Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Nobody Cares About Security

adatosystems.com

Post reply on HN
Print view View original

81–90 of 93 posts

Re: Nobody Cares About Security

#81

Post by saagarjha »

mikewarot wrote: post #74
antisthenes wrote: post #73

Earlier quoted context omitted.

That's definitely not "solved" for any but the highest level definition, simply due to the fact that it's an absolute nightmare to maintain this kind of approach in large organizations due to people coming, leaving, changing their security levels. Basically you have to have a whole team of people whose only job is to maintain the correct/accurate security levels for everyone else, grant and revoke them in a timely ma…

We deploy systems of a similar nature to protect our electrical grid, all the way down to individual outlets. Image if some agency had decided that knowledge of fuses and circuit breakers should be restricted in the national interest. This would make electo-security a Trillion dollar industry. Just as cyber security is now. -- We let random people plug things into the electrical grid. We don't have to run an "electri…

Running attacks on the electrical grid is dangerous and expensive. This is nothing like how cyberattacks work.

Re: Nobody Cares About Security

#82

Post by _xiaz »

mamcx wrote: post #19

An angle that sometimes helps is reframing security as (business) validation and introducing proper type modeling. The best thing anybody can do for this is making apis that make `unrepresentable` unsafe things. ` A classic is password length. Instead of `login(user:str, pwd:str)`, do `login(user:NotEmptyStr, pwd:ValidPwd)`. This is stuff that must be done in the lower layers, to take advantage of how lazy people is.…

This is a bit of a stretch, but I'm willing to entertain the idea if you could toss me a link or two to more in-depth write ups on the topic

Re: Nobody Cares About Security

#83

Post by _xiaz »

mikewarot wrote: post #72

Computer security is a solved problem.[1] The problem arose during the VietNam conflict, and was solved in the 1970s. I suspect that the current widespread ignorance of this fact is the result of a covert operation by one or more TLAs. [1] https://en.wikipedia.org/wiki/Multilevel_security

It's about the same level of solved as moon landings and supersonic flight...

If we could now find out how to do security in an economical, non-annoying way, that would be great

Re: Nobody Cares About Security

#84

Post by hcfman »

lofaszvanitt wrote: post #28
y-c-o-m-b wrote: post #20

I've been saying this since at least 2009 when the company I worked for was sending credit card info from card readers across the network in plain text and they dragged their feet to fix it even though they knew we were violating some serious SOX policies. At another company in 2015, I discovered we were sending user credentials for a large hospitals in plain text across the network and need to fix this ASAP. When I…

Until they are fined 10% of yearly revenue. That's why you need a strong government.

Can we not also have really extreme punishments for government officials that break the law?

Re: Nobody Cares About Security

#85

Post by acuozzo »

hcfman wrote: post #84
lofaszvanitt wrote: post #28

Earlier quoted context omitted.

Until they are fined 10% of yearly revenue. That's why you need a strong government.

Can we not also have really extreme punishments for government officials that break the law?

Checks & balances do not work in the absence of empowered incorruptible entities because of collusion. At best, they just slow things down.

Re: Nobody Cares About Security

#86

Post by dadrian »

alphazard wrote: post #32

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

What do you think secure by default means?

Re: Nobody Cares About Security

#87

Post by tim333 »

Not exactly the authors point but quite a lot of end consumers care about security. This has helped the likes of Apple who have a good reputation do well. (2004 market caps Apple 8bn, MSFT 298bn, Apple now bigger than MSFT). And there are other examples that are similar - I switched my mum from yahoo mail to gmail when yahoo kept getting hacked - Google doing well, Yahoo basically went bust and so on.

Re: Nobody Cares About Security

#88

Post by alphazard »

dadrian wrote: post #86
alphazard wrote: post #32

There are many common software tasks that are just hard to do securely, and there is an incentive to keep it that way. Security is a huge industry mostly filled with people who check boxes and memorize obscure trivia. Consider TLS, the "industry standard" for connecting two processes securely over the network. There is a huge amount of complexity just to accomplish something that should be secure by default. Certific…

What do you think secure by default means?

By secure I mean at least confidential, authenticated, and repudiable. So no one can read the data sent between A and B, B knows that it is communicating with A, and B cannot prove to anyone else that A sent particular data.

There are more formal/rigorously defined terms for this and variations. You can google IND-CCA to start digging in.

By default I mean that the least complicated, easiest to use, front-and-center API establishes this sort of connection with the 2nd party. And sending insecure data becomes akin to dealing with raw ethernet frames, possible, sometimes necessary, but not even allowed on most operating systems without elevated privileges. Concretely that might look like replacing `dial(host, port) -> Conn` functions with `dial(publicKey, host, port) -> SecureConn` functions.

Re: Nobody Cares About Security

#89

Post by dadrian »

alphazard wrote: post #88
dadrian wrote: post #86

Earlier quoted context omitted.

What do you think secure by default means?

By secure I mean at least confidential, authenticated, and repudiable. So no one can read the data sent between A and B, B knows that it is communicating with A, and B cannot prove to anyone else that A sent particular data. There are more formal/rigorously defined terms for this and variations. You can google IND-CCA to start digging in. By default I mean that the least complicated, easiest to use, front-and-center…

I'm confused as to why you think you can replace all the things in TLS that provide security with some sort of magical SecureConn function. TLS is the secure connection, so much so that your code example is exactly what happens in Golang when you use the TLS library. net.TLS provides a Dial() and a net.Conn implementation.

Your argument seems to be "TLS is bad because it is complicated. We should replace it with something logically equivalent, but better in some way that I have not defined." This is a fundamentally unserious argument, unless you can say what is wrong and what the requirements for a new solution are that are not provided by TLS currently.

Re: Nobody Cares About Security

#90

Post by alphazard »

dadrian wrote: post #89
alphazard wrote: post #88

Earlier quoted context omitted.

By secure I mean at least confidential, authenticated, and repudiable. So no one can read the data sent between A and B, B knows that it is communicating with A, and B cannot prove to anyone else that A sent particular data. There are more formal/rigorously defined terms for this and variations. You can google IND-CCA to start digging in. By default I mean that the least complicated, easiest to use, front-and-center…

I'm confused as to why you think you can replace all the things in TLS that provide security with some sort of magical SecureConn function. TLS is the secure connection, so much so that your code example is exactly what happens in Golang when you use the TLS library. net.TLS provides a Dial() and a net.Conn implementation. Your argument seems to be "TLS is bad because it is complicated. We should replace it with some…

Go write up the code to connect two parties. Just A and B. A knows about B and wants to connect to B specifically, B will talk to anyone, but wants to know exactly who. It's far more than just Serve and Dial, and often you have to involve a 3rd party, or know a lot of details about self-signed certificates and the particulars of authenticating them.

If it was just Serve and Dial with the guarantees I mentioned, we would be in agreement that it was easy and a suitable default.

> "TLS is bad because it is complicated. We should replace it with something logically equivalent, but better in some way that I have not defined."

I thought I was fairly clear in saying: less complicated == better. That is the way in which it is better, that I am now defining explicitly for you. If that's controversial then that probably explains most your disagreement. The complexity has to be so low relative to other solutions that it is more likely to be used than not.

Post reply on HN