Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OWASP Non-Human Identities Top 10

owasp.org

Post reply on HN
Print view View original

31–37 of 37 posts

Re: OWASP Non-Human Identities Top 10

#31

Post by RIMR »

belter wrote: post #28

It’s already wise to establish a shared authentication word or phrase with family and colleagues, because AI can now convincingly mimic a person’s face, voice, gestures, even their gait during video calls or phone conversations. A bot won’t know the secret passcode when you ask for it. Within the next 20–25 years, you may need that same safeguard in face-to-face meetings, since Replicants will be lifelike enough to f…

Please click through the link before commenting. NHIs have absolutely nothing to do with AIs masquerading as humans. This is basically about service accounts and API keys...

Re: OWASP Non-Human Identities Top 10

#32

Post by belter »

RIMR wrote: post #31
belter wrote: post #28

It’s already wise to establish a shared authentication word or phrase with family and colleagues, because AI can now convincingly mimic a person’s face, voice, gestures, even their gait during video calls or phone conversations. A bot won’t know the secret passcode when you ask for it. Within the next 20–25 years, you may need that same safeguard in face-to-face meetings, since Replicants will be lifelike enough to f…

Please click through the link before commenting. NHIs have absolutely nothing to do with AIs masquerading as humans. This is basically about service accounts and API keys...

I did. And took it further and read the docs.. :-)

"Unlike human identities, NHIs are not controlled or directly owned by a human. Their identity object and authentication often work differently to human, and common human user security measures do not apply to them."

So this is about identities who are not human as they use those service accounts. Some would go as far as to say: AIs masquerading as humans.

Re: OWASP Non-Human Identities Top 10

#34

Post by disruptiveink »

2d8a875f-39a2-4 wrote: post #23

I especially enjoyed NHI10:2025 Human Use of NHI. Time to stop all that pesky human use. Switch off the servers too, just to be sure.

Amusing nomenclature, but it's a legitimate concern. If your SREs use application credentials to connect to the database, your ability to have effective access controls and have accurate access audit trails are severely hampered.

Re: OWASP Non-Human Identities Top 10

#36

Post by LoganDark »

lexicality wrote: post #27
LoganDark wrote: post #6

Hah, turns out they're talking about stuff like access tokens, not otherkin!

Glad I wasn't the only one whose mind immediately jumped to "On the internet, nobody knows you're a dog"

On most of my platforms I try to make sure everyone knows :)

Re: OWASP Non-Human Identities Top 10

#37

Post by atypeoferror »

antithesis-nl wrote: post #25

I would love to hear about any useful work around leak/abuse-resistance improvements of service accounts and API keys (i.e. the 'NHI' referenced here -- awkward terminology!). Passkeys are a great solution when some kind of end-user interactivity is feasible, and AWS Secrets Manager is supposedly very good if you're entirely on that platform, but for self-hosting, the options seem limited (and things like Hashicorp V…

Linters help in terms of detection. We’ve gotten a lot of mileage out of regularly running gitleaks, trivy and trufflehog over our repos
Post reply on HN