How to approach sensitive "data security" relevant questions?

Question

I personally like questions about data recovery, post mortem analyses and generally pushing some security limits (e.g. to access personal data, crack/circumvent forgotten passphrases, retrieving data from half broken devices and so on). It had many (good!) uses for me and some of my friends in the past.

The general information on how to do X is neutral, however it cannot be guaranteed that it is used with benign intentions only. To boot, all information is freely accessible here too so benign ambitions of the OP or not, there'll be readers that will misuse it eventually.

Should these questions be answered and how? What in case the intentions are unclear? It's somewhat like the old discussion about full-disclosure or not.

Answer 1

Full-disclosure. Just answer the question if you can. If you are unsure about the intentions, then it's still a valid question. If you encounter a question of the "How can steal someones address book from a locked Android device?" flag it for moderation.

We are here to provide valuable and good quality Questions and Answers. The example is a valid question. I would not bother to question the intention if it can be seen as valid question.

Answer 2

The interesting thing is how many questions of this kind are asked by first-timers (feels like 95% up). It's rarely one with rep coming up with such a question. Next interesting fact is how often the OP shows up afterwards: I'd say 80% up do never show up again, 10% just on the very first day to prove their point and destroy doubts, if possible. Which makes it quite suspicious.

Don't take me wrong: The information is freely available if you know the sources, you don't even have to identify yourself to get it. That's why I'd say "big fish" never turns up like that ("big fish" not only knows where the food is, but also "how to get the crab out of its shell"). So what's left must be either "small fish" (those who just "found" a single device -- which is not worth the big research and maybe little to big monetary investment), and people of "legitimate interest".

Not being interested in the former, this leaves the latter. Who are they? People like t0mm13b, who are simply technically interested, or willing to help "friends in need" (i.e. people they know). These usually already have a higher rep -- and I see no reason to hide things from them. But then there's the last remaining group: those without any rep, who just f***ed off their device (in this case -- call me bad -- it's a good point to start learning not to fiddle with things you don't understand -- or to be more careful with your sensitive stuff, sorry), or in fact had "bad stuff happening" (the brothers little daughter playing with the... how did she get her hands on it?).

So my opinion on this: I go with t0mm13b. If technically possible, real sensitive stuff should require a certain rep (at least 1,000+). Everybody below that level could still get the "obvious legitimate solutions", such as to specify their Google credentials on a messed-up pattern lock, or see their local Rabbi¹... oops, service technician. If it's really your device, you have the papers to prove -- and the solution to your problem is reached faster when taking those papers and looking up a service point (you can return successfully just within minutes) but to prove the legitimacy to "us".

If it's really a legitimate thing, (s)he will do so. For a petty thief, even this little effort will be too much -- and if it requires more afford, (s)he probably doesn't find it as worth the next time.

¹SYLOR is the term for getting sensitive information on e.g. our judaism stack (See Your Local Orthodox Rabbi. Meaning: This is real sensitive (and maybe personal) stuff which should be explained by an expert face-to-face: He can identify you and tell you what you really should know -- as opposed to what you say you need to know -- guess you get my point.

Answer 3

I'd like to add this thought, as per the linky in the above comment, I did think the question was rogue, but who am I to judge?!

I could be very well wrong on that type of question asked, and my thinking was "Was that a very deceptive social-engineering ploy to extract information?" but I digress.

Obviously, the line needs to be drawn, perhaps, by limiting the answer to those type of questions with a certain reputation level maybe? i.e. if the question posed, is of a nature where it elicits an answer that involves a form of hacking or exploiting the handset, whether benign intentions or unintentional (as in "Whoops I fouled up and now I cannot get into my handset"), a reputation of say 5,000 can view the answer as a result of gaining that level of trust by the community!

But on the other hand, if an answer is posted for all to see, it WILL be abused and misused for whatever exploitation techniques regardlessly for whatever reasons that would be outside of the domain of the community.

That question, meanwhile was bizarre to say the least! But refrained from answering publicly in case it turns out to be false, i.e. Was it a stolen handset and that the OP was trying to extract data from it but then again, the OP did dodge it by back-tracking over the gmail and switched tactics about yahoo mail hence the comments in the said question.