Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ATT dumps Kevin Mitnick

theregister.co.uk

Post reply on HN
Print view View original

41–45 of 45 posts

Re: ATT dumps Kevin Mitnick

#41

Post by Locke1689 »

jacquesm wrote: post #32
jacquesm wrote: post #8

I find Kevin Mitnick going to the authorities for protection a little bit weird. If your claim to fame is that you are the 'worlds baddest hacker' you take the script kiddies as going with the territory. It's like Billy the Kid complaining about the wanna-be's that want to meet him at noon on main street. "The move by AT&T came this week after Mitnick hired a lawyer to complain that his privacy was being invaded by p…

Dear downmodders, if you disagree speak your mind. Feel free to downmod away but at least let me know which bit you disagree with and why.

I think it's ok to use the up and down arrows to express agreement. Obviously the uparrows aren't only for applauding politeness, so it seems reasonable that the downarrows aren't only for booing rudeness.

--pg

It seems many people have responded to you though.

Re: ATT dumps Kevin Mitnick

#42

Post by three14 »

apotheon wrote: post #38
three14 wrote: post #36

Earlier quoted context omitted.

Reading my comment over, I realize that I wasn't so clear. There are two almost unrelated issues: AT&T has poor security - agreed. Security through obscurity is a universal evil - not so fast. Quick example - you have ciphertext where you don't know the key vs. the same ciphertext where you don't know the key AND you don't know the algorithm. The latter is more secure, because it's harder to brute force. The reason s…

Please give the public origins of the notion that security through obscurity is broken a closer look. Until you understand what that means, you will keep making arguments like "keeping your key" (such as a password) "secret is just security through obscurity". I recommend starting with Kerckhoffs' Principle. Basically, you can regard "security through obscurity" as any violation of Kerckhoffs' principle -- which tran…

I have given it a closer look. Many times.

You're making an argument by assertion: Kerckhoffs' principle says don't keep secrets other than the key, so therefore you have to not keep secrets other than the key. Huh?

Kerckhoffs' principle is a great idea - but understand it. It doesn't say that extra secrecy makes you less secure. It just says that when you're designing a system using encryption, the key should be the single point of failure.

Let's say I'm locking a door. So you shouldn't be able to get in without the key - but it's going to be harder for you if you also can't find the keyhole.

When you're designing locks, don't try to hide the keyhole - spend all your effort getting a good, unpickable lock - but still, don't deny that hiding the lock isn't pointless.

Re: ATT dumps Kevin Mitnick

#43

Post by apotheon »

three14 wrote: post #42
apotheon wrote: post #38

Earlier quoted context omitted.

Please give the public origins of the notion that security through obscurity is broken a closer look. Until you understand what that means, you will keep making arguments like "keeping your key" (such as a password) "secret is just security through obscurity". I recommend starting with Kerckhoffs' Principle. Basically, you can regard "security through obscurity" as any violation of Kerckhoffs' principle -- which tran…

I have given it a closer look. Many times. You're making an argument by assertion: Kerckhoffs' principle says don't keep secrets other than the key, so therefore you have to not keep secrets other than the key. Huh? Kerckhoffs' principle is a great idea - but understand it. It doesn't say that extra secrecy makes you less secure. It just says that when you're designing a system using encryption, the key should be the…

No, that's not an argument by assertion. It's an argument by pointing out that your "definition" of security through obscurity is apparently at odds with the very origins of the concept.

I'm not saying that hiding the keyhole harms security. I'm saying that pretending hiding the key is the same as hiding the keyhole is an exercise in something so silly I can't even think of the word.

Re: ATT dumps Kevin Mitnick

#44

Post by three14 »

Locke1689 wrote: post #40
three14 wrote: post #36

Earlier quoted context omitted.

Reading my comment over, I realize that I wasn't so clear. There are two almost unrelated issues: AT&T has poor security - agreed. Security through obscurity is a universal evil - not so fast. Quick example - you have ciphertext where you don't know the key vs. the same ciphertext where you don't know the key AND you don't know the algorithm. The latter is more secure, because it's harder to brute force. The reason s…

"The reason you use widely published encryption algorithms is because they've been vetted for poor assumptions. They need to be open to be vetted, not to be secure, and we've found that's always been a good tradeoff." True. Most people (including Schneier, Ferguson, Rivest, etc) agree that the NSA is secure. This is because they have a veritable army of cryptographers at their disposal. Peer review is the most import…

"However, obscurity can never make a secure algorithm more secure."

If you're talking about the security of the algorithm, fine. But you're talking about the security of the system, and the algorithm is seldom the problem. If it takes two months to find the problem with the key management, then your obscurity that added two months just doubled the time to break in.

I still say you should use publicly vetted systems - but the community is in denial over the value (second rate, but still value) of security through obscurity.

Case in point: when Slashdot first released their source code, they didn't escape quotes in passwords, so it was possible to log in as an admin using an appropriately modified SQL statement. Sure, you could have figured what the command needed to be via trial and error before the code was released, but I was lazy. Releasing the code meant that I could now break into something I wouldn't try to break into before. The obscurity protected them from a certain threat model. It was still much better when they fixed the bug, of course.

Re: ATT dumps Kevin Mitnick

#45

Post by paulsilver »

branden wrote: post #31
paulsilver wrote: post #14

Earlier quoted context omitted.

I had to re-read the article about the eight digit password. As it is for his phone provider, I presume it has to be numbers so it can be typed in from any phone keypad. I can't believe someone with Mitnick's track record would use an all-numbers password by choice.

"Mitnick said that per AT&T policy, his password could only be digits and no more than eight characters long."

Thanks branden, I didn't re-read far enough down the article.
Post reply on HN