41–50 of 102 posts
> Canadian internet of things (IoT) startup Tapplock learned the hard way why you should never knit your own cryptography If they wanted to knit their own cryptography, then cryptocurrency and ICO was their place to be.
Genuinely curious how people still manage to fuck up this kind of super basic secure coding practices
IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.
Genuinely curious how people still manage to fuck up this kind of super basic secure coding practices
Silicon Valley prefers teams to have epic backstories, not experience. A first-year dropout from MIT and a Thiel fellow are much more likely to get funded than an engineer with a state uni BSc+25 years industry experience plus a former sales manager in the same industry.
Genuinely curious how people still manage to fuck up this kind of super basic secure coding practices
IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.
> Web programmer? Don’t make account IDs easy to guess. In an otherwise secure system, account numbers that go 1,2,3… shouldn’t be a problem, but why make it easy? Is that the best advice to web programmers they can give based on this story? That's the "obscurity" part in the security by obscurity scheme. If you've got your security otherwise nailed down fine, some obscurity on the top doesn't hurt: security-in-depth…
> Your authentication state is not "logged in", it's "logged in as user X". So the code that decides whether a client can see a specific page can and should (!) depend on what specifically you're authenticated as. "the code that decides whether a client can see a specific page" should not care about authentication, this is authorization issue. I see these things conflated too often. Identification, Authentication and…
Utterly horrifying, but ultimately irrelevant. No lock of this size is meant to be anything other than inconvenient to open. Angle grinders are cheap, and more easily wielded than HTTP request crafting.
Consider using it for your gym-locker. The changing room is typically occupied by at least some people whenever the gym is open so if someone is pulling out a bolt-cutter or an angle grinder it would probably lead to someone notifying the gym-employees/police. Meanwhile someone who just walks up to the lock and seemingly opens it must be legit and goes unnoticed.
Genuinely curious how people still manage to fuck up this kind of super basic secure coding practices
IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.
Earlier quoted context omitted.
IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.
While true in many cases, in my experience it's not only the engineers. Unless you have the senior managers on board as well, they'll just lean on the engineers to "ship now".
IoT is electronics people coming into the software world and building software like it's the 90s.