Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stop Hacklore – An Open Letter

hacklore.org

Post reply on HN
Print view View original

91–100 of 115 posts

Re: Stop Hacklore – An Open Letter

#91

Post by dolmen »

peanut-walrus wrote: post #60
johncoatesdev wrote: post #31

Earlier quoted context omitted.

Updating software is good advice. Do you realize how many CVEs are reported on a daily basis? Once you've got a password manager you're largely protected against phishing, so the biggest target becomes your computer, and the most likely way to compromise that would be through outdated software with public vulnerabilities. What do you expect your browser security levels to the max to do? Browsers are designed to be se…

Vulnerabilities in the software you use don't even make the top 5 in ways bad guys actually compromise you. The most common attacks: - Phishing - Getting the user to run the malware themselves - Credential reuse - Literal physical theft - Users uploading their own stuff completely willingly to some sketchy service Vulnerabilities in the services you use are important, but you can't update those yourself :)

> Users uploading their own stuff completely willingly to some sketchy service

> Getting the user to run the malware themselves

Here are two good reasons for not trusting a password manager that stores your vault online.

On the other hand, most people have no backup strategy for their digital life.

Re: Stop Hacklore – An Open Letter

#92

Post by [deleted] »

eulgro wrote: post #89
yegle wrote: post #77

Earlier quoted context omitted.

There seems to be an easy solution: use a password manager and save the answer to the question as an additional password. (This is actually a FR to any password manager's product team: it's time to treat things like 2FA recovery code and secret question answers as first class citizen in your product).

Exactly. My mother's maiden name is "xGj5kLm9abM16q". Which is why she no longer uses it I guess?

[deleted]

Re: Stop Hacklore – An Open Letter

#93

Post by 8organicbits »

drtgh wrote: post #87
8organicbits wrote: post #54

Earlier quoted context omitted.

Then what? The user presumably sees TLS certificate warnings since you don't have valid certicates. HSTS would prevent downgrades to plain HTTP and is pretty common on sensitive websites. Isn't the better advice to avoid clicking through certificate warnings? That applies both on and off open wifi networks. There is a privacy concern, as DNS queries would leak. Enabling strict DoH helps (which is not the default brow…

I am afraid that it is not only about privacy (that they recommend ignoring), there are many options to chose, like CA vectors, lets say TrustCor (2022), e-Tugra (2023), Entrust (2024), Packet injection vectors, or Click here or use your login first vectors as you commented, bugs and configurations. This ones known. Therefore I just cannot believe that those who wrote the open letter did not even though about such si…

> like CA vectors

This gets complicated because you're not safe on your home or corporate network either when CAs are breached. The incident everyone talks about, DigiNotar (2011), had stolen CA keys issuing certificates that intercepted traffic across several ISPs. If that's the threat you're looking to handle, "avoid public wifi" isn't the right answer. Perhaps you're doing certificate pinning, application level signing, closed networks, etc.

> Entrust (2024)

I recently wrote a blog post[1] about CA incidents, so I notice this one isn't like the others. Entrust's PKI business was not impacted by the hack and Entrust remains a trusted CA.

> Click here or use your login

Password manager autofill is the solution there, both on public wifi and on a corporate network. Perhaps an ad blocker as well.

> people connecting to an unknown unsupervised network

Aren't most people's home networks "unsupervised"?

[1] https://alexsci.com/blog/ca-trust/

Re: Stop Hacklore – An Open Letter

#94

Post by dolmen »

golem14 wrote: post #66
thomastjeffery wrote: post #27

Don't worry about cookies or bother using a VPN, because... you are being tracked anyway? What's the point of including such a defeatist stance? > the real world across industry, academia, and government. Gotcha, so no one here gives a shit about privacy. They only care about avoiding the inconveniences of fraud and leaked secrets. Use a password manager and a feature-complete adblocker (ublock origin on Firefox). Se…

BTW, I really would like to have a way to partially clear cookies – i.e., I don't want to be signed out of gmail, and maybe not out of the Mechanic's Bank of Alaska or Amazon or Netflix, but most other things could go. I don't think this is easy in Chrome, Safari or other mainstream browsers, is it? Yesyes, I do know that Big Ad can mostly stitch together some proxy profile of me anyway, but it would be more blurry.

Just use a separate browser profile for your critical accounts.

Re: Stop Hacklore – An Open Letter

#95

Post by card_zero »

thayne wrote: post #65
HiPhish wrote: post #24

I have two more to add to the list: > Secret questions No, my mother's maiden name is not a secret. And some questions like "who was your best friend in elementary school?" might have different answers depending on when you ask me. Plus, unless my best friend's name was Jose Pawel Mustafa Mungabi de la Svenson-Kurosawaskiwitz (we used to call him Joe) it's pretty easy to guess with a dictionary attack. The only way t…

> "kittycat", but "k!ttyc4T" is still less secure than "horse battery staple correct". Well... something like that. Please don't use exactly "horse battery staple correct".

Oh, that was probably the point, that it's very weak but still better than k!ttyc4T. We both got downvoted for not picking up that implication. This thread requires too much mind-reading for me.

Re: Stop Hacklore – An Open Letter

#96

Post by vrighter »

jeltz wrote: post #78
yegle wrote: post #77

Earlier quoted context omitted.

There seems to be an easy solution: use a password manager and save the answer to the question as an additional password. (This is actually a FR to any password manager's product team: it's time to treat things like 2FA recovery code and secret question answers as first class citizen in your product).

