Hot answers tagged

174 votes

Convince people not to share their password with trusted others

The nice and educational way This is a bit similar to your third bullet point. Nobody else should know your password, not even people you trust. That is the only way you can be sure only you have ...
Anders's user avatar
  • 65.6k
160 votes

Convince people not to share their password with trusted others

This post is about communication with people that have absolutely no technical knowledge or interest; especially people afraid of technology. Don't explain, don't complain It is incredible hard to ...
AnoE's user avatar
  • 2,389
144 votes
Accepted

Does it improve security to use obscure port numbers?

Does it improve security to use obscure port numbers? If you're already using high entropy passwords or public key authentication, the answer is "not really". Mostly you're just getting rid of noise ...
Steve Sether's user avatar
  • 21.6k
119 votes

Would removing spaces in a string protect against SQL injection?

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied ...
wireghoul's user avatar
  • 5,959
119 votes

How to explain to traditional people why they should upgrade their old Windows XP device?

(updated, at the bottom - "The 1950 car") Forget talking about security. Don't take the "SECURITY" road. Because if you talk about "security" alone, then chances are good ...
LSerni's user avatar
  • 22.8k
83 votes

How to explain to traditional people why they should upgrade their old Windows XP device?

Most people (this isn't simply "old timers") think computers get broken into by a hacker sitting in a dark room personally trying to attack them by typing really fast. That's why you get responses ...
Steve Sether's user avatar
  • 21.6k
77 votes

Convince people not to share their password with trusted others

Funny enough, I actually don't accept your premise. As an IT professional you can read other people's emails and other communication, delete their directories etc. It is part of the professional code ...
Peter - Reinstate Monica's user avatar
66 votes

I detected someone probing my site for weaknesses, what can I do about it?

Welcome to the internet! This is the normal situation, business as usual. You don't have to do anything, but to harden your website. Probes like that occurs all the time, on every site, day and night....
ThoriumBR's user avatar
  • 53.9k
60 votes

Does it improve security to use obscure port numbers?

Yes, it does. The real question is: By how much? Why it does? You already have basic security, so the everyday bot attacks don't worry you. But there could be a 0-day tomorrow and the attackers know ...
Tom's user avatar
  • 10.3k
49 votes

Would removing spaces in a string protect against SQL injection?

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other ...
Julie Pelletier's user avatar
38 votes

Convince people not to share their password with trusted others

Just change the password after you're done helping them, and send them a password reset link. They will soon learn that it's easier to keep their passwords safe than to restore them. Alternatively (e....
Dmitry Grigoryev's user avatar
31 votes

Does it improve security to use obscure port numbers?

No, it will not improve security. It may reduce log clutter, as automated attacks will only try default ports for e.g. ssh. But the port will still show up as SSH in a port scan, and shodan.io. Those ...
vidarlo's user avatar
  • 16k
29 votes
Accepted

Is my iPhone being targeted by the US Department of Defense?

I don't believe you (or anyone else) is targeted by the US Department of Defense. More plausibly, AT&T screwed up something on their server. A very quick research on the number 1111301000 returns ...
Andrew T.'s user avatar
  • 571
29 votes
Accepted

Is it acceptable to exclude folders in antivirus?

Ah yes, ye olde problem of security tools making a system unusable. My arch nemesis. when is it acceptable to exclude folders in antivirus, and why? Short answer: There's an old adage on this site ...
Mike Ounsworth's user avatar
28 votes
Accepted

What lessons can be learned from the latest spate of Ransomware attacks?

I think one of the main lessons learned is that the security services shouldn’t be hoarding zero days and tools to exploit them, (especially) if they can’t properly secure them. The thing to remember,...
TheJulyPlot's user avatar
  • 7,819
27 votes

Is strategic cyber-warfare feasible today?

The problem with such attacks is that neither the attacker nor the defender have any incentives to claim responsibility of the attack. As such attacks can be done with small number of people and the ...
Lie Ryan's user avatar
  • 31.4k
24 votes

What are the negative aspects of creating fake security footprints?

Note: I like honeypots a lot but to answer your question some negative aspects include: You are not reducing your workload. You are increasing the amount of signals you have to process. You are ...
Trey Blalock's user avatar
  • 14.2k
24 votes

A destructive force can always leak information through HTTP packets. Should I bother configuring outbound rules on my firewall?

You're confusing several things. First, pretty much every standard protocol (save for FTP which you should avoid like plague) has only a handful of standard ports. Since these ports are standards, ...
Stephane's user avatar
  • 18.7k
21 votes

How to explain to traditional people why they should upgrade their old Windows XP device?

One possible response could be: "Because I can't support helping you fix it anymore. If you want help from me, in the future, you'll need to upgrade." Yes, this is effectively holding your expertise ...
Glen Pierce's user avatar
17 votes

Would removing spaces in a string protect against SQL injection?

It would limit the problem, but not eliminate it. Consider the following situation: $un = str_replace(" ", "", $_POST["username"]); $pw = hash($_POST["password"]; $sql = "SELECT * FROM users WHERE ...
Anders's user avatar
  • 65.6k
16 votes

Is it acceptable to exclude folders in antivirus?

It is often necessary if performance matters. I work in HPC, developing software for computer simulations of chemical processes. Just like the vendor you're talking about, we would often recommend our ...
TooTea's user avatar
  • 851
15 votes
Accepted

Does insert only db access offer any additional security

The short answer is "Yes", it does offer some additional security as you make it more difficult for an attacker to gain the information these outside users are entering. The long answer is that a ...
calloc_org's user avatar
13 votes

Would removing spaces in a string protect against SQL injection?

No. Let's say you have this as your SQL: "select * from people where last_name = '" + surname + "'" If I enter: 'OR(1=1)OR'a'=' into the input it turns into: select * from people where last_name = '...
JimmyJames's user avatar
  • 3,059
13 votes

Convince people not to share their password with trusted others

Knowledge leads to responsibility. Imagine you gave me your password... I have to keep your password (which happens to be beerbar2) a secret. The next time I'm at the beer bar, I must actively avoid ...
mafu's user avatar
  • 705
12 votes

What lessons can be learned from the latest spate of Ransomware attacks?

One lesson that came up before is that authorities should not be hoarding vulnerabilities for their own purposes. Through extended non-disclosure they were putting companies and individuals at risk ...
floworbit's user avatar
  • 326
11 votes

How to explain to traditional people why they should upgrade their old Windows XP device?

The answer may very well be that you're wrong. Yes, this is counter-intuitive, but it may be true. Whether or not using an XP machine is a problem depends a lot on your setup (mostly router, since ...
Damon's user avatar
  • 5,211
11 votes

Is it acceptable to exclude folders in antivirus?

One example I recall as a software developer is the exclusion of "build" folders. In these folders, the compiler creates new executables. New executables are of course suspect to virus ...
MSalters's user avatar
  • 2,689
10 votes

How secure is 7z encryption?

See the links below for details about several bugs that were reported in 2019 concerning weak random number generation, and a flaw in the way that the IV is generated, in versions of 7zip at that time:...
mti2935's user avatar
  • 23.4k

Only top scored, non community-wiki answers of a minimum length are eligible