4 ms·

Came here to say just that. I did general customer support for a telco for a few months a while back, and most of the general public can't really deal with high

by vacri 11y ago

Came here to say just that. I did general customer support for a telco for a few months a while back, and most of the general public can't really deal with high security for personal information. If you were as strict with security as you should be, you'd be locking half of your subscribers out of their accounts eventually. This would create a phenomenal amount of follow-up paperwork for your company, meaning higher costs on your end and greater resentment on the customer's end - costs go up for you and customers head elsewhere. It's why banks still use laughably short and simple PIN codes.

bigiain 11y ago
While that's true, and perhaps even needs to be "the default", there really needs to be a way to say "Hey, I'm concerned, and am prepared to take responsibility for my own access credentials. I demand you categorically _do not_ disclose any of my personal information to anyone without a warrant or court order." And for that sort of demand to have appropriate legal teeth to ensure people collecting that data are sufficiently motivated to act properly on it.
- bigiain 11y ago
  Startup idea: Whitehat Social Engineering (as a service). You authorise a whitehat team to attempt to social engineer all your discoverable internet presence/accounts to see what personal information their systems and/or customer service will disclose based on existing publicly available data. (I suspect legally that'd at least be on the white-ish side of grey rather than blackhat...) I wonder how long it'll be before (or how long ago it became) sensible to register a shell company as the holder of any public record you're legally required to make public? It's probably much easier to roll your shell companies "registered address" if you discover it's been compromised than it is to move house every time Amazon's customer service goes "above and beyond" on your behalf to your attackers...
  - JoshTriplett 11y ago
    > Startup idea: Whitehat Social Engineering (as a service). You authorise a whitehat team to attempt to social engineer all your discoverable internet presence/accounts to see what personal information their systems and/or customer service will disclose based on existing publicly available data. (I suspect legally that'd at least be on the white-ish side of grey rather than blackhat...) You'd need to take care to avoid getting people locked out of their accounts, but otherwise that sounds like a useful service for the small fraction of people who have a high enough profile that others may actively target them. I don't know if that represents a large enough target market for a sustainable business, but it might. > I wonder how long it'll be before (or how long ago it became) sensible to register a shell company as the holder of any public record you're legally required to make public? It's probably much easier to roll your shell companies "registered address" if you discover it's been compromised than it is to move house every time Amazon's customer service goes "above and beyond" on your behalf to your attackers... Depends on how easily you can register a shell company that doesn't itself have easily traceable public records of ownership. Little point in the indirection if you can then look up the shell company and its official owners and legal contacts.
    - bigiain 11y ago
      Whitehat Social Engineering won't be "a unicorn", so don't expect Sandhill Rd to invest, but it's not like whitehat pentesting is a unicorn type idea either, and there's lots of people running successful and profitable <sneer type="SV Startup DoucheBro">lifestyle businesses</sneer> doing that.
  - whitehat_data 11y ago
    There are companies already doing this.
- JoshTriplett 11y ago
  Unfortunately, far more people think they want that than can take full personal responsibility for it. See also: people who don't understand that full-disk encryption means they lose their data if they forget their passphrase. That doesn't make full-disk encryption in any way bad, but if you train people to think that all accounts have a "forgotten password" option, they might get a nasty surprise.
  - pyre 11y ago
    While ago I setup FDE on a new drive, put the passphrase in my encrypted password file, put the new copy of the password file on the encrypted drive, and then proceeded to wipe machine that had the only other copy of that password file (well at least the up-to-date version with that passphrase). A nasty surprise indeed. Thankfully I only lost a month's worth of files (mostly photos).
    - bigiain 11y ago
      Heh. In the spirit of it being my turn to ' … belatedly reveal the time … " I mentioned upthread… One time I had my carefully encrypted secrets thoughtfully spread across my laptop drive, my iPod as backup #1, and an external hard drive as backup #2. All of which I had in my backpack one night - which I proceeded to leave at a restaurant where I'd been sitting outside on the sidewalk tables, and I didn't notice until _way_ after they'd closed for the night. (I used up a _great_ deal of luck that night - we went to that restaurant enough to be "regulars", and the waitstaff found it and knew it was one of ours, and it was waiting for me when they opened the next day...)
  - bigiain 11y ago
    Sure - it needs to be somewhat difficult to turn on, and turning it on needs to very clearly include an "I accept all responsibility for this" declaration. Most of "us" already deal with these things though - there's no "forgot password" for my ssh keys or my ssl keys or my topt seeds - there's no "forgot password: for my 1Password and Keypass safes. We occasionally get to laugh at out less diligent colleagues and peers who belatedly reveal the time they "lost" the ssl private key or the production webserver ssh key, but it's not like we see critical infrastructure falling apart regularly because of forgotten-but-unretrievable passphrases. But I suspect you're right, there'd probably be a whole lot of "Hold my beer and watch me turn on full personal responsibility here! Oh, hang on - shit. Oooops..." if Ama-Face-Goo-Yah-stagram allowed this...

by vacri 11y ago

bigiain 11y ago

While that's true, and perhaps even needs to be "the default", there really needs to be a way to say "Hey, I'm concerned, and am prepared to take responsibility for my own access credentials. I demand you categorically _do not_ disclose any of my personal information to anyone without a warrant or court order." And for that sort of demand to have appropriate legal teeth to ensure people collecting that data are sufficiently motivated to act properly on it.

bigiain 11y ago
Startup idea: Whitehat Social Engineering (as a service). You authorise a whitehat team to attempt to social engineer all your discoverable internet presence/accounts to see what personal information their systems and/or customer service will disclose based on existing publicly available data. (I suspect legally that'd at least be on the white-ish side of grey rather than blackhat...) I wonder how long it'll be before (or how long ago it became) sensible to register a shell company as the holder of any public record you're legally required to make public? It's probably much easier to roll your shell companies "registered address" if you discover it's been compromised than it is to move house every time Amazon's customer service goes "above and beyond" on your behalf to your attackers...
- JoshTriplett 11y ago
  > Startup idea: Whitehat Social Engineering (as a service). You authorise a whitehat team to attempt to social engineer all your discoverable internet presence/accounts to see what personal information their systems and/or customer service will disclose based on existing publicly available data. (I suspect legally that'd at least be on the white-ish side of grey rather than blackhat...) You'd need to take care to avoid getting people locked out of their accounts, but otherwise that sounds like a useful service for the small fraction of people who have a high enough profile that others may actively target them. I don't know if that represents a large enough target market for a sustainable business, but it might. > I wonder how long it'll be before (or how long ago it became) sensible to register a shell company as the holder of any public record you're legally required to make public? It's probably much easier to roll your shell companies "registered address" if you discover it's been compromised than it is to move house every time Amazon's customer service goes "above and beyond" on your behalf to your attackers... Depends on how easily you can register a shell company that doesn't itself have easily traceable public records of ownership. Little point in the indirection if you can then look up the shell company and its official owners and legal contacts.
  - bigiain 11y ago
    Whitehat Social Engineering won't be "a unicorn", so don't expect Sandhill Rd to invest, but it's not like whitehat pentesting is a unicorn type idea either, and there's lots of people running successful and profitable <sneer type="SV Startup DoucheBro">lifestyle businesses</sneer> doing that.
- whitehat_data 11y ago
  There are companies already doing this.
JoshTriplett 11y ago
Unfortunately, far more people think they want that than can take full personal responsibility for it. See also: people who don't understand that full-disk encryption means they lose their data if they forget their passphrase. That doesn't make full-disk encryption in any way bad, but if you train people to think that all accounts have a "forgotten password" option, they might get a nasty surprise.
- pyre 11y ago
  While ago I setup FDE on a new drive, put the passphrase in my encrypted password file, put the new copy of the password file on the encrypted drive, and then proceeded to wipe machine that had the only other copy of that password file (well at least the up-to-date version with that passphrase). A nasty surprise indeed. Thankfully I only lost a month's worth of files (mostly photos).
  - bigiain 11y ago
    Heh. In the spirit of it being my turn to ' … belatedly reveal the time … " I mentioned upthread… One time I had my carefully encrypted secrets thoughtfully spread across my laptop drive, my iPod as backup #1, and an external hard drive as backup #2. All of which I had in my backpack one night - which I proceeded to leave at a restaurant where I'd been sitting outside on the sidewalk tables, and I didn't notice until _way_ after they'd closed for the night. (I used up a _great_ deal of luck that night - we went to that restaurant enough to be "regulars", and the waitstaff found it and knew it was one of ours, and it was waiting for me when they opened the next day...)
- bigiain 11y ago
  Sure - it needs to be somewhat difficult to turn on, and turning it on needs to very clearly include an "I accept all responsibility for this" declaration. Most of "us" already deal with these things though - there's no "forgot password" for my ssh keys or my ssl keys or my topt seeds - there's no "forgot password: for my 1Password and Keypass safes. We occasionally get to laugh at out less diligent colleagues and peers who belatedly reveal the time they "lost" the ssl private key or the production webserver ssh key, but it's not like we see critical infrastructure falling apart regularly because of forgotten-but-unretrievable passphrases. But I suspect you're right, there'd probably be a whole lot of "Hold my beer and watch me turn on full personal responsibility here! Oh, hang on - shit. Oooops..." if Ama-Face-Goo-Yah-stagram allowed this...