KeepassXC already supports 2FA.

this is not 2fa though

Re: Stop Hacklore – An Open Letter

#97

Post by vrighter »

ocdtrekkie wrote: post #15
Animats wrote: post #8

Note that most of the signers are from companies which collect substantial consumer information for revenue purposes. Hence the emphasis on "updating". And the absence of "turn up browser security levels to max" or "get a good ad blocker". Also, any password manager that's "cloud based" is potentially a security hole. Yeah, they say the server is secure. Right.

Password managers are one of those things I am still stunned is staying popular for advice, even though it's nearly akin to "use one password for everything". I assume a big part of it is the affiliate deals subscription password managers have with infosec influencers. There are absolutely valid use cases, but they are much fewer and further between than people claim.

in my case it's use one password, that i have not used anywhere else ever, and a physical yubikey that sites don't let you use anyway.

Re: Stop Hacklore – An Open Letter

#98

Post by voodooEntity »

johncoatesdev wrote: post #43
voodooEntity wrote: post #5

So, since this seems to be relevant im a CISO myself. And i would definitely not agree with everything in this letter. Personally, i think the worst part about it is handling a low probability as something that's not gonne happen. Thats, especially in IT-Sec, one of the worst practices. To take on point as example - the "never scan public QR codes". Apart from the fact that there have been enaugh exploits in the past…

It's funny your warning about QR codes goes onto warn about PDF exploits. Yet you clicked the link to this article, by your own definition opening you up to "a whole different world of possible exploitations via whatever file is being returned". It's the nature of the internet to follow links, but our updated browsers keep us safe from exploits. When was the last time you saw an un-targeted mass 0-day exploit campaig…

First of all, the problem here is more a point of trust.

Ill try explain based on your example with "any link".

If you type amazon.com you trust that there will be amazon.com returned and not any maleware. On a QR code, the target url isn't as obvious so the user should be aware that a qr code, even if for example below it says "hackernews - the best news in the IT world" the qr code could still link to "https://news.xn--combinator-xwi.com" (edit : because ycombinator is a nice website it auto resolves the unicode char here : bad example tho but i dont have the time to recraft it and i guess you know unicode link/url tricks therefor i can just let it be the way i pasted it) did u spot the difference? Its not a regular "y" and just could get you on a fishing page. So ye even just know "urls" that you review on a qr code still can be dangerous if not typed by yourself. And than, for alot of users it prolly wouldn't event take that of a measure to trick them. Its not like the average Jane/John Doe does very good on url verification - else alot of scammers would go bancrupt.

Therefor i hope you understand you don't need a 0day. I also stated that in my answer but you seem to be so keen focusing on me listing some 0days (to disprove the initial article) that you kinda lost my point.

Also - sure everyone should keep his/her device updated - noone said anything else. Apart from that no i wouldn't recommend people to use whatsapp but that was't the point and im not actually sure why you mentioning it but here i said it : i wouldn't recommend it if that helps ¯\_(ツ)_/¯

Edit: not to forget - i for myself know that clicking on unknown links poses a certain risk and have several measures in place to reduce this risk.

Re: Stop Hacklore – An Open Letter

#99

Post by voodooEntity »

Hizonner wrote: post #81
voodooEntity wrote: post #5

So, since this seems to be relevant im a CISO myself. And i would definitely not agree with everything in this letter. Personally, i think the worst part about it is handling a low probability as something that's not gonne happen. Thats, especially in IT-Sec, one of the worst practices. To take on point as example - the "never scan public QR codes". Apart from the fact that there have been enaugh exploits in the past…

"Never scan public QR codes" is functionally equivalent to "never type in a URL and never click on a link". Other than the smallish scan-specific attack surface that you mention and then largely dismiss, there's nothing that makes QR codes more dangerous than any other way of delivering links. It's somewhere between impractical and impossible to evaluate a URL and know anything about its "safety". So if you can't mak…

Well we are as sadly so often in the world of only "black and white" discussion without ignoring gray areas.

While i pointed out that i think that the claim of public qr codes are always safe and cannot pose any danger is wrong, i also didn't state you should wall yourself in and handle like everything is f0rk3d.

You, as with everything in life, should evaluate whats worth risks and what not. Scanning a QR code in a museum linking an audio track to describe the exhibt, scanning a qr code in a restaurant for a menu, scanning a qr code from a sticker on a traffic light.

These are 3 completly different scenarios that can be weighted different and therefor not be answered with a single "yep good/bad" for every situation. My initial point regarding the article was that i don't think stating scanning public placed qr codes is always safe. People should not just NEVER scan a public qr, but they should understand possible risks, they should learn how to evaluate which risks are worth taking, and also learn what thinks they should look for. My point is that of make the public more informed.

Re: Stop Hacklore – An Open Letter

#100

Post by voodooEntity »

tptacek wrote: post #35
voodooEntity wrote: post #5

So, since this seems to be relevant im a CISO myself. And i would definitely not agree with everything in this letter. Personally, i think the worst part about it is handling a low probability as something that's not gonne happen. Thats, especially in IT-Sec, one of the worst practices. To take on point as example - the "never scan public QR codes". Apart from the fact that there have been enaugh exploits in the past…

The article doesn't claim that things like O.MG don't exist, just that they're not a serious threat to modern devices. It's explicit on that point.

Well i just listed the O.MG cable to show that there are alot of people not knowing that such things exist. My point is that of : people should be better informed about what vectors of attacks exist. So mentioning the cable (in relation to a coworker coming to my desk and asking about it) was just an example of how informed average Joe/Jane are and that i think this is the more important part - educate the public not just tell them not to worry.
Post reply on HN