How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole • Hacker News Board

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#91

Post by zwischenzug » Thu, Oct 25, 2012, 5:21 AM UTC

rachelbythebay wrote: post #19

Xion wrote: post #13

Earlier quoted context omitted.

Or paranoid. Or naive. Or narcissistic. It might be somewhat feasible if they wanted him to be security engineer, not a devop. Still, he expected they have set up what essentially is an elaborate prank just to send a cold-call email to just one of probably numerous potential candidates. How likely this is? What would be the risk-to-reward ratio for doing that, considering that many of unsolicited recruiting mails are…

Back when I believed the hype, I made the same mistake with materials from Google's recruiters. They gave me driving instructions from SJC which left me in the wrong part of the valley on a Friday night during rush hour (this was before smartphone navigation). I figured it was some kind of test. It wasn't. I called it my "cleverness attribution error" and wrote about it this summer: http://rachelbythebay.com/w/2012/0…

The chess champion Capablanca said that he was protected from losing games due to minor blunders because his opponents assumed he was so brilliant that he saw something they didn't, so they played safe and avoided taking advantage.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#92

Post by Dylan16807 » Thu, Oct 25, 2012, 5:54 AM UTC

seanica wrote: post #52

darkarmani wrote: post #25

Earlier quoted context omitted.

> "But the government of Iran probably could"...At this point I stopped reading, as this article became propaganda. How is that propaganda? You don't think most countries have that kind of computing power?

> How is that propaganda? defn: "Information, esp. of a biased or misleading nature, used to promote or publicize a particular political cause or point of view" http://mw1.merriam-webster.com/dictionary/propaganda 2: the spreading of ideas, information, or rumor for the purpose of helping or injuring an institution, a cause, or a person 3 : ideas, facts, or allegations spread deliberately to further one's cause or to…

How is it misleading? Iran has shown willingness to use fake certificates and the US has been cyber-attacking them. It's a reasonable example for a country. The point here is to make the threat less abstract by using a scenario, not to rally political sentiment.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#93

Post by samuellb » Thu, Oct 25, 2012, 7:53 AM UTC

snowwrestler wrote: post #89

DKIM is not the only tool for catching spoofed emails; to my knowledge SPF is more widely used because it is much easier to set up. I'd be shocked if the little Larry/Sergei joke email made it to their inbox since it would fail the SPF lookup.

Yes lots of sites have SPF, but what I've seen most sites set it to soft-fail mode.

I think this is because SPF is still sometimes broken in practice. For example, it can fail when there are misconfigured e-mail forwarding (e.g. mail aliases) at _other_ peoples servers[1]. Or with web forms that set the envelope sender to the "From" field in web page...

http://en.wikipedia.org/wiki/Email_forwarding#Forwarding_ver...

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#94

Post by Kliment » Thu, Oct 25, 2012, 8:49 AM UTC

I got one of those emails too once. I still can't figure out why. I did post to LKML a couple times in the past, but I haven't done anything kernel in over a decade. And a random Google recruiter emails me to congratulate me on my experience and offer me an unspecified position as a SRE. Not only do I have zero experience or interest in sysadmin and large server type stuff, they don't even have any facilities within 400km of me. What the fuck, Google?

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#95

Post by wia » Thu, Oct 25, 2012, 9:31 AM UTC

Sloppy work by affected companies since RFC was unambiguous. But why didn't RFC keep it consistent by requiring verifiers to only work with the same minimum key length?

RFC 4871 (sorry for formatting but ipad issue) " signers MUST use RSA keys of at least 1024 bits for long-lived keys. Verifiers MUST be able to validate signatures with keys ranging from 512 bits to 2048 bits, and they MAY be able to validate signatures with larger keys. Verifier policies may use the length of the signing key as one metric for determining whether a signature is acceptable.

   Factors that should influence the key size choice include the
   following:

   o  The practical constraint that large (e.g., 4096 bit) keys may not
      fit within a 512-byte DNS UDP response packet

   o  The security constraint that keys smaller than 1024 bits are subjec to offline attacks..."

