Google Moves Its Corporate Applications to the Internet • Hacker News Board

Re: Google Moves Its Corporate Applications to the Internet

#121

Post by andrewchambers » Thu, May 14, 2015, 2:43 AM UTC

Afforess wrote: post #74

cs702 wrote: post #38

I'm so happy to see this. As Bruce Schneier (who runs an open WiFi network at home) explains, "if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1] The same is true for corporate applications (and devices like printers). If they're not secure on a public network, securing the corporate network won't reduce their risk that much: they're still exposed to…

There are other, valid reasons to not run a public access point. Not wanting neighbors to steal your bandwidth, run a TOR node off it, or host illegal content, for example. All of these activities could get you removed from your ISP, and even taken to court. While you could probably prove your innocence in court, I can not imagine why taking the risk for absolutely no personal benefit is worth the risk. I don't reall…

I have seen an open router which automatically sends the clients through tor first so the activity of free guests is disassociated from your home ip address.

You can easily limit the bandwidth guests can use so it is not noticeable to you anyway.

Re: Google Moves Its Corporate Applications to the Internet

#122

Post by andrewchambers » Thu, May 14, 2015, 2:45 AM UTC

Istof wrote: post #77

cs702 wrote: post #38

I'm so happy to see this. As Bruce Schneier (who runs an open WiFi network at home) explains, "if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1] The same is true for corporate applications (and devices like printers). If they're not secure on a public network, securing the corporate network won't reduce their risk that much: they're still exposed to…

Does Bruce have his open-wifi clients connections pass through a VPN (in-between him and clients destination) ...

Tor would be good, guests wouldn't appear as your own ip, instead as a tor exit node.

Re: Google Moves Its Corporate Applications to the Internet

#123

Post by jldugger » Thu, May 14, 2015, 2:47 AM UTC

mikecb wrote: post #7

Finally, the zero trust network has its day. I've been following this for quite a while, especially since this kind of architecture makes even more sense for smaller businesses than large ones that can pay for sophisticated network-edge protection. Edit: Great talk at lisa in 2013: https://www.usenix.org/conference/lisa13/enterprise-architec...

On what planet was that talk "great?"

Re: Google Moves Its Corporate Applications to the Internet

#124

Post by rev_bird » Thu, May 14, 2015, 2:50 AM UTC

marssaxman wrote: post #105

snowwrestler wrote: post #99

Earlier quoted context omitted.

Bruce Schneier is a very smart guy, but let's not deify him; he can be wrong about things too. For example in the above column he repeats an urban myth: that running an open WiFi access point provides an affirmative defense against prosecution for things like piracy, hacking, or child porn. I call it an urban myth because, personally, I have yet to find a court case in which such an argument was made, let alone one i…

People assert the counterexample, too, but in reality it's hard to find real cases where anything bad happened as a result of running an open wifi network.

There are many, though they all came out of people trying to get away from kiddie porn charges. http://www.huffingtonpost.com/2011/04/24/unsecured-wifi-chil...

Re: Google Moves Its Corporate Applications to the Internet

#125

Post by rev_bird » Thu, May 14, 2015, 2:50 AM UTC

marssaxman wrote: post #105

snowwrestler wrote: post #99

Earlier quoted context omitted.

Bruce Schneier is a very smart guy, but let's not deify him; he can be wrong about things too. For example in the above column he repeats an urban myth: that running an open WiFi access point provides an affirmative defense against prosecution for things like piracy, hacking, or child porn. I call it an urban myth because, personally, I have yet to find a court case in which such an argument was made, let alone one i…

People assert the counterexample, too, but in reality it's hard to find real cases where anything bad happened as a result of running an open wifi network.

There are many, though they all came out of people trying to get away from kiddie porn charges. http://www.huffingtonpost.com/2011/04/24/unsecured-wifi-chil...

Re: Google Moves Its Corporate Applications to the Internet

#126

Post by rev_bird » Thu, May 14, 2015, 2:59 AM UTC

I think I'm missing something important here. I understand it as far as "internal networks give people a false sense of security," but it's still worth something, isn't it? Why not implement all of these security features AND keep your internal network locked up? Is it really just convenience?

Re: Google Moves Its Corporate Applications to the Internet

#127

Post by RyJones » Thu, May 14, 2015, 3:10 AM UTC

chias wrote: post #119

RyJones wrote: post #114

Earlier quoted context omitted.

What is a registered gun? I have plenty of guns, none of them are registered.

They all have serial numbers, and you had to show ID when buying them. So yes they are registered, you just might not be aware of this fact.

I cut a bunch of them from aluminum, for which I showed no ID, and they do not have serial numbers.

Re: Google Moves Its Corporate Applications to the Internet

#128

Post by douche » Thu, May 14, 2015, 3:12 AM UTC

chias wrote: post #119

RyJones wrote: post #114

Earlier quoted context omitted.

What is a registered gun? I have plenty of guns, none of them are registered.

They all have serial numbers, and you had to show ID when buying them. So yes they are registered, you just might not be aware of this fact.

At least in the US, private sales are legal, and there is no requirement to file any paperwork whatsoever.

Moreover, there is a staggering number of firearms that predate any sort of government record-keeping. It's not like these are muskets and black-powder revolvers, either - most of the designs for hunting rifles and shotguns are nearly unchanged from models that were available a century ago.

Re: Google Moves Its Corporate Applications to the Internet

#129

Post by douche » Thu, May 14, 2015, 3:36 AM UTC

zenbowman wrote: post #69

passive wrote: post #20

As a remote worker, it's delightful to see things move in this direction, as VPNs are a regular thorn in my side. Of course, there's a certain irony that Google isn't fond of remote workers. :)

It isn't just corporations that are not fond of remote work. As a lay-employee, I am not fond of remote work either. I would much rather have all my teammates in the same room. Tribal? Yes, unapologetically so.

Why?

Re: Google Moves Its Corporate Applications to the Internet

#130

Post by philipw » Thu, May 14, 2015, 4:32 AM UTC

tedchs wrote: post #21

furyg3 wrote: post #13

We tried this where I worked (with the exception of the evil desktop app financial program)... and had to retract after a zero day defacement in one of our web apps. In the meantime we also learned that keeping all of your web apps 100% up to date at all times is really freaking difficult. The good news is that the (failed) attempt got us off of a few client side applications and made us much more platform agnostic t…

You can't succeed with this model by just setting your firewall to allow 0.0.0.0/0. This approach still requires defense in depth, and a holistic view of security. If someone was able to deface your web app, then your company wasn't actually using all the components that are required to make this model work (such as authenticated devices, device patch management, and user 2-factor authentication).

Device patch management only works when there are patches available, ever heard of a 0day?