130

You cannot hide HTML and expect the browser to be able to interpret it. The browser needs full access to the HTML in order to display all parts of the site. As soon as the browser has access to it, the user can also gain access to it. On a further note, JavaScript is also not able to "hide" the content of the site and still make it accessible to the browser,...


101

Well, IMHO the only reliable way to prevent the user to know the mail address it to have the mail sent server side instead of client side. Said differently the client only gives their own mail address and the text, it is uploaded to the server by the form, and the mail is sent by the server application which is the only part knowing the recipient address. ...


82

You have identified only one risk, that of an attacker identifying machine roles on the network by using predictable host names. I think you missed the competing risk, that of increased operator error by not using predictable and descriptive host names. This is how I would assess those conflicting measures: Use unpredictable host names Benefit(s) An ...


56

You can't. The question doesn't even make sense on a conceptual level. A mailto: link is simply a convenient way to communicate to an end user where they can send email to. If your mailto link works, the end user will by definition know where the email is going to, the same way the end user will by definition know where a link they're clicking will be going ...


51

Data destruction is a technique of last resort. If you are planning to use a new storage device, you should use full disk encryption. This allows you to either destroy the encrypted master key or simply forget the password, effectively rendering all data unrecoverable, despite no data actually being wiped. Encryption is a solution for both solid state and ...


23

This could be related to almost anything, personal information are sold just like any other "things" on the darkweb and even on the "web" by relatively legal entities, Databrokers are selling personal information just like any other stuff. In addition to this as @anon said OSINT tools might be used to gather information about persons, and there are lot of ...


19

Windows system executables do not contain any sensitive information. They may reveal the version of the operating system you are using, but personal information is not stored in executables. Instead, it is stored in configuration files or databases kept throughout the system. While it would be theoretically possible to store sensitive information in ...


19

The fact that there is no readily available information to support your conclusion, should give you some idea about its validity. The point is, that if your attacker is already in, he will need to do some additional foot-printing anyway. Your host name may be database.xyz.intranet, but if the nmap gives you 1521 (oracle), 1433 (sql server) or 5432(Postgress)...


15

What you're advocating for is called "security though obscurity". While in theory obscurity does provide some extra protection while not making things worse, it usually does make things worse in practice. It (1) adds complexity to the system which leads to errors, (2) dilutes the understanding of what information is secret and what isn't, and (3) may have a ...


15

You can't. And neither can Javascript. You have three options, and they all depend on a backend language. You have two options, one right way and two lunatic ways if you have no server: The right way: You do a form submit to a server, and the server handles this e-mail over SMTP. The okay way: You submit to another domain or API that can handle it server-...


13

Tl;dr: Because you can never trust all storage drives to securely wipe themselves, you must plan as if none of your drives can be securely wiped. Placing a dependency on the type of media is not the right way to approach the problem, because the technology is always evolving and changing, and you can never be in 100% control of all IT spend. Remember that ...


12

Should I give them a second chance Yes. It is typical to wait several months and communicate several times with the developing company before taking any further action. If the company has shown that it is not willing to fix the issue, a possible next step is to publicly disclose the issue. or contact some kind of data protection authority? This is a ...


11

You can HTML-encode it, like this: <form action="&#x6d;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#x73;&#x6f;&#x6d;&#x65;&#x6f;&#x6e;&#x65;&#x40;&#x65;&#x78;&#x61;&#x6d;&#x70;&#x6c;&#x65;&#x2e;&#x63;&#x6f;&#x6d;"> However, that only really obfuscates it. ...


10

This kind of attack is called shoulder surfing and it is a real problem. Hardly a day goes by where I do not see someone putting themselves at risk of this either on the train, a cafe or in various other public places. There are a number of countermeasures, most of which are as simple and basic as the attack itself. Situational awareness Beware of your ...


9

They can contain file paths from the system they were compiled on, which may be sensitive if these are programs you compiled on your own system.


9

When your organization is subject to the GDPR, then it should have a designated Data Protection Officer. This person is responsible for ensuring that data protection laws are applied within the organization. This should be the first place to report to.


8

One way to check for personal information is by using google. Just insert the string you want to search for and surround it with ". Like "NAME SURNAME". This will display some sites where exactly this match is found. You can check for other personal data from that mail, too. That way you propably can get close to the source of the information leakage. There ...


8

if you can contact the recipient by other means besides email, one easy way to send securely content over email is putting the content (images,documents,etc) into a encrypted container (a zip, 7zip, .rar file) that is protected with a secure and not easily guessable password. Then after you sent the email contact the recipient and provide them with the ...


7

FDE does not need to know anything about overprovisioning. If the partition is encrypted, no plain-text will ever be written anywhere. Blocks reserved for wear leveling will either have un-initialized random data, or encrypted blocks. If you are using the encryption provided by the controller, encryption/decryption occurs inside the controller, so no plain ...


7

If you encrypt the disk from the start, when you first start using it, then this isn't a problem. All data you write is encrypted and remapped sectors just lead to encrypted data being remanent on the over-provisioned area. Since the data is encrypted, you can't do anything with it even if you recover it using direct flash reads on a disassembled SSD. ...


7

TL;DR: No. If I understand your problem correctly, you do not want to hide the e-mail address from the users, but from bots which parse the source code to collect e-mail addresses for spamming. Sure, in JavaScript there are several easy ways reduce to this problem to practically zero, because it needs execution of the script which hardly any spammer does: ...


7

While these are not super-critical, I'd personally go for a responsible disclosure. In a nutshell that means that you inform them about the vulnerabilities and also tell them that you will publish those after x days - regardless of wether they fixed them or not. Google has a 90-day disclosure policy, which seems pretty standard nowadays. The idea of this ...


6

To accomplish what you're trying to do, get a gmail address or forwarding address that you use in your form, which serves your purpose of keeping your real email address secret.


5

Your PI (personal information) is your PI, and in the 21st century you can't really avoid to spread it around everywhere. That means when someone has your PI it's hard to find out from where they might have gotten it. In some countries you have a legal right to ask companies to tell you, but that obviously only works if the source of the email is easily ...


5

it seems there is one prime contender for the solution, which is to encrypt parts of the URI or all of it. Hashing does not seem to be an option since the data is highly predictable and calculating the entire set of values is easy. Encrypting the entire URI will limit a lot of the advantages of the approach. Symmetric encryption requires ...


5

The answer is mentioned next to the sentence in the cheat sheet that you read. Do not use RDBMS database, row or table level encryption. The data can be retrieved in the clear by anyone with direct access to the server, or over the network using the application credentials. It might even traverse the network in the clear despite being "encrypted" on ...


5

In the blog post about the new feature, Signal says: Message contents are end-to-end encrypted with the Signal Protocol as normal, but the “envelope” containing the sender certificate as well as the message ciphertext is then also encrypted using the sender and recipient identity keys: The feature is designed to hide the sender of the message from plain ...


4

To simply put, there isn't any "one true secure method". Why, you might ask? Because computing has always been about trust, whether implicit or explicit. Regardless if it was the 1960's or today, you trust the machine in question to act like you expect. This can prove quite an issue, because potentially, you could be dealing with a software or hardware ...


4

I am thinking about encryption as well as using a proprietary format to make it difficult to reverse engineer anything..... I want to create a file format that will be difficult to reverse engineer so that application is safe. A file format which is difficult to reverse engineer is way more difficult to implement correctly in the application than a ...


Only top voted, non community-wiki answers of a minimum length are eligible