The Stack Overflow podcast is back! Listen to an interview with our new CEO.
452

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one still has to use these techniques. And many developers are simply not aware of security problems. Most care that the application works at all and don't care ...


353

"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account." The rational point here is that technology is morally neutral. Encryption does not work differently depending on whether the attacker is morally right and the defender morally wrong, or vice versa. It is all ...


272

Because it's not a problem. When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up for negligence? When was the last time a company lost a big contract because their company website login page didn't validate ...


223

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the saved image. (Paint doesn't.) There are some things to watch out for, though: The width of the blanked region places an upper bound on the length of the secret ...


117

SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax trees as first-class objects, not by concatenating strings that represent fragments of a language. There has been a bit of progress in recent years with the ...


109

There's a number of reasons: If it has happened to one person, it might have happened to more. These other people might not be as kind. Who knows, this person might change their mind. When they made the effort to contact you, and just gets a "meh" in return, they might be a bit annoyed and decide to punish you for it. Or maybe they just want to poke around ...


106

PCI DSS The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform to a set of security practices and (usually) audit requirements, or (b) stop handling payment card data themselves and delegate it to someone who can handle ...


105

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption. The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten ...


94

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


83

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data and avoid data that is not yours. Make sure you include the URLs. Document those in a way that a lawyer can understand. This is likely to become a legal ...


81

I would take their argument and replace "cryptography" with "locks and keys on our houses" and see if they still agree: If more terrorists and criminals would be caught by not having locks and keys on our houses, I would not blame warrantless searches by government and companies in our homes.


70

Explain it with questions: Do you close the door when you poop? Why? Everybody poops, you aren't doing anything special in there, so what do you have to hide? If someone leaves a pile of poop downtown in the middle of the road does that mean we must all poop with door open? Simply because the pile of poop was gathered in a bathroom?


68

I commonly use a Password manager to store and share passwords. There are many password managers that have this functionality. A password is shared from one account to the other, with the notification of the share sent via email to the other person, who can choose to accept, reject, or just ignore the share. The communication of the password is secure, ...


66

Here is what they spy on, finally officially admitted after being proved again and again by different independent sources. That should make a pretty good idea on what actually is transmitted. To actually see what's being reported you can give yourself permissions for %ProgramData%\Microsoft\Diagnosis directory and look what's in there, but the file are ...


63

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a GIF, JPG, or PNG image destroys the previous contents. Drawing a black box over a section of a Photoshop, Corel Draw, or Paint Shop Pro native image does not ...


62

A common practice is to send the user an initial password via email which is only valid for a very short time and needs to be changed immediately during the first login. This is not perfect either. An attacker with read access to the user's email could intercept that initial password before the user and use it on their behalf. The user would notice as soon ...


58

While it's impossible to read the minds of the people at play - I'd think that the independent programmer A) Doesn't want to be accused of impropriety - It's much harder to be accused of IP theft if you kick and scream to have your access revoked post-haste. B) Is aghast at the security posture of the company that controls the private repository and knows ...


57

The thing I haven't yet seen anyone mention is: Ordinary criminals are far more common than terrorists. While crypto might help a terrorist evade the FBI (for a while, anyway) it also helps protect you from ordinary criminals who want to steal your money and hijack your computer for their own ends. The question is, will you concretely give up your safety ...


55

When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe". This works, and your application seems to work fine. Then, one day, someone names their child Robert'); DROP TABLE Students; -- (little Bobby Tables). Of ...


54

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do that, they would have no end of workarounds, up to printing QR codes on A4 sheets. Rather, it is to prevent employees from saving sensitive information on USB ...


51

Very good question. Yes, by default, WinRAR leaves traces of temporarily extracted files. WinRAR does indeed create temporary files when opening them directly from the archive. It also performs a normal deletion once WinRAR is closed. However, deleted files do physically stay on the disk after you delete them. Normal delete operations only delete the file ...


47

Imagine if, during the civil rights era, people had access to things like email and smartphones. People like the organizers of the Montgomery bus boycotts would have a little pocket computer that could tell the authorities where they’d been, who they talked to, and what they were talking about. The authorities, at the time, considered these people ...


45

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost. However, the PNG format supports storage of an unlimited amount of metadata which is usually not displayed by image viewers. This feature is often used by image editors to add additional metadata to the image. One possible use-case is ...


43

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various legal requirements , which vary depending on the nature of the data being stored, as well as the jurisdiction that the data falls under. Retaining log data can ...


38

You do get some security from the way your fuse box is connected to the mains. In principle you should get a good signal across any part of the wiring in your house that is on the same phase, and you shouldn't get any on the other phases. In reality though, that isn't quite true - depending on your fuse box, you may get some bleed over onto the other ...


38

Memory dumps often have document contents It's worth noting that if you're sending a memory dump of a crashed application at the moment of its crash (which is a reasonable way of analyzing crashes) then that memory dump is very likely to include the contents of whatever document(s) were opened in that app at the time. So if you're "just" sending app crash ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


36

There is mainly two kind of people to consider in this question: The person working on the computer. This person is your employee, they went through your HR screening and abides by your policies. They have been trusted to access and work with some data. Due to this, since they need to see, no technical measure can prevent them from taking photographs (using ...


34

I live in a detached family home in Texas. I have a pair of Trendnet TPL-303E powerline adapters and have experienced the signal bleed from my next door neighbor. I ran the Powerline utility that came with the adapters and could identify two other powerline adapters using the same network name. I got anywhere between 10 to 20Mbps of throughput between their ...


32

There is an element of truth to this one - an attack was discovered which took advantage of data remanence in RAM, allowing an attacker to grab data from the RAM in a machine. There was a very short timeframe (a matter of seconds or minutes) in which to do this, but it wasn't a hack of the PC as such. Simple Wikipedia link to Cold Boot Attack here And the ...


Only top voted, non community-wiki answers of a minimum length are eligible