Security - Revision history

Rudxain: link deceptive lang

2026-05-24T18:03:47Z

link deceptive lang

← Older revision		Revision as of 18:03, 24 May 2026
Line 10:		Line 10:

	==How security relates to consumer rights==		==How security relates to consumer rights==
	Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse consider that "the emperor may not have any clothes" and their security is not as strong as they portray it. {{Citation needed\|reason=needs verifiability}}		Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use [[Deceptive language frequently used against consumers#"For the safety of the consumer"\|security as an excuse]] to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse consider that "the emperor may not have any clothes" and their security is not as strong as they portray it. {{Citation needed\|reason=needs verifiability}}

	===Poor security principals harm the consumer===		===Poor security principals harm the consumer===
Line 36:		Line 36:
	==Further reading==		==Further reading==

	* [[End-user license agreement]]		*[[End-user license agreement]]
	* [[Terms of service]]		*[[Terms of service]]
	* [[Right to own]]		*[[Right to own]]
	* [[Internet of Things]]		*[[Internet of Things]]

	==References==		==References==

Bananabot: Added archive URLs for 2 citation(s) using CRWCitationBot

2026-02-23T07:37:45Z

Added archive URLs for 2 citation(s) using CRWCitationBot

← Older revision		Revision as of 07:37, 23 February 2026
Line 4:		Line 4:
	A security vulnerability is any function of a product that allows an unauthorized agent is able to gain some level of control over the product, its information, or the product's environment. Vulnerability severity can range depending on how much access an unauthorized agent is granted. To further understand vulnerabilities it is useful to list some real examples:		A security vulnerability is any function of a product that allows an unauthorized agent is able to gain some level of control over the product, its information, or the product's environment. Vulnerability severity can range depending on how much access an unauthorized agent is granted. To further understand vulnerabilities it is useful to list some real examples:

	#The apache log4j exploit<ref>[https://www.ibm.com/think/topics/log4j "What is the Log4j vulnerability?"] - ibm.com - accessed 1/22/2025</ref> where a malicious user could remotely execute code (known as an RCE Attack) by feeding the logger malicious data which causes it to download and execute malicious code. This vulnerability could compromise the security of nearly any system running applications with older versions of log4j. The impact of the log4j exploit could have been massive due to its status as a Java library, meaning that many programs use it solely for the purpose of logging information causing log4j to have massive reach.		#The apache log4j exploit<ref>[https://www.ibm.com/think/topics/log4j "What is the Log4j vulnerability?"] - ibm.com - accessed 1/22/2025 ([http://web.archive.org/web/20260113232610/https://www.ibm.com/think/topics/log4j Archived])</ref> where a malicious user could remotely execute code (known as an RCE Attack) by feeding the logger malicious data which causes it to download and execute malicious code. This vulnerability could compromise the security of nearly any system running applications with older versions of log4j. The impact of the log4j exploit could have been massive due to its status as a Java library, meaning that many programs use it solely for the purpose of logging information causing log4j to have massive reach.
	#The NoFly.csv leak where the majority if not the entirety of the US No Fly list was exposed on an unsecured server.<ref>[https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ "EXCLUSIVE: U.S. airline accidentally exposes ‘No Fly List’ on unsecured server"] - dailydot.com - accessed 1/22/2025</ref> Similar data leaks have and can occur containing more sensitive user information: emails, passwords, real names, social security numbers (SSN), etc.		#The NoFly.csv leak where the majority if not the entirety of the US No Fly list was exposed on an unsecured server.<ref>[https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ "EXCLUSIVE: U.S. airline accidentally exposes ‘No Fly List’ on unsecured server"] - dailydot.com - accessed 1/22/2025 ([http://web.archive.org/web/20250602100136/https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ Archived])</ref> Similar data leaks have and can occur containing more sensitive user information: emails, passwords, real names, social security numbers (SSN), etc.