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#96

Post by HerraBRE » Thu, Oct 25, 2012, 12:53 PM UTC

Kliment wrote: post #94

I got one of those emails too once. I still can't figure out why. I did post to LKML a couple times in the past, but I haven't done anything kernel in over a decade. And a random Google recruiter emails me to congratulate me on my experience and offer me an unspecified position as a SRE. Not only do I have zero experience or interest in sysadmin and large server type stuff, they don't even have any facilities within…

In my experience (ex-Googler here), recruiters tend to be contractors who work off a script and get bonuses proportionate to how many people end up in the hiring pipeline. There are checks and balances to prevent outright spam, but the motivations are aligned in such a way that a pretty wide net is cast.

Also, until you have interviewed, all positions are "unspecified". Many positions need to be filled and they don't pick one for you until they know what you can do.

Geography is not really considered to be an issue. Once SRE finds someone they really want they will help with relocation.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#97

Post by scotty79 » Thu, Oct 25, 2012, 1:25 PM UTC

tolos wrote: post #60

What a happy ending, no threats of jail or lawsuits.

It's still bit of a let down that they didn't contacted him in any way. They could at least track him and since he is a well meaning guy they could send him something funny.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#98

Post by binxbolling » Thu, Oct 25, 2012, 3:43 PM UTC

zwischenzug wrote: post #91

rachelbythebay wrote: post #19

Earlier quoted context omitted.

Back when I believed the hype, I made the same mistake with materials from Google's recruiters. They gave me driving instructions from SJC which left me in the wrong part of the valley on a Friday night during rush hour (this was before smartphone navigation). I figured it was some kind of test. It wasn't. I called it my "cleverness attribution error" and wrote about it this summer: http://rachelbythebay.com/w/2012/0…

The chess champion Capablanca said that he was protected from losing games due to minor blunders because his opponents assumed he was so brilliant that he saw something they didn't, so they played safe and avoided taking advantage.

I think I read an article recently (probably highlighted on HN) that talked about how Deep Blue did exactly this versus Kasparov. A bug caused it to make a sub-optimal move, and it's quite likely Garry misinterpreted it as genius and psyched himself out going forward.

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#99

Post by DanBC » Thu, Oct 25, 2012, 7:34 PM UTC

onthedole wrote: post #81

downandout wrote: post #80

Earlier quoted context omitted.

Just register serverX-paypal.com (where x is a number) ftw. People in general are stupid. When asked what browser they use, the overwhelming majority respond by saying "Google". That says all that needs to be said about the general public.

Quite a sad view of humanity. I don't think people are stupid, I think they just don't care and shouldn't care about the browser. It's a tool used to get access to the information they need. I am reading HN on chrome, but unless I go looking for what browser I use, I wouldn't know.

Stupid is a harsh word. But it's short and simple and easy to understand.

"Assume the user is stupid" isn't really being mean to users. It's just shorthand for "make everything as easy as possible. Sane defaults; great design; remove ambiguity; correct documentation; and so on."

Re: How a Google Headhunter’s E-Mail Unraveled a Massive Net Security Hole

#100

Post by cyber » Fri, Oct 26, 2012, 12:44 AM UTC

HerraBRE wrote: post #96

Kliment wrote: post #94

I got one of those emails too once. I still can't figure out why. I did post to LKML a couple times in the past, but I haven't done anything kernel in over a decade. And a random Google recruiter emails me to congratulate me on my experience and offer me an unspecified position as a SRE. Not only do I have zero experience or interest in sysadmin and large server type stuff, they don't even have any facilities within…

In my experience (ex-Googler here), recruiters tend to be contractors who work off a script and get bonuses proportionate to how many people end up in the hiring pipeline. There are checks and balances to prevent outright spam, but the motivations are aligned in such a way that a pretty wide net is cast. Also, until you have interviewed, all positions are "unspecified". Many positions need to be filled and they don't…

Also an ex-Googler here, they cast the net far and wide trying to pick up SRE. When I was there they were offering significant bounties for submitting recommendations that only had to make it pass the resume screen. Want a brand new shiny PS3? Less than 10* that made it past the resume screen, and it was yours.

I has additionally heard rumors that recruiters were so silo'ed that they would actually just throw away a resume rather than route it. Reason being that they were in a competition with all recruiters, and worst performers (based strictly on a numbers game) didn't get their contracts renewed.

*May have been as low as less than 5, its been a few years, and I never really took to memorize what was posted on the wall while I was at the urinal.