Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security for the people

google-opensource.blogspot.com

Post reply on HN
Print view View original

11–20 of 58 posts

Re: Security for the people

#11

Post by sauere »

I see the motivation behind it and appreciate the cause, however it is not just about the tools. Yes we need better tools but that alone wont help. 1-Click solutions often promise a lot but only end up giving a false sense of security. I belive that a certain amount of understanding of the underlying, general technology will always be required - both for users and developers.

Encrypting your e-mail does not help you if your machine is compromised.

Your super-secure 24 character password is useless if you use it on every single website.

Encrypting and salting your users credentials is useless if your SSH password is 6-digits.

What i'm saying is: REALLY staying secure is not easy and it never will be.

Re: Security for the people

#12

Post by tptacek »

Researching and developing usability and security auditing practices. How do we measure the two in a single assessment?

You don't. They're wildly different disciplines. Security auditing is fundamentally a systems programming problem. The least effective security "auditors" approach security as something different than software engineering. The most significant security issues arise from correctness issues; finding and fleshing them out involves discovering the degrees of freedom offered to an attacker by faulty assumptions made by blocks of code scattered throughout an entire system.

That's not to take anything away from the practice this team is trying to start! Someone should be doing security usability work, because I don't know anyone who does it well now.

Providing real software security for open source projects is a tricky problem. Talented software security people are in enormous demand. Bill rates are going up. One thing a project like this might want to tackle is onboarding more technical people into the discipline, to address the supply problem.

Re: Security for the people

#13

Post by gress »

hack_edu wrote: post #7
gress wrote: post #3

"We’re excited for a future where people won’t have to choose between ease and security, and where tools that allow people to secure their communications, content, and online activity are as easy as choosing to use them." That future is now according to Apple. In any case the real issue is protecting people from Google itself.

Apple's devotion to privacy ends at phone unlock; the easiest attack vector to social engineer or forensically determine. Today's announcement is not much more than a PR stunt to cover their ass and distract from their own repeated failings to secure their platform or networks.

"Apple's devotion to privacy ends at phone unlock."

If you had read either the privacy policy or security architecture, you would know that you have made a false statement here.

I think it's you who is trying to distract us from the fact that Google itself uses your private data for its own business purposes, and has a vested interest in not protecting you from itself.

Re: Security for the people

#14

Post by richardwhiuk »

stevekl wrote: post #2

And don't forget the end-to-end project[1], which is the javascript crypto library by google. The significance of these types of project extend beyond browser privacy. As crypto-currency become more prominent, we NEED better, carefully auditted javascript crypto-libraries. Right now, all the crypto-code are home baked. e.g.: https://github.com/bitcoinjs/bitcoinjs-lib/blob/master/src/e... While, I think they are all d…

Obligatory link to "Javascript Cryptography considered harmful" which neatly summarizes the pitfalls here: http://matasano.com/articles/javascript-cryptography/

Re: Security for the people

#15

Post by tomp »

bradleyjg wrote: post #9
tomp wrote: post #5

Earlier quoted context omitted.

I don't think that JS or any other interpreted/JIT-compiled crypto code will ever be vetted by cryptographers. Simply the fact that you can't control the memory, CPU cache and instruction scheduling means that your code is vulnerable to at least side-channel exploits.

The Stanford Javascript Crypto Library was written / overseen by Dan Boneh who is a serious cryptographer by any definition. http://bitwiseshiftleft.github.io/sjcl/

> We believe that SJCL provides the best security which is practically available in Javascript. (Unforunately, this is not as great as in desktop applications because it is not feasible to completely protect against code injection, malicious servers and side-channel attacks.)

Re: Security for the people

#17

Post by cbhl »

tptacek wrote: post #12

Researching and developing usability and security auditing practices. How do we measure the two in a single assessment? You don't. They're wildly different disciplines. Security auditing is fundamentally a systems programming problem. The least effective security "auditors" approach security as something different than software engineering. The most significant security issues arise from correctness issues; finding a…

I'm not so sure. "User uses the system as designed" is a huge faulty assumption -- look at all the people who put SSH private keys (or Amazon AWS keys) on GitHub or who write a shared company-wide password on a sticky note taped to their monitor. A more usable system might prevent these sorts of failure modes, or at least inform the user of the risks that result from such decisions.

Re: Security for the people

#18

Post by tombrossman »

The simplysecure.org domain uses Google Analytics which isn't disclosed on their privacy page (as required by Google Analytics' TOS). There is also a mixed-content warning because someone hard-coded an http:// link to the balloons image in the blog post on their https site. I went to email them and first looked for PGP keys (us pro-privacy & security people all use PGP, right?) and found none for the domain on any key servers.

I point all this out because it perfectly illustrates their point. Here are a group of smart people launching a great initiative with a beautiful and modern website, and they made some mistakes just like the rest of us do.

I've offered to help and recommended they switch to Piwik (and fix the http link). I hope others here on HN who care about security and privacy will also offer to help out. Some of this stuff is easy to fix and I think it's a great initiative.

Re: Security for the people

#19

Post by tptacek »

cbhl wrote: post #17
tptacek wrote: post #12

Researching and developing usability and security auditing practices. How do we measure the two in a single assessment? You don't. They're wildly different disciplines. Security auditing is fundamentally a systems programming problem. The least effective security "auditors" approach security as something different than software engineering. The most significant security issues arise from correctness issues; finding a…

I'm not so sure. "User uses the system as designed" is a huge faulty assumption -- look at all the people who put SSH private keys (or Amazon AWS keys) on GitHub or who write a shared company-wide password on a sticky note taped to their monitor. A more usable system might prevent these sorts of failure modes, or at least inform the user of the risks that result from such decisions.

I'm probably being imprecise. There's a big and important discipline of assessing the usability of a system and the impact of all the affordances the interface of a system provides. I believe that also takes a special skillset, and it's a skillset I'm happy to see new initiatives like this taking on.

I am not suggesting that security usability (or, to keep it technical, security UX) is easy, or that software security practices are necessarily good at it.

Re: Security for the people

#20

Post by tptacek »

Tepix wrote: post #16

Nitpicking: They should use a SHA256 certificate :-) And DANE and TLSA

Baffling that anyone could still be advocating for DANE after the NSA slides indicating that the USG has owned up CAs came out. Why exactly does anyone believe the DNS roots are harder to own up?
Post reply on HN