Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Hacklore – An Open Letter

hacklore.org

Post reply on HN
Print view View original

11–20 of 115 posts

Re: Stop Hacklore – An Open Letter

#11

Post by magackame »

Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

> Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

You think of someone stealing your password vault and cracking AES? The vault is E2EE.

Re: Stop Hacklore – An Open Letter

#12

Post by emidln »

I'm not a CISO just a random dog on the internet, but this open letter seems to assume that privacy is not a part of your security posture and that spear phishing isn't common these days. (Is 'spear phishing' still the term for targeted electronic scams to steal credentials/access?)

I realize not everyone is using a physically stripped burner, a graphene os install, etc and not everyone works at a high value financial, govt, or infra target but for those of us who need to deal with opsec or are commonly targeted by spear phishing this advice seems abysmal.

In the current political climate of the US, if you are living or traveling here and the current party isn't cheering for you personally, you really should be considering both state-sponsored attacks and no longer have the luxury of assuming good faith by the state. Telling people to enable cheap drive by attacks that are in active use by certain government agencies is irresponsible malpractice at best and actively evil at worst.

Source: I've worked at analytics companies that actively deanonymized users using cookies when available. We used wifi and Bluetooth details when available. We built "multi channel marketing" which was just taking any information we could scrape from the user to fingerprint them and cross reference and deanonymize them so we could sell interactions to businesses like geofenced price discrimination, value of users, and could offer cross website information on shopping habits/financial profile. The shit I did 15 years ago didn't go away and no matter how much I wish I didn't write that, it was the tip of the iceberg and relatively benign.

Re: Stop Hacklore – An Open Letter

#15

Post by ocdtrekkie »

Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Password managers are one of those things I am still stunned is staying popular for advice, even though it's nearly akin to "use one password for everything". I assume a big part of it is the affiliate deals subscription password managers have with infosec influencers.

There are absolutely valid use cases, but they are much fewer and further between than people claim.

Re: Stop Hacklore – An Open Letter

#16

Post by ropetin »

I find it interesting that the comment about VPNs offering little additional privacy or security benefits is wrapped up under 'Avoid Public WiFi' rather than being called out explicitly. It drives me nuts all the ads I see for NordVPN or whatever claiming that by using their services you are now totally safe from all the hacks. If anything, it makes the median user less safe because they have a false sense of security.

Re: Stop Hacklore – An Open Letter

#17

Post by yearolinuxdsktp »

You can only avoid rotation on passwords that are MFA-protected.

If you implement a password manager, you must mandate auto-fill only and actively discourage (via training) copy/paste of credentials to a web site. Train the users to view “auto-fill not working” as a red flag. (This doesn’t apply to non-website credentials). Mandate all passwords to be auto-generated. Mandate that the only manually-entered password is the one for the password manager. Of course, you must have MFA on the password manager entry.

This will allow your users to comply with frequent password rotations much more easily. Auto-fill requirement/culture is critical to reducing phishing success, especially for tired eyes.

Re: Stop Hacklore – An Open Letter

#18

Post by blauditore »

ocdtrekkie wrote: post #15
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Password managers are one of those things I am still stunned is staying popular for advice, even though it's nearly akin to "use one password for everything". I assume a big part of it is the affiliate deals subscription password managers have with infosec influencers. There are absolutely valid use cases, but they are much fewer and further between than people claim.

No. If a shitty service stores your password in plain and leaks it, this won't affect your other accounts, unless you reuse passwords.

I simply can't remember dozens of passwords, so a pw manager is the best I can do realistically. Yes, it's a single point of failure, but so is using the same pw everywhere.

Re: Stop Hacklore – An Open Letter

#19

Post by losvedir »

ocdtrekkie wrote: post #15
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Password managers are one of those things I am still stunned is staying popular for advice, even though it's nearly akin to "use one password for everything". I assume a big part of it is the affiliate deals subscription password managers have with infosec influencers. There are absolutely valid use cases, but they are much fewer and further between than people claim.

Depends on your threat model. I went all in on 1Password when I realized that realistically the most likely attack vector for me is phishing, which it absolutely protects against (won't be duped by a fake site and auto fill password).

Re: Stop Hacklore – An Open Letter

#20

Post by xboxnolifes »

ocdtrekkie wrote: post #15
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Password managers are one of those things I am still stunned is staying popular for advice, even though it's nearly akin to "use one password for everything". I assume a big part of it is the affiliate deals subscription password managers have with infosec influencers. There are absolutely valid use cases, but they are much fewer and further between than people claim.

It's quite different from use one password everywhere. My threat vector I wish to protect against that some random website I signup to will mismanage passwords and end up with them leaked, causing every website using that password to be compromised. Remembering hundreds of unique passwords is unreasonable, thus, password manager.

Considering the amount of times my email has ended up in a leaked dataset, and the only accounts I've ever had visibly compromised were ones I did not use a password manager for, this seams to be the correct mindset.

Post reply on HN