There's always a commercial before the movie starts here and they kind of want to show off their sound system so they boost the volume but wayyyy too much.
Dear Abby,
My mother-in-law passed away last October. She was very, uh, involved in my and my spouse's life, so I was if not exactly looking forward to her demise (perish the thought!) at least ready for the next, more independent stage of my life.
I should have suspected, when she decided in ...
@MarkBuffalo the thing is, it's all hard, and companies don't want/can't spend enough money to keep up. Now everything is connected/online and people want it faster/cheaper, the chances of more secure ain't high. So the senior people accepting risks is a kind of inevitable thing
Yeah, it's pretty hard, but from my perspective I know a lot of things about networking, systems, programming, black hattery (not that I would do this to anyone but myself), etc. SO when I come up with a solution, I have to spend most of my time managing risk... and thinking of ways to minimize the impact of my changes on the business, etc
@MarkBuffalo TBH it is a complex topic and one which is very situational (i.e. the company/industry/country affect it) the first step tends to be agreeing a threat model (i.e. who do we think will try to break this control and how) then you can work on appropriate controls for the system...
a developer team says "it would take us many hours of work and maintenance to implement authentication for this, we'll accept the risk" when a sec team says "you should use authentication"
and if it's a money-making feature they're not going to pull it
@Ohnana then the "business owner" gets to make the call... and they have to weigh blowing the budget (they didn't figure they needed this control) against the chance of having a breach later, and they almost always tend towards taking the risk...
which is logical from their perspective
the problem is that there's a tragedy of the commons effect at play, if they have a breach it may cause problems outwith the system (e.g. negative publicity) but that isn't necessarily factored in when decisions are made
well planned systems reduce this problem (everyone knows the costs up front) but it's hard to do well in some cases
Why would it necessarily cost a lot of money to fix?
As a developer with a penchant for infosec, I can fix a lot of things really quickly during downtime
@RоryMcCune I've noticed that
The developer, for example, is your payroll... you can pay them to fix it. Of course, as long as it isn't interrupting critical services, etc., you should be alright... when downtime comes into play, you have a problem, I'd say
rules for incident responders: 1) breathe, 2) actually read messages, 3) when you hear hoofbeats, think "horses" not "zebras" - God what a waste of time my juniors sent me on this morning ....
Seriously though, do you put your credentials in your email signatures or is that a faux pas these days?
Do you hang your certs at your desk? Or do you stay mum about them?
Certifications don't mean everything and are by no means a guaranteed indicator of skill, but they do add some credibilit...
@RoryAlsop yeah bruh and another one I think I've heard of, the others... not so much. I'm a bit worried to be googling "Sorry I forgot you were hard", sounds like a job for an incognito window :)
@Ohnana I just like the idea of sneaking some appropriate imagery into the presentation if I can "e.g. hiding a badly photo-shopped michael Cera in there"
@RоryMcCune Well, they previously succeeded in getting their CA key compromised. That set a pretty high bar. It is a tribute to their persistence that they keep trying to do worse.
exploiting it is super-simple. someone visits a page you own, you check the User-Agent, if it's Chromodo, you pull as many cookies as you can from their cookie jar, then go on a spree of pretending to be that user on various sites
Comundo was an ISP (owned by the Lycos search engine) that around 2000 was running a TV ad that showed you how to connect to the Internet: just download the connection kit, run it, and voilà! you are connected to the Internet.
@JukEboX ah . Same origin policy is the only reason that any website can't pull the cookie of any other (and thereby steal the users session). Without Same origin if you visit a malicious website they can steal your session with any other site and impersonate you
@MarkBuffalo and that.. is a big part of the problem
it's like anyone saying "yeah I can build your house for you and wire up the gas and electric"
@JukEboX nono any site you've logged into. Say you visit "maliciousiste.com" in a browser that you've used to visit facebook, amazon etc. The owner of the malicious site can just pull your facebook, amazon etc cookies
what stops that happening normally is Same origin policy which says that sites can only access cookies from the same origin as them (so malicioussite.com can only see cookies for malicioussite.com and not facebook.com)
what comodo did is disable that protection in their browser (god only knows why)
it's basically the cornerstone of browser security...
@RоryMcCune I'll even list in the readme: "steals all your data and collects it." I'll list everything it does wrong.... See how many people will use it even then
Keeping the design secret does not make the door insecure per se; however, believing that it adds to security is a dangerous delusion.
If revealing the details of the authentication system would allow breaking it, then that system is pure junk and should be discarded. Therefore, if you did your ...
Keeping the design secret certainly adds to the security of the system. The dangerous delusion is believing that a system can be kept secure by only maintaining the confidentiality of the design.
I do agree that obscurity has traditionally been applied with the avowed goal of increasing security, and that many people have come to believe, and still do, that they succeeded at increasing security by keeping the design obscure.
However I have never found any instance where security was really unambiguously improved in that way.
In practice, what helps a lot is discretion.
If you do not babble about your system, then chances are that most potential attackers won't even become aware of the system existence.
@ThomasPornin The exact value of security by obscurity is certainly up for debate. However, I don't think anyone can sensibly say that it detracts from the system's security.
@ThomasPornin @Iszi keeping the design secret does not at all increase security; in the worst case, it hides security weaknesses (which might be a good thing, depending on who you consider it to be most hidden from); in the best case (where there are no trivial vulnerabilities that would be exposed by publishing the design), it still does not increase security - but it does minimize the attack surface.
Minimizing attack surface (even without the presence of a vulnerability) is definitely a good thing; however this needs to be weighed and traded-off (tradeoffed?) against the benefits of publishing, namely many-eyes and security theater.
@RоryMcCune I had a big banner that you banned @Ohnana
Dear Abby,
My mother-in-law passed away last October. She was very, uh, involved in my and my spouse's life, so I was if not exactly looking forward to her demise (perish the thought!) at least ready for the next, more independent stage of my life.
I should have suspected, when she decided in ...
Seriously though, do you put your credentials in your email signatures or is that a faux pas these days?
Do you hang your certs at your desk? Or do you stay mum about them?
Certifications don't mean everything and are by no means a guaranteed indicator of skill, but they do add some credibilit...
