Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

South Korea’s online security dead end

palant.info

Post reply on HN
Print view View original

81–90 of 144 posts

Re: South Korea’s online security dead end

#81

Post by likecarter »

kragen wrote: post #69
MBCook wrote: post #59

Earlier quoted context omitted.

Isn’t this an issue of mandating the means and not the ends? If the regulations said banks had to be secure by ‘taking all due care’ and follow ‘best practices’ and such, this wouldn’t be such an issue. That gives room for improvements and for problematic standards to be weeded out over time. It sounds like the government instead said banks had to be secure by using (for example) SSL 1.0 with a 64-bit key. Because th…

that just leaves the courts to decide what the best practices are, and what due care is or isn't, which i think is actually what happened in south korea that would be great if judges were hackers and legislators weren't, but that isn't the current situation

In court, you bring in experts (usually professors from reputable universities) to state best practices. Judges don't act as experts in a trial.

Re: South Korea’s online security dead end

#82

Post by kragen »

likecarter wrote: post #81
kragen wrote: post #69

Earlier quoted context omitted.

that just leaves the courts to decide what the best practices are, and what due care is or isn't, which i think is actually what happened in south korea that would be great if judges were hackers and legislators weren't, but that isn't the current situation

In court, you bring in experts (usually professors from reputable universities) to state best practices. Judges don't act as experts in a trial.

judges decide who counts as experts, and doing that correctly requires expertise

this is why so many people get convicted on the basis of pseudoscience like lie detector tests and tracy harpster's 911 call analysis https://www.propublica.org/article/911-call-analysis-fbi-pol...

it would not be especially difficult to find a professor from a reputable university who would explain that using dynamically typed languages was malpractice, or that using the waterfall model was, or that using threads was, or that running the servers on microsoft windows was just fine, or that running virus scanners was useless, or that running virus scanners was essential and therefore it's malpractice to not run on an os that can run them, or that using crypto that had lost a nist competition was malpractice, or that unauthenticated rce security holes were unavoidable and the best you can do is to patch them quickly, or that you need to prove all your security-relevant code correct with coq or something before you ship it and therefore any security hole is malpractice, etc.

Re: South Korea’s online security dead end

#83

Post by kragen »

JAlexoid wrote: post #73
kragen wrote: post #35

Earlier quoted context omitted.

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

This comment is hard to understand. PCI-DSS is not a government body, nor is legally mandated by the government. It's not the government.

clueless regulation is equally harmful regardless of how it's imposed

both governments and visa are in a position to impose it

Re: South Korea’s online security dead end

#84

Post by LadyCailin »

astrange wrote: post #70
pessimizer wrote: post #51

Earlier quoted context omitted.

In non-authoritarian countries like the US, the users are responsible for all of the bank's losses.

They certainly aren’t. That’s what FDIC / Reg E / Reg NMS and co are for. US financial regulation is pretty customer friendly.

And who do you think pays if the FDIC is activated?

Re: South Korea’s online security dead end

#85

Post by kragen »

chunsj wrote: post #80
kragen wrote: post #35

Earlier quoted context omitted.

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

Neither, this should not be an example/a cautionary tale against government regulation. This is an example of wrong/invalid kind of regulation which other countries should not follow. We, SK, could not fixed this problem because the private sector (companies who pursuit their private interest and against public interest) depending on the wrong/invalid regulation has lobbied and prevented several attempts to fix the r…

the clueless regulation is the problem, not capitalism

once you're competing by lobbying for regulation what you're doing isn't capitalism anymore

Re: South Korea’s online security dead end

#86

Post by astrange »

LadyCailin wrote: post #84
astrange wrote: post #70

Earlier quoted context omitted.

They certainly aren’t. That’s what FDIC / Reg E / Reg NMS and co are for. US financial regulation is pretty customer friendly.

And who do you think pays if the FDIC is activated?

Not the specific customers of the failed bank.

And not really anyone else either. You'd lose more wealth in a financial crisis than you would from the government printing money to refill the FDIC fund.

Re: South Korea’s online security dead end

#87

Post by thaumasiotes »

MBCook wrote: post #59
kragen wrote: post #35

Earlier quoted context omitted.

this is a cautionary tale for people who hope that government regulation will solve the current computer security disaster outside korea you cannot solve problems by giving authority to people who are motivated to solve them, but do not understand what the problem is, so that they can tell the people who do understand the problem what to do anyone who has dealt with pci-dss presumably knows this but that is a much sm…

Isn’t this an issue of mandating the means and not the ends? If the regulations said banks had to be secure by ‘taking all due care’ and follow ‘best practices’ and such, this wouldn’t be such an issue. That gives room for improvements and for problematic standards to be weeded out over time. It sounds like the government instead said banks had to be secure by using (for example) SSL 1.0 with a 64-bit key. Because th…

> This is the danger of legislating an exact how. It may be the right thing sometimes, but it can also go sideways.

> If the regulations said banks had to be secure by ‘taking all due care’ and follow ‘best practices’ and such, this wouldn’t be such an issue.

Legislating the outcome is even worse than legislating the means.

American medical care is regulated in the exact manner you describe - a doctor is required to follow the local standard of care, whatever that may be.

This means that every time anyone takes a precaution, it becomes part of the standard of care and must be taken in every case from now until the end of time. If you stop doing it, perhaps because on a cost-benefit analysis it has wildly negative benefits, you're not following the local standard of care and you're wide open to a malpractice suit.

Your preferred legal phrasing is a ratchet; the only outcome it can ever have is insanity.

Legislating outcomes can be even worse than that: https://www.theonion.com/proposed-bill-would-bring-4-000-tro...

Re: South Korea’s online security dead end

#89

Post by shkkmo »

LadyCailin wrote: post #84
astrange wrote: post #70

Earlier quoted context omitted.

They certainly aren’t. That’s what FDIC / Reg E / Reg NMS and co are for. US financial regulation is pretty customer friendly.

And who do you think pays if the FDIC is activated?

The FDIC is funded by insurance premiums that banks pay that are then invested an generate returns.

Thus it comes out of the returns the bank generates using your money to invest, and then also from the returns the FDIC generates investing the premiums.

In the case of a black swan event, the US Gov might have to step in to increase funding, but that is not how the FDIC normally operates.

Re: South Korea’s online security dead end

#90

Post by gruez »

r2vcap wrote: post #28

Disclaimer. I am Korean and currently live in Korea. Online banking in Korea is very poor, so even though I code on Linux and macOS, I use Windows for internet banking. As in many other countries, banking in Korea is a state-regulated industry. However, Korea's regulatory system rule downs to the smallest detail. For example, in the Digital Signature Act(전자서명법), a content that allows only digital certificates in the…

>Korea's financial regulators are strict, but Korean politicians and media are paternalistic, so if there's a problem with finance, most of them try to side with financial consumers. For example, the issue of password leakage due to a keylogger installed on a user's PC is considered to be a bank problem, not a user problem.

Isn't this also the case in the US? You're generally not liable for fraudulent transactions, as long as you took "reasonable" measures to prevent the fraud from happening. Given the technical ineptitude of the average person, banks/regulators will rarely blame the consumer.

Post reply on HN