	Security vulnerabilities primarily show up in software products but they can also exist in real life. Home security often depends upon locks which are themselves physical security implementations that prevent intruders from entering but this does not stop someone from just smashing the window: a physical security vulnerability		Security vulnerabilities primarily show up in software products but they can also exist in real life. Home security often depends upon locks which are themselves physical security implementations that prevent intruders from entering but this does not stop someone from just smashing the window: a physical security vulnerability

Drakeula: /* Further reading */

2025-10-11T16:20:31Z

Drakeula: wikilinks - authorization

2025-10-11T15:57:20Z

wikilinks - authorization

← Older revision		Revision as of 15:57, 11 October 2025
Line 21:		Line 21:

	====Security through authorization====		====Security through authorization====
			{{main\|Authorization}}

	Authorization is the process of confirming that a user is who they say they are. Authorization processes are extremely important to the functioning of the internet but risk becoming a security vulnerability and threat to consumer rights if used improperly. Authorization features can be used by companies to lock out features when the user's subscription expires, in this case the purpose of authorization is lost because the user need not confirm who they are, just that they have a valid subscription. These sorts of lock-outs are significant in that the product's physical features still work but the company is intentionally preventing the user from accessing them because their internet-based subscription has ended.		Authorization is the process of confirming that a user is who they say they are. Authorization processes are extremely important to the functioning of the internet but risk becoming a security vulnerability and threat to consumer rights if used improperly. Authorization features can be used by companies to lock out features when the user's subscription expires, in this case the purpose of authorization is lost because the user need not confirm who they are, just that they have a valid subscription. These sorts of lock-outs are significant in that the product's physical features still work but the company is intentionally preventing the user from accessing them because their internet-based subscription has ended.

Line 31:		Line 33:
	#Avoid using physical products that need a subscription to use. For example, a normal treadmill won't brick itself if the company goes out of business, or decides to [[Peloton Removes Just Run Feature\|eliminate a subscription free feature]] in the name of safety or security.		#Avoid using physical products that need a subscription to use. For example, a normal treadmill won't brick itself if the company goes out of business, or decides to [[Peloton Removes Just Run Feature\|eliminate a subscription free feature]] in the name of safety or security.
	#Avoid using closed-source products if equivalent open-source products exist. Open source products are not necessarily more secure, but they are far less likely to violate a consumer's rights simply because the consumer has the ability to change the product as they wish.		#Avoid using closed-source products if equivalent open-source products exist. Open source products are not necessarily more secure, but they are far less likely to violate a consumer's rights simply because the consumer has the ability to change the product as they wish.

			==Further reading==

	==References==		==References==
	<references />		<references />

	[[Category:Common terms]]		[[Category:Common terms]]
	[[Category:Articles in need of additional work]]		[[Category:Articles in need of additional work]]

Drakeula: /* Security through obscurity */ main link

2025-10-11T15:52:28Z

Security through obscurity: main link

← Older revision		Revision as of 15:52, 11 October 2025
Line 16:		Line 16:

	====Security through obscurity====		====Security through obscurity====
	[[Security through obscurity\|Obscuring]], or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities{{Citation needed\|reason=needs verifiability}} it can never stop them{{Citation needed\|reason=Who?}}, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]]. {{Citation needed\|reason=needs verifiability}}		{{main\|Security through obscurity}}

			Obscuring, or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities{{Citation needed\|reason=needs verifiability}} it can never stop them{{Citation needed\|reason=Who?}}, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]]. {{Citation needed\|reason=needs verifiability}}

	====Security through authorization====		====Security through authorization====

Sojourna: /* How to avoid losing rights in the name of "security" */

2025-06-14T22:22:37Z

How to avoid losing rights in the name of "security"

← Older revision		Revision as of 22:22, 14 June 2025
Line 26:		Line 26:

	#Avoid using physical and software products that needlessly require connection to the internet. Your fridge does not need to be "smart". Choosing to use a smart appliance opens the door for companies to take away your rights as well as open you to security vulnerabilities.		#Avoid using physical and software products that needlessly require connection to the internet. Your fridge does not need to be "smart". Choosing to use a smart appliance opens the door for companies to take away your rights as well as open you to security vulnerabilities.
	#Avoid using physical products that require a proprietary app to use. While the product itself may not connect directly to the internet, your internet device now serves as a bridge to it. This opens the door for companies to take away your rights via the app. In addition the app itself may have security vulnerabilities of its own.		#Avoid using physical products that require a proprietary app to use. While the product itself may not connect directly to the internet, your internet device now serves as a bridge to it. This opens the door for companies to take away your rights via the app. In addition, the app itself may have security vulnerabilities of its own.
	#Avoid using physical products that need a subscription to use, a normal treadmill won't brick itself if the company goes out of business, or decides to [[Peloton Removes Just Run Feature\|eliminate a subscription free feature]] in the name of safety or security.		#Avoid using physical products that need a subscription to use. For example, a normal treadmill won't brick itself if the company goes out of business, or decides to [[Peloton Removes Just Run Feature\|eliminate a subscription free feature]] in the name of safety or security.
	#Avoid using closed-source products if equivalent open-source products exist. Open source products are not necessarily more secure, but they are far less likely to violate a consumer's rights simply because the consumer has the ability to change the product as they wish.		#Avoid using closed-source products if equivalent open-source products exist. Open source products are not necessarily more secure, but they are far less likely to violate a consumer's rights simply because the consumer has the ability to change the product as they wish.

