478 votes

SQL injection is 17 years old. Why is it still around?

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one ...
user avatar
353 votes
Accepted

How can I explain to non-techie friends that "cryptography is good"?

"If lack of encryption allows FBI to catch terrorists, then lack of encryption allows criminals to loot your emails and plunder your bank account." The rational point here is that technology is ...
user avatar
  • 168k
283 votes

SQL injection is 17 years old. Why is it still around?

Because it's not a problem. When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the ...
user avatar
226 votes
Accepted

How secure is 'blacking out' sensitive information using MS Paint?

As mentioned in the answers to a very similar question, scribbling over part of an image will destroy the original pixels, assuming that your editor doesn't store any layers or undo history in the ...
user avatar
  • 2,491
120 votes

SQL injection is 17 years old. Why is it still around?

SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax ...
user avatar
109 votes

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

There's a number of reasons: If it has happened to one person, it might have happened to more. These other people might not be as kind. Who knows, this person might change their mind. When they made ...
user avatar
  • 64.2k
107 votes
Accepted

Why is credit card information not stolen more often?

PCI DSS The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
user avatar
  • 8,370
96 votes
Accepted

How do I inform a company I found a leaked database of theirs on the Internet?

Don't give security info to non-security people. Use whatever contact method is available to ask for the right security person. Don't give details about what you found until you get someone who will ...
user avatar
  • 123k
82 votes

How can I explain to non-techie friends that "cryptography is good"?

I would take their argument and replace "cryptography" with "locks and keys on our houses" and see if they still agree: If more terrorists and criminals would be caught by not having locks and keys ...
user avatar
  • 920
82 votes

Ex-contractor published company source code and secrets online

First take screenshots of what you find. For the data that is yours, you should catalogue that. Personally, I would download it so you have a reference. You should take screenshots of your own data ...
user avatar
72 votes

How can I explain to non-techie friends that "cryptography is good"?

Explain it with questions: Do you close the door when you poop? Why? Everybody poops, you aren't doing anything special in there, so what do you have to hide? If someone leaves a pile of poop ...
user avatar
69 votes

Alternative to sending password over mail?

I commonly use a Password manager to store and share passwords. There are many password managers that have this functionality. A password is shared from one account to the other, with the ...
user avatar
  • 607
68 votes
Accepted

Does Windows 10's telemetry include sending *.doc files if Word crashed?

Here is what they spy on, finally officially admitted after being proved again and again by different independent sources. That should make a pretty good idea on what actually is transmitted. To ...
user avatar
  • 8,719
64 votes

How secure is 'blacking out' sensitive information using MS Paint?

Ditto Ben N, but let me add a couple of points that are too long to fit as comments. I'd emphasize the distinction between layered and un-layered data formats. Drawing a black box over a section of a ...
user avatar
  • 859
63 votes
Accepted

Alternative to sending password over mail?

A common practice is to send the user an initial password via email which is only valid for a very short time and needs to be changed immediately during the first login. This is not perfect either. ...
user avatar
  • 48.8k
61 votes

SQL injection is 17 years old. Why is it still around?

When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe"....
user avatar
  • 1,197
58 votes

How can I explain to non-techie friends that "cryptography is good"?

The thing I haven't yet seen anyone mention is: Ordinary criminals are far more common than terrorists. While crypto might help a terrorist evade the FBI (for a while, anyway) it also helps protect ...
user avatar
58 votes

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

While it's impossible to read the minds of the people at play - I'd think that the independent programmer A) Doesn't want to be accused of impropriety - It's much harder to be accused of IP theft if ...
user avatar
54 votes
Accepted

Does WinRAR leave traces of temporarily extracted files?

Very good question. Yes, by default, WinRAR leaves traces of temporarily extracted files. WinRAR does indeed create temporary files when opening them directly from the archive. It also performs a ...
user avatar
  • 43.7k
54 votes
Accepted

Is disallowing write to USB actually an efficient way to prevent data leakage?

One of the main reasons behind the prohibition of writing data to USB drives (I had this explained to me once) is not to prevent employees from stealing sensitive information. If they wanted to do ...
user avatar
  • 22.5k
47 votes

How can I explain to non-techie friends that "cryptography is good"?

Imagine if, during the civil rights era, people had access to things like email and smartphones. People like the organizers of the Montgomery bus boycotts would have a little pocket computer that ...
user avatar
  • 607
46 votes
Accepted

Can you recover original data from a screenshot that has been 'blacked out'?

Usually the PNG format does not support multiple layers. So when you draw over something, whatever was there before is lost. However, the PNG format supports storage of an unlimited amount of ...
user avatar
  • 48.8k
44 votes
Accepted

Should we keep logs forever to investigate past data breaches?

There is no "correct" answer to your question, unfortunately. Data retention policies are specific to the needs of an organization, and are often implemented out of necessity to comply with various ...
user avatar
  • 769
39 votes

As a contractor how do I work on multiple client networks without data leakage?

You could use a very small VM for each one, but keep the IDE on the host, not on the guests. Share a folder from the VM to the host, so you use the host and its resources to develop, and use the VM ...
user avatar
  • 50.3k
38 votes

Does Windows 10's telemetry include sending *.doc files if Word crashed?

Memory dumps often have document contents It's worth noting that if you're sending a memory dump of a crashed application at the moment of its crash (which is a reasonable way of analyzing crashes) ...
user avatar
  • 8,370
38 votes

How do I inform a company I found a leaked database of theirs on the Internet?

One option if you're not having luck finding contact details is to contact the CERT (Computer/Cyber Emergency Response Team) in your's or the entity's country List of global CERTs. These organisations ...
user avatar
  • 559
37 votes
Accepted

Is it possible to prevent unauthorized copying or recording of data by photographing screens?

There is mainly two kind of people to consider in this question: The person working on the computer. This person is your employee, they went through your HR screening and abides by your policies. ...
user avatar
36 votes

At what point in their employment should security policies be explained to an employee?

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You ...
user avatar
  • 123k
36 votes
Accepted

Pwned by a website I never subscribed to - How do they have my e-mail address?

Web scraping is indeed a possibility, as mentioned in this Wired article: As Apollo noted in its letter to customers, it draws a lot of its information from public sources around the web, including ...
user avatar
  • 2,235
35 votes
Accepted

How to securely, physically destroy a hard drive at home?

You want fast and simple? Step 1: Try and take it apart. If you have the right screwdrivers, great, if not, just go to the next step. EDIT2: Also use sandpaper on the platters before smashing them. ...
user avatar
  • 956

Only top scored, non community-wiki answers of a minimum length are eligible