The six dumbest ideas in computer security (2005) • Hacker News Board

Re: The six dumbest ideas in computer security (2005)

#71

Post by sand500 » Wed, Jan 25, 2023, 6:46 AM UTC

josephg wrote: post #24

msla wrote: post #12

> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…

> "We can't stop the occasional problem" - yes, you can. All those tools (checklists, redundancies, etc) exist to increase the reliability rate. And to stop the occasional problem (ground crew forgets to refuel plane) from turning into a disaster[1]. I might be overly generous, but thats my read of the author's intent. That just like in the airline industry, we have tools to stop occasional problems from turning into…

I wonder how well the swiss cheese model works when there is an adversary actively targeting you as opposed to accidental disasters.

Re: The six dumbest ideas in computer security (2005)

#72

Post by adql » Wed, Jan 25, 2023, 6:47 AM UTC

msla wrote: post #12

> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…

Aviation industry mostly protects against random failures and human mistakes, not targeted attacks so comparison there is silly from the start.

There are lessons to be learned, but they are about building resilient systems, not secure ones. All of the "security" of airplanes pretty much relies on pilot noticing something is wrong, without that man with SDR could fuck up a lot of stuff

Re: The six dumbest ideas in computer security (2005)

#73

Post by adql » Wed, Jan 25, 2023, 6:49 AM UTC

> One of the best ways to get rid of cockroaches in your kitchen is to scatter bread-crumbs under the stove, right? Wrong! That's a dumb idea. One of the best ways to discourage hacking on the Internet is to give the hackers stock options, buy the books they write about their exploits, take classes on "extreme hacking kung fu" and pay them tens of thousands of dollars to do "penetration tests" against your systems, right? Wrong! "Hacking is Cool" is a really dumb idea.

That's like, entirely unrelated. Black hats are motivated by monetary gains, not scout badges. The proliferation of internet made "for fun" hackers minority and irrelevant factor (or benefit, as they might actually report a bug instead of sow mayhem) when it comes to security.

Re: The six dumbest ideas in computer security (2005)

#74

Post by adql » Wed, Jan 25, 2023, 6:51 AM UTC

quickthrower2 wrote: post #21

User education is not dumb. Services that send test phishing emails and check that people mark them as such are a good idea. It gets people used to receiving suspect emails and dealing with them.

Especially considering most big breaches appear to be "some human somewhere fucked up"

Re: The six dumbest ideas in computer security (2005)

#75

Post by pabs3 » Wed, Jan 25, 2023, 6:55 AM UTC

pastage wrote: post #70

u801e wrote: post #61

Earlier quoted context omitted.

> Objecting to user education is an idea that is coming back into vogue, especially with authentication and phishing. It's the idea that has held up best here. The notion that users can't really be educated has led to a lot of questionable security practices that prioritize ease of use over real security. For example, 2FA using codes sent by email or SMS as the second factor rather than relying on key based authentic…

My bank used client TLS certificates early on, while it is nifty it was a really bad idea without hardware security. (Paper OTP in their case) IMHO, client side certificates are a big failure even on server to server. The UX of doing it is error prone and insecure because of foot guns. It fails because there are so many different incompatible ways to use them. Mostly this idea of mine is based on never having had a g…

Apple/etc Passkeys (WebAuthn in software instead of hardware tokens) seems similar to TLS client certs, so I'm sure the UX stuff with certs is solvable if anyone cared.

Re: The six dumbest ideas in computer security (2005)

#76

Post by BulgarianIdiot » Wed, Jan 25, 2023, 6:58 AM UTC

adql wrote: post #73

> One of the best ways to get rid of cockroaches in your kitchen is to scatter bread-crumbs under the stove, right? Wrong! That's a dumb idea. One of the best ways to discourage hacking on the Internet is to give the hackers stock options, buy the books they write about their exploits, take classes on "extreme hacking kung fu" and pay them tens of thousands of dollars to do "penetration tests" against your systems, r…

Yeah the cockroach analogy is kinda bad. A more apt analogy would be that you can either let rodents help themselves to your food supplies on their own terms, or you can set up traps with a little bit of cheese on them.

The traps with little bit of cheese on them here being offering hackers a viable low-stress way to earn income and the respect of society for doing ethical work, which they'll prefer over the high-risk, despite higher-gain, illegal activity they'd contemplate and perpetrate otherwise.

Similar mechanics in many ecosystems. Carrot and stick work best together.

