Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
161 votes

Roles to play when tailgaiting into a residential building

There are some basic social engineering approaches to use that work in most situations, not just tailgating: urgency authority curiosity pretexting Urgency Be someone with a specific task to ...
schroeder's user avatar
  • 130k
137 votes
Accepted

Defence methods against tailgating

This is not a problem that has a social solution. No amount of corporate policy will save you. Humans are social animals. In the end, if people can let other people in, they will. Even if you may be ...
Anders's user avatar
  • 65.6k
121 votes

Can secret GET requests be brute forced?

You are essentially asking if it is safe to pass secret parameters in a GET request. This is actually classified as a vulnerability. It is not feasible to brute force a sufficiently long pseudorandom ...
forest's user avatar
  • 66.8k
117 votes

How is 'Removing RAM' a security risk?

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to ...
Peleus's user avatar
  • 3,897
113 votes
Accepted

What is the purpose of the rotating plate in front of the lock?

It's called anti-drill plate. With the anti-drill rotating plate, the drill bit won't be able to go through the cylinder. It's supposed to be in hardened steel and act as an other layer of security. ...
Deunis's user avatar
  • 759
102 votes
Accepted

Hardening Linux desktop machine against people from my household

Use a strong and difficult password for the root user. Secondly, always login and work from another user with no administrative rights (and also a strong password). Enable the BIOS password option. ...
Chris Tsiakoulas's user avatar
98 votes

Hardening Linux desktop machine against people from my household

I hate to be this guy, but Law 3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore. You are asking how to best lock a plywood door. People are ...
user1717828's user avatar
  • 2,402
83 votes

Roles to play when tailgaiting into a residential building

Just stand outside the door at some distance talking on your phone. Don't look at the door, don't look at the person coming to open it, don't look like you want to get in. Don't ask to be let in. Don'...
Anders's user avatar
  • 65.6k
81 votes
Accepted

Why is iPhone's internal storage so hard to crack/decrypt?

I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that ...
Steffen Ullrich's user avatar
75 votes
Accepted

Secure USB cable for charging in untrusted environments

Could I mitigate that risk by taking a regular usb cable and cutting the data (but not the power) cables? Or does the usb protocol needs a data handshake to begin charging? Such a cable does exist, ...
Alexander O'Mara's user avatar
71 votes

How to safeguard physical keys stored in a fire dept. lockbox?

To be clear: a Knox Box is a lock box that holds keys for emergency personnel. If the fire department needs to get inside your building while it is locked, the fire crew will have a key to unlock your ...
freehunter's user avatar
70 votes

Hardening Linux desktop machine against people from my household

Depending on the performance you require and money you are willing to expend, a removable "Live USB" or completely bootable normal system on a USB "hard drive" (a small ssd would work great) might be ...
Jeff Meden's user avatar
  • 3,976
63 votes

Defence methods against tailgating

You protect yourself by politely challenging people who are trying to get in without using the controls. You simply ask to see their pass or offer to escort them to reception/security. I use the ...
schroeder's user avatar
  • 130k
59 votes
Accepted

What are the potential risks of leaving a device in public, but locked?

Everything I reference the 10 immutable laws of security, especially #3: If a bad guy has unrestricted physical access to your computer, it’s not your computer anymore Of course a computer sitting ...
Conor Mancone's user avatar
57 votes

What's the down side of a dynamic numbered radial keypad?

There is a Security User Experience (SUX) downside, which you might consider to be minor. As someone who is more kinestheticly inclined, I don't memorize things like phone numbers or PINs: I memorize ...
schroeder's user avatar
  • 130k
51 votes

Secure USB cable for charging in untrusted environments

USB devices can negotiate the provided current from the host device. If power negotiation is not possible (because you cut the data wires), a maximum of 100 mA is supplied. This means you can charge ...
Sjoerd's user avatar
  • 30.8k
47 votes
Accepted

Does the saying "physical access = game over" apply to smartphones, too?

"Physical access = game over" is an over-simplification. It absolutely boils down to the outcome of a threat assessment, or what the vendor needs to protect and to what level. The direct answer to ...
Pedro's user avatar
  • 3,901
43 votes

Roles to play when tailgaiting into a residential building

The main element, as you've said, is to not look like you're waiting for your mark to arrive. What you need is a prop that gives a visual indication why you're standing outside the door. Useful props ...
Richard's user avatar
  • 939
41 votes

Secure USB cable for charging in untrusted environments

Although not entirely in line with the OP's question, I wanted to share a different solution. You could take a powerbank with you. Small powerbanks capable of charging your phone at least 1 time don'...
BlueCacti's user avatar
  • 950
40 votes

If password expiration is applied, should door-lock expiration be applied too?

You asked, ‘if passwords should expire periodically, then should door locks expire periodically?’. Well, from a false premise you can derive any conclusion! The premise of periodic password ...
Squeamish Ossifrage's user avatar
39 votes

Defence methods against tailgating

The cheap solution is to put up scary “no tailgating - everyone must badge in at this door - no exceptions - don’t risk your job - report all tailgate requests to Joe at 123-456-7890” signs at each ...
John Deters's user avatar
  • 34.2k
39 votes

What is the purpose of the rotating plate in front of the lock?

What Deunis said, except it is not only an anti-drill plate. The fact that it rotates freely makes it anti-drill on top. Originally, these were an upgrade for existing lock cylinders which didn't ...
Damon's user avatar
  • 5,221
37 votes

If password expiration is applied, should door-lock expiration be applied too?

Password rotation policies are in place to reduce specific risks which allow an attacker to get (and use) the user’s password. These risks are password reuse, credential phishing or other forms of ...
Steffen Ullrich's user avatar
36 votes
Accepted

Stolen MacBook: should I worry about my data?

Your data is probably* safe if the following three criteria are met: You have FileVault turned on (full disk encryption). Your laptop requires a password on boot and every time you open the lid (auto ...
Jonathan's user avatar
  • 2,346
34 votes

Can secret GET requests be brute forced?

This is a common approach to share public things restricted to the ones who know the URL. An example is Google Docs: The second option, "Anyone with the link", creates a link similar to yours. Same ...
WoJ's user avatar
  • 9,038
28 votes

Defence methods against tailgating

(Just a passer-by opinion) Obviously, a physical gate would work the best. In case you don't want to install these, you may try to request all employees to challenge tailgaters, as schroeder ...
Petr's user avatar
  • 381
27 votes

Selecting a secure PIN for building access

PINs are usually accompanied by some other authentication factor, like biometrics or a physical token. So, the PIN is not a lone factor in authentication. But you appear to describe a situation where ...
schroeder's user avatar
  • 130k
26 votes

Does multiple numbers per button have an effect on security?

Think about the technical implementation, not about the user or what's painted on the buttons: it's a keypad with 5 buttons. In order to unlock the device, it needs a sequence of those 5 buttons (...
schroeder's user avatar
  • 130k
25 votes

How is 'Removing RAM' a security risk?

If you log in somewhere (say in a browser, or some application), the password you typed in is temporarily stored in RAM for comparison against the correct password. Most applications assume the RAM is ...
Luc's user avatar
  • 32.9k

Only top scored, non community-wiki answers of a minimum length are eligible