204
votes
Accepted
Why is Steam so insistent on security?
Steam has about 100 million users (random link saying they had 75 million almost 2 years ago). If they spend on average $10 per year, we're talking $1,000,000,000 per year - and I'd say that's a ...
- 3,630
117
votes
Why is Steam so insistent on security?
I think it's very understandable, especially why they feel the need to force security measures on user:
A Steam account can be a very valuable asset, many Steam libraries would easily cost hundreds, ...
- 8,494
44
votes
How can a non-admin program cover your entire screen with a window?
Fullscreen is easy: The vast majority of video games, for example, do it. I don't know if Windows has a dedicated API call for this, but if it doesn't, it's easy to fake: Just make a screen-sized ...
- 34.6k
38
votes
How can a non-admin program cover your entire screen with a window?
A fullscreen app in C#:
using System;
using System.Windows.Forms;
namespace FullScreen
{
static class Program
{
[STAThread]
static void Main()
{
...
- 3,376
30
votes
Why is Steam so insistent on security?
The real reason is fraud. A typical scam looks like this:
The scammer buys a game off the Steam store, or an item off the Steam Market using a stolen credit card or stolen account. Many CS:GO, TF2, ...
29
votes
Should crash dumps (e.g. from Breakpad, Windows) be encrypted and signed?
Dumps give too much info for hackers to reverse engineer or hack the software, say to enable features or licenses?
The dumps must, at some point, exist in unencrypted form. An attacker with full ...
- 15.4k
21
votes
Why is Steam so insistent on security?
Another thing that is not mentioned in the other answers is the impact of Valve's structure as a company and their philosophies for scalable solutions.
Most Valve employees (if not all) are hired into ...
- 313
21
votes
Accepted
What does Blue Coat Unified Agent application do?
The BlueCoat Unified Agent has been built to provide security on the cloud. The Unified Agent client monitors the Internet Breakout IP being used by the user and switches from Active to Passive mode ...
- 281
14
votes
Insecure versions of crypt hashes
BCrypt variants
$2$
The original specification used the prefix $2$. This was in contrast to the other algorithm prefixes:
$1$ - MD5
$5$ - SHA-256
$6$ - SHA-512
$2a$
The original specification did ...
- 2,244
12
votes
Is malware distributed with pirated software actually common?
Finding statistics for this is rather difficult, but here are some sources that are close (I say close, because most look at platforms that are often used to distribute pirated software, but also to ...
- 29.5k
11
votes
Why is Steam so insistent on security?
At this point, some people have thousands of dollars' worth of games in their account. To be sure, Steam accounts are not exactly liquid, and you can't easily convert them to cash (though I guess you ...
- 1,104
10
votes
Accepted
Did information technology had a increase or decrease in security with the introduction of automatic update features?
Auto-updates greatly improved security by fixing any non zero-day vulnerabilities.
Most vulnerabilities only become known to the general public after a patch for it is released. Years ago, when auto-...
- 49.3k
10
votes
Why default settings are generally weaker than optimal ones?
One reason is that older algorithms are likely to have wider support. Such defaults probably ensure that the software runs on a wide variety of platforms out of the box. The software itself might also ...
- 293
9
votes
Why is Steam so insistent on security?
As other answers mentioned, many reasons for Valve's security measures are fraud, your account could have hundreds or thousands of dollars worth of games and tradable items, payment information is ...
- 3,362
9
votes
Crash a computer using waves or similar techniques?
Several motherboards have overheating protection, if the computer or especially the CPU / graphics card gets too hot, the computer will switch off. So ... turn up the heat in the room (with a big heat-...
- 2,037
8
votes
Why is Steam so insistent on security?
You have a different definition of security than me,
Steam isn't even remotely secure. Every app installed gets full access to your entire system. You have no idea of any game is installing a root ...
- 458
8
votes
Accepted
School installs something on my Mac in order to connect to the school network. Should I be concerned?
They have also installed a certificate to get rid of the annoying SSL errors that pop up when attempting to access a webpage.
This indicates that they're running an HTTPS man-in-the-middle proxy - ...
8
votes
Accepted
Does karabiner elements on Mac OSX contain, or potentially contain, malware?
I am not sure anyone here would be willing to read through it but my advice would be:
Read through the bug reports
Research information on it and read as many reviews as you can. It has a lot of ...
- 4,345
7
votes
Do the skills of a software developer transfer well into working in computer security or white hat hacking?
As a developer of 15 years who has moved into a pen-test role, I can say that yes there are many transferable skills, some of which will put you at and advantage to testers who came from a pure ...
- 1,890
7
votes
What is a good data encryption strategy for a shared resource(text)?
Someone who breaks into your server will make off with the software and the databases. Having all of your factors, they will then be able to run the decryption strategy in reverse to recover all the ...
- 1,240
7
votes
Accepted
Does HTTP/2 prevent security vulnerabilites like CRLF injection?
TLS related security features in HTTP/2
The concrete security improvements mentioned in the FAQ are related to TLS encryption: HTTP/2 MUST use at least TLS 1.2 and it support SNI. Also, HTTP/2 ...
- 18.7k
6
votes
Is MD5 considered insecure?
Just to complement the answers already given (most of which are excellent) we now have a real world example of where a data breach (Ashley Madison) lead to the entire password table being leaked. They ...
- 3,818
6
votes
Disk encryption with OTP to protect source code
Send one of your engineers with the laptop. Rationale:
If it's important enough to send a laptop, it's important enough to send a person
There will be no problems caused by ad-hoc encryption and lock-...
- 731
6
votes
What software can be used to read data from smart cards?
In the past, i have used CardPeek for this. It is easily extensible through LUA and can therefore adapt to unknown cards. It presents the "files" on the card via a TreeView and offers annotations on "...
- 325
6
votes
Why are security properties non-compositional?
Secure+secure != secure
What "non-compositional" means by definition is that if you have two components/thingies/processes/whatever that each on their own are secure (i.e. satisfy some security ...
- 8,429
5
votes
Why is Steam so insistent on security?
One thing that the other answers don't mention is how fraud affects the banks versus steam. If a bank account gets frauded they return the money and that's about that. They might lose customers, maybe....
- 160
5
votes
What reputable site should I download Putty from?
As of May 2017 (!), the official PuTTY website is available over HTTPS.
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
Combined with the HTTPS download links added a little while ...
- 151
5
votes
Accepted
Protect software from copy
There is a lot of information you can acquire about the hardware of the computer your program is running on, including serial numbers of individual pieces of hardware (consult stackoverflow for code ...
- 49.3k
5
votes
Accepted
Is there a security risk in using pointers instead of struct instances?
I don't know the specifics of the routine you were asked to amend, but I can tell you the following.
When you allocate memory on the heap, even if you correctly de-allocate it, there is no guarantee ...
- 1,152
Only top scored, non community-wiki answers of a minimum length are eligible