I think it's beneficial to prevent social engineering attacks based on content our users post in this site.

One example of the problem is responses to this question, where users are asked about their current environment. Subsequently, users may have information in the Bio section that will identify their employers or the projects they are working on. This disclosure may be in volation of thier IT policy, and may be a risk in some situations..

With those goals in mind, I think it's a good idea to consider more security features on the user profile page (such as redaction), or the ability to post anonymous questions and answers.

I would even go so far and recommend that users use a different OpenID when using this site until we find a solution.

So based on that...

  1. What are you thoughts on importance of this issue?
  2. How can we make things better?
share
add comment

4 Answers

Yes, this is a very good point to raise, note that a similar issue was discussed here - though that was about the FAQ.
It might be a bit paranoid, but then that's to be expected here, no?

While I do think it is important, I also think everybody here can be responsible enough to not post really sensitive information in public. Perhaps a reminder, put it in the FAQ, maybe 3 1/2 words in our blurb, possibly even a banner for new users or once in a while...

That said, I do think it might be a good idea to propose to @Jeff Atwood and the team... I dont think redaction could work well, but supporting anonymous posts might be worth doing (although not trivial).

Also, it occurs to me that there is a great place to get more ideas from the best security pros, if you can generalize the question. Who knows what we'll come up with, they'd probably appreciate having the community come up with security solutions for them :D

share
    
I do agree that self-moderation is key, along with the tools that are used to protect the poster. Along those lines, anonomizing select posts will build a better community than communing with overly-anonymous users. Not to mention having the sense that one is communicating with an 'expert' in the field will benefit everyone involved. If there is a programatic solution, I'm all for it. –  makerofthings7 Nov 23 '10 at 22:25
    
I think extending the idea of "community wiki", and making it possible to have completely anonymous posts (goes without saying pointsless and awardless) could be worked into something very useful. –  AviD Nov 23 '10 at 22:44
    
Sounds like a good approach! –  makerofthings7 Nov 24 '10 at 1:11
add comment

Just use your secondary browser, you know the one without persistant store, and post as if you had no account on security.stackexchange.com.

Don't work for meta aparently...

trying of the main site attempting to post sends me to

http://security.stackexchange.com/questions/ask/submit

which states simply 'Oh tin of pink meat / I ponder what you may be / Snout or ear or feet?'

I wonder what is the minimal set of things I need to turn on to get past that...

share
add comment

As we have the question about APT SIEM, I think we should definitely allow anonymous postings - I am interested if anyone can say anything here without risking themselves. However, as folks pointed out, everyone may be under NDA's so this may not work.

Anonymous postings really only help when people want to post something which may heighten their risk, not to help someone breach NDA without discovery.

share
add comment

I think anonymous posting is too extreme, but maybe I'm reading the question to narrowly.

Are you suggesting anonymous as in not logging in, or log in and post anonymously?

The second is the only one that makes sense for being able to give feedback (and also prevent abuse). It would make sense to generate a one-time username that is associated with the question that you can access via your main account. That way you can log into your normal account, and have your "anon" questions visible (only visible to you but not publicly linked to your account). This would require you to trust the site admins (and possibly moderators).

For partial anonymity, I think most people will be fine with pseudonyms. Create another ID and use that for sensitive stuff.

For full anonymity, the truly paranoid would need to compartmentalize their questions across many openIDs to reduce the information leakage across multiple questions. I don't think this is too much of a burden for the few people that need it. The people with the greatest security needs should pay the most.

If a large number of people really need anonymity, then I think we should come back and think about changing this core principle of identities.

share
    
I agree. The community is supposed to be self-moderating, so we should trust users to decide what they do or do not wish to say here. –  user185 Dec 9 '10 at 9:07
1  
The problem comes when they want to say something, in order to get the answer they need, but shouldnt say it publicly. To some extent this might be true on other sites, but especially here Security issues can be highly sensitive - but what ya gonna do if ya need an answer? –  AviD Dec 9 '10 at 10:33
    
@AviD: I agree with you. I just don't know if the use-case warrants adding functionality, when people can create a new openID and post using a pseudonym. If it is a common use-case, then I think we can come back and find the best compromise between security/paranoia and features. –  rox0r Dec 9 '10 at 22:06
add comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .