34

Should I not give an answer if the user asked about an outdated method?

Actually, the OP asked about manually storing password with md5() and checking it manually. However Laravel comes with the built-in bcrypt(). And upon commenting md5() is not secure and bcrypt() should be used, the OP insists on using md5().

Then I answered with a solution using md5(), and then one user commented 'Is it a good idea to help?'. I am asking the same here.

Insecure rather than outdated?

6
  • 20
    I don't see any problem as long as you make clear in the answer that it is a bad idea (as you did). It might also help adding a sentence or two to make it clear why it is a bad idea and/or how critical an issue it is.
    – duplode
    Feb 11, 2017 at 18:40
  • 14
    "People might know what they want, but not what they need" seems apt in this case.
    – Braiam
    Feb 12, 2017 at 12:44
  • 3
    @Sanzeeb Aryal You can answer any question without somebody permission.:) Feb 13, 2017 at 23:32
  • 1
    @VladfromMoscow Yes. but the answer is actually less secure and OP insists on using that. Feb 14, 2017 at 3:30
  • 1
    As long as you point out that the method is outdated and tell them what they should use instead, I see no issue in also answering the question as asked.
    – Andrew
    Feb 14, 2017 at 13:41
  • There is no outdated methods, only backward-compatible ones ;p
    – Kilazur
    Feb 14, 2017 at 14:15

2 Answers 2

43

A method being "outdated" is relative. The user may be using an old version of Laravel, or there may be any number of different reasons that would require the use of the outdated method. Other users may run into these same conditions and end up in the same place and—if you don't answer it today—someone is going to ask something similar tomorrow. Eventually it will get an answer and Earth will continue to rotate on its axis.

If you see an answerable on-topic non-duplicate question that you can answer, answer it.

8
  • 9
    I believe there should be exceptions to this, such as when an answer is likely endangering all the users that any programmer using this technique will serve. The answer to this question should be how to do it properly, along with an explanation of how doing it in the outdated, dangerous way, is indeed dangerous. Feb 13, 2017 at 22:49
  • 8
    Of course, you should definitely explain every answer that you post as much as necessary.
    – user4639281
    Feb 14, 2017 at 0:04
  • Do you consider md5 a safe cryptography hash function?
    – Braiam
    Feb 15, 2017 at 0:36
  • 1
    @Braiam I consider it a cryptography hash function. I do not consider a method's relative safety to be a condition that should be used to evaluate whether or not a question asking about it should receive an answer. A detailed explanation of why a method is not safe should be a part of an answer to such a question, but a question's reception of an answer should not be predicated upon the question asking for something safe or not.
    – user4639281
    Feb 15, 2017 at 0:57
  • Who's saying that you shouldn't answer? We are saying that you shouldn't provide a broken answer, an answer that you know is utterly crap, irrespectively of what OP ask! If OP asks to use md5 to hash passwords, you shouldn't answer how to do it with md5, you answer with a secure method instead.
    – Braiam
    Feb 15, 2017 at 13:11
  • 2
    So you should ignore the question and answer a completely different question? That makes absolutely no sense. It makes even less sense than just not answering. @Braiam
    – user4639281
    Feb 15, 2017 at 15:03
  • 2
    Recommended read meta.stackexchange.com/questions/66377/what-is-the-xy-problem. The problem is to store a password safely, the user thinks "I know, lets use md5!" and then asks about that. But the user do not know, and you should answer with an actual method to store passwords safely.
    – Braiam
    Feb 15, 2017 at 17:03
  • The question is not how to store the password safely. The question is asking about manually storing password with md5() and checking it manually. It is not about whether the method is secure or not. It's about the use of the method. Purposefully submitting an answer that does not answer the question and provides a solution that you know will not work for the asker is counter-productive at best and actively harmful at worst. @Braiam
    – user4639281
    Feb 15, 2017 at 18:13
16

In this specific case, and talking as a security aware user, I do not answer a question and dissuade anyone from doing so if it is a known attack vector. We've seen several times where answers with vulnerabilities bite our collective behinds where developers, ignoring all warnings, use this methods because "they solve the problem" (obvious example of this: Problematic PHP Cryptography Advice in Popular Questions).

In cases where the OP insists using the broken method, it has to make a very strong case why it should be done that way, otherwise, even while knowing the answer, I recommend not providing it. As internet denizens and developers, enabling others to deploy vulnerable services is a disservice against ourself and our environment becomes more hostile and insecure over time.

