128

You cannot hide HTML and expect the browser to be able to interpret it. The browser needs full access to the HTML in order to display all parts of the site. As soon as the browser has access to it, the user can also gain access to it. On a further note, JavaScript is also not able to "hide" the content of the site and still make it accessible to the browser,...


101

Well, IMHO the only reliable way to prevent the user to know the mail address it to have the mail sent server side instead of client side. Said differently the client only gives their own mail address and the text, it is uploaded to the server by the form, and the mail is sent by the server application which is the only part knowing the recipient address. ...


82

You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names. I think you missed the competing risk, that of increased operator error by not using predictable and descriptive host names. This is how I would assess those conflicting measures: Use unpredictable host names Benefit(s) An ...


56

You can't. The question doesn't even make sense on a conceptual level. A mailto: link is simply a convenient way to communicate to an end user where they can send email to. If your mailto link works, the end user will by definition know where the email is going to, the same way the end user will by definition know where a link they're clicking will be going ...


51

Data destruction is a technique of last resort. If you are planning to use a new storage device, you should use full disk encryption. This allows you to either destroy the encrypted master key or simply forget the password, effectively rendering all data unrecoverable, despite no data actually being wiped. Encryption is a solution for both solid state and ...


39

You could use a very small VM for each one, but keep the IDE on the host, not on the guests. Share a folder from the VM to the host, so you use the host and its resources to develop, and use the VM networking to access the client environment. Most of the VPN software can run on Linux, so you could create a very light Linux guest with 256MB of memory and ...


37

Web scraping is indeed a possibility, as mentioned in this Wired article: As Apollo noted in its letter to customers, it draws a lot of its information from public sources around the web, including names, email addresses, and company contact information. But it also scrapes Twitter and LinkedIn.


32

Everybody's (me included) reflex answer to such a question will normally be: Huh huh huh (falls off chair). No! How would you think this could even work? Executables are signed nowadays, which prevents them from being modified! However, if you consider "exe" files in general, not just those from a fresh naked Windows install, the answer must be: Careful!. ...


23

This could be related to almost anything, personal information are sold just like any other "things" on the darkweb and even on the "web" by relatively legal entities, Databrokers are selling personal information just like any other stuff. In addition to this as @anon said OSINT tools might be used to gather information about persons, and there are lot of ...


19

Windows system executables do not contain any sensitive information. They may reveal the version of the operating system you are using, but personal information is not stored in executables. Instead, it is stored in configuration files or databases kept throughout the system. While it would be theoretically possible to store sensitive information in ...


19

The fact that there is no readily available information to support your conclusion, should give you some idea about its validity. The point is, that if your attacker is already in, he will need to do some additional foot-printing anyway. Your host name may be database.xyz.intranet, but if the nmap gives you 1521 (oracle), 1433 (sql server) or 5432(Postgress)...


16

If you use a operating system that has support for separate networking namespaces, use that feature to start each VPN client and all applications in a distinct client-namespace. There are a lot of tutorials how to achieve that with Linux: e.g. this or this and there is also a tag on unix stack exchange. This approach uses a lot less resources than starting ...


15

What you're advocating for is called "security though obscurity". While in theory obscurity does provide some extra protection while not making things worse, it usually does make things worse in practice. It (1) adds complexity to the system which leads to errors, (2) dilutes the understanding of what information is secret and what isn't, and (3) may have a ...


15

You can't. And neither can Javascript. You have three options, and they all depend on a backend language. You have two options, one right way and two lunatic ways if you have no server: The right way: You do a form submit to a server, and the server handles this e-mail over SMTP. The okay way: You submit to another domain or API that can handle it server-...


13

Tl;dr: Because you can never trust all storage drives to securely wipe themselves, you must plan as if none of your drives can be securely wiped. Placing a dependency on the type of media is not the right way to approach the problem, because the technology is always evolving and changing, and you can never be in 100% control of all IT spend. Remember that ...


12

Should I give them a second chance Yes. It is typical to wait several months and communicate several times with the developing company before taking any further action. If the company has shown that it is not willing to fix the issue, a possible next step is to publicly disclose the issue. or contact some kind of data protection authority? This is a ...


11

You can HTML-encode it, like this: <form action="&#x6d;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#x73;&#x6f;&#x6d;&#x65;&#x6f;&#x6e;&#x65;&#x40;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x63;&#x6f;&#x6d;"> However, that only really obfuscates it. ...


10

This kind of attack is called shoulder surfing and it is a real problem. Hardly a day goes by where I do not see someone putting themselves at risk of this either on the train, a cafe or in various other public places. There are a number of countermeasures, most of which are as simple and basic as the attack itself. Situational awareness Beware of your ...


9

They can contain file paths from the system they were compiled on, which may be sensitive if these are programs you compiled on your own system.


9

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization. This should be the first place to report to.


9

WhatsApp client makes http GET request to the site sender types in, in order to fetch site's meta properties that show up in preview. <meta property="og:title" content="Information Security Stack Exchange"> <meta property="og:description" content="Q&A by infosec enthusiasts"> <meta property="og:...


8

One way to check for personal information is by using google. Just insert the string you want to search for and surround it with ". Like "NAME SURNAME". This will display some sites where exactly this match is found. You can check for other personal data from that mail, too. That way you propably can get close to the source of the information leakage. There ...


8

if you can contact the recipient by other means besides email, one easy way to send securely content over email is putting the content (images,documents,etc) into a encrypted container (a zip, 7zip, .rar file) that is protected with a secure and not easily guessable password. Then after you sent the email contact the recipient and provide them with the ...


7

FDE does not need to know anything about overprovisioning. If the partition is encrypted, no plain-text will ever be written anywhere. Blocks reserved for wear leveling will either have un-initialized random data, or encrypted blocks. If you are using the encryption provided by the controller, encryption/decryption occurs inside the controller, so no plain ...


7

If you encrypt the disk from the start, when you first start using it, then this isn't a problem. All data you write is encrypted and remapped sectors just lead to encrypted data being remanent on the over-provisioned area. Since the data is encrypted, you can't do anything with it even if you recover it using direct flash reads on a disassembled SSD. ...


7

TL;DR: No. If I understand your problem correctly, you do not want to hide the e-mail address from the users, but from bots which parse the source code to collect e-mail addresses for spamming. Sure, in JavaScript there are several easy ways reduce to this problem to practically zero, because it needs execution of the script which hardly any spammer does: ...


7

While these are not super-critical, I'd personally go for a responsible disclosure. In a nutshell that means that you inform them about the vulnerabilities and also tell them that you will publish those after x days - regardless of wether they fixed them or not. Google has a 90-day disclosure policy, which seems pretty standard nowadays. The idea of this ...


7

Enable split tunneling, so the only traffic that goes across the VPN to Client X is traffic bound for their servers.


6

To accomplish what you're trying to do, get a gmail address or forwarding address that you use in your form, which serves your purpose of keeping your real email address secret.


6

If you are on a Linux laptop, I recommend a separate Linux user for each client. Those separate users can each have their own scripts to connect to a network and VPN if necessary. With this method and setting proper permissions, unless you deliberately su to another user you are almost assured to not cross-contaminate. I recommend having another user for ...


Only top voted, non community-wiki answers of a minimum length are eligible