Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Great Cannon has been deployed again

cybersecurity.att.com

Post reply on HN
Print view View original

321–330 of 470 posts

Re: The Great Cannon has been deployed again

#321

Post by flattone »

DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

surprised the relevant powerful/time tested and highly technical participants at whichever appropriate layer of networking aren't just forcing https only. #studentquestion

Re: The Great Cannon has been deployed again

#322

Post by brentonator »

LeftHandPath wrote: post #313
DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The emai…

I'd recommend using an OpenID Connect provider to authenticate if you're concerned about their practices but it's just as easy to improperly implement auth even with mainstream libraries to help you connect something like Auth.0 to your app.

e.g. Don't assume the email address is owned by the person making the claim. You can sign up for an account with an email and if it's not verified or the verification is mis-clicked or phished into being clicked the original account owner would never know the difference.

Still, at least with OpenID Connect you know your password isn't sitting in plain text.

Re: The Great Cannon has been deployed again

#323

Post by SlowRobotAhead »

marcusverus wrote: post #136
SlowRobotAhead wrote: post #109

Earlier quoted context omitted.

Wait, didn’t that happen though? I thought the arch duke was originally supposed to be killed in a failed bombing, and the handgun was a second and happenstance scenario.

There was a royal procession to City Hall in Sarajevo, during which a grenade was thrown at the Archduke. It (barely) missed, they drove off, and had a meeting with some local magistrate. After the meeting, Franz wanted to travel to the hospital to visit the civilians who'd been wounded by the errant grenade. En route, his driver, confused, took the same route from the morning procession. When they realized what was…

Thought so, that (in much less detail) was my recollection. Thanks for that.

Re: The Great Cannon has been deployed again

#324

Post by earenndil »

jacquesm wrote: post #316
pwnguin wrote: post #265

Earlier quoted context omitted.

I'm not sure 'We have the technology to censor the internet, and it's okay to deploy it' is the message you want to give the CCP.

That's not censorship. https://en.wikipedia.org/wiki/Censorship The criminal co-opting of networks and nodes on those networks is not speech by any definition.

That's not the issue. The issue is that there is speech accompanying the malware, which should not be systematically censored. (Though any individual is free to do so for themselves.)

Re: The Great Cannon has been deployed again

#325

Post by w0m »

hombre_fatal wrote: post #111
MisterTea wrote: post #5

Earlier quoted context omitted.

This is a tiring example of why the web and all its technologies thoroughly suck. It's a boiling toilet fueled by greed.

This just seems like "web bad" naivety. Popular native apps could execute the same exact attack, except this time you wouldn't be able to simply open a browser's developer console to debug it.

They'd have to arbitrarily download and execute code from the internet w/ out any proper checks in place; not sure Vim does that by default...

Re: The Great Cannon has been deployed again

#326

Post by throw0101a »

randyrand wrote: post #308
DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I think China's government requires websites to give them their private keys. HTTPS is useless then.

Not with (perfect) forward security:

> In cryptography, forward secrecy (FS), also known as perfect forward secrecy (PFS), is a feature of specific key agreement protocols that gives assurances that session keys will not be compromised even if the private key of the server is compromised.[1] Forward secrecy protects past sessions against future compromises of secret keys.[2][3][3]

* https://en.wikipedia.org/wiki/Forward_secrecy

There's still the risk of MITM identity spoofing of course.

Re: The Great Cannon has been deployed again

#327

Post by turk73 »

randyrand wrote: post #308
DyslexicAtheist wrote: post #254

This should be mitigated by browser vendors by integrating HTTPSEverywhere as a core functionality of the browser that needs to be explicitly turned off (instead of the current state of affairs where we have a tiny minority on the web who are familiar with installing security add-ons). Visiting a HTTP site should come with a scary warning. I understand this throws old sites under the bus, but there could be other sol…

I think China's government requires websites to give them their private keys. HTTPS is useless then.

I suspect my company is MITM-ing SSL, so China is here Jack.

Re: The Great Cannon has been deployed again

#328

Post by logfromblammo »

jacquesm wrote: post #208
dmead wrote: post #205

Earlier quoted context omitted.

that's what they want. a bifurcation of the internet.

No they don't. They want to use it as a weapon against targets of their choosing and co-opt the rest of the net in doing so. The economic importance of the internet to China can not be overstated.

They want a semipermeable membrane that money can cross, but uncontrolled information can't.

Re: The Great Cannon has been deployed again

#329

Post by webXL »

chewbacha wrote: post #161
MR4D wrote: post #142

Earlier quoted context omitted.

War seems to progress as follows: 0 - Peace 1 - Trade War 2 - Financial War 3 - Electronic War 4 - Shooting War Note that 1 & 2 are different types of Economic war, and could be grouped together. The steps occur in order, but steps can be skipped. From a US-centric point of view, North Korea and Iran seem to be at #3. China & Russia are at a limited version of #2. Chinese/HK seem to be at #3 with each other.Given how…

I don't know who to attribute this to but I've heard a saying: "Countries that trade with each other don't make war with each other." As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.

"When goods don’t cross borders, Soldiers will." -unknown (often credited to Frederic Bastiat)

Here's what Otto Mallery said though:

"If soldiers are not to cross international boundaries, goods must do so. Unless the Shackles can be dropped from trade, bombs will be dropped from the sky."

https://fee.org/resources/if-goods-dont-cross-borders/

Re: The Great Cannon has been deployed again

#330

Post by hinkley »

nullc wrote: post #174

The web needs to start moving towards a strong same-origin policy for all embedded content-- require sites to proxy requests if they want third party content. The first step could be sending CORS preflight, then requiring it, then just not allowing cross origin to different domains (but allow sub-/sibling- domains).

About a month ago we were discussing this and a few of us came to the conclusion that an eventually-required CORS header for cross-origin GETs would be a good thing. CDNs and SSO services could start sending this header so they can stay in business when the browsers turn off all cross-origin requests by default.

Unfortunately (from my perspective) that'll do nothing to stop third party ad tracking but you can't have everything, I suppose.

Post reply on HN