Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Your computer should say what you tell it to say

eff.org

Post reply on HN
Print view View original

191–200 of 263 posts

Re: Your computer should say what you tell it to say

#191

Post by fragmede »

Scoundreller wrote: post #185
delusional wrote: post #149

Earlier quoted context omitted.

I work in a bank. Until a year ago, our passwords are 8 characters max, no special characters, upper and lowercase letters are equal. We were running IE7 up until 2 years ago. A huge amount of the business is still organized around sending excel sheets to each other, with no sidechannel validation. The fact that you recieved an excel sheet from some email is treated as proof that it's valid. Last I checked we were al…

> Until a year ago, our passwords are 8 characters max, no special characters, upper and lowercase letters are equal. That’s pretty good. A major Canadian bank until ~2020 had 6 character limit passwords (possibly you could enter more, but only the first six count) and mapped all alpha characters to numbers in groups of 3 (so your assigned telephone banking PIN was just a “hash” of your password). https://news.ycombi…

The best part is when the frontend input and backend validation get out of sync, so your password works sometimes depending on where you come in from.

Re: Your computer should say what you tell it to say

#192

Post by charcircuit »

dns_snek wrote: post #107
charcircuit wrote: post #71

>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the dat…

> An attestation taken does not contain information about the device that can be used to identify since the data the site gets is low entropy. Citation needed, how does WEI make it _impossible_ for attesters to return higher entropy information? Pinkie promises are insufficient. > WEI doesn't stop you from changing your user agent False, this is an explicit design goal: "Allow web servers to evaluate the authenticity…

>how does WEI make it _impossible_ for attesters to return higher entropy information?

It isn't impossible, but doing so would violate users privacy which isn't the goal of the proposal. You don't need WEI to violate people's privacy.

>False, this is an explicit design goal: "Allow web servers to evaluate the authenticity of the device and honest representation of the software stack and the traffic from the device."

That statement means that the site would learn that for example the server can trust that the user is using Chrome on windows. A feature of Chrome is that it's possible to spoof your user agent.

>Seeing a message that says "Sorry, this website is only accessible by browsers that support WEI" is very intrusive.

This can apply to anyone API. It's happened for WebGPU. It's blocking users is not a goal of the API.

>no website is going to trust your attestation service. This is equivalent to saying "Just create your own CA".

It is possible to create your own CA. How do you think things like Lets Encrypt came into existence. Trust is hard to earn. That doesn't mean that it is impossible to get people to trust you.

>No, the physical analog is "lying", which isn't illegal in most situations

I agree, but WEI is meant to be used in situations where lying should be illegal.

Re: Your computer should say what you tell it to say

#193

Post by fragmede »

volkl48 wrote: post #110
freedomben wrote: post #93

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chom…

While I'm willing to believe banks are very security minded in terms of their core infrastructure, banks do not appear to be with regards to their customer access and usually seem to move very slowly to secure that end of things. Hell, many/most of these large institutions seem to still only support SMS for 2FA and even that's a relatively recent introduction to actually mandate. Which is to say, I expect banks to be…

U2F is starting to take off, thankfully. I'm worried about what happens if it gets lost/stolen/mugged and the token is gone, but at least no SS7 attack.

Re: Your computer should say what you tell it to say

#194

Post by Temporary_31337 »

LinuxBender wrote: post #186
freedomben wrote: post #93

I think a realistic description/story from real experience I've had as a security engineer might help some people understand why this will end up so bad. I've worked with banks, who are among the most security-minded of organizations. It's not because they're security nerds, it's because the cost of getting hacked is astronomical, and because regulations require them to be "as secure as possible." Banks won't be chom…

all the CDNs like Cloudflare, and it will be a simple checkbox When this happens will this accidentally create a new business model of people selling VPN-like access that mimics WEI or uses a farm of cell phones to create a proxy farm of sorts? What else might people do to circumvent this?

This is already explained in the article- it shifts the burden on the honest consumer and in many cases is actually already illegal. In other words in no way is it a good development if I have to buy a service of questionable legality from some questionable 3rd party just to keep my browsing private like I want to.