Re: The six dumbest ideas in computer security (2005)

#77

Post by cpuguy83 » Wed, Jan 25, 2023, 7:03 AM UTC

josephg wrote: post #62

jjav wrote: post #54

Earlier quoted context omitted.

> my iPhone is more secure than linux for the same reason The phrase "more secure" doesn't mean anything, I wish it wasn't used. One needs to talk about the threat model(s) you care about and how a particular solution addresses them (or not). Any given solution can be both more secure and less secure than an alternative, depending on what threat models you care about. Which may well be different than the threat model…

> The phrase "more secure" doesn't mean anything Fair point. I'll elaborate: The linux (UNIX) security model is designed to protect users from other (potentially malicious) users on the same computer. The system as a whole is designed such that a malicious (or incompetent) user can't make the system as a whole stop working. The system is more important than any particular users' data. Software is assumed to be correc…

Linux has lots of protective measures outside of just user isolation. There's capabilities, namespaces, cgroups, seccomp, landlock, selinux, apparmor.

The difference is Linux gives the owner of the machine (for better or worse) decide what to do here. There are distros that try to force you into a more secure posture (Qubes), though.

Re: The six dumbest ideas in computer security (2005)

#78

Post by trashtester » Wed, Jan 25, 2023, 7:04 AM UTC

adql wrote: post #72

msla wrote: post #12

> "We can't stop the occasional problem" - yes, you can. Would you travel on commercial airliners if you thought that the aviation industry took this approach with your life? I didn't think so. This person has a fundamentally mistaken idea of how airliners and, therefore, security systems as a whole work. Yes, airliners have the occasional problem. That's why they have: * checklists and inspections, to catch them bef…

Aviation industry mostly protects against random failures and human mistakes, not targeted attacks so comparison there is silly from the start. There are lessons to be learned, but they are about building resilient systems, not secure ones. All of the "security" of airplanes pretty much relies on pilot noticing something is wrong, without that man with SDR could fuck up a lot of stuff

Came here to say this.

Protecting the average corporate networks against the most sophisticated state actors is like protecting an airliner against an F35 armed with AIM-260 missiles.

Re: The six dumbest ideas in computer security (2005)

#79

Post by lmm » Wed, Jan 25, 2023, 7:04 AM UTC

josephg wrote: post #62

jjav wrote: post #54

Earlier quoted context omitted.

> my iPhone is more secure than linux for the same reason The phrase "more secure" doesn't mean anything, I wish it wasn't used. One needs to talk about the threat model(s) you care about and how a particular solution addresses them (or not). Any given solution can be both more secure and less secure than an alternative, depending on what threat models you care about. Which may well be different than the threat model…

> The phrase "more secure" doesn't mean anything Fair point. I'll elaborate: The linux (UNIX) security model is designed to protect users from other (potentially malicious) users on the same computer. The system as a whole is designed such that a malicious (or incompetent) user can't make the system as a whole stop working. The system is more important than any particular users' data. Software is assumed to be correc…

> Its much more likely that me or my family suffers from a keylogger or ransomware attack than we suffer as a result of government intrusion into our digital lives.

Are you sure? How would you know? We can't know how many people the government blackmails with data taken from their iphones, because it's illegal to publish information about them doing so, whereas ransomware attacks are widely publicised.

Re: The six dumbest ideas in computer security (2005)

#80

Post by saagarjha » Wed, Jan 25, 2023, 7:07 AM UTC

tptacek wrote: post #46

ufmace wrote: post #10

I wonder how well we all think this article has aged? "Penetrate and Patch" is supposedly dumb. But what do we practically do with that? We've seen in the last decade or so a lot of long-lived software everyone thought was secure get caught with massive security bugs. Well, once some software you depend on has infact been found to have a bug, what's there to do but patch it? If some software has never had a bug found…

1. Default deny is one of the oldest best practices in security engineering; it barely needed saying in 1995 (but Cheswick & Bellovin said exactly that in Firewalls & Internet Security). 2. "Enumerating badness" is simultaneously an attempt to connect vulnerability research to antivirus (security practitioners have had contempt, mostly justified, for AV since the late 1980s) and an endorsement of the heuristic detect…

> Objecting to user education is an idea that is coming back into vogue, especially with authentication and phishing. It's the idea that has held up best here.

This can be good or bad depending on how you do it. If you default to the good thing and there really isn’t any need to do the bad thing then it can be quite good. If there is a genuine need for some people to sometimes do the bad thing (so it’s not actually universally “bad”) pretending like nobody can ever make an informed decision here is not a good policy. Sure, it’s very difficult to get people to make informed choices, but you can’t really brush this off as people being uneducateable.