Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Hacklore – An Open Letter

hacklore.org

Post reply on HN
Print view View original

31–40 of 115 posts

Re: Stop Hacklore – An Open Letter

#31

Post by johncoatesdev »

Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Updating software is good advice. Do you realize how many CVEs are reported on a daily basis? Once you've got a password manager you're largely protected against phishing, so the biggest target becomes your computer, and the most likely way to compromise that would be through outdated software with public vulnerabilities.

What do you expect your browser security levels to the max to do? Browsers are designed to be secure from default settings.

Re: Stop Hacklore – An Open Letter

#32

Post by tptacek »

Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

A significant fraction of every high-profile industry security person I know has signed this thing. There are people on that list that I'm not super impressed with, but also people everybody is impressed with. No argument that this thing is motivated by commercial interests is going to survive, and a lot of this is advice that security cool kids have been giving for upwards of 10 years.

Re: Stop Hacklore – An Open Letter

#33

Post by tptacek »

emidln wrote: post #12

I'm not a CISO just a random dog on the internet, but this open letter seems to assume that privacy is not a part of your security posture and that spear phishing isn't common these days. (Is 'spear phishing' still the term for targeted electronic scams to steal credentials/access?) I realize not everyone is using a physically stripped burner, a graphene os install, etc and not everyone works at a high value financia…

The piece is explicitly about retiring outdated security advice and doesn't claim to provide a complete, coherent defensive posture (that posture would have to depend on who you are and what your threat model is!). I don't like that they included the "recommendations for the public" section, but I don't think there's a reasonable way to read it as intending to be a complete action plan.

Re: Stop Hacklore – An Open Letter

#34

Post by drtgh »

That open letter is filled with malice, so I can only guess that it's either trolling or a bad taste joke (due people could think are outdated recommendations and spread, lets remember the flat-earth thing).

Re: Stop Hacklore – An Open Letter

#35

Post by tptacek »

voodooEntity wrote: post #5

So, since this seems to be relevant im a CISO myself. And i would definitely not agree with everything in this letter. Personally, i think the worst part about it is handling a low probability as something that's not gonne happen. Thats, especially in IT-Sec, one of the worst practices. To take on point as example - the "never scan public QR codes". Apart from the fact that there have been enaugh exploits in the past…

The article doesn't claim that things like O.MG don't exist, just that they're not a serious threat to modern devices. It's explicit on that point.

Re: Stop Hacklore – An Open Letter

#36

Post by wavemode »

ocdtrekkie wrote: post #15
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Password managers are one of those things I am still stunned is staying popular for advice, even though it's nearly akin to "use one password for everything". I assume a big part of it is the affiliate deals subscription password managers have with infosec influencers. There are absolutely valid use cases, but they are much fewer and further between than people claim.

> even though it's nearly akin to "use one password for everything"

It's not at all akin to that.

Firstly, every respectable password manager requires multi-factor authentication to log in to. Someone finding out the password to your manager is almost never sufficient. They would probably need to find it out as well as gain physical access to a device of yours which has the manager installed.

Secondly, the whole issue of "use one password for everything" is that if one site gets hacked and they store passwords insecurely (or, indeed, if the people who run the site are themselves malicious), then someone can use that same password to access all of your other accounts. So you have to trust the security of every single site you make an account with.

Using a password manager doesn't have that problem, since each site is being provided with a different password. So then you don't have to trust any website, you only have to trust the password manager itself. And you don't have to use a big cloud-hosted one if you distrust them - there are many password managers that you can just run locally on your computer (though without the cloud benefits of backup / disaster recovery). You can also just use a notebook with a padlock or something - frankly it doesn't really matter how you track your passwords, as long as nobody can get to it but you, and you use a different password for everything, and you have some plan for disaster recovery. That's the idea.

Re: Stop Hacklore – An Open Letter

#37

Post by f_devd »

drtgh wrote: post #34

That open letter is filled with malice, so I can only guess that it's either trolling or a bad taste joke (due people could think are outdated recommendations and spread, lets remember the flat-earth thing).

Where do you detect malice? The claims are quite accurate.

Re: Stop Hacklore – An Open Letter

#38

Post by drtgh »

f_devd wrote: post #37
drtgh wrote: post #34

That open letter is filled with malice, so I can only guess that it's either trolling or a bad taste joke (due people could think are outdated recommendations and spread, lets remember the flat-earth thing).

Where do you detect malice? The claims are quite accurate.

Accurate? Lets take the Wifi (Other users already commented the other ones). Open a wifi access point with the name of the restaurant, intercept the DNS requests and serve your filtered stuff.

PS: If the text is real and not trolling, the keyword in the text is 'rarely happen', which we could apply to car seatbelts then.

Re: Stop Hacklore – An Open Letter

#39

Post by InsideOutSanta »

diath wrote: post #6

> Never scan QR codes: There is no evidence of widespread crime originating from QR-code scanning itself. > The true risk is social engineering scams... Exactly. My grandma is very susceptible to phishing and social engineering, I don't want her scanning random QR codes that would lead to almost identical service to the one she would think she is on and end up with identity theft or the likes. > Regularly change pass…

If databases contain your password, you have a problem that regular password changes won't fix.

Re: Stop Hacklore – An Open Letter

#40

Post by 8organicbits »

magackame wrote: post #11
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

> Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right. You think of someone stealing your password vault and cracking AES? The vault is E2EE.

The LastPass hack is a good example of that happening. Weak master passwords and a smaller number of KDF rounds, made the situation worse.

Realistically, most users benefit from using a reputable cloud-based password manager, and should focus on securing it with a strong password and MFA. You should also change your passwords if your password manager is breached.

The open letter tries to steer us towards reputable guides, linking to this one by EFF: https://ssd.eff.org/module/choosing-the-password-manager-tha...

Post reply on HN