ADRdaniel: /* How security relates to consumer rights */ added annotations citation need

2025-01-24T23:12:17Z

How security relates to consumer rights: added annotations citation need

← Older revision		Revision as of 23:12, 24 January 2025
Line 10:		Line 10:

	==How security relates to consumer rights==		==How security relates to consumer rights==
	Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse consider that "the emperor may not have any clothes" and their security is not as strong as they portray it.		Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse consider that "the emperor may not have any clothes" and their security is not as strong as they portray it. {{Citation needed\|reason=needs verifiability}}

	===Poor security principals harm the consumer===		===Poor security principals harm the consumer===
Line 16:		Line 16:

	====Security through obscurity====		====Security through obscurity====
	[[Security through obscurity\|Obscuring]], or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities it can never stop them, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]].		[[Security through obscurity\|Obscuring]], or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities{{Citation needed\|reason=needs verifiability}} it can never stop them{{Citation needed\|reason=Who?}}, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]]. {{Citation needed\|reason=needs verifiability}}

	====Security through authorization====		====Security through authorization====

Jack Andersen: /* How security relates to consumer rights */ Tweaked one sentence.

2025-01-23T22:02:16Z

How security relates to consumer rights: Tweaked one sentence.

← Older revision		Revision as of 22:02, 23 January 2025
Line 10:		Line 10:

	==How security relates to consumer rights==		==How security relates to consumer rights==
	Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse the emperor may not have any clothes ~~to begin with~~.		Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse consider that "the emperor may not have any clothes" and their security is not as strong as they portray it.

	===Poor security principals harm the consumer===		===Poor security principals harm the consumer===

Mingyee: Fixed link

2025-01-23T12:40:50Z

Fixed link

← Older revision		Revision as of 12:40, 23 January 2025
Line 15:		Line 15:
	A large number of security incidents are caused because the producer of a product has a general misunderstanding of what security is and how to produce secure products. In addition a misunderstanding of the purpose of security can induce companies to take actions capable of harming consumer rights.		A large number of security incidents are caused because the producer of a product has a general misunderstanding of what security is and how to produce secure products. In addition a misunderstanding of the purpose of security can induce companies to take actions capable of harming consumer rights.

	====~~[[Security Through Obscurity\|~~Security through obscurity]]====		====Security through obscurity====
	Obscuring, or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities it can never stop them, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]].		[[Security through obscurity\|Obscuring]], or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities it can never stop them, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]].

	====Security through authorization====		====Security through authorization====

Mingyee at 12:37, 23 January 2025

2025-01-23T12:37:58Z

← Older revision		Revision as of 12:37, 23 January 2025
Line 1:		Line 1:
	Security is an engineering principal whereby the risk of an unauthorized malicious agent gaining control of a product, its information, or its environment is minimized. Security of programs and physical products is critical to consumer protection.		'''Security''' is an engineering principal whereby the risk of an unauthorized malicious agent gaining control of a product, its information, or its environment is minimized. Security of programs and physical products is critical to consumer protection.

	==Security vulnerabilities==		==Security vulnerabilities==
Line 12:		Line 12:
	Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse the emperor may not have any clothes to begin with.		Security is both a blessing and a curse towards control over the things consumers own. Being forced to login to a laptop to use it is a sensible decision, being forced to connect your treadmill to the internet and gain authorization just to run on it (as seen [[Peloton Removes Just Run Feature\|here]]) is not. Companies may use security as an excuse to reduce consumer control and so it is important to identify these misuses. If a company takes away consumer rights using security as an excuse the emperor may not have any clothes to begin with.

	=== Poor security principals harm the consumer ===		===Poor security principals harm the consumer===
	A large number of security incidents are caused because the producer of a product has a general misunderstanding of what security is and how to produce secure products. In addition a misunderstanding of the purpose of security can induce companies to take actions capable of harming consumer rights.		A large number of security incidents are caused because the producer of a product has a general misunderstanding of what security is and how to produce secure products. In addition a misunderstanding of the purpose of security can induce companies to take actions capable of harming consumer rights.

