"Is (x) Secure" Question Anti-Pattern

Question

A common problem that I see with questions is that they ask something like "Is (x) secure", which to me is an unanswerable question, the same way as asking "is the city north", it has no meaning in an absolute sense and requires context

In order for a question to make sense the asker needs to provide some details on what they're looking to secure and from whom they are looking to secure it. So instead of asking:

"is this algorithm secure?"

it would be something like:

"I'm writing an application which will store data on disk for an e-commerce website which processes financial transactions. I want to encrypt my data to protect it in the event that my server is compromised, would this algorithm help me achieve that goal"

In terms of a FAQ entry, something like:

Asking questions about whether something is "secure" or not is unlikely to get a satisfactory answer as, without additional details about the system or process you are trying to secure and information about who you are trying to secure it from it is not generally possible to provide an answer which is likely to be accurate. Please ensure that this information is included, otherwise your question may end up being closed.

Answer 1

I have certainly seen my fair share of questions that are unanswerable without context and / or a threat model. Having something in the FAQ to point at would be amazing.

I also like the content of your FAQ blurb, but would lower the language to make it a bit more accessible. Maybe something like:

Security is always relative, and depends on the context. A question asking whether or not something "is secure" is very hard to answer unless the question includes details about 1) the system or process you are trying to secure 2) the kind of attacker you are trying to protect against. For example, protecting a server against remote access is one thing, but protecting it against a rogue admin is an entirely different question. Please ensure that this information is included, otherwise your question may end up being closed as too broad.

The other point worth making is that we have both experts and non-experts on this site. We get a lot of first-time posters here who are fishing for entry-level information, and I think that should be encouraged. In that case, "Is it secure to enable [setting X] on my home router?" seems like a perfectly fine question. Pressing them for a threat model will not be productive, nor will it encourage them to come back.

Answer 2

Agreed. In some cases, it seems like this question would be unclear. In most cases, it feels like it would be too broad to answer, as you'd have to dig deep into that particular implementation.

My only worry is that in some rare cases, this might be a valid question. For example, if there's an insecure implementation that people are using, this is an easily answerable question. If it's something well-known such as, "Is md5 secure?", this is easily answerable without it being too broad.

The problem with my above question about MD5 is that it may give people the wrong idea that it might be a quality question in all cases, leading to some confusion, so I think a better question might be, "Why shouldn't I use MD5?"

However, I think your FAQ addition would be a great add.

Answer 3

The version of this I encountered today was "How do I determine which encryption library is trustworthy?", which was getting voted to close based on this kind of logic. But I think it's a very different question, one that I think is on topic.

Just because "how do I know who to trust?" is a hard question with no clear answer doesn't mean it is off topic, because it's one we all answer constantly. Maybe I should refer the querent to Schneier's book "Liars and Outliers".

Answer 4

I agree that those kinds of questions are not good, and anything to help guide posters is helpful. I just want to point out that our FAQ already includes some wording on this:

What background should I give in my question? Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, and vice versa. Are you trying to protect something of global value against Advanced Persistent Threats? Or are you looking for a cost-effective approach for a low-profile small business? To get the most helpful answers you should tell us:

• what assets you are trying to protect
• who uses the asset you're trying to protect, and who you think might want to abuse it (and why)
• what steps you've already taken to protect that asset
• what risks you think you still need to mitigate

One good starting point would be to point question-askers to that part of the FAQ, and enforce it by closing questions that don't provide the necessary context (as "unclear what you are asking" if they don't provide context, or possibly "too broad" if they don't explain what their security goals are).

Adding the wording you mention wouldn't hurt, either.

Answer 5

Note: posting as community Wiki, feel free to edit this post if I got it wrong. Also feel free to remove the current note.

When asking "Is (X) secure" - as stated - no context is provided. Besides, the question in this format suggests a "Yes" / "No" answer.

In order to help find a better way to ask, Some alternatives:

Good questions:

• "What are the disadvantages of using (X) for (W)?"

  • Asks for disadvantage of using (X) when doing (W)
  • Context provided (W)

• "What are the reasons to not use (X) to (W)?"

  • Ask for reasons / motivations against (X) when doing (W)
  • Context provided (W)

• "What vulnerabilities of (X) are a concern for (W)?"

  • Asks for relevant vulnerabilities of (X) when doing (W)
  • Context provied (W)

• "What vulnerabilities of (X) are a concern for (W)?"

  • Asks for relevant vulnerabilities of (X) when doing (W)
  • Context provied (W)

Note: Consider W a use case.

Bad questions (because of lack of context):

• "Is (X) secure?"

  • Asks whatever or not (X) is secure / trustworthy
  • Encorages "Yes" / "No" - good answers should follow with the reasoning.
  • No Context provided [1]

• "Why wouldn't I use (X)?"

  • Asks for reasons / motivations against (X) (No constraints on what counts)
  • No context is provided [1]

• "What are the disadvantages of using (X)?"

  • Asks for thing that can be a disadvantage of using (X)
  • No context is provided [1]

Others:

• "Is (Z) a concern when using (X)[ for (W])?"

  • Asks whatever or not (Z) is problematic when using (X)[ for (W)]
  • Encorages "Yes" / "No" - good answers should follow with the reasoning.

• "Should I worry about (Z) when using (X)[ for (W)]?"

  • Asks whatever or not (Z) is problematic when using (X)[ for (W)]
  • Encorages "Yes" / "No" - good answers should follow with the reasoning.

• "Why is (Z) a concern when using (X)[ for (W)]?"

  • Asks for the reasons why (Z) is problematic when using (X)[ for (W)]
  • Lodaded question, presumes (Z) is problematic in the context.

Note: consider the portions in brakets as optional.

[1] Other that being somehow related to security, simply by being posted on the site.

Answer 6

I'm not so sure. Keep in mind that those who have security questions but security isn't their field may not even be very familiar with the term "threat model", let alone its significance, so closing their question because they didn't specify their threat model is likely to be more irritating than helpful, at least if there is a canonical threat model that you could have assumed.

To them, it might feel kind of like asking if 2 + 2 = 4... it's true that the question doesn't specify the number field, but you can probably assume it to be over the real or complex numbers and answer it accordingly so that your answer is actually helpful.

I realize not every such question can be answered in this manner, but some can, and since no one seems to have mentioned the downsides I thought I should.

Answer 7

What is the site topic, it shouldn't be decided in an ivory tower.

Now you are starting to expel newbies. This will make the site a closed circle of old members licking eachothers boot.

It must match the common conception of a new member knowing nothing from the site except its name. Yes, questions "is ... secure" are ontopic on this conception.

The typical answer to such a question should enumerate the details of the system/software/conception/solution of the question.

Well, I admit they are not the best questions. But: banning a newbie on the spot because it was his first question, it expels him. You are on the best way to cut your own aftergrowth.