2022 Developer Survey is open! Take survey.
196 votes
Accepted

Is public Wi-Fi a threat nowadays?

Public WiFi is still insecure, and it will always be if not used together with something like a VPN. Many websites use HTTPS, but not nearly all. In fact, more than 30 percent don't. Only around 5 ...
user avatar
  • 64.2k
145 votes

Why is storing passwords in version control a bad idea?

The way I see it, not storing passwords in Git (or other version control) is a convention. I suppose one could decide not to enforce it with various results, but here's why this is generally frowned ...
user avatar
  • 6,504
119 votes

Is public Wi-Fi a threat nowadays?

I'm a little surprised that nobody has pointed out that there's more to the internet than HTTP. Even if your claims about HTTP(S) and HSTS were correct (and other answers discuss that), you're ...
user avatar
  • 2,606
95 votes

Why is storing passwords in version control a bad idea?

First, the non-security reason: Password Change Workflow Passwords change independently of a software application code. If a DBA changes a database password, does it make sense for developers to ...
user avatar
  • 961
51 votes

What is a threat model, and how do I make one?

FilipedosSantos' answer does a great job of explaining a formal threat modelling exercise under, for example, the Microsoft STRIDE methodology. Another great resource is the threat modeling course ...
user avatar
50 votes
Accepted

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

There is no real concept of an "average user with no special access rights". From the perspective of an attacker the main point is if the effort needed for an attack is less then the gain of the ...
user avatar
48 votes
Accepted

What's the Impact of the CloudFlare Reverse Proxy Bug? ("#CloudBleed")

Compared to the famous HeartBleed bug leak, this is similar in some ways: the uninitialized memory exposure means unrelated private data is disclosed. The things that are better This only affected ...
user avatar
  • 38.1k
40 votes

When do honest people need privacy or anonymity? (e.g. they have nothing to hide)

There's a great short essay written by Bruce Schneier on the right of privacy: The most common retort against privacy advocates -- by those in favor of ID checks, cameras, databases, data mining ...
user avatar
  • 5,040
37 votes
Accepted

Evaluating the security of home security cameras

Like most embedded hardware (routers, etc), their firmware often sucks, and unless you have unlimited time I'm afraid there is no way to thoroughly check every single camera out there. And even if you ...
user avatar
  • 12.7k
30 votes

When do honest people need privacy or anonymity? (e.g. they have nothing to hide)

Positive reasons Instead of a beach holiday, we joined a Christian Mission this summer in Malawi. We're keeping quiet about it in case the children are teased at school. I leapt into the road and ...
user avatar
  • 32.6k
25 votes

Why is storing passwords in version control a bad idea?

It's always important to keep in mind that suggestions do have to be tailored to fit your use-case. Security safeguards taken by, say, the NSA to protect all the zero-days they keep around for a ...
user avatar
24 votes

Is public Wi-Fi a threat nowadays?

Another difficulty of public wifi access is that you are on the same local network as other unknown actors. Any misconfiguration of your local network permissions can lead to an intrusion into your ...
user avatar
  • 1,017
22 votes

What is a threat model, and how do I make one?

A great definition can be found in this excerpt from the OWASP page about Threat Modelling: A threat model is essentially a structured representation of all the information that affects the ...
user avatar
18 votes

Where does the root of trust actually lie?

My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack? The attack in the hypothetical example that you describe ...
user avatar
  • 19.6k
16 votes

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Like many things, there is a tiny bit of truth in there, but overall it is a non-issue in practice and incidents are reported/perceived totally out of perspective. Most stuff, including every new ...
user avatar
  • 4,951
14 votes

Is there any way of preventing (or punishing) abuse of anonymity networks?

Officially, they are pushed forward to allow people in dictatorships to break laws restricting their freedom of information and/or expression. Because, the problem with the law is, that you need some ...
user avatar
  • 2,153
13 votes

When do honest people need privacy or anonymity? (e.g. they have nothing to hide)

Just to address one point: Credit card insurance protects them from fraud This makes several assumptions, none of which are to be relied on: You assume that the insurance will pay out. It would be ...
user avatar
  • 4,185
13 votes

Why is storing passwords in version control a bad idea?

Keeping secrets (passwords, certificates, keys) separate from source code makes it possible to manage source and secrets according to different policies. Like, all engineers can read the source code, ...
user avatar
12 votes

Why is storing passwords in version control a bad idea?

This convention, like many other security "best practices" is a handy way of making sure that things don't go wrong because of bad habits or routine. If you always remember that your sensitive ...
user avatar
  • 9,994
12 votes

Where does the root of trust actually lie?

My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack? One way to avoid being the target is to not do anything ...
user avatar
  • 10.8k
11 votes
Accepted

Why would a replay attack be considered a threat to integrity and not confidentiality?

A replay attack is an attack where you record a legitimate transaction and then replay it at a later date. It is not an attack on confidentiality because the attacker isn't learning any new ...
user avatar
  • 18.5k
11 votes

Evaluating the security of home security cameras

This started off as a comment on Andre's answer, but it got a bit long. USB is fine as long as none of the cameras are more than 16 foot from the host :) Since you need to run power out to the ...
user avatar
  • 18.3k
11 votes

Is public Wi-Fi a threat nowadays?

I would argue that any time you connect to a publicly accessible network you're putting yourself at risk, VPNs are great, but do nothing to firewall your machine against the threats on the local ...
user avatar
  • 189
11 votes

Where does the root of trust actually lie?

The root CA list is not hardware-based (in the general case, see about the TPM below). It comes as a built-in feature of your operating system. Other software (e.g. browsers, mail clients, etc...) may ...
user avatar
  • 3,395
10 votes

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

"Should I worry?" is not a technical question-- you can worry about anything you want. For Information Security purposes it is more helpful to consider specific threats, balancing their probability ...
user avatar
  • 9,061
9 votes

Evaluating the security of home security cameras

EDIT - Modified this answer slightly (now three parts) Low Budget Version Pick up a used router (laying around the house?), install dd-wrt on it and turn off the WiFi. Bingo, ready made 4 port ...
user avatar
9 votes

Is public Wi-Fi a threat nowadays?

Some of the concern has to do with MiTM attacks and the tendency for laptops to be configured to blindly connect to open networks based on SSID after the initial connect. Nothing stops an unknown ...
user avatar
  • 211
9 votes

What is a threat model, and how do I make one?

A threat model answers the question - what are the reasonably expected threats for the concrete software (or "system"). Emphasis on concrete (== not academic/theoretic) and reasonably (== not ...
user avatar
  • 199
8 votes

Why doesn't TLS have a threat model?

RFC 5246 does include a threat model, but it is described very succinctly and quite informally. It is at the start of Appendix F: The TLS protocol is designed to establish a secure connection ...
user avatar
  • 168k
8 votes

Could you anonymously upload a file on the internet if the threat model was the entire world trying to find your identity after you do so?

Tl;DR Time is on your side. Note: leave your own phone at home and preferably own a car without GPS. Drive 100 miles from home and buy a cheap used laptop/Android device with functioning Wi-Fi in ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible