"?

To explain "cryptography" in your scenario requires an understanding of the value of "private communications". It's not about the technology, but about the benefit to society of being able to ...
schroeder's user avatar
  • 131k

Only top scored, non community-wiki answers of a minimum length are eligible