196
votes
Accepted
Is public Wi-Fi a threat nowadays?
Public WiFi is still insecure, and it will always be if not used together with something like a VPN.
Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't.
Only around 5 ...
- 64.2k
145
votes
Why is storing passwords in version control a bad idea?
The way I see it, not storing passwords in Git (or other version control) is a convention. I suppose one could decide not to enforce it with various results, but here's why this is generally frowned ...
- 6,504
119
votes
Is public Wi-Fi a threat nowadays?
I'm a little surprised that nobody has pointed out that there's more to the internet than HTTP.
Even if your claims about HTTP(S) and HSTS were correct (and other answers discuss that), you're ...
- 2,606
95
votes
Why is storing passwords in version control a bad idea?
First, the non-security reason:
Password Change Workflow
Passwords change independently of a software application code. If a DBA changes a database password, does it make sense for developers to ...
- 961
51
votes
What is a threat model, and how do I make one?
FilipedosSantos' answer does a great job of explaining a formal threat modelling exercise under, for example, the Microsoft STRIDE methodology.
Another great resource is the threat modeling course ...
- 57.1k
50
votes
Accepted
Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?
There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the ...
- 181k
48
votes
Accepted
What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")
Compared to the famous HeartBleed bug leak, this is similar in some ways: the uninitialized memory exposure means unrelated private data is disclosed.
The things that are better
This only affected ...
- 38.1k
40
votes
When do honest people need privacy or anonymity? (e.g. they have nothing to hide)
There's a great short essay written by Bruce Schneier on the right of privacy:
The most common retort against privacy advocates -- by those in favor
of ID checks, cameras, databases, data mining ...
- 5,040
37
votes
Accepted
Evaluating the security of home security cameras
Like most embedded hardware (routers, etc), their firmware often sucks, and unless you have unlimited time I'm afraid there is no way to thoroughly check every single camera out there. And even if you ...
- 12.7k
30
votes
When do honest people need privacy or anonymity? (e.g. they have nothing to hide)
Positive reasons
Instead of a beach holiday, we joined a Christian Mission this summer in Malawi. We're keeping quiet about it in case the children are teased at school.
I leapt into the road and ...
- 32.6k
25
votes
Why is storing passwords in version control a bad idea?
It's always important to keep in mind that suggestions do have to be tailored to fit your use-case. Security safeguards taken by, say, the NSA to protect all the zero-days they keep around for a ...
- 29.8k
24
votes
Is public Wi-Fi a threat nowadays?
Another difficulty of public wifi access is that you are on the same local network as other unknown actors. Any misconfiguration of your local network permissions can lead to an intrusion into your ...
- 1,017
22
votes
What is a threat model, and how do I make one?
A great definition can be found in this excerpt from the OWASP page about Threat Modelling:
A threat model is essentially a structured representation of all the
information that affects the ...
- 1,088
18
votes
Where does the root of trust actually lie?
My question is, what are some guidelines that individuals and
organizations can follow to ensure they don't become a target of such
an attack?
The attack in the hypothetical example that you describe ...
- 19.6k
16
votes
Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?
Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective.
Most stuff, including every new ...
- 4,951
14
votes
Is there any way of preventing (or punishing) abuse of anonymity networks?
Officially, they are pushed forward to allow people in dictatorships to break laws restricting their freedom of information and/or expression.
Because, the problem with the law is, that you need some ...
- 2,153
13
votes
When do honest people need privacy or anonymity? (e.g. they have nothing to hide)
Just to address one point:
Credit card insurance protects them from fraud
This makes several assumptions, none of which are to be relied on:
You assume that the insurance will pay out. It would be ...
- 4,185
13
votes
Why is storing passwords in version control a bad idea?
Keeping secrets (passwords, certificates, keys) separate from source code makes it possible to manage source and secrets according to different policies. Like, all engineers can read the source code, ...
- 131
12
votes
Why is storing passwords in version control a bad idea?
This convention, like many other security "best practices" is a handy way of making sure that things don't go wrong because of bad habits or routine.
If you always remember that your sensitive ...
- 9,994
12
votes
Where does the root of trust actually lie?
My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack?
One way to avoid being the target is to not do anything ...
- 10.8k
11
votes
Accepted
Why would a replay attack be considered a threat to integrity and not confidentiality?
A replay attack is an attack where you record a legitimate transaction and then replay it at a later date.
It is not an attack on confidentiality because the attacker isn't learning any new ...
- 18.5k
11
votes
Evaluating the security of home security cameras
This started off as a comment on Andre's answer, but it got a bit long.
USB is fine as long as none of the cameras are more than 16 foot from the host :)
Since you need to run power out to the ...
- 18.3k
11
votes
Is public Wi-Fi a threat nowadays?
I would argue that any time you connect to a publicly accessible network you're putting yourself at risk, VPNs are great, but do nothing to firewall your machine against the threats on the local ...
- 189
11
votes
Where does the root of trust actually lie?
The root CA list is not hardware-based (in the general case, see about the TPM below). It comes as a built-in feature of your operating system.
Other software (e.g. browsers, mail clients, etc...) may ...
- 3,395
10
votes
Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?
"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability ...
- 9,061
9
votes
Evaluating the security of home security cameras
EDIT - Modified this answer slightly (now three parts)
Low Budget Version
Pick up a used router (laying around the house?), install dd-wrt on it and turn off the WiFi. Bingo, ready made 4 port ...
- 1,411
9
votes
Is public Wi-Fi a threat nowadays?
Some of the concern has to do with MiTM attacks and the tendency for laptops to be configured to blindly connect to open networks based on SSID after the initial connect. Nothing stops an unknown ...
- 211
9
votes
What is a threat model, and how do I make one?
A threat model answers the question - what are the reasonably expected threats for the concrete software (or "system"). Emphasis on concrete (== not academic/theoretic) and reasonably (== not ...
- 199
8
votes
Why doesn't TLS have a threat model?
RFC 5246 does include a threat model, but it is described very succinctly and quite informally. It is at the start of Appendix F:
The TLS protocol is designed to establish a secure connection ...
- 168k
8
votes
Could you anonymously upload a file on the internet if the threat model was the entire world trying to find your identity after you do so?
Tl;DR
Time is on your side.
Note: leave your own phone at home and preferably own a car without GPS.
Drive 100 miles from home and buy a cheap used laptop/Android device with functioning Wi-Fi in ...
- 493
Only top scored, non community-wiki answers of a minimum length are eligible