344 votes
Accepted

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

Do I need to verify the user for every single page? Absolutely. Not only every page, but every request to a privileged resource, e.g POST request to update data, delete, view, etc, etc. It is not ...
user avatar
  • 2,809
123 votes
Accepted

Why don't video conferencing web applications ask permission for screen sharing?

Either way, the user agent responds by presenting a user interface that prompts the user to choose the screen area to share. Both of these implementations of startCapture() return the MediaStream ...
user avatar
  • 12.6k
109 votes

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

There's a number of reasons: If it has happened to one person, it might have happened to more. These other people might not be as kind. Who knows, this person might change their mind. When they made ...
user avatar
  • 64.3k
104 votes
Accepted

What is the point of encrypting the home directory?

The point is to protect against your disk being accessed outside of the OS. Encryption is useful against attackers who have physical access to your computer. Without it, it would be trivial to read ...
user avatar
  • 29k
101 votes
Accepted

Why is root security enforced but $HOME typically unprotected?

I'm going to disagree with the answers that say the age of the Unix security model or the environment in which it was developed are at fault. I don't think that's the case because there are ...
user avatar
  • 1,628
99 votes
Accepted

Reason to not use chmod -R 777 on internal server for project source code?

However, after putting some thought into it I can't come up with a reason why shared executable code on an internal server shouldn't have 777 permissions. Because you're not only trusting every ...
user avatar
  • 71.9k
80 votes
Accepted

Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?

There's an even easier way to bypass the "execute" permission: copy the program into a directory you own and set the "execute" bit. The "execute" permission isn't a security measure. Security is ...
user avatar
  • 34.4k
67 votes
Accepted

What are the potential vulnerabilities of allowing non-root users to run apt-get?

apt-get update -o APT::Update::Pre-Invoke::=/bin/sh From GTFOBins This gives you a root shell on the system. No creating packages and adding fake repos; this will give the user who runs this command ...
user avatar
  • 845
60 votes
Accepted

How can I prevent a user from copying files to another hard drive?

You can disable USB storage on Linux by blacklisting the module. modprobe -r usb-storage echo blacklist usb-storage >> /etc/modprobe.d/10-usbstorage-blacklist.conf echo blacklist uas >> /...
user avatar
  • 12.6k
59 votes

Why is it considered safe to install something as a non-root user in Linux environments?

We always hear... Do we? I don't. Installing some untrusted program as a normal user is a bad idea with Linux the same it is with Windows or Mac: this program has access to all your data and can ...
user avatar
58 votes

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

While it's impossible to read the minds of the people at play - I'd think that the independent programmer A) Doesn't want to be accused of impropriety - It's much harder to be accused of IP theft if ...
user avatar
55 votes

Why is root security enforced but $HOME typically unprotected?

Because the UNIX-based security model is 50 years old. UNIX underlies most widespread OSs, and even the big exception Windows has been influenced by it more than is apparent. It stems from a time ...
user avatar
52 votes

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

Is 2FA via mobile the best security there is? No. SMS 2FA is the weakest form of 2FA, however, it's still worthwhile because it does improve security and it has a relatively low barrier of entry ...
user avatar
  • 31.1k
46 votes

What are the potential vulnerabilities of allowing non-root users to run apt-get?

You say you're using a "custom curated apt repository" but there's no way to enforce that. Any user that can invoke apt can specify their own source list, for example apt install root-backdoor -o Dir::...
user avatar
  • 39.6k
42 votes
Accepted

Why do mobile apps have fine-grained permissions while desktop apps don't?

There are two main reasons why smartphones have fine-grained permissions while desktop computers don't. History. Mainframe operating systems have a tradition of giving permissions to the user rather ...
user avatar
  • 34.4k
38 votes

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

The quick answer is yes, as you gathered. But it doesn't need to be the huge job you're thinking of. (The whole security thing might be big, but this is only one part of it). You have far more ...
user avatar
  • 1,664
36 votes
Accepted

Why is it considered safe to install something as a non-root user in Linux environments?

In short: yes, being on a low-privilege account helps protect you against malware, but does not make you immune. Like any security measure, no single thing is going to keep you 100% safe. TL;DR: ...
user avatar
31 votes

Why is root security enforced but $HOME typically unprotected?

This is a highly astute observation. Yes, malware running as your user can damage/destroy/modify data in your home directory. Yes, user separation on single user systems is less useful than on ...
user avatar
  • 15.8k
30 votes

What is the point of encrypting the home directory?

The Linux permissions only work on your own system. If you take the disk and put it in another computer, or just boot another OS on the same computer that can read your Linux partition you will ...
user avatar
  • 403
28 votes

User can't navigate to webpage through the UI due to permissions, but are able to navigate to page by pasting the URL. How do I protect against this?

You need to check the user permission level for every request (GET, POST, PUT, DELETE). Browsing to a page, like in your case is a GET request. A user shouldn't be able to post a request without ...
user avatar
28 votes

Is 2FA via mobile phone still a good idea when phones are the most exposed device?

SMS 2FA is not only a bad idea; it's worse than not having 2FA at all (password only). This is because virtually all services offering "SMS 2FA" are actually delivering SMS 1FA! That is, they allow ...
user avatar
27 votes

Unix execute permission can be easily bypassed. Is it superfluous, or what's the intention behind it?

You can set the execute bit, but not the read bit, on an executable file. That way, noone will be able to copy the file, but people can execute it anyway. This is quite pointless today, because a) it ...
user avatar
26 votes

Reason to not use chmod -R 777 on internal server for project source code?

I'm gonna second @gowenfawr and say that breeding better chimpanzees is a goal unto itself here. (now I will extrapolate wildly about your corporate culture) At my software development company, we've ...
user avatar
25 votes

Why is root security enforced but $HOME typically unprotected?

The original design of Unix/Linux security was to protect a user from other users, and system files from users. Remember that 30-40 years ago, most Unix systems were multi-user setups with many ...
user avatar
  • 21.5k
21 votes

Why do mobile apps have fine-grained permissions while desktop apps don't?

For technical reasons it is not possible to tell which permissions an application needs until it tries to use them, which means that an application needs some way to declare this. Applications on ...
user avatar
  • 48.8k
21 votes

How can I prevent a user from copying files to another hard drive?

Client-server architecture This is another approach that could make copying files much harder, but it requires investing more effort from your side. Access to the information could be setup on a ...
user avatar
  • 1,234
19 votes

Is it urgent to revoke the access to a private repo once a person has been mistakenly granted it and become aware of this?

One thing to note is that giving an additional user access to a repository opens up a whole new possible attack vector. If someone else with malicious intentions has access to the account which has ...
user avatar
  • 7,313
19 votes

How can I prevent a user from copying files to another hard drive?

In addition to blocking USB (see other answers above): Disable networking, because... ... otherwise user will use remote access to your machine, e.g. via scp or ftp, and copy files from your machine....
user avatar
  • 8,472
15 votes

Claim that Skype is an unconfined application able to access all one's own personal files and system resources

It’s like this comic: Generally, any program that runs under your account can access any resources that your account can access. Can Skype really scan anything I have in my home directory ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible