94

Don't give security info to non-security people. Use whatever contact method is available to ask for the right security person. Don't give details about what you found until you get someone who will understand it. Then provide the details about what you found. Don't ask for reward or demand any kind of action or else you are very likely not to be taken ...


37

One option if you're not having luck finding contact details is to contact the CERT (Computer/Cyber Emergency Response Team) in your's or the entity's country List of global CERTs. These organisations generally have methods of contacting the appropriate people (within the affected entity and national authorities). In Australia at least, contact from AusCERT ...


27

According to developer.chrome.com: [Chrome Extensions] are built on web technologies such as HTML, JavaScript, and CSS. This means, anything that could affect the behavior of an extension will exist in a plain-text format (as opposed to a binary). Chrome allows you to debug extensions, giving you a comparatively easy way to see what an extension is doing,...


23

So if I wish to open "any" site on a new tab while doing my online shopping, is it safe The same origin policy should prevent other sites from accessing your data in the online shopping site. That is assuming that the shopping site has no vulnerabilities that leak data (CSRF, XSS, XSSI, broken CORS, broken messaging, etc.). Having only one tab ...


13

The private keys are not displayed, not even ephemeral ones used only for that session. But public keys are displayed. Person with access to output of ssh -vvv would be able to identify the server in an internet scan (if server is open to the internet) and identify the client using something like "ssh public key is associated with github account". ...


12

Tracing your browser traffic using a free proxy like fiddler can show some eye opening things. I could see an outbound request to an unfamiliar domain after every page I visited. Looking at the headers of the unfamiliar requests in Fiddler, i could see the URL of the page i visited! I disabled my chrome extensions one by one until I found the culprit. ...


12

Initial premise: Finding was obtained lawfully You need to dig up who is their security contact, who in the org should be contacted around disclosure of security faults. How that is (or isn't) organised is entirely up to the org. It's also entirely up to them to ignore or misunderstand you so please bear that in mind and set your expectations. Finding a ...


8

The only useful thing about your routine is cleaning the cookies. It's not useful in itself, it is just that, this way, you delete your login session and so a new login (which requires inputting a secret like a password) is required to interact with the shopping site. A better alternative (in terms of your user experience and security) would be logging out ...


5

How much effort do you want to make and why do you want to make it? low-effort, "I don't care about them, I just want to be a good person" answer: Get yourself a throw-away e-mail. Send them a message to the support address, starting with "please forward to CISO or other person responsible for information security" and let them know where you found what, ...


5

Consider handing the info to an impartial, well-known clearing house like Troy Hunt. https://www.troyhunt.com/ and https://haveibeenpwned.com/ That way you can stay completely anonymous.


4

The GDPR isn't just about storing sensitive data, but it's more general. In fact, it's actually about processing personal data. Here are a few interesting quotes from the GDPR that you might want to consider (emphasis added): Article 2(1) - This Regulation applies to the processing of personal data wholly or partly by automated means and to the processing ...


4

Your plan is full of holes. and these cannot be fixed. if you allow PDFs out you allow anything that can be converted to pdf out. if you allow any email out source code can be copied and pasted into an email. if you allow web access source code can be copied and pasted into gmail. I think the only solution is to keep the most secret stuff on a server ...


4

"Breach" has a specific meaning: existing controls were somehow broken or bypassed. This could have been accidental or malicious. Outside or inside people could breach controls. Hackers who manipulate a system to gain access to data they are not authorised to access is a data breach, as is an employee going against policy/procedure which exposes data. "Leak"...


4

A scenario with three different applications If you have three different applications in most cases they should not all have full access to the database in the first place, just the data each needs. If they all need the same data, that is already a setup that reeks of misusing the database as a synchronization mechanism. If that's the database's main ...


4

The option "-vvv" leads to displaying mot information on your display. An attacker that is only observing your network traffic will not get any of this information because the traffic between your terminal and remote host is encrypted. For instance, "-vvv" option leads to displaying information about environment variables defined on the ...


