59

A common problem that I see with questions is that they ask something like "Is (x) secure", which to me is an unanswerable question, the same way as asking "is the city north", it has no meaning in an absolute sense and requires context

In order for a question to make sense the asker needs to provide some details on what they're looking to secure and from whom they are looking to secure it. So instead of asking:

"is this algorithm secure?"

it would be something like:

"I'm writing an application which will store data on disk for an e-commerce website which processes financial transactions. I want to encrypt my data to protect it in the event that my server is compromised, would this algorithm help me achieve that goal"

In terms of a FAQ entry, something like:

Asking questions about whether something is "secure" or not is unlikely to get a satisfactory answer as, without additional details about the system or process you are trying to secure and information about who you are trying to secure it from it is not generally possible to provide an answer which is likely to be accurate. Please ensure that this information is included, otherwise your question may end up being closed.

| |
  • 53
    Is this question secure? – Mark Buffalo Feb 5 '16 at 12:32
  • 37
    @MarkBuffalo There's no CVE for this question. So assume it's secure until someone exposes a vulnerability :-) – S.L. Barth - Reinstate Monica Feb 5 '16 at 13:05
  • 3
    I'd add to that "is xxx safe" and "is it safe to xxx". My only concern is that sometimes the threat model is obvious, and then people should be able to ask simple questions. In fact, Mike puts this better than me in his answer below. – paj28 Feb 6 '16 at 11:21
  • Sorry, can't resist. My next question will be "How to force the user to read the FAQ in order to prevent a vulnerability on this question?" – Steve Dodier-Lazaro Feb 11 '16 at 21:07
  • well for that we just have a nice FAQ answer to point the users at when we're explaining why their question isn't any good :) – Rory McCune Feb 12 '16 at 12:35
  • 3
    SO punchline: This isn't even C++!; UL punchline: Don't parse ls output; EE punchline Happy electrocution with that! and now IS punchline: What is your threat model? – Dmitry Grigoryev Feb 16 '16 at 13:06
  • An example of a great "is <x> secure" question that has real-world meaning ("secure" is pretty well-defined) and great answers that can really help people make good decisions: superuser.com/questions/351576/… – Christopher Schultz Feb 16 '16 at 22:29
  • 1
    A hypothetical city located on the North Pole is north. – emory Feb 29 '16 at 23:26
  • Is Rory McCune brother of Rory Alsop? – Anonymous Platypus Mar 3 '16 at 6:43
  • no, similar first names do not usually denote familial ties... – Rory McCune Mar 3 '16 at 11:07
  • Every time someone asks a question like that which I answer, I always have to start out with "it depends", and the answer turns rather long as I have to guess their threat model for them. "Is this secure? [it depends]" – guest Nov 19 '17 at 2:43
28

I have certainly seen my fair share of questions that are unanswerable without context and / or a threat model. Having something in the FAQ to point at would be amazing.

I also like the content of your FAQ blurb, but would lower the language to make it a bit more accessible. Maybe something like:

Security is always relative, and depends on the context. A question asking whether or not something "is secure" is very hard to answer unless the question includes details about 1) the system or process you are trying to secure 2) the kind of attacker you are trying to protect against. For example, protecting a server against remote access is one thing, but protecting it against a rogue admin is an entirely different question. Please ensure that this information is included, otherwise your question may end up being closed as too broad.

The other point worth making is that we have both experts and non-experts on this site. We get a lot of first-time posters here who are fishing for entry-level information, and I think that should be encouraged. In that case, "Is it secure to enable [setting X] on my home router?" seems like a perfectly fine question. Pressing them for a threat model will not be productive, nor will it encourage them to come back.

| |
  • 3
    Yep that's good wording. On the home user bit, to me the fact that they are a home user on its own is likely to be threat model enough to start making some reasonable conclusions, so I'd say that q. would be ok on it's own from that perspective – Rory McCune Feb 5 '16 at 15:43
  • 3
    Maybe to encourage them, we could have them rephrase it "what security threats are changed by enabling setting X" or something like that. Basically, include "what is the threat model" in the question. – PyRulez Feb 6 '16 at 14:08
15

Agreed. In some cases, it seems like this question would be unclear. In most cases, it feels like it would be too broad to answer, as you'd have to dig deep into that particular implementation.