Re: Your computer should say what you tell it to say

#195

Post by fragmede »

flangola7 wrote: post #176
amadeuspagel wrote: post #161

Earlier quoted context omitted.

Right now, many banks require a mobile app, which can only be installed from an app store, which is only available on devices that you don't control. Even if they have a web interface, you need the mobile app to login.

What banks are those? My grandma isn't going to buy a smartphone to use her bank.

Like with cheques, she might get left behind. Which is terrible.

Re: Your computer should say what you tell it to say

#196

Post by charcircuit »

NoGravitas wrote: post #111
charcircuit wrote: post #71

>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the dat…

> "End users are not the only stakeholders in the web." Wrong. RFC 8890 clearly states that the internet is for end users. https://www.rfc-editor.org/rfc/rfc8890.html

That is the opinion of the IAB. The IAB are not relevant here.

Re: Your computer should say what you tell it to say

#197

Post by charcircuit »

convolvatron wrote: post #179
charcircuit wrote: post #71

>You can choose not to send this to the remote server, but you lose the ability to send an altered or randomized description of your device and its software if you think that's best for you. The EFF is being misleading here by conflating the attestation taken and fingerprintable information like a user agent. An attestation taken does not contain information about the device that can be used to identify since the dat…

your business model involves selling ads. but its being undermined by fraud. you should be able to _change the internet_ so the business model makes sense again.

Yes, because ads are beneficial to the web. So is account security, spam detection, anticheat, etc. The current implementation of the web is not set in stone and we should take steps to improve it.

Re: Your computer should say what you tell it to say

#198

Post by JohnFen »

mvnuweucxqokii wrote: post #157
JohnFen wrote: post #114

Earlier quoted context omitted.

> are you really willing to completely opt out of online banking Sure, why not? It's not like it's a huge sacrifice on my part. It's just a little reduction in convenience. No big deal. > because you're not permitted to send fake browser identification? That's not the issue for me at all. The issue is if sites require me to use specific browsers, to not use specific extensions, to not be able to modify the browsers,…

> Sure, why not? It's not like it's a huge sacrifice on my part. It's just a little reduction in convenience. No big deal. I can easily imagine a world where in ~20-30 years, there are no bank branches or phones or ATM machines or cash--because 99.99% of people have no interest in using those things anymore. In that world, suddenly it becomes an almost insurmountable inconvenience not to acquiesce to whatever is requ…

And when that day comes, then I'll figure out some other mitigation strategy.

Re: Your computer should say what you tell it to say

#199

Post by hot_gril »

LunicLynx wrote: post #37

Here is an idea: If WEI is available use it to block chrome otherwise allow access disregarding WEI. XD

Ok but seriously, this might be the only way to combat WEI. Don't even preach to the user about the evils of WEI (ain't nobody gonna read that wall of text), just say it is not supported and tell them succinctly how to turn it off / get a different browser.

Re: Your computer should say what you tell it to say

#200

Post by bryanrasmussen »

ndriscoll wrote: post #140
knodi123 wrote: post #109

Earlier quoted context omitted.

> I will no longer be using the bank's website That's a great temporary measure, but once this has rolled out everywhere and is part of standard commercial experiences, are you really willing to completely opt out of online banking because you're not permitted to send fake browser identification? It's a fine philosophical position, but it feels akin to refusing to use public streets because of the existence of survei…

Unless they're going to trust my own attestion provider (unlikely, and then what's the point?), I would have to buy another computer to use online banking. My computer does not have attestation. I'm not going to move to Windows just to use my bank's website (and I think I saw Windows 11 requires a new computer anyway, exactly because of this attestation stuff?). All of the programs I use and workflow are on Linux. I…

all valid points - but if every bank requires attestation your solution will be? go use the ATM? I guess you're in the U.S probably so that's an option but basically for some parts of Europe this will mean people will have to use attestation to basically exist.
Post reply on HN