3 ms·
I've accepted that we live in an age where no one can secure data that is coveted by determined attackers. Even companies with the best infosec are often taken
by drzaiusapelord 11y ago
I've accepted that we live in an age where no one can secure data that is coveted by determined attackers. Even companies with the best infosec are often taken down by the simplest social engineering or clumsy spear-phisihng attempts that work well enough.
I hope this changes as we migrate away from passwords and passphrases to mandatory two factor login with physical keyfob tokens, from C to Rust, and from putting things directly onto the internet to putting everything behind a IPS/IDS that updates itself via signatures, honepots, etc. Especially in the home where no one runs IPS, the same way early consumer OS's didn't bother to ship with firewalls.
Phones need something like this too, especially with blocking known spammer numbers/providers. Everyday I get an Indian call center impersonating either state farm or blue cross. I have no way to stop this as they randomize the phone number each time, often in mocking ways like starting with a movie 555 prefix or having a prefix starting with 1.
I also don't want a relationship with companies like Dell where they store all my info. Why can't I buy something via a private OpenID/Persona-like system that has a tokenized version of my credit card and Dell just ships the product? I must have hundreds of accounts spread out with various sites, vendors, etc. Each of them ripe for the taking by scammers and hackers with my real name, stored card, etc.
I hope this stuff is what breaks the camel's back. IT security right now is a nightmare. I suspect it will get much worse before it gets better. Cryptolocker didn't suddenly fix corporate IT security. From what I can tell, its just as bad as its ever been.
- prplhaz4 11y agoBecause retailers figured out a while ago that having a personal relationship with their customers (knowing everything about them) is EXTREMELY valuable. Think of the merchant wars with MC/Visa/ApplePay...etc as well as how much they sink into loyalty programs. Knowing your customer pays off in spades (until you have a security breach and get sued into oblivion). Would be nice to be able to opt-in to a "forget everything you know about me" program - Newegg would probably get tons of business from paranoid nerds with an option like that in place.
- chris_wot 11y agoI have to warn you that you just triggered a liars paradox.
- rbc 11y agoIt does feel like Internet security depends on the software equivalent of Shōji doors, windows and dividers. We need some stronger construction. No offense to traditional Japanese architecture intended. It's just descriptive.
- davismwfl 11y agoI agree that there is no way to prevent the determined hacker or state actor from breaking into just about anything they want. Just like putting locks on our doors keeps the common criminal out for the most part, but the determined guy/gal will find his way in. What always bothers me more is how caviler many companies, especially many marketing companies I have seen, are with our personal details. As recently as just a few years ago I was fixing one such marketing company's issues, like using sequential id's on exposed web links sent in emails. Which all you had to do was increment the id and you could get personal details for other people from the database (which had happened). They fixed that issue and some others but still never addressed security as a whole, which just bugged me. Plain text passwords in a database, no encryption on sensitive data etc. And I see it over and over, a company won't change unless they are forced to, and then it is change only enough to appear secure, not be secure.