Anonymous speaks: the inside story of the HBGary hack • Hacker News Board

Re: Anonymous speaks: the inside story of the HBGary hack

#81

Post by stcredzero » Thu, Feb 17, 2011, 2:17 PM UTC

t3chg1rl wrote: post #80

stcredzero wrote: post #70

Earlier quoted context omitted.

I don't mean to shatter your dream of how security firms are run, but on the whole, I'd bet we're no better than the industry at large. If it's ever possible for me to hire a security firm that has higher standards than this, I'm going to do that!

I agree with stcredzero. You need some standards if you're going to put yourself out there as a security company. I'm a random chick with some web programming and I know that you should iterative hash or salt your hashes. I also know you shouldn't use the same passwords, and what sql injections attacks are. Hey, maybe I should start a security company!

It's more of an issue with, "do they practice what they preach?" "Do they eat their own cooking?"

When people at a company don't do this, it's often a symptom. A friend of my girlfriend worked at an AT&T store. She could've gotten a huge discount on AT&T mobile? Her answer: no thanks.

Re: Anonymous speaks: the inside story of the HBGary hack

#82

Post by stcredzero » Thu, Feb 17, 2011, 2:22 PM UTC

timwiseman wrote: post #72

pyre wrote: post #34

Earlier quoted context omitted.

The 'real' story is that HBGary charges that big bucks to tell other companies and/or government agencies about how they aren't following security best practices, yet they themselves weren't doing so. I don't think that anyone would be ragging on HBGary for lax security if Anonymous had pulled out some 0day kernel exploit to break into HBGary's systems. They failed in: - Keeping their systems patched and up-to-date.…

- Convincing/forcing their users to use separate passwords per system. I have to disagree that this one is really a best practice at all. I have dozens of different accounts on different computer systems, if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. With that said, I absolutely think passwords on critical systems must be…

if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible.

There are a variety of good password vault programs out there. I keep my passwords in a KeePass 1 file on Dropbox. I can run Keepass on Windows, Linux, OS X, and my iPhone and iPad. There are a variety of low-cost and free options that are about this good or better.

Sometime, I'll be working on a Keepass compatible iPhone program that can access Dropbox directly.

Re: Anonymous speaks: the inside story of the HBGary hack

#83

Post by count » Thu, Feb 17, 2011, 3:20 PM UTC

Sandman wrote: post #42

gaius wrote: post #32

Earlier quoted context omitted.

That's not a technical problem tho', it's social/organizational. If you make passwords too complex and change too often and enforce it in software, you simply encourage people to write them down, save them in the browser, etc. Or people will be phoning the helpdesk every day to get a reset, and security as a whole will be discredited as a waste of time. NOTE: I'm not saying that it is a waste of time, but the best po…

Your last paragraph actually has a very good point - why do companies insist on changing the employee passwords every month? Chances are, if somebody got hold of your password, he/she is not going to wait a month before using that knowledge, right? So, really, I'm curious as to why most companies have this policy.

Passwords historically got weaker over time, but not in the sense that 'if he got your password hes not going to wait to use it'. They weaken in their hashed form. It used to be (still is, really) trivial to score the passwd file of a system, and get all the hashes of passwords, but no plaintext.

By changing passwords every N months, you eliminated the ability of someone to crack the hashes and obtain a cleartext password where they previously only had a hash.

That time window has gotten absurdly short, however...and with Pass the Hash and MITM, I don't even need your password anymore :(

Re: Anonymous speaks: the inside story of the HBGary hack

#84

Post by timwiseman » Thu, Feb 17, 2011, 5:20 PM UTC

sigil wrote: post #77

timwiseman wrote: post #72

Earlier quoted context omitted.

- Convincing/forcing their users to use separate passwords per system. I have to disagree that this one is really a best practice at all. I have dozens of different accounts on different computer systems, if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. With that said, I absolutely think passwords on critical systems must be…

> I have to disagree that this one is really a best practice at all. I have dozens of different accounts on different computer systems, if I didn't do at least some password reuse I would have a hard time writing them all down, and remembering them would be totally impossible. Yes, it's a pain in the ass (at present), but yes, you should be using different passwords for everything, and pubkey authentication where pos…

You make good points and I think I may have to work more on using more distinct passwords.

Though, as you alude, this will become easier as keyring managers mature. I am also hoping that as security technology matures more places will move to forms for two factor authentication.