Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything authenticated by Microsoft is tainted

graz.social

Post reply on HN
Print view View original

271–280 of 381 posts

Re: Everything authenticated by Microsoft is tainted

#271

Post by yrro »

inetknght wrote: post #253
yrro wrote: post #127

Earlier quoted context omitted.

More seriously, on my Debian stable system: $ dpkg -l ca-certificates Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-===============-============-============-================================= ii ca-certificates 20230311 all Common CA certif…

And so, to back to your question: > Imagine what the CA/Browser Forum would do if they discovered that a PKIX CA had lost control of its signing keys, didn't revoke them and in fact carried on using them for 2 years without telling anyone... Are these certificates affected? Or perhaps the CA/Browser Forum aren't aware of the scope.

I sure hope not. But I suppose only Microsoft are able to confirm whether their PKIX CA private keys are or are not affected by their various security incidents, including the Azure token leak mentioned by ggeorgovassilis.

Re: Everything authenticated by Microsoft is tainted

#272

Post by raintrees »

bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

For my smaller clients, I have been migrating them to Synology Directory Services (LDAP/DNS/SAMBA)... I import AD, switch the DNS on the workstations, good to go.

Test it out, if curious - Pretty straight-forward. And a heck of a lot more economical.

Re: Everything authenticated by Microsoft is tainted

#273

Post by bogwog »

jerska wrote: post #262
bilekas wrote: post #255

Earlier quoted context omitted.

> This was a bad breach, for sure, and we may not fully understand its scope at this point > I mean, emphasis on able to, as in "in theory, based on what I know, it is POSSIBLE", not that they did. When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality. If you find a zero day exploit, you don't just ignore pat…

Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited. You try to check if some were and it’s obvious that people at Microsoft are doing exactly that. Not saying that MS’s response was great, but I agree with GP that the whole thing is hyberbolic.

> Of course you patch it, but you don’t assume that every system affected by this 0-day got exploited.

Uhh, what? Of course you do. Why give the benefit of the doubt to hackers who hacked you with malicious intentions? That's the type of security nonsense that I'd expect from... Well, Microsoft lol

Re: Everything authenticated by Microsoft is tainted

#274

Post by crabbone »

dcow wrote: post #215
crabbone wrote: post #202

Earlier quoted context omitted.

This would sound like ChatGPT if I didn't know better... All of your arguments are "made up" arguments, they contradict themselves or each other or assume some very unlikely situations, especially on behalf of what the post you replied to wanted to say, where it's clear it's not what it wanted to say. Let's dive in! > So are you suggesting that the most practicable alternative is to be a slave Clearly, the post you r…

You said it best yourself: The operating system chosen to run a business was never a serious factor in terms of whether the company succeeded or failed. While I don’t think that statement is universally true because for certain products OS matters, but generally, why would anybody migrate away from windows just because of a security incident? Linux has had its fair share of RCEs and 0-day exploits. Are you saying Lin…

I didn't argue for moving to Linux. My argument is that we need redundancy. If one system has a huge failure like this one -- we shouldn't find ourselves being hostages of this system.

Similarly, I'm not against Microsoft products being used in hospitals. I'm for transparency of standards, rules used by hospitals to acquire and maintain software, public interfaces, reporting...

If such rules are created and Microsoft is playing by the rules -- then I have no problem with it, but having Microsoft decide what the rules are is a disaster.

Re: Everything authenticated by Microsoft is tainted

#275

Post by dredmorbius »

ajb wrote: post #159
ladams wrote: post #157

Earlier quoted context omitted.

Is it? Every large company has a well compensated CTO whose job it is to think through these sorts of hypotheticals. But “nobody gets fired for choosing Microsoft”, and so the monopoly continues…

"A sound banker, alas, is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional and orthodox way along with his fellows, so that no one can really blame him"

JMK: https://www.greatsayings.net/john-maynard-keynes-sayings/a-s...>

Re: Everything authenticated by Microsoft is tainted

#276

Post by imchillyb »

hnlmorg wrote: post #254
imchillyb wrote: post #190

Earlier quoted context omitted.

You are correct. There are those who warn, and those who ignore. There is no consensus. But, that's with every industry, every field, every platform. Some warn, others ignore. Wanna bet who's right?