Now, addressing the general case, I would recommend instead of giving a complete ready to copy solution, just describing how it should be done itself. That would force any potential reader to understand what is being done and why it is not recommended, instead of just blindly copy-n-pasting.

17
  • Yes, this, a thousand times. Feb 13, 2017 at 22:48
  • 5
    My favourite example of this: stackoverflow.com/questions/9079298/…
    – ninjalj
    Feb 13, 2017 at 23:37
  • @ninjalj ok, that was awesome.
    – Braiam
    Feb 13, 2017 at 23:49
  • 5
    Security by obscurity is not security, seems to apply here too even if a bit differently... Also, SO is not a forum where you should answer with a non-answer "don't do it". The right way is to answer (perhaps very briefly), but explain the problems carefully. Only way to increase overall security is helping all developers to understand the issues. Bad / uncaring developers will create security vulnerabilities, whether you answer their questions or not, and answering them gives an opportunity to educate all readers, not just the OP.
    – hyde
    Feb 14, 2017 at 6:17
  • @hyde Where in the world you arrive to those conclusions based on my answer? If anything my answer says that if OP wants to shoot itself in the foot we shouldn't provide a gun loaded so he can shoot us all!
    – Braiam
    Feb 14, 2017 at 10:59
  • 2
    Well, you wrtie "I do not answer a question and dissuade anyone from doing so if it is a known attack vector"... And going with gun metaphor, a properly loaded gun in the hands of the care-free foot-shooter is still safer, than letting them load it themselves and blow their head of instead of their foot, if they insist on shooting with it even after warnings.
    – hyde
    Feb 14, 2017 at 11:38
  • 1
    @hyde a guy ask you for a gun, so he can put a nail to the wall, would you provide a gun? Or you will tell him "a gun is a bad tool to do that because <reasons>, use a hammer instead this way"? Which of the two is preferable?
    – Braiam
    Feb 14, 2017 at 11:46
  • We can still say, we can do it with hammer choose gun if you wish to. Feb 14, 2017 at 13:25
  • @SanzeebAryal but at least give the gun unloaded and with the safety in place ;)
    – Braiam
    Feb 14, 2017 at 13:33
  • 1
    A more apt analogy would be that of someone asking how to use a hammer and nail to build something when it would really be better if they used a nail gun. The hammer is still going to work, but it will take a long time and there is more of a chance that you're going to hammer one of their fingers instead of a nail at some point. If they want to use a hammer, or don't have a cess to a nail gun, using a hammer is up to them, just explain why it's better to use a nail gun, then tell them how to use the hammer.
    – user4639281
    Feb 14, 2017 at 15:53
  • @TinyGiant that analogy misses the point: there isn't danger in doing it either way. In the example OP uses, there's a very palpable danger that something goes seriously wrong! That's why gun/pistol/ak-47, something that in many situations can cause harm to others and yourself when used in situations that isn't needed should be mentioned, the danger involving the tool has to assessed.
    – Braiam
    Feb 14, 2017 at 16:00
  • 1
    There is definitely a danger in breaking your fingers if you hit one of them instead of the nail. That danger would be assessed in the analogy I offered, and there is no correlation between a hammer and nail and an ak47
    – user4639281
    Feb 14, 2017 at 16:20
  • 1
    Again, using a gun has nothing to do with using a hammer, not even in the same castle unless the gun is a nail gun. What if the asker does not have access to bcrypt and can only utilize md5? Would you deny them an answer and in turn force them to break all of their fingers because you couldn't be bothered to tell them that they should probably use pliers to hold the nail?
    – user4639281
    Feb 14, 2017 at 22:01
  • 1
    You're wrong because a gun can't reliably put a nail in the wall. I mean, you could put a nail in the gun, and it could propel the nail through the wall, but you're not going to end up with a nail in a wall. You can use md5 to hash a password though, and if you don't have access to bcrypt then it is a perfectly viable alternative. There are some downfalls and security concerns associated with this, but you will end up with a hashed password. Just like using a hammer and nail instead of a nail gun. It would be much better to use a nail gun, but a hammer also works.
    – user4639281
    Feb 15, 2017 at 0:15
  • 1
    You're trying to compare apples to oranges, and that is an unfair comparison which makes no sense.
    – user4639281
    Feb 15, 2017 at 0:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .