Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I read the federal government’s Zero-Trust Memo so you don’t have to

bastionzero.com

Post reply on HN
Print view View original

291–300 of 369 posts

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#291

Post by floatboth »

ryukafalz wrote: post #150
dathinab wrote: post #135

Earlier quoted context omitted.

Well, the fact that I can't do credit card payments for some banks if I don't have an iphone or non rooted, google android phone is a problem which already exists. Worse supposedly this is for security, but attackers which pulled of a privilege escalation tend to have enough ways to make sure that non of this detection finds them. In the end it just makes sure you can't mess with your own credit card 2FA process by n…

This should be obvious from your comment but I think it's worth calling something out explicitly here: a bank that does that is mandating that you accept either Apple's or Google's terms of service. That's a lot of power to give to two huge companies. I think we'd do well to provide the option to use open protocols when possible, to avoid further entrenching the Apple/Google duopoly.

What bank doesn't have a regular web app?

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#292

Post by pas »

pishpash wrote: post #169
Signez wrote: post #36

Earlier quoted context omitted.

Let's note that this very concerning problem is only one if organizations take an allowlist approach to this "context aware authorization" requirement. Detecting changes — and enforcing escalation in that case — can be enough, e.g. "You always uses Safari on macOS to connect to this restricted service, but now you are using Edge on Windows? Weird. Let's send an email to a relevant person / ask for a MFA confirmation…

Who gets to decide what changes are kosher? Sounds like bureaucratic behavior modeling.

The cheapest vendor that was selected, obviously.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#293

Post by d110af5ccf »

darkwater wrote: post #289
kortilla wrote: post #272

Earlier quoted context omitted.

> What's the use case there, everyone sharing a Google account? Yes. Everyone having their own distinct accounts is a property of high computer literacy in the family. Many of my older extended family members have a single email account shared by a husband and wife. Or in one case the way to email my aunt is to send an email to an account operated by a daughter in a different town. Aunt and daughter are both signed i…

> Many of my older extended family members have a single email account shared by a husband and wife. Or in one case the way to email my aunt is to send an email to an account operated by a daughter in a different town. Aunt and daughter are both signed in so the daughter can help with attachments or “emails that go missing”, etc. As usual with the "personas" scenarios, people creates their unrealistic scenario (just…

This is amazing. He just spelled out for you in great detail the sort of problems that arise in practice in the real world every day and you dismissed them out of hand as being unrealistic. I think you are far more sheltered and far less experienced than you realize. This sort of attitude is exactly what leads to these sorts of things becoming problems in the first place!

> They will just print it (or have someone print it for them) beforehand.

Yes, they will do that precisely because they do not trust technology to work for them because it frequently does not! I have family members like this. I log in to their accounts on my devices for various reasons. Even worse, I run Linux. We run in to these problems frequently. Spend time helping technically illiterate people with things. While doing so, make a concerted effort to understand why they say or think some of the things that they do.

Edit to add, I find it amusing that you make fun of his seaman example. Almost that exact scenario (in terms of number of devices, shared devices, and locations) is currently the case for two of my relatives. Two! And yet you ridicule it.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#294

Post by Hikikomori »

AaronFriel wrote: post #269
solatic wrote: post #128

Meh. OMB also mandated moving to IPv6 more than a decade ago: https://www.cio.gov/assets/resources/internet-protocol-versi... Nobody cares. It just gets postponed forever.

The memo you're linking to was recently updated and did have force. The DOD, one of the largest federal agencies, issued its own memo with similar deadlines, and this & others have had the result of jumpstarting IPv6 / dual stack support for all of the major clouds & Kubernetes. If FedRAMP qualification is tied to IPv6 support, you'll see every major contractor and cloud provider support it promptly. If you look at t…

Yeah AWS has added a lot of ipv6 support recently, like ipv6 only subnets so you can actually benefit from using ipv6. Waiting for rds support though.

Azure is so far behind on this it's silly.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#295

Post by duckmysick »

floatboth wrote: post #291
ryukafalz wrote: post #150

Earlier quoted context omitted.

This should be obvious from your comment but I think it's worth calling something out explicitly here: a bank that does that is mandating that you accept either Apple's or Google's terms of service. That's a lot of power to give to two huge companies. I think we'd do well to provide the option to use open protocols when possible, to avoid further entrenching the Apple/Google duopoly.

What bank doesn't have a regular web app?

In the future banks may start accepting connections only from a handful of approved browsers. Similarly to how 4k steaming on Netflix is not available on all browsers.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#297

Post by tallanvor »

adreamingsoul wrote: post #16

Here in Norway we have BankID which uses MFA. To access any government, banking, or official system you have to authenticate with your BankID. Its simple amazing.

The problem with BankID is that for older accounts, there's no real guarantee you are who you claim to be.

I mean, sure, my bank in Norway has my account tied to a person number, but they don't actually know that when I log in with bankid that I really am the person associated with that person number. --Theoretically the post office was supposed to verify my identity before they gave me the packet containing the code brick, but they forgot to do so - this was over 10 years ago before they had to register the ID details.

So basically I have a highly trusted way of authenticating to financial and government services in Norway even though nobody actually knows that I am who I claimed to be when I opened the bank account, setup bankid, etc.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#298

Post by tialaramex »

Godel_unicode wrote: post #152
sodality2 wrote: post #112

Earlier quoted context omitted.

My OpenSK chip begs to differ. https://github.com/google/OpenSK

The disclaimer on the linked page agrees with me. "This project is proof-of-concept and a research platform. It is NOT meant for a daily usage. The cryptography implementations are not resistent against side-channel attacks."

There are a lot of other providers in this space, Yubico are the best known and probably one of the more competent offerings, but this is not a situation where the government is picking a winner by picking a standard.

A bunch of situations aren't going to end up with a separate physical authenticator anyway, they'll do WebAuthn, which in principle could be a Yubico Security Key or any of a dozen competitor products - but actually it's the contractor's iPhone, which can do the exact same trick. Or maybe it's a Pixel, or whatever the high-end Samsung phone is today.

That's what standardisation gets us. If CoolPhone Co. build a phone that actually uses a retina scan to unlock, they can do WebAuthn and deliver that security to your systems without you even touching your software. And yes, in the Hollywood movie version the tricky part is the synthetic eyeball so as to trick the retina scanner, but in the real world the problem is after you steal the ambassador's CoolPhone she can't play Wordle and she reports the problem to IT before you can conduct your break-in, synthetic eyeball or not.

Re: I read the federal government’s Zero-Trust Memo so you don’t have to

#300

Post by tialaramex »

mormegil wrote: post #271
tialaramex wrote: post #224

Earlier quoted context omitted.

If banks were actually onboard with this stuff, I'm pretty sure you can either make this happen in FIDO2 anyway, or you could add a FIDO extension that does it and get big vendors like Yubico to support that extension. Notice that off-line authenticating a Windows 10 PC relies on hmac-secret in FIDO, which is not a core FIDO feature, but it got ratified because there's a use for it, and a Yubikey can do hmac-secret.…

I think the FIDO Alliance is already discussing solutions to these use cases. (And also this is a bit circular reasoning, isn’t it? “Why don’t you use the XYZ standard? Because it does not support our use case. So why don’t you cooperate on adding support to the standard? Why? So that you can use the XYZ standard!”) Also, I think there already are extensions supporting some basic forms of this, however, they are not…

Which requirement of PSD2 do you think is so stringent?

I have three bank accounts here:

One of them (my good bank) has a chiclet keypad physical authenticator which needs these manual codes entering to get a value back that proves I used the authenticator.

The large European bank that handles my salary and so on, relies on SMS entirely, I ask to perform a transaction, they send an SMS with a code, I type it into a box on the web site. The SMS is trying to tell me what that transaction is, and has improved (it used to say things like GBP20000 which, yes everybody on Hacker News knows what that means but I bet my grandmother wouldn't, today it says £20 000 which is easier to understand) but notice that the code you get isn't related to the transaction details, it's just an arbitrary code. So I needn't understand the transaction to copy-paste the code.

The third bank is owned by the British government and so is inherently safe with unlimited funds unlike a commercial bank (they can and do print money to fund withdrawals, they're the government) but they too use SMS and their SMS messages are... not good. Of course unlike a commercial bank if they get fined for not obeying security rules that's the government fining the government, who cares?

FIDO would be obviously better than the latter two, and I don't see any reason that (with some effort) it couldn't improve on the first one as well.

Post reply on HN