Web security is something I'm severely lacking knowledge in.

XSS, XSRF, IDOR, SQLi... I get the theory but don't grok the details.

@forest I wish I knew if I was one

I guess it depends on who you're asking

I once answered a date related question on SO. It has 30+ views and my answer is accepted and top voted. Turns out it doesn't work in january. Ooops. Poor copy pasters. stackoverflow.com/a/32624747/2200659

At last, a question that can be answered just by "No": security.stackexchange.com/q/243484/127837

I was waiting for so long to be able to do it.

I still failed to do it...

@A.Hersean I think there's a six character limit anyway. You would have had to cheat with a HTML comment to get it to accept "No" as an answer.

@FireQuacker "No, definitely no." Could work too.

However I do not understand the downvote and requests to close this question. I understand that it is boring, obvious, and its usefulness is limited in time; but I still think it is on topic, as defined here: security.stackexchange.com/help/on-topic

Not sure if this is the right place to complain.So last week I found out the internal project I'm on stored password in plain text. "Not great,

"Not great, but at least it's just internal " I hear you say. Except the week before I accidentally found out you could access both the test and production environments from outside the network. I raised the issue but it seems to be known, but for some reason it isn't the highest priority. Other than names and email addresses, I'm not 100% sure what else is stored. I'm happy I've resigned despite not even working there for 6 months, too many issues.

@BrownishMonster You came to the right place ;)

However, please be advised that this process will most likely not lead to anything productive.

We will still strive to help you to rant to your heart's content.

Your ex-company's issue is a good example of the proverb "the shoemaker's children go barefoot".

@A.Hersean that's perfectly fine. That's a good saying, one I'll likely use in the future. Nothing can be done, my current employer is a lost hope. The only thing they seem to be doing right is preventing SQL injection in the Classic ASP part of the project.

@BrownishMonster That is far more common than it should be, especially for small sites

It's highly unlikely that you'll be able to change it, even from the inside. It's usually best not to hang out in such places long-term (although you've obviously left already)

@A.Hersean I'm not exactly sure which part of the on-topic section this falls under. To me it looks like a question that can be answered with a google search. (If you can explain how its on-topic I'll retract my close vote)

One of my favorites along those lines: medium.com/@sresearcher039/…

I know I don't actually want to know, but I can't help but wonder what this dude was doing:

> The browser I used was a Hidden Calculator Browser

@nobody Whether it can be answered by a google search or not is irrelevant to be on topic. "Topics include, but are not limited to: (...) security tools, using cryptography (...)". Keep in mind that this question is asked by and for novices in cybersecurity: of course its "level" is low. That does not make it less useful for them or illegitimate.

It could be better formulated, but the requirements "what are the assets to protect" and "what are the risks" are implicit and trivial to guess here, due to the simplicity of the question.

The "google search" requirements is only for "requests to break something" (that are on topic too!).

(You could also note that you could not have found the answer I wrote with just a google search. But that's not the issue here.)

@A.Hersean Ok, lets suppose something that requires a simple google search can be on-topic. Even so, the answer to this question can get outdated in... well, anywhere between seconds to years (getting out-dated too quickly is why product recommendations are off-topic). Also, I don't think asking if something has publicly known exploits falls into "security tools, using cryptography". IMO questions about security tools should be asking about how to use them.

If we can ask about vulnerabilities in security tools, well, then were gonna get flooded pretty quickly by questions asking if there publicly known exploits for X

How's everyone?

@MechMK1 yo

@nobody The question makes it seem like he's asking if there's a weakness in the cryptographic protocol, not a bug in the software implementation. Though that makes it better on Cryptography.