	==== [[Security Through Obscurity\|Security through obscurity]] ====		====[[Security Through Obscurity\|Security through obscurity]]====
	Obscuring, or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities it can never stop them, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]].		Obscuring, or hiding, a product's information increases the time a person or organization would need to take to fully understand how a product works. While this will delay the discovery of security vulnerabilities it can never stop them, in addition obscuring product information prevents maintenance of products by the consumer, violating their [[Right to Repair\|right to repair]].

	==== Security through authorization ====		====Security through authorization====
	Authorization is the process of confirming that a user is who they say they are. Authorization processes are extremely important to the functioning of the internet but risk becoming a security vulnerability and threat to consumer rights if used improperly. Authorization features can be used by companies to lock out features when the user's subscription expires, in this case the purpose of authorization is lost because the user need not confirm who they are, just that they have a valid subscription. These sorts of lock-outs are significant in that the product's physical features still work but the company is intentionally preventing the user from accessing them because their internet-based subscription has ended.		Authorization is the process of confirming that a user is who they say they are. Authorization processes are extremely important to the functioning of the internet but risk becoming a security vulnerability and threat to consumer rights if used improperly. Authorization features can be used by companies to lock out features when the user's subscription expires, in this case the purpose of authorization is lost because the user need not confirm who they are, just that they have a valid subscription. These sorts of lock-outs are significant in that the product's physical features still work but the company is intentionally preventing the user from accessing them because their internet-based subscription has ended.

← Older revision		Revision as of 16:20, 11 October 2025
Line 4:		Line 4:
	A security vulnerability is any function of a product that allows an unauthorized agent is able to gain some level of control over the product, its information, or the product's environment. Vulnerability severity can range depending on how much access an unauthorized agent is granted. To further understand vulnerabilities it is useful to list some real examples:		A security vulnerability is any function of a product that allows an unauthorized agent is able to gain some level of control over the product, its information, or the product's environment. Vulnerability severity can range depending on how much access an unauthorized agent is granted. To further understand vulnerabilities it is useful to list some real examples:

	#The apache log4j exploit<ref>[https://www.ibm.com/think/topics/log4j "What is the Log4j vulnerability?"] - ibm.com - accessed 1/22/2025</ref> where a malicious user could remotely execute code (known as an ~~[[RCE attack\|~~RCE Attack]]) by feeding the logger malicious data which causes it to download and execute malicious code. This vulnerability could compromise the security of nearly any system running applications with older versions of log4j. The impact of the log4j exploit could have been massive due to its status as a Java library, meaning that many programs use it solely for the purpose of logging information causing log4j to have massive reach.		#The apache log4j exploit<ref>[https://www.ibm.com/think/topics/log4j "What is the Log4j vulnerability?"] - ibm.com - accessed 1/22/2025</ref> where a malicious user could remotely execute code (known as an RCE Attack) by feeding the logger malicious data which causes it to download and execute malicious code. This vulnerability could compromise the security of nearly any system running applications with older versions of log4j. The impact of the log4j exploit could have been massive due to its status as a Java library, meaning that many programs use it solely for the purpose of logging information causing log4j to have massive reach.
	#The NoFly.csv leak where the majority if not the entirety of the US No Fly list was exposed on an unsecured server.<ref>[https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ "EXCLUSIVE: U.S. airline accidentally exposes ‘No Fly List’ on unsecured server"] - dailydot.com - accessed 1/22/2025</ref> Similar data leaks have and can occur containing more sensitive user information: emails, passwords, real names, ~~SSNs~~, etc.		#The NoFly.csv leak where the majority if not the entirety of the US No Fly list was exposed on an unsecured server.<ref>[https://www.dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair/ "EXCLUSIVE: U.S. airline accidentally exposes ‘No Fly List’ on unsecured server"] - dailydot.com - accessed 1/22/2025</ref> Similar data leaks have and can occur containing more sensitive user information: emails, passwords, real names, social security numbers (SSN), etc.

	Security vulnerabilities primarily show up in software products but they can also exist in real life. Home security often depends upon locks which are themselves physical security implementations that prevent intruders from entering but this does not stop someone from just smashing the window: a physical security vulnerability		Security vulnerabilities primarily show up in software products but they can also exist in real life. Home security often depends upon locks which are themselves physical security implementations that prevent intruders from entering but this does not stop someone from just smashing the window: a physical security vulnerability
Line 35:		Line 35:

	==Further reading==		==Further reading==

			* [[End-user license agreement]]
			* [[Terms of service]]
			* [[Right to own]]
			* [[Internet of Things]]

	==References==		==References==