244 votes

My school wants to keep the details of our door authentication system a secret. Is that a good idea?

Obscurity isn't a bad security measure to have in place. Relying upon obscurity, as your sole or most substantial security measure, is more or less a cardinal sin. Kerckhoff's Principle is perhaps ...
user avatar
  • 27k
213 votes
Accepted

Is momentary physical access dangerous?

That all depends on the system, the attacker, and the level of preparation they had. If they have unlimited preparation, they could do effectively anything that they could do with an unlimited access ...
user avatar
  • 64k
193 votes

4-dial combination padlock: Is it more secure to zero it out or to blindly spin the dials after locking?

I would recommend setting it to 0000 or some other specified combination (doesn't really matter what). "Mashing around the dials" is a little vague, but I would guess based on my own behavior that ...
user avatar
138 votes
Accepted

Defence methods against tailgating

This is not a problem that has a social solution. No amount of corporate policy will save you. Humans are social animals. In the end, if people can let other people in, they will. Even if you may be ...
user avatar
  • 64.2k
130 votes
Accepted

What's to stop someone from 3D print cloning a key?

The simple answer is: nothing. This has already been done for many years, with keys being cast or created from blanks using hand drawn copies, photographs, remembered shapes etc all being ...
user avatar
  • 61.4k
130 votes
Accepted

Why are my plastic credit card and activation code sent separately?

Many low level crimes are ones of opportunity, not planned out attacks. By separating the two needed pieces of mail in time, it forces the attacker to intercept the same person's mail more than once. ...
user avatar
  • 21.5k
123 votes
Accepted

How can I protect myself from false accusations when our company practices password escrow?

That's what the envelope is (or should be) for: In order to use your password, one needs to break the seal of the envelope you signed. When you think your password was abused, you can ask to see the ...
user avatar
  • 48.8k
120 votes
Accepted

4-dial combination padlock: Is it more secure to zero it out or to blindly spin the dials after locking?

In theory zeroing or any predetermined sequence is more secure as you could, in theory make a guess at how far someone might move the dials. It is also conceivable that if you were able to check the ...
user avatar
  • 1,226
117 votes

How is 'Removing RAM' a security risk?

RAM is used to store sensitive non-persistent information in a lot of cases. Encryption keys would be a common example. Sometimes it is possible to remove RAM and place it into another device to ...
user avatar
  • 3,807
116 votes
Accepted

What is the purpose of the rotating plate in front of the lock?

It's called anti-drill plate. With the anti-drill rotating plate, the drill bit won't be able to go through the cylinder. It's supposed to be in hardened steel and act as an other layer of security. ...
user avatar
  • 769
113 votes
Accepted

How resistant are barcodes and QR-codes against attempts to change stored data?

... how secure is a QR-code? Data in a QR code are kind of protected against accidental damage by having some error correction but they are not protected against deliberate manipulation. Also, an ...
user avatar
103 votes

My school wants to keep the details of our door authentication system a secret. Is that a good idea?

Keeping the design secret does not make the door insecure per se; however, believing that it adds to security is a dangerous delusion. If revealing the details of the authentication system would ...
user avatar
  • 168k
89 votes

What's to stop someone from 3D print cloning a key?

As the guys previously said, nothing! Even more, I've been working on such a project myself at the university! (albeit I don't say this as an official target, of course) I am trying to do duplicate ...
user avatar
  • 959
82 votes
Accepted

How should I set up emergency access to business-critical secrets in case I am "hit by a bus"?

My advice would be to remove the secrets from the drop-box and store them elsewhere. Your instructions have to be easily human readable by anyone, but they can include instructions on how to get ...
user avatar
  • 9,206
82 votes
Accepted

Why is iPhone's internal storage so hard to crack/decrypt?

I don't think that you interpret the rule you've heard in the right way. If an attacker has physical access to an encrypted but switched off device he cannot simply break the encryption provided that ...
user avatar
75 votes
Accepted

Secure USB cable for charging in untrusted environments

Could I mitigate that risk by taking a regular usb cable and cutting the data (but not the power) cables? Or does the usb protocol needs a data handshake to begin charging? Such a cable does exist, ...
user avatar
74 votes

How should I set up emergency access to business-critical secrets in case I am "hit by a bus"?

Get a USB device. Put all secrets on the USB, preferably in a KeePass file. In the documentation, tell the new person where the USB is and how to unlock it, but put the device in a secure physical ...
user avatar
  • 4,737
73 votes
Accepted

Is physical security less important with disks on a server being encrypted?

Physical access, in many, likely most, situations means a total loss of security - for a variety of reasons (this all assumes encrypted disks): Theft - An attacker could steal the server or disks, to ...
user avatar
  • 1,794
64 votes

Why does one need a strong password on Unix?

You seem to have a pretty clear understanding of the risks. As others have stated it highly encouraged to use a strong password, so if you are running a sensitive service, then by all means, please ...
user avatar
  • 13.8k
63 votes

Defence methods against tailgating

You protect yourself by politely challenging people who are trying to get in without using the controls. You simply ask to see their pass or offer to escort them to reception/security. I use the ...
user avatar
  • 123k
63 votes

Emergency method to erase all data off a machine within seconds

Thermite. Thermite burns at a temperature of thousands of degrees centigrade, which would be more than sufficient to destroy all the data stored in any modern data storage medium. It is also already ...
user avatar
62 votes

How resistant are barcodes and QR-codes against attempts to change stored data?

QR codes are normally not protected against manipulation. But: You could include a digital signature in the data so anyone can check if the QR code is made by you and has not been modified. Then the ...
user avatar
  • 670
60 votes
Accepted

Why would security cover things like natural disasters?

All other answers are fine. I'm going to offer you a classic security perspective. Starting a fire/flood is a textbook scenario for physical penetration/exfiltration. People under stress are less ...
user avatar
  • 5,286
60 votes

How "scrambled" is the data on a RAID5 disk?

Raid 5 stripes the data across the disks but the blocks used for striping are typically pretty big. At the very least they will bewhole sectors but normally they will much larger than that. For ...
user avatar
  • 4,909
58 votes

Laptop Anti-Theft Measures

Consider getting a software product which fully encrypts your hard drives. Such a software will prompt the user to enter the password used to encrypt the hard drive during boot. Without the correct ...
user avatar
  • 48.8k
53 votes

Can a lock picker slowly undermine the security of a deadbolt door?

The answer to your question is yes, though whether this will ever actually help them is dependent on the lock and their 'skill'. With a typical (cylinder?) deadbolt repeated attempts can advance an ...
user avatar
  • 2,923
53 votes
Accepted

Can a lock picker slowly undermine the security of a deadbolt door?

Yes, there's a classic attack that involves incremental access. The attacker starts out with a blank key that fits into the lock in question. The attacker approaches the door, puts the key in, ...
user avatar
  • 81.9k
52 votes

What to do if caught in a physical pentest?

There's a flip side: what to do if you discover a physical pentester. When I was working at a bank, I happened to notice the iconic metasploit cli welcome banner flash up for a second on a desktop in ...
user avatar
  • 123k
52 votes
Accepted

Emergency method to erase all data off a machine within seconds

There are two DEFCON videos from 2012 and 2015 exploring this exact issue: DEFCON 19: And That's How I Lost My Eye: Exploring Emergency Data Destruction DEFCON 23: And That's How I Lost My Other Eye.....
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible