Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Great Cannon has been deployed again

cybersecurity.att.com

Post reply on HN
Print view View original

461–470 of 470 posts

Re: The Great Cannon has been deployed again

#461

Post by geofft »

therealjumbo wrote: post #459
geofft wrote: post #400

Earlier quoted context omitted.

Why do they have to use self-signed certs? Ship the device with a valid cert for $last_three_octets_of_mac_address.$vendor.com to the device, and print it clearly on the setup instructions. Typing in something like d63d15.ui.com isn't onerous. The CA/Browser Forum allows certs up to 27 months - do routers sit on store shelves for 27 months before being configured? Do they even sit for 12 months? (Once they're online,…

We sell industrial equipment which will live its entire life (20+ years) off the internet. Browsers and the people who sit on these committees are understandably more focused on their own use cases, but there really does need to be a viable certificate solution for small embedded devices, preferably works with mDNS too. I'm not going to hold my breath, but until this happens any/all IOT devices will remain largely in…

That's a little bit of a different problem, since the client end of the connection isn't the general public. (At least for industrial equipment.) The router problem is that you need a normal, unconfigured web browser to be able to access the router's config page.

The immediate solution that occurs to me is installing a private CA, possibly one with name constraints for the vendor, because private CAs aren't held to the same rules about validity. I'm curious why this doesn't work - is it just that the tooling needed to make it happen isn't polished enough for small vendors?

I'm guessing that internet of things devices are, by their name, on the internet and can talk to a CA. Yes, this will require some way to give them a real domain name, but you could either give them names on the vendor's site or encourage people to get a domain name for themselves.

Re: The Great Cannon has been deployed again

#462

Post by chachachoney »

jstummbillig wrote: post #278
TheRealPomax wrote: post #267

Earlier quoted context omitted.

This sounds like a knee-jerk reaction that doesn't take into consideration the ramifactions of the suggested policy. It won't stop DDoS attacks, because those exist _because the internet exists_ and unless you dismantle the very concept of interconnected "everyone can reach everyone" networking, all you're doing is locking down access to more and more people until only technical experts or the people with enough mone…

This, on the other end of the spectrum, seems overly and naively liberal, when not being paired with a workable solution to the massive body of education required to provide adequate technical sophistication to (what has to be most of) 8 billion people.

>> a workable solution to the massive body of education required to provide adequate technical sophistication

The problem doesn't have to be one of education if it is tackled as a legitimate UI/UX problem and served by a WC3 that supports the needs of end users over corporate partners.

Re: The Great Cannon has been deployed again

#464

Post by greggman2 »

greggman2 wrote: post #241
upofadown wrote: post #218

Browsers really have to be a lot more skeptical about the code they run. Running code should not be able to randomly attack any IP address on the internet. Code from non-TLS pages should not be able to run at all. Perhaps that should also apply to code loaded from 3rd party sites. Connecting to a web page should not be consent to allow the operators of that web page to make my computer/phone do whatever they want on…

Unfortunately there's a giant category of devices that can't serve TLS. Like pretty much every consumer router in existence that you connect to through a webpage. Someone needs to come up with a solution for that. Ideally one that works with free and open source projects and not just well funded companies.

Found out there's a w3 working group trying to come up with solutions

https://www.w3.org/community/httpslocal/

Re: The Great Cannon has been deployed again

#465

Post by yspeak »

GhettoMaestro wrote: post #457
kitteh wrote: post #409

Earlier quoted context omitted.

It's not just them. AS4837 (China Unicom) and a few others who have intl permission to route in and out of China. That said, you're going to hurt a lot of non-china multinationals who operate there.

> That said, you're going to hurt a lot of non-china multinationals who operate there. Not my problem. Figure out a better way than getting in bed with fascist countries and then complaining when the inevitable door swings shut due to rightful backlash.

[dead]

Re: The Great Cannon has been deployed again

#466

Post by spurgu »

thyrsus wrote: post #417
TheRealPomax wrote: post #267

Earlier quoted context omitted.

This sounds like a knee-jerk reaction that doesn't take into consideration the ramifactions of the suggested policy. It won't stop DDoS attacks, because those exist _because the internet exists_ and unless you dismantle the very concept of interconnected "everyone can reach everyone" networking, all you're doing is locking down access to more and more people until only technical experts or the people with enough mone…

I have NoScript installed on FireFox, and when I visit sites, I individually grant temporary permission to anywhere from one to more than twenty javascript sources. I suspect that I am among the 1% of those willing to make that effort. I haven't noticed NoScript distinguish between http and https sources for javascript, but perhaps I don't visit sites that pull in javascript via http.

I did this last summer and managed maybe 1-1.5 months until it drove me crazy having to fiddle to get (way too many) sites to work with a minimal amount of accepted JS. Which is a shame, because it's quite a fool proof method of rendering most malicious actors helpless.

Re: The Great Cannon has been deployed again

#467

Post by pas »

Someone1234 wrote: post #23
pavel_lishin wrote: post #19

Earlier quoted context omitted.

> But these folks still have no answer for how free websites they consume daily (e.g. news) are to be funded, they don't pay, and don't want to see ads either. Yet they still expect these websites to exist. This folk has an answer: display ads the ol' fashioned way, with a pair of and tags.

Ad blockers still remove them. They have tried not to and the users intentionally moved to ad blockers that still did. https://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_...

How big/relevant is the adblock user market segment?

Also, flattr and other micropayment sites could/would work. Just as patreon and other subscription methods.

After all paid-via-unskippable-ads is the inverse of consumed-without-payment. Both are the extremes of the spectrum and the majority of users probably would stop visiting/consuming if they were forced to look at the ads for a significant amount of time.

I mean TV channels probably spent hundreds of millions on trying to maximize ad time while keeping viewers. (And now YouTube too.)

But of course there will always be a segment that will be very bothered by ads. (Hence the success of Netflix.)

Re: The Great Cannon has been deployed again

#468

Post by thw0rted »

etatoby wrote: post #340
zeven7 wrote: post #334

Earlier quoted context omitted.

Could you expand on that a little? What do you mean? Won't my browser complain if the cert if self signed?

Yes, it will complain and for good reason: it has no way of knowing whether the kid next door is spoofing your router's IP or Mac address and presenting their own self-signed certificate. I wouldn't go as far as calling it «capricious constraints imposed by the system of "certificate authorities"» but at the same time, I agree that it's not a fundamental limitation of the technology. Better protocols could be develop…

You should only have to store the self-signed cert exception once, at least on a given device. Now, if you're being targeted by a state-sponsored actor they might somehow be able to get you onto a honeypot network within the 2-minute window between plugging in your router and making your first connection to its web interface, but for everybody else a self-signed cert that you accept once during initial setup should be plenty good enough.

Re: The Great Cannon has been deployed again

#469

Post by thw0rted »

burtonator wrote: post #382
nullc wrote: post #174

The web needs to start moving towards a strong same-origin policy for all embedded content-- require sites to proxy requests if they want third party content. The first step could be sending CORS preflight, then requiring it, then just not allowing cross origin to different domains (but allow sub-/sibling- domains).

Can't the CORS preflight, by itself, be a DoS?

If you read the OP they say they were specifically crafting links that led to an image resizing webservice, so each load wasn't just requesting static content, it was consuming non-trivial compute cycles. Of course you can have a DDoS comprised of tons of requests for HTML or JPGs but the added overhead of performing a "resize" was at least a part of the plan. Failing a pre-flight would have eliminated that hit.
Post reply on HN