Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Hacklore – An Open Letter

hacklore.org

Post reply on HN
Print view View original

101–110 of 115 posts

Re: Stop Hacklore – An Open Letter

#101

Post by HiPhish »

yegle wrote: post #77
HiPhish wrote: post #24

I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in elementary school?" might have different answers depending on when you ask me. Plus, unless my best friend's name was Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz (we used to call him Joe) it's pretty easy to guess with a dictionary attack. The only way t…

There seems to be an easy solution: use a password manager and save the answer to the question as an additional password. (This is actually a FR to any password manager's product team: it's time to treat things like 2FA recovery code and secret question answers as first class citizen in your product).

That's what I do as well, but that defeats the purpose of the secret question being something only I know and will not forget. And that's because I am aware of the flaw of this system; someone naive might actually fill out that question with the honest answer and leave himself wide open to being exploited. Password manager are not a solution, they are a band-aid fix to a problem we should not be having in the first place.

Re: Stop Hacklore – An Open Letter

#102

Post by voodooEntity »

TZubiri wrote: post #71
voodooEntity wrote: post #5

So, since this seems to be relevant im a CISO myself. And i would definitely not agree with everything in this letter. Personally, i think the worst part about it is handling a low probability as something that's not gonne happen. Thats, especially in IT-Sec, one of the worst practices. To take on point as example - the "never scan public QR codes". Apart from the fact that there have been enaugh exploits in the past…

>Personally, i think the worst part about it is handling a low probability as something that's not gonne happen. Thats, especially in IT-Sec, one of the worst practices. If you are an online service provider, sure. Low probability means it's going to happen, especially as you scale with users. For a small business IT team? You can't keep a clean sheet, the strategy is to reduce the probabilities of an incident and re…

Well even tho i think at the end of your comment you went a bit out of the way, i get your point and i agree to a certain point.

You cannot reduce the risks to 0 - that's a matter of fact and i would never claim you could.

I tend to say its a question of cost/gain. If the cost the attacker has to pay (work/invest/...) is higher than the possible gain (data/funds/...) you are on a good track for your companies security.

Im btw not working for an ISP, rather something you would see as a smaller sized IT company. Therefor i also have certain points where i in theory could go alot harder on security, but i don't because its not feasible.

Another thing especially in that regard i find important is trying to educate your users, at least we work on that. We don't just enforce hard rules on them, but we also try to make sure they understand why we have these rules and mechanisms in place - not to annoy them but to protect them.

Finally, thats my favorite point of your article, "force users to use lots of passwords ".

Well our business has to undergo regular audits by partners which are lets say rather meticulous when it comes to the security of our systems. These enforce certain things on us we have to than enforce on our users even if we don't think its good.

So ye, now you can blame on me that i enforced something on our users, but keep in mind - it was also enforced on me - i even discussed certain things with these partners trying to explain to them why some measures sound cool on paper but in reality are just impractical - not that anyone would care. So we implement it.

Therefor the next time you argue that some security measure is just an CISO that doesn't really care about its users, maybe keep in mind that some things are forced upon us even tho we don't like and don't support them.

Re: Stop Hacklore – An Open Letter

#103

Post by HiPhish »

thayne wrote: post #65
HiPhish wrote: post #24

I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in elementary school?" might have different answers depending on when you ask me. Plus, unless my best friend's name was Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz (we used to call him Joe) it's pretty easy to guess with a dictionary attack. The only way t…

> "kittycat", but "k!ttyc4T" is still less secure than "horse battery staple correct". Well... something like that. Please don't use exactly "horse battery staple correct".

Yeah, I was referencing XKCD 936. Of course everyone should use a set of dice to roll their own truly random diceword passphrase and use five or six worst. My point was that adding numbers and other special characters does not actually make the password more secure than four, five, six or however many random plain English words that just use lower-case characters, so this rule should never be enforced.

Re: Stop Hacklore – An Open Letter

#104

Post by drtgh »

8organicbits wrote: post #93
drtgh wrote: post #87

Earlier quoted context omitted.

I am afraid that it is not only about privacy (that they recommend ignoring), there are many options to chose, like CA vectors, lets say TrustCor (2022), e-Tugra (2023), Entrust (2024), Packet injection vectors, or Click here or use your login first vectors as you commented, bugs and configurations. This ones known. Therefore I just cannot believe that those who wrote the open letter did not even though about such si…

> like CA vectors This gets complicated because you're not safe on your home or corporate network either when CAs are breached. The incident everyone talks about, DigiNotar (2011), had stolen CA keys issuing certificates that intercepted traffic across several ISPs. If that's the threat you're looking to handle, "avoid public wifi" isn't the right answer. Perhaps you're doing certificate pinning, application level si…

Why do you talk about home networks "unsupervised" when we are talking about public networks, access points, created to hunt people?

Do you notice that your proposed solutions try to fix a problem, isn't it? The open letter does not propose solutions; it merely denies them.

It is needed to be sincere with people, those "incidents" have happened for a long time, and unfortunately will keep happening (given the history), bad actors hunting, yesterday the CAs, and tomorrow? So if one connect to an open wifi one may fall victim to a trap, probably not at home but in an Airport or other crowded places with long waits, and even if you do not browse another app in background will be trying to do it.

It was needed many years to make people just sightly aware, and now they -if the text is real- pretend to undo it. But to be sincere I really do not mind much, I just perceive that open letter as malicious.

Re: Stop Hacklore – An Open Letter

#105

Post by fmajid »

bigiain wrote: post #83
yearolinuxdsktp wrote: post #29

Earlier quoted context omitted.

Max browser security levels and a good ad-blocker will not prevent you from getting phished or hacked more than an encryption-audited cloud-based zero-knowledge vault, where server compromise is irrelevant. All competent #1 cloud-based password managers are like that.

Phish resistant MFA is worth mentioning. You and all your staff with access to critical credentials should have something like YubiKeys, so you can't (as easily) get tricked into entering some TOTP (or email/sms) code into a fraudulent website. At least that ups the threshold to "someone who can not only poison your dns or MITM your network, but can also generate trusted TLS certs for the website domain they're phish…

And SMS should be retired completely for authentication, not simply deprecated as NIST did in SP 800-63B with companies like banks assuming full liability for losses to others if they continue with this unacceptably insecure mechanism.

Re: Stop Hacklore – An Open Letter

#106

Post by bigiain »

fmajid wrote: post #105
bigiain wrote: post #83

Earlier quoted context omitted.

Phish resistant MFA is worth mentioning. You and all your staff with access to critical credentials should have something like YubiKeys, so you can't (as easily) get tricked into entering some TOTP (or email/sms) code into a fraudulent website. At least that ups the threshold to "someone who can not only poison your dns or MITM your network, but can also generate trusted TLS certs for the website domain they're phish…

And SMS should be retired completely for authentication, not simply deprecated as NIST did in SP 800-63B with companies like banks assuming full liability for losses to others if they continue with this unacceptably insecure mechanism.

I've been sending people this like since 2012: https://www.itnews.com.au/news/telcos-declare-sms-unsafe-for...

"The lobby group for Australian telcos has declared that SMS technology should no longer be considered a safe means of verifying the identity of an individual during a banking transaction."

Re: Stop Hacklore – An Open Letter

#109

Post by 8organicbits »

drtgh wrote: post #104
8organicbits wrote: post #93

Earlier quoted context omitted.

> like CA vectors This gets complicated because you're not safe on your home or corporate network either when CAs are breached. The incident everyone talks about, DigiNotar (2011), had stolen CA keys issuing certificates that intercepted traffic across several ISPs. If that's the threat you're looking to handle, "avoid public wifi" isn't the right answer. Perhaps you're doing certificate pinning, application level si…

Why do you talk about home networks "unsupervised" when we are talking about public networks, access points, created to hunt people? Do you notice that your proposed solutions try to fix a problem, isn't it? The open letter does not propose solutions; it merely denies them. It is needed to be sincere with people, those "incidents" have happened for a long time, and unfortunately will keep happening (given the history…

CA compromise feels like an exotic attack, beyond what "everyday people and small businesses" should worry about. There's no solution to CA compromise offered because the intended audience is not getting hacked in that way. If your concern is that high risk individuals need different advice, I agree, but the letter also makes that clear they are not the focus.

Are there specific, modern examples of CA compromise being used to target low-risk individuals? Is that a common attack vector for low-risk individuals and small businesses?

Re: Stop Hacklore – An Open Letter

#110

Post by exsomet »

Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

The update thing struck me as slightly out of touch; if I were to make a list of my top 10 most used consumer products that can be updated, probably 8-9 of them have abused updates to make things worse.

We spend so much time training people that if you hit update, it’s going to suck: you’re going to suddenly get ads in your favorite app, or some new feature is going to get paywalled, or the UI is going to completely change with no warning. It seems counterproductive to accept that our industry does this stuff and then publish an open letter finger-wagging people for not updating.

Post reply on HN