3

This is a popular online scam so you should delete the email and move about your business. See the FBI's Public Service Announcement on this scam specifically. https://www.ic3.gov/media/2020/200420.aspx


3

First, you are dealing with developers. They are known to sidestep and bypass everything that stands in their way. No matter what protections you setup, a developer will bypass it sooner or later. And tell the others. Data can be a copy or moved inside the company internal network You cannot guarantee that even with a VPN. If the user owns its own ...


3

I was developing extension for Chrome working with network of browser (not only current window). And I was surpriset how many data are transfered even when I don't do any actions. There was communication of: inactive tabs closed tabs (through service worker) extensions but it's hard to determine what is leaking of data and what is communication necessary ...


3

This would be the work of Cookies, fingerprints and/or other tracking techniques. Many sites have a Facebook (tracking) pixel for advertising purposes, or inject Facebook scripts for including feeds or a like button. This sends data to FB about your visit and possibly any interaction you have with the website. You do not need to login to these sites using ...


3

This is not a safe approach! You should encrypt your data and/or use another biometric template protection scheme. For an example, see a technical report of the Indian Aadhaar system, where it is described how they handle it (e.g. on page 47). Depending on your jurisdition, biometric information may be considered as sensitive. For example, in the EU under ...


2

I have been in a similar situation. I contacted my boss and the owner immediately (we only had 25 people). The owner handled everything, but he asked me to be available for a phone call. Since this involved a DOD contractor in the US, it was a DOD responsibility. We were never told the outcome. Let the owner/COO/corporate counsel contact law enforcement. ...


2

The most practical option for physically destroying an SSD is to simply use a hammer. If you can, open the SSD and locate the data-bearings chips and make sure that each chip is sufficiently destroyed. If this is a service you are offering to businesses, however, beware of legal requirements for both data disposal and recycling, and consider investing in ...


2

Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state GDPR indicates to protect data in storage, processing and in transit. The data in the volatile memory is(in most cases)/shall only be accessible to trusted process/ child or parent process or processes. Basically make sure process can not be ...


2

Short answer: GDPR does not strictly require you to use encryption. Long answer: There are no guidelines on how to see encryption in the scope of the GDPR, which really is a pity given existing confusions. However, there are some guidelines mentioning encryption. But guidelines are not something mandatory. Although the GDPR obviously requires that ...


2

One more option in case the relevant jurisdiction does not have a CERT organization (though chances are high that if you're reading this post, you live in a country with one or the other company is based in such a country) and you can't find any other way to contact a relevant person at the company, but one you need to be more careful with, is contacting a ...


2

Two very common situations: no one thought about it that was not the original design, but scope creep or "temporary measures" meant that the final product exceeded the plans for review, so it wasn't on anyone's radar As a single developer, you hold all the moving parts in your head and you touch every part of the system. You could think about the impacts ...


2

I hesitated before posting this answer since it's only helpful for web applications, but I believe it belongs here. There are some efforts that try to standardize the way security issues should be reported, and a database leak is one of those. The proposal is called security.txt, and as far as I know, the paper is still a draft. security.txt (put simply) ...


2

I do this to ensure any other websites that I open on new tab does not sneak into my credit card information. Is this even possible or just a myth? That is simply not possible, because the browser doesn't allow such a request due to the same origin policy without the website explicitly stating it in their CORS headers; apart from that, credit card info isn'...


1

There are several aspects which lead to insecure software, data leaks etc. The main requirement for any business task is always that it has to work since otherwise it would be useless. Security comes only second and in no way should security requirements impact the actual use too much. Add to this insecure defaults and the complexity of the software stack ...


1

Is it completely safe to do with a smartphone "Completely safe" is a myth. or can there be security threats? The security threats depends upon what application you got installed on the phone and other varying factors too. This makes me think of if there could be security risks or surveillance threats. You need to look into processes and connections, ...


Only top voted, non community-wiki answers of a minimum length are eligible