My only worry is that in some rare cases, this might be a valid question. For example, if there's an insecure implementation that people are using, this is an easily answerable question. If it's something well-known such as, "Is md5 secure?", this is easily answerable without it being too broad.

The problem with my above question about MD5 is that it may give people the wrong idea that it might be a quality question in all cases, leading to some confusion, so I think a better question might be, "Why shouldn't I use MD5?"

However, I think your FAQ addition would be a great add.

| |
  • 11
    Actually the md5 thing is a good example of my point, there are times where the use of MD5 would be just fine, even if there are better alternatives available... – Rory McCune Feb 5 '16 at 12:53
  • 7
    Exactly right Rory. "MD5 is unsafe" without context is nonsense. A more accurate statement would be "the use of MD5 for applications that rely on collision resistance is unsafe, however it is safe (as far as we know) to use MD5 for applications that rely on preimage resistance". So it's a perfect example of the point you were trying to make. You should have thought of it yourself :-) – mgr326639 Feb 7 '16 at 16:45
  • 4
    After seeing a different and valid perspective, I have reversed my stance. I'll leave this post up just because it's a good example. – Mark Buffalo Feb 7 '16 at 17:08
  • 3
    Is this answer secure? There is a Mark Ruffalo avatar with a Mark Buffalo username. It lools like a MitM altered something. – A.L Mar 2 '16 at 13:21
  • 2
    @A.L BitM. Buffalo in the Middle. – Mark Buffalo Mar 2 '16 at 14:10
8

The version of this I encountered today was "How do I determine which encryption library is trustworthy?", which was getting voted to close based on this kind of logic. But I think it's a very different question, one that I think is on topic.

Just because "how do I know who to trust?" is a hard question with no clear answer doesn't mean it is off topic, because it's one we all answer constantly. Maybe I should refer the querent to Schneier's book "Liars and Outliers".

| |
  • 2
    This question I think would be on topic, as it asks for how you would do it. That is answerable. – Rory Alsop♦ Feb 10 '16 at 22:33
6

I agree that those kinds of questions are not good, and anything to help guide posters is helpful. I just want to point out that our FAQ already includes some wording on this:

What background should I give in my question? Security is a very contextual topic: threats that are deemed important in your environment may be inconsequential in somebody else's, and vice versa. Are you trying to protect something of global value against Advanced Persistent Threats? Or are you looking for a cost-effective approach for a low-profile small business? To get the most helpful answers you should tell us:

  • what assets you are trying to protect
  • who uses the asset you're trying to protect, and who you think might want to abuse it (and why)
  • what steps you've already taken to protect that asset
  • what risks you think you still need to mitigate

One good starting point would be to point question-askers to that part of the FAQ, and enforce it by closing questions that don't provide the necessary context (as "unclear what you are asking" if they don't provide context, or possibly "too broad" if they don't explain what their security goals are).

Adding the wording you mention wouldn't hurt, either.

| |
1

Note: posting as community Wiki, feel free to edit this post if I got it wrong. Also feel free to remove the current note.

When asking "Is (X) secure" - as stated - no context is provided. Besides, the question in this format suggests a "Yes" / "No" answer.

In order to help find a better way to ask, Some alternatives:

Good questions:

  • "What are the disadvantages of using (X) for (W)?"

    • Asks for disadvantage of using (X) when doing (W)
    • Context provided (W)

  • "What are the reasons to not use (X) to (W)?"

    • Ask for reasons / motivations against (X) when doing (W)
    • Context provided (W)

  • "What vulnerabilities of (X) are a concern for (W)?"

    • Asks for relevant vulnerabilities of (X) when doing (W)
    • Context provied (W)

  • "What vulnerabilities of (X) are a concern for (W)?"

    • Asks for relevant vulnerabilities of (X) when doing (W)
    • Context provied (W)

Note: Consider W a use case.

Bad questions (because of lack of context):

  • "Is (X) secure?"

    • Asks whatever or not (X) is secure / trustworthy
    • Encorages "Yes" / "No" - good answers should follow with the reasoning.
    • No Context provided [1]

  • "Why wouldn't I use (X)?"