I like how you open with "you are correct" then go on to completely ignore the GPs comments. I've been doing this stuff for longer than a lot of people on here have been alive and the biggest risk is always your weakest link. The weakest link in most companies isn't the cloud, it's the engineers deploying to the cloud. That weak link exists regardless of whether those engineers deploy to a centralised place or on-pre…

Well, the supposition GP made was that Security Experts AGREE ON ANYTHING. Which is a patently false supposition.

Some warn, others ignore. Is true. It's true for every industry, every walk of life, in every country, on the entire planet.

Experts, though, when have they agreed on anything, in any field?

One must ascertain for themselves which authoritative sources can be relied upon. The experts that warn of centralization are authoritative and masters in their fields.

Centralization in any other area of life tends to be bad for citizens, so I ask you this: Why would centralization lead to MORE security, or MORE benefit to the users and citizens of the world?

I'll wait...

Re: Everything authenticated by Microsoft is tainted

#277

Post by eqvinox »

madsbuch wrote: post #211
bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

If it is the case that it is going to be extremely risky to run of MS supplied infrastructure (including Windows) we should see insurance premiums sky-rocket for companies and organisations using those platforms. Eventually, it will become cheaper to migrate off the MS platforms. This is mixed with an ever increasing legislative push and higher fines for leaking PII.

This already seems to be happening overall, though I can't quite find vendor specific data.

e.g.: https://www.cnbc.com/2022/10/11/companies-are-finding-it-har...

Re: Everything authenticated by Microsoft is tainted

#278

Post by hotnfresh »

dgudkov wrote: post #261
hotnfresh wrote: post #250

Earlier quoted context omitted.

Doubt it. Data governance and access control is just getting to be a bigger deal with each passing year, and nobody wants to (pay enough to) self-manage that. Or to take personal responsibility for it. Maybe “on prem” but largely managed by someone else, which is already a thing.

It's ironic that data governance and access control are getting to be a bigger deal every year exactly because everyone migrated off premises to the cloud. People lost control over their data when they migrated it to the cloud and now they try to take control back by imposing more and more policies.

Kinda, but a lot of it’s managing and auditing internal and external access, and maintaining data and source catalogs and crap like that, down to granular levels and across multiple levels of data-cleanup/polish/transformation and reporting. The machine learning/LLM push (biiiiig hype in companies) is making that even messier. The solutions that don’t involve a horrifying amount of DIY are heavily cloud-oriented.

[edit] to editorialize, I also think ~everyone is going to get this very wrong. I think doing this stuff such that you don’t grind productivity to a halt but also don’t have mile-wide vulnerabilities is goddamn near an Apollo Program level of difficult, and basically nobody is treating it that way (and a lot of them would probably sooner abandon their grand mass-data-total-control plans if they had to treat it that way—which is exactly what I think most of them should do, but execs just love the idea of perfect legibility of data and processes end to end on their phone or whatever, even if it’s in-fact just a money-wasting and risk-generating fantasy for most companies)

Re: Everything authenticated by Microsoft is tainted

#279

Post by iknowstuff »

nolist_policy wrote: post #233
dcow wrote: post #215

Earlier quoted context omitted.

You said it best yourself: The operating system chosen to run a business was never a serious factor in terms of whether the company succeeded or failed. While I don’t think that statement is universally true because for certain products OS matters, but generally, why would anybody migrate away from windows just because of a security incident? Linux has had its fair share of RCEs and 0-day exploits. Are you saying Lin…

The thing is: Windows and Office is insecure by default. Admins react by sprinkling anti-virus on top of it, but that doesn't help any. It still enables users to open random mail attachments in Office or similar. And Office doesn't have any sandboxing or other mitigation in place, again it's insecure by default. If you enable users to do stuff like this, you have noone to blame if you get owned. Are the usual Linux d…

If those are your criteria, macOS is the better choice for businesses. Certainly not qubesos lol

Re: Everything authenticated by Microsoft is tainted

#280

Post by mycall »

insanitybit wrote: post #245

Such hyperbole. This was a bad breach, for sure, and we may not fully understand its scope at this point. But... > They were able to implant #backdoors, self-made keys, ... all over the place. I mean, emphasis on able to , as in "in theory, based on what I know, it is POSSIBLE", not that they did . > If you didn't understand until now: basically EVERYTHING at Microsoft got hacked and Microsoft can't (or won't) get ri…

I'm sure Microsoft is provided all the resources they need to flush out any embedded binaries and ill-configurations including every federal agency available.
Post reply on HN