Answers

Keeping it safe

The small number of mistakes behind most breaches, and the handful of habits that prevent them.

1. How does text I saved in a comment end up running as JavaScript in someone else's browser?The comment stayed text in storage; a page that later pasted it into its own markup made the browser read it as code.
2. Why does escaping the quotes in user input not stop SQL injection?Escaping quotes only cleans one context; SQL injection stops only when query text and values travel separately, so the value is never parsed as code.
3. Why isn't encrypting the password enough to keep it safe if the database leaks?Because encryption can be undone by your own login code, so the key that lets you check a password usually sits near the database, and anyone who copies both can read every password.
4. How do I stop one service from reading another service's password?Give every service its own identity, grant only the credentials it uses, and test that it cannot read another service's password.
5. Is it actually OK to look at a risk and decide not to fix it?Yes, if the decision not to fix it is written down with a reason, a named owner and a date or trigger for looking again; otherwise it is just an oversight.
6. Why does storing a random salt with each hash stop rainbow tables?Because the salt is different for every account, a table built once from common passwords matches at most one row, so the work has to be redone account by account.
7. Isn't threat modelling just brainstorming what could go wrong?No. It is a fixed checklist of six questions asked at every boundary, which gives a list with a known shape and a record of what was examined.
8. Are environment variables safe for storing passwords?No: environment variables are convenient, but they are inherited by child processes, visible to process inspection and crash reports, and no record is kept when a password is read from them.
9. Is a TLS certificate itself a secret?No. The certificate is public and is sent to every client that connects. The private key kept beside it is the secret, and it is one of the highest value credentials you hold.
10. How do I pick the iteration count or cost factor for password hashing?Pick a time budget for one login, measure what setting meets it on your own hardware under load, and store that setting in each stored record.
11. How fast can an attacker guess passwords after stealing a hash database?About ten thousand million guesses a second on one rented graphics card against a fast hash, so most of a stolen table falls in under a second.

The other subjects