Comments on: Security is for Suckers

Security is for Suckers

fenriq — Wed, 06 Sep 2006 22:38:13 -0800

The Best Hiding Place is Right Out in the Open?
Yes, its a simple Google search. But it returns confidential pdf's and pages from all over the internet. Business plans, powerpoint presentations and other naughty bits exposed to, well, anyone who finds it.
Oops.

By: Kickstart70

Kickstart70 — Wed, 06 Sep 2006 22:46:07 -0800

"not for public release"

By: Stunt

Stunt — Wed, 06 Sep 2006 22:48:52 -0800

Oops, indeed.

By: aeschenkarnos

aeschenkarnos — Wed, 06 Sep 2006 22:49:24 -0800

It's a neat idea, I saw this on www.boingboing.net this morning and spent a half-hour or so looking through search results, but it seems in practice that for anything that's actually "do not distribute", there are dozens of other things that read along the lines of: "The policy states that documents are to be marked 'confidential - do not distribute'". The most interesting thing I found in my cursory travels was the counsellor rules for a prison counselling program for girls: counsellors are told to keep anything the girls say confidential, and do not distribute condoms.

By: tepidmonkey

tepidmonkey — Wed, 06 Sep 2006 22:51:38 -0800

Now I can finally build my very own whatever this thing is.

By: trinarian

trinarian — Wed, 06 Sep 2006 22:51:39 -0800

"secret underground lair"

By: carsonb

carsonb — Wed, 06 Sep 2006 22:57:40 -0800

powerpoint pitches best left behind closed doors. I feel for those who gave these presentations. "secret underground lair" there's the reason I haven't seen any furries around lately.

By: George_Spiggott

George_Spiggott — Wed, 06 Sep 2006 23:03:17 -0800

That's wonderful. People have this naive belief that links they don't deliberately publicize won't get spidered. But sooner or later it's quite likely a search engine will find it -- in someone's public referrer log, or because you didn't disable directory listings, or somewhere down in the long, unedited history of an email message that eventually found its way onto a publicly archived mailing list. If you must put something on the web that you don't want made public, you have to secure it using honest-to-god access control (which is not exactly difficult). But even then, somebody may just lose track of a copy which gets posted somewhere public.

By: Muirwylde

Muirwylde — Wed, 06 Sep 2006 23:03:34 -0800

Wow... if Im not mistaken thats the final schematic for a nuclear warhead trigger mechanism...either that or a Dairy Queen soft whip dispenser...:::turns schematic over:::

By: jimmythefish

jimmythefish — Wed, 06 Sep 2006 23:20:30 -0800

I once got a job from someone who googled an old, unlinked resume of mine, hosted on a backwater ISP that I'd forgotten about entirely, and called me up. Nothing is safe, though in that case it was a good thing.

By: squalor

squalor — Wed, 06 Sep 2006 23:32:43 -0800

This result is particularly ironic.

By: punkbitch

punkbitch — Wed, 06 Sep 2006 23:33:49 -0800

I don't know about posting google searches. But I'd love to see "Secret Underground Lair" vs. "Not for Public Release" deck it out over at googlefight. In fact.... here. (the results are shocking!)

By: infini

infini — Wed, 06 Sep 2006 23:40:22 -0800

oy! what fun... but thanks for hours of joyful browsing...

By: damn dirty ape

damn dirty ape — Wed, 06 Sep 2006 23:49:03 -0800

Ninjas long have known the best place to hide is out in the open. Or as... cheerleaders. Whichever one. They're both good.

By: VulcanMike

VulcanMike — Thu, 07 Sep 2006 00:05:42 -0800

"company confidential" works decently as well... I've been limiting by PDF. I'll say I'm a bit disturbed by how many items I was afraid to click, overall.

By: coelecanth

coelecanth — Thu, 07 Sep 2006 00:26:45 -0800

In my experience, every document template in every large company on the planet contains some mention of confidentiality.

By: coelecanth

coelecanth — Thu, 07 Sep 2006 00:31:16 -0800

...although my survey isn't totally complete.

By: Sukiari

Sukiari — Thu, 07 Sep 2006 00:51:04 -0800

inurl:CgiStart?page=Single axis inurl:view/index.shtml

By: orthogonality

orthogonality — Thu, 07 Sep 2006 01:10:03 -0800

OMG Bunny! (page 12)

By: orthogonality

orthogonality — Thu, 07 Sep 2006 01:17:43 -0800

NOFORN

By: Herr Fahrstuhl

Herr Fahrstuhl — Thu, 07 Sep 2006 02:04:06 -0800

Not to spoil the fun, but the first search hit is also linked from the official company site, so it is probably to be considered declassified.

By: about_time

about_time — Thu, 07 Sep 2006 04:46:29 -0800

Google Hacking database is what you meant to post.

By: itchylick

itchylick — Thu, 07 Sep 2006 05:02:09 -0800

I'll say I'm a bit disturbed by how many items I was afraid to click, overall. Oh come on, take some chances. Hold on, someone knocking at the door ...

By: localroger

localroger — Thu, 07 Sep 2006 05:53:13 -0800

If you are a programmer "proprietary source code" is also good for a few laughs.

By: CynicalKnight

CynicalKnight — Thu, 07 Sep 2006 06:14:39 -0800

thats the final schematic for a nuclear warhead trigger mechanism...either that or a Dairy Queen soft whip dispenser They are one and the same. In the final moments before an atomic blast individuals at ground zero are treated to delicious soft ice cream treats.

By: trinarian

trinarian — Thu, 07 Sep 2006 06:22:00 -0800

punkbitch: I win!!

By: davy

davy — Thu, 07 Sep 2006 07:18:16 -0800

Daddy, what's a Oingo Boingo?

By: yhbc

yhbc — Thu, 07 Sep 2006 07:49:43 -0800

Is this really a link to "something cool on the web"? If it was a link to an article about this (apparently) common security flaw, maybe; as it is, this is only a link to a google search which will inevitably change over time.

By: mindless progress

mindless progress — Thu, 07 Sep 2006 08:11:08 -0800

Sukiari: "inurl:CgiStart?page=Single axis inurl:view/index.shtml" Wow, that's neat. I just watched some guy buy something in a hardware store.

By: craniac

craniac — Thu, 07 Sep 2006 08:21:50 -0800

electronics store. If I was that guy I'd totally wear a chicken suit. Lazyweb: someone needs to make a fake security cam that is actually a flash video that shows aliens landing in the background or something.

By: TechnoLustLuddite

TechnoLustLuddite — Thu, 07 Sep 2006 08:37:54 -0800

Heh, i love net voyeurism! guinea pig cam!

By: djfiander

djfiander — Thu, 07 Sep 2006 08:46:41 -0800

Once, a long time ago, I worked for a company that did some contract work for a large blue computer firm. We were working on a product that hadn't been released yet, and all the documentation was stamped "BLUE CONFIDENTIAL: DO NOT DISTRIBUTE". When the product was released, staff from Blue arrived, counted our "confidential" documentation to make sure it was all accounted for, shredded it, and gave us new documentation which was identical except that it was NOT stamped confidential. This obviously eliminates the problem of trying to determine if they really want that "confidential" document linked to the company home page or not.

By: Schroder

Schroder — Thu, 07 Sep 2006 08:48:56 -0800

Re: not exactly difficult Posted by George_Spiggott And there is always <meta name="Robots" content= "noindex, nofollow">

By: Kickstart70

Kickstart70 — Thu, 07 Sep 2006 08:55:26 -0800

Is this really a link to "something cool on the web"? Yep, it is. I, for one, would like to form my own opinions about things instead of reading regurgitated pap from media hacks all the time.

By: leftcoastbob

leftcoastbob — Thu, 07 Sep 2006 09:14:19 -0800

Is this really a link to "something cool on the web"? If it was a link to an article about this (apparently) common security flaw, maybe; as it is, this is only a link to a google search which will inevitably change over time. posted by yhbc You're right--it can't be cool unless I know from someone else what to think. On preview--what Kickstart70 said.

By: yhbc

yhbc — Thu, 07 Sep 2006 09:40:05 -0800

You're missing my point, which was not that anyone needs to be told what to think, but that this post breaks the posting guidelines.