    • Asks for reasons / motivations against (X) (No constraints on what counts)
    • No context is provided [1]

  • "What are the disadvantages of using (X)?"

    • Asks for thing that can be a disadvantage of using (X)
    • No context is provided [1]

Others:

  • "Is (Z) a concern when using (X)[ for (W])?"

    • Asks whatever or not (Z) is problematic when using (X)[ for (W)]
    • Encorages "Yes" / "No" - good answers should follow with the reasoning.

  • "Should I worry about (Z) when using (X)[ for (W)]?"

    • Asks whatever or not (Z) is problematic when using (X)[ for (W)]
    • Encorages "Yes" / "No" - good answers should follow with the reasoning.

  • "Why is (Z) a concern when using (X)[ for (W)]?"

    • Asks for the reasons why (Z) is problematic when using (X)[ for (W)]
    • Lodaded question, presumes (Z) is problematic in the context.

Note: consider the portions in brakets as optional.

[1] Other that being somehow related to security, simply by being posted on the site.

| |
  • This is, I feel, a far better FAQ entry than the proposed one, since it actually suggests ideas of the questions they are likely to be trying to ask, typically something like "Does X contain known vulnerabilities, or is it otherwise deprecated by the security community for some reason?" – Dewi Morgan Mar 1 '16 at 18:17
1

I'm not so sure. Keep in mind that those who have security questions but security isn't their field may not even be very familiar with the term "threat model", let alone its significance, so closing their question because they didn't specify their threat model is likely to be more irritating than helpful, at least if there is a canonical threat model that you could have assumed.

To them, it might feel kind of like asking if 2 + 2 = 4... it's true that the question doesn't specify the number field, but you can probably assume it to be over the real or complex numbers and answer it accordingly so that your answer is actually helpful.

I realize not every such question can be answered in this manner, but some can, and since no one seems to have mentioned the downsides I thought I should.

| |
  • Agree. I think some things can be assumed without having to devolve into "armchair theoreticians." – user103094 Mar 10 '16 at 4:06
-3

What is the site topic, it shouldn't be decided in an ivory tower.

Now you are starting to expel newbies. This will make the site a closed circle of old members licking eachothers boot.

It must match the common conception of a new member knowing nothing from the site except its name. Yes, questions "is ... secure" are ontopic on this conception.

The typical answer to such a question should enumerate the details of the system/software/conception/solution of the question.

Well, I admit they are not the best questions. But: banning a newbie on the spot because it was his first question, it expels him. You are on the best way to cut your own aftergrowth.

| |
  • 1
    Who said anything about banning or expelling people? The suggestion here is to have clear wording in the FAQ to explain to users why questions with a statement of "is (x) secure" are unlikely to receive good answers without details about the environment/threat model context of the question... – Rory McCune Feb 22 '16 at 9:04
  • @RĐ¾ryMcCune If a question lacks the needed context to be answerable, then it should be closed as "unclear". The is no need for a specific reason for such cases, it will only lead to the significant problems I detailed. – peterh - Reinstate Monica Feb 22 '16 at 9:10
  • 1
    so you're against providing information in FAQ's about what good/bad questions look like because.... – Rory McCune Feb 22 '16 at 9:25
  • @RĐ¾ryMcCune No. I didn't say even any similar. – peterh - Reinstate Monica Feb 22 '16 at 10:13
  • 1
    ok so help me understand. The question suggests adding a FAQ about this kind of question and why they're bad (it says nothing about banning or closing anything). You post a negative response saying you think this is a bad idea. From that I derive that you think the FAQ is a bad idea, I say that and you say that you said nothing similar. what is it I'm missing here? – Rory McCune Feb 22 '16 at 10:20
  • @RĐ¾ryMcCune I think it is a bad idea to explicitly declare, that questions like "is ... secure" are offtopic. I think it is bad idea to define a site topic which is significant different from a newbie visitiing the site at the first site. – peterh - Reinstate Monica Feb 22 '16 at 11:08
  • 1
    but the proposed FAQ at the top doesn't say those questions are off-topic! It recommends including additional information to ensure the question is answerable – Rory McCune Feb 22 '16 at 12:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .