Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

111–120 of 144 posts

Re: South Korea’s online security dead end

#111

Post by palant »

Kamq wrote: post #96
rippercushions wrote: post #55

Earlier quoted context omitted.

Writing the critical parts of a OS kernel in C is sensible. Browser extensions, not so much. As the author notes, they're not just being snobby about languages, the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows.

> the main issue with C from a security POV is the total lack of memory safety and the consequent vulnerability to buffer overflows. Sure, but C++ also has these issues, so the "not even C++" doesn't exactly make sense.

Disclaimer: I am the author of this article.

Not really. With C++, you don’t have to use manual memory management. In the typical scenario, C++ objects take care of memory without the developer having to think about it. And you have all kinds of smart pointers for the more complicated scenarios.

That doesn’t mean of course that there are no buffer overflows in C++, or use-after-free bugs. There is still plenty of room for mistakes. But C++ code following best practices tends to have far fewer vulnerabilities than comparable C code.

Re: South Korea’s online security dead end

#113

Post by franga2000 »

kragen wrote: post #85
chunsj wrote: post #80

Earlier quoted context omitted.

Neither, this should not be an example/a cautionary tale against government regulation. This is an example of wrong/invalid kind of regulation which other countries should not follow. We, SK, could not fixed this problem because the private sector (companies who pursuit their private interest and against public interest) depending on the wrong/invalid regulation has lobbied and prevented several attempts to fix the r…

the clueless regulation is the problem, not capitalism once you're competing by lobbying for regulation what you're doing isn't capitalism anymore

So the US isn't doing capitalism anymore? If your system is based on the idea that "those with more money have more power", then those people using that power to stop competitors sounds like an entirely logical outcome to me. "Doing capitalism" means running your company with profit as your goal, and if the best way to profit is lying, bribing, preventing competition, exploiting workers and destroying the environment, that's what a capitalist will do.

That's not to say that capitalism can't be, to some extent, prevented from doing those harms by strong regulation. But as long as those writing the regulation live in and benefit from that same system, that regulation will never be particularly strong - and that's by design.

Re: South Korea’s online security dead end

#114

Post by 4ggr0 »

PradeetPatel wrote: post #64
thorncorona wrote: post #48

Earlier quoted context omitted.

AliPay is 3rd party?

It has been established that large private enterprises in China have connections with the Communist Party of China, aka the government.

> It has been established that large private enterprises in [COUNTRY] have connections with the [POLITICAL SYSTEM] of [COUNTRY], aka the government.

Not disagreeing with you and I know that people should be aware of this, but I don't get why this fact is always quoted as if that's a special situation in China. I mean, take the US as an example, you can't tell me that large private enterprises have connections with the government. Same for 99% of the countries, no?

I'd say the same for my european country and all of my neighboring countries. Sure, it does depend who or what the government is.

Re: South Korea’s online security dead end

#115

Post by esjeon »

int_19h wrote: post #57
Roark66 wrote: post #29

Oh boy... Once I saw this: >This starts with a simple fact: some of these applications are written in the C programming language, not even C++. I had to stop reading and come here to see if anyone else got annoyed by it. Seriously? "not even c++" are we still in 1990s?

Got annoyed by what? Idiomatic C++ is safer than idiomatic C, whether the 90s or today (if anything, the gap is wider today).

Yes, but, compared to higher level languages, idiomatic C++ is significantly unsafe and the difference b/w C and C++ gets scaled down to the point where it rounds to zero.

Re: South Korea’s online security dead end

#116

Post by himinlomax »

richbell wrote: post #20

This reminds me of krebsonsecurity's experience attempting to contact the FSB. https://krebsonsecurity.com/2021/06/adventures-in-contacting... A lot of countries seemingly did not have access to American encryption technologies or did not trust them — arguably for good reasons[0] — which has lead to this hodge-podge of homegrown security. [0] https://www.washingtonpost.com/graphics/2020/world/national-...

Yeah I found his problem in the first line of the article

> KrebsOnSecurity recently had occasion to contact the Russian Federal Security Service (FSB), the Russian equivalent of the U.S. Federal Bureau of Investigation (FBI).

The FSB is not equivalent to the FBI, it's the successor to the KGB. If it's equivalent to any other country's org, look to the Gestapo.

Re: South Korea’s online security dead end

#117

Post by pjc50 »

martinald wrote: post #62
cameronh90 wrote: post #56

Earlier quoted context omitted.

In the UK, the bank is also usually responsible for any unauthorised transfer, yet our banks are generally quite digitally enabled. Some banks solve the transfer authorization issue using an external bit of hardware that you type the transaction details into and it gives you a signature OTP.

I honestly dont know much much longer the banks can continue to refund people for fraud. The scale of it is enormous - £600m last year (which is likely to be the floor of it as I imagine it doesn't all get reported correctly). If it continues growing (~40% y/y) at this kind of rate then it will soon outstrip any profits from retail banking (which is pretty low margin as it is compared to banks investment and commerci…

UK banking still looks pretty profitable: https://www.theguardian.com/business/2022/oct/25/hsbc-intere...

The banks will be made to keep reimbursing people. They are, after all, in control of the system and the people with most information about what might be fraudulent.

Re: South Korea’s online security dead end

#118

Post by pjc50 »

kragen wrote: post #35
r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

> think of that the next time someone contrasts bitcoin with the heavily regulated conventional banking system

Just watching the largest fraud trial in history unfold over at FTX.

Bitcoin deals with any and all questions of fraud by dumping them on the victim. No help and no recourse. Very libertarian, but of course routinely results in people losing life changing amounts of money.

Re: South Korea’s online security dead end

#119

Post by sandos »

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

So if keyloggers are such an issue I must assume that they don't even use any kind of 2-factor system?

Re: South Korea’s online security dead end

#120

Post by stop50 »

JAlexoid wrote: post #76
wmf wrote: post #19

Earlier quoted context omitted.

Are there any US banks that are actually secure? AFAIK they're all using SMS 2FA or worse.

I wouldn't say that American digital banking is that bad at this point. SMS 2FA is pretty robust, as biometrics on the phones reduce the number of SMSes sent.

In germany most banks don't do this anymore due of security reasons.
Post reply on HN