What do we do about answers which propose to introduce a blatant security risk?

Question

So, scanning recently edited things, I found an answer to this question here which is accepted but introduces a massive security risk of storing a keyring with no password.

To that end, I have a question about answers being written introducing clear and obvious security risks. While I myself have specifically asked two or more targeted security-risk-introducing questions but ONLY to create a testing environment to try and breach my own VMs, and might be being hypocritical, I'm still asking this question.

What do we do about answers which introduce security risks, such as the answer I linked earlier to removing a password from the security keyring for a user? Do we downvote these questions, or what?

And to clarify: I mean answers which suggest to introduce a security risk that is NOT requested. (I specifically mean such as the aforementioned issues, not where, say, the question asks how to specifically introduce that risk in order to test exploiting it, like a question I would ask would be)

Answer 1

I believe Walter's answer to that question is a better solution, for most people, than the answer that is concerning you. So I've upvoted Walter's answer.

Sometimes comments on an answer aren't adequately visible. This is especially likely when the answer is long or there's a large number of earlier comments about other matters. Neither applies in the case of your example.

Occasionally it's appropriate to add a warning to the top of someone's answer, as Wilf suggests. But except when the author of an answer is likely to agree the banner is appropriate, I think this should be reserved for situations where:

• the risk is exceptional, by which I mean unusually high relative to the situation, and
• alternative ways of warning people wouldn't achieve a degree of visibility appropriate in light of how exceptional the risk is.

Even a pretty small security risk might be considered exceptional, in the way I'm using that term, depending on the situation. For example, an answer about finding the filetype of a file, that involves chmoding something to 777, even if that thing is pretty unimportant, might still warrant a "warning banner" if somehow it was accepted or got more votes than other answers, was long, and had lots of pre-existing comments about other things. (Of course, that's not likely to happen.)

Even a pretty big security risk might be considered non-exceptional, in the way I'm using that term, depending on the situation. (That's addressed in your meta question--occasionally someone will ask for something that necessarily reduces security, sometimes by a large amount, while understanding that's what they are doing.)

Most of the time, large security risks are exceptional (high relative to the situation) and small ones are not.

I've chosen the term "exceptional" to emphasize that it is a situation where it makes sense to use the Stack Exchange system in a somewhat unusual way, and that stapling likely unwanted warnings to the top of people's answers should be the exception rather than the rule, when it comes to addressing problems in posts.

If the author wants the warning, it's not exceptional and we shouldn't be extremely reluctant to apply it. But in that situation, the author may be willing to make more substantial edits to the answer that more clearly explain the risk.

---

There's a single example given here, and it's not a situation where we should be editing the answer to make it say something we think may be different from what its author intends.

1. The answer already makes mention of the risk, though it would be better if it emphasized it more. ("The system will give you a warning about storing passwords unencrypted.")

2. The answer is short and there are not already many comments about other things. (So far every comment there relates directly to the security risk.)

3. Comments are already warning adequately of the risk.

4. There is another answer which, so far, has a higher score. If we guess the upvotes on this meta question reflect shared concern about its example, maybe there are a couple more people who would vote for the alternative answer.

5. The method recommended in the answer does not actually introduce a "massive" security risk. The risk of storing keyring password in cleartext is probably, for most users, comparable to storing autofill passwords unencrypted in a browser. That is the default behavior of most web browsers.

   (That developers of most browsers have made a design choice about default configuration does not magically make that configuration acceptably secure for most people. But it does suggest that the burden of proof must fall heavily on anyone who wishes to make policy based on the claim that such a configuration is unacceptably insecure or that there exists a consensus saying it is.)

6. The question is asking how to make something work without having to enter a password. I don't think that answer is the best way to achieve this for most people. But the context established by the question may be interpreted as accepting reduced security.

On the other hand, if the problematic answer had 40 votes and all the other answers were new, editing in a warning banner would probably be okay.

Answer 2

A simple way is just to add a obvious warning - for example:

WARNING
This may work, but will likely cause your system to become insecure. Explanation. Helpful link.

This would be more helpful if this included a link and a short explanation (preferably a SE one, so it is likely to still exist later on) which explains the issue (in this case, what happens to security if the password prompt is removed). This is helpful if this is in the answer itself, as sometime people may not look at the comments.

If it says to do something stupid - install dodgy programs etc - flagging for deletion or something else may be best.

Answer 3

If you do anything then downvote. Without a downvote less experienced users are in danger. Better would be downvote+edit or downvote+comment.