[deleted]
Stop Hacklore – An Open Letter
51–60 of 115 posts
Re: Stop Hacklore – An Open Letter
#52Earlier quoted context omitted.
Where do you detect malice? The claims are quite accurate.
Accurate? Lets take the Wifi (Other users already commented the other ones). Open a wifi access point with the name of the restaurant, intercept the DNS requests and serve your filtered stuff. PS: If the text is real and not trolling, the keyword in the text is 'rarely happen', which we could apply to car seatbelts then.
> intercept the DNS requests and serve your filtered stuff.
How do you get from a malicious DNS response to a browser-validated TLS cert for the requested host?
Re: Stop Hacklore – An Open Letter
#53So, since this seems to be relevant im a CISO myself. And i would definitely not agree with everything in this letter. Personally, i think the worst part about it is handling a low probability as something that's not gonne happen. Thats, especially in IT-Sec, one of the worst practices. To take on point as example - the "never scan public QR codes". Apart from the fact that there have been enaugh exploits in the past…
It's funny your warning about QR codes goes onto warn about PDF exploits. Yet you clicked the link to this article, by your own definition opening you up to "a whole different world of possible exploitations via whatever file is being returned". It's the nature of the internet to follow links, but our updated browsers keep us safe from exploits. When was the last time you saw an un-targeted mass 0-day exploit campaig…
>It's funny your warning about QR codes goes onto warn about PDF exploits. Yet you clicked the link to this article, by your own definition opening you up to "a whole different world of possible exploitations via whatever file is being returned". It's the nature of the internet to follow links, but our updated browsers keep us safe from exploits.
you really don't know what they did.
In the time of containerized OSs and virtualized-everything it's silly to guess.
Re: Stop Hacklore – An Open Letter
#54Earlier quoted context omitted.
Where do you detect malice? The claims are quite accurate.
Accurate? Lets take the Wifi (Other users already commented the other ones). Open a wifi access point with the name of the restaurant, intercept the DNS requests and serve your filtered stuff. PS: If the text is real and not trolling, the keyword in the text is 'rarely happen', which we could apply to car seatbelts then.
Then what? The user presumably sees TLS certificate warnings since you don't have valid certicates. HSTS would prevent downgrades to plain HTTP and is pretty common on sensitive websites.
Isn't the better advice to avoid clicking through certificate warnings? That applies both on and off open wifi networks.
There is a privacy concern, as DNS queries would leak. Enabling strict DoH helps (which is not the default browser setting).
Re: Stop Hacklore – An Open Letter
#55I might be alone in this, but I feel the advice regarding 2FA and password managers is putting people into risk. My mom using those would be one “I don’t know where I put that” away from permanently losing access to her pictures or any other similar access. This is as potentially harmful as any attack.
Fwiw, Apple has a notion of a recovery contact, someone else who can get you back into your account.
Re: Stop Hacklore – An Open Letter
#56Knowing what rules not to follow and what isn't a risk is important to know where to invest energy.
Tech and non tech users have a budget to spend on IT Sec, so if you impose a lot of useless or marginally useful rituals along with the useful prophylaxis, the user will be forced to drop some of the measures, so it's better to drop some rules early on by policy rather than letting users decide what good practices to avoid.
Re: Stop Hacklore – An Open Letter
#57For 1, you can still have extremely malicious networks. It's true that your web traffic is likely encrypted but... What services are exposed on your machine? Do you have mapped samba shares?
For 5 - session cookies are one of the main things stealers look for. Deleting cookies is absolutely good advice until browsers build in better mitigations against cookie theft.
For 6 - if there was a standard interface how password managers could rotate my creds, I would sure as hell use it. Force rotating passwords is only "bad" if people need to remember them. Any random credentials stored in a vault absolutely should be rotated periodically, there is no reason not to.
I don't see the point of this letter, none of the "bad" advice they call out is harmful to security in any way, if people feel safer avoiding public wifi, so be it. Is it just a call out to other cisos to update their security hygiene powerpoints?
Re: Stop Hacklore – An Open Letter
#58I don’t understand why people promote password managers for individuals. You don’t need to store your password in a central location that is a prime target to hackers; even if it’s encrypted, that’s more of a risk than keeping one of your own.
And some of the previous advice they’re stepping back from like avoiding QR codes you’re unfamiliar with is still good advice; you should be careful and not expose yourself too much.
Re: Stop Hacklore – An Open Letter
#59I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in elementary school?" might have different answers depending on when you ask me. Plus, unless my best friend's name was Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz (we used to call him Joe) it's pretty easy to guess with a dictionary attack. The only way t…
I remember that a not-so-recent investigation recommended five words. (Also you got the order wrong, "correct" was at the front, but you'd probably get it right second try, so the concept is still good.)
Re: Stop Hacklore – An Open Letter
#60Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.
Updating software is good advice. Do you realize how many CVEs are reported on a daily basis? Once you've got a password manager you're largely protected against phishing, so the biggest target becomes your computer, and the most likely way to compromise that would be through outdated software with public vulnerabilities. What do you expect your browser security levels to the max to do? Browsers are designed to be se…
Vulnerabilities in the software you use don't even make the top 5 in ways bad guys actually compromise you.
The most common attacks:
- Phishing
- Getting the user to run the malware themselves
- Credential reuse
- Literal physical theft
- Users uploading their own stuff completely willingly to some sketchy service
Vulnerabilities in the services you use are important, but you can't update those yourself :)