Make sure you're linking to something on the web. If you're posting a generalized question to the audience, or posting a comment as a main thread, either find an appropriate mailing list, or use MetaTalk.

My question was rhetorical - it is not a link to "something cool on the web" (which is another quote from the posting page), but an example of a google search. Although it may warrant discussion, it does not belong here. Sorry I confused both of you by trying to be polite and not derail the thread. I won't make that mistake again.

By: Sangre Azul

Sangre Azul — Thu, 07 Sep 2006 09:46:09 -0800

Oy, I was waiting for this to show up on the blue. One of my clients has a PDF in the first page of search results, and we had a little chat shortly after the BB article went up about how "with FTP access comes great responsibility". "The policy states that documents are to be marked 'confidential - do not distribute'". This was true in my client's case, and the "confidential" materials were actually part of a very public press campaign some years ago. We think the document in question had been linked via a news posting at the time (laziness on PR's part, or an inability to generate a "clean" PDF). On the plus side, they hit their daily average of hits for the day before 10am.

By: jacquilynne

jacquilynne — Thu, 07 Sep 2006 11:08:30 -0800

When the product was released, staff from Blue arrived, counted our "confidential" documentation to make sure it was all accounted for, shredded it, and gave us new documentation which was identical except that it was NOT stamped confidential. As was explained to me many, many, many, many, many (you have no idea how many more manys I could conceivably write here and not be exaggerating) whilst I worked there, when maintaining a confidential documents policy it's just as important to ensure that non-confidential information is not marked confidential as it is to ensure that confidential information is marked as such. It had to do with lawsuits over trade secrets or industrial espionage or somesuch.

By: oraknabo

oraknabo — Thu, 07 Sep 2006 11:34:28 -0800

Now I can finally build my very own whatever this thing is. Check those plans again. They responded.

By: raedyn

raedyn — Thu, 07 Sep 2006 12:30:55 -0800

Adding "site:.gov" is an interesting variation. A lot of the searched documents are just policies about confidential documents. But not all of them. Now I can finally build my very own whatever this thing is. - tepidmonkey Check those plans again. They responded. - oraknabo At least they have a sense of humour about it. Some managers would go on some kind of crusade about how the internets are ruining civilisation.

By: Kickstart70

Kickstart70 — Thu, 07 Sep 2006 12:43:35 -0800

Sorry I confused both of you by trying to be polite and not derail the thread. I won't make that mistake again. Actually the flaw was in your use of the word 'article', which was even emphasized in italics. If you hadn't used that, we wouldn't have assumed that you wanted an article, thinking that it was better than linking to a Google search. </desnark>

By: longbaugh

longbaugh — Thu, 07 Sep 2006 14:15:12 -0800

I'll see your NOFORN and raise you a WNINTEL.

By: x_3mta3

x_3mta3 — Thu, 07 Sep 2006 16:01:13 -0800

I got a kick out of the sponsored ad: Sponsored Links Protect Confidential Data.....

By: kozad

kozad — Thu, 07 Sep 2006 16:53:23 -0800

very clever post

By: carsonb

carsonb — Thu, 07 Sep 2006 19:15:40 -0800

I don't think google searches are categorically excluded from "something cool on the web". unless....uh, what do you mean by "something"?

By: lekvar

lekvar — Thu, 07 Sep 2006 19:36:38 -0800

Check those plans again. They responded. Feh. I was hoping they'd added a "Hobnostic Defrosticator" or "Framistat" label.

By: five fresh fish

five fresh fish — Thu, 07 Sep 2006 20:06:55 -0800

So I take it no one found anything really freaky, eh?

By: caution live frogs

caution live frogs — Thu, 07 Sep 2006 21:55:40 -0800

Just that photo of you naked with a wombat, fff. Otherwise, nothing good.

By: five fresh fish

five fresh fish — Fri, 08 Sep 2006 08:39:38 -0800

A wombat? Good. S'alright, then.

By: davy

davy — Fri, 15 Sep 2006 18:53:27 -0800

That was no wombat, that was my wife!