10

So, scanning recently edited things, I found an answer to this question here which is accepted but introduces a massive security risk of storing a keyring with no password.

To that end, I have a question about answers being written introducing clear and obvious security risks. While I myself have specifically asked two or more targeted security-risk-introducing questions but ONLY to create a testing environment to try and breach my own VMs, and might be being hypocritical, I'm still asking this question.

What do we do about answers which introduce security risks, such as the answer I linked earlier to removing a password from the security keyring for a user? Do we downvote these questions, or what?

And to clarify: I mean answers which suggest to introduce a security risk that is NOT requested. (I specifically mean such as the aforementioned issues, not where, say, the question asks how to specifically introduce that risk in order to test exploiting it, like a question I would ask would be)

| |
  • 2
    the answer you mentioned can be down-voted with appropriate comment. Also ask answerer to include security risk in answer or if not than edit answer including appropriate warning – Pandya Oct 2 '14 at 2:41
  • There are countless answers in existence which advise people to set the permissions of /var/www to 0777, or to set its ownership to the www-data user, or to add normal users to the www-data group, and so forth, and they are overwhelmingly upvoted - my pleas for sanity in the comment sections are basically drowned out and ignored simply due to the number of people who upvote such answers. It frustrates me greatly. This is an example where the wisdom of the many is based on poor security practices and the wisdom of those who actually know a thing or two about security is unable to find a voice. – thomasrutter Oct 6 '14 at 12:40
  • 3
    @neon_overload DOWNVOTE ALL TEH THINGS – Braiam Oct 6 '14 at 15:29
  • Of course I downvote but when the leading answer advises to chmod to 777 and is leading with a margin of over over 5 votes, a downvote does nothing. And if it already has over 5 comments, the comment virtual disappears too. – thomasrutter Oct 6 '14 at 23:02
  • @Braiam Ha ha ha! – angulared Nov 25 '14 at 6:00
7

I believe Walter's answer to that question is a better solution, for most people, than the answer that is concerning you. So I've upvoted Walter's answer.

Sometimes comments on an answer aren't adequately visible. This is especially likely when the answer is long or there's a large number of earlier comments about other matters. Neither applies in the case of your example.

Occasionally it's appropriate to add a warning to the top of someone's answer, as Wilf suggests. But except when the author of an answer is likely to agree the banner is appropriate, I think this should be reserved for situations where:

  • the risk is exceptional, by which I mean unusually high relative to the situation, and
  • alternative ways of warning people wouldn't achieve a degree of visibility appropriate in light of how exceptional the risk is.

Even a pretty small security risk might be considered exceptional, in the way I'm using that term, depending on the situation. For example, an answer about finding the filetype of a file, that involves chmoding something to 777, even if that thing is pretty unimportant, might still warrant a "warning banner" if somehow it was accepted or got more votes than other answers, was long, and had lots of pre-existing comments about other things. (Of course, that's not likely to happen.)

Even a pretty big security risk might be considered non-exceptional, in the way I'm using that term, depending on the situation. (That's addressed in your meta question--occasionally someone will ask for something that necessarily reduces security, sometimes by a large amount, while understanding that's what they are doing.)

Most of the time, large security risks are exceptional (high relative to the situation) and small ones are not.

I've chosen the term "exceptional" to emphasize that it is a situation where it makes sense to use the Stack Exchange system in a somewhat unusual way, and that stapling likely unwanted warnings to the top of people's answers should be the exception rather than the rule, when it comes to addressing problems in posts.

If the author wants the warning, it's not exceptional and we shouldn't be extremely reluctant to apply it. But in that situation, the author may be willing to make more substantial edits to the answer that more clearly explain the risk.


There's a single example given here, and it's not a situation where we should be editing the answer to make it say something we think may be different from what its author intends.

  1. The answer already makes mention of the risk, though it would be better if it emphasized it more. ("The system will give you a warning about storing passwords unencrypted.")

  2. The answer is short and there are not already many comments about other things. (So far every comment there relates directly to the security risk.)

  3. Comments are already warning adequately of the risk.

  4. There is another answer which, so far, has a higher score. If we guess the upvotes on this meta question reflect shared concern about its example, maybe there are a couple more people who would vote for the alternative answer.

  5. The method recommended in the answer does not actually introduce a "massive" security risk. The risk of storing keyring password in cleartext is probably, for most users, comparable to storing autofill passwords unencrypted in a browser. That is the default behavior of most web browsers.

    (That developers of most browsers have made a design choice about default configuration does not magically make that configuration acceptably secure for most people. But it does suggest that the burden of proof must fall heavily on anyone who wishes to make policy based on the claim that such a configuration is unacceptably insecure or that there exists a consensus saying it is.)

  6. The question is asking how to make something work without having to enter a password. I don't think that answer is the best way to achieve this for most people. But the context established by the question may be interpreted as accepting reduced security.

On the other hand, if the problematic answer had 40 votes and all the other answers were new, editing in a warning banner would probably be okay.

| |
  • Being the author of the answer in question here, I'll weigh in... I have no problem editing my answer to emphasize the warning about a security risk, and actually prefer Walter's solution, which I had not known about before. – Charles Green Oct 4 '14 at 14:47
6

A simple way is just to add a obvious warning - for example:

WARNING
This may work, but will likely cause your system to become insecure. Explanation. Helpful link.

This would be more helpful if this included a link and a short explanation (preferably a SE one, so it is likely to still exist later on) which explains the issue (in this case, what happens to security if the password prompt is removed). This is helpful if this is in the answer itself, as sometime people may not look at the comments.

If it says to do something stupid - install dodgy programs etc - flagging for deletion or something else may be best.

| |
2

If you do anything then downvote. Without a downvote less experienced users are in danger. Better would be downvote+edit or downvote+comment.

| |
  • The "warning" edit proposed above by Wilif makes much more sense to me. A downvote may also be helpful if there is a better answer, but probably not helpful at all on its own when compared to a warning. – Brian Z Oct 5 '14 at 9:29
  • 1
    Hi @BrianZ a downvote perfectly fits the purpose of showing that a certain answer might be dangerous. We can't start adding 'warning edits' all over the place. – don.joey Oct 5 '14 at 16:49
  • Downvotes are frequently useless on such answers because of the overwhelming majority who upvote it and do not understand (or care about) the security implications. The "standard" answer to many permissions related problems (especially with regard to web servers or PHP) is to chmod everything to 777 and you'll rarely get many people questioning it - it's always upvoted - (because, after all, it works). If it does get any downvotes they are so often more than cancelled out by the upvotes. – thomasrutter Oct 6 '14 at 12:42
  • @neon_overload That makes sense. Hence I argue for downvote+edit or downvote+comment. But you should downvote. – don.joey Oct 6 '14 at 16:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .