4 ms·

I feel this is a defeatist stance to take; LFI's are a solved problem and we should be looking to how and why this happened and prevent it in the future. Anoth

by wepple 10y ago

I feel this is a defeatist stance to take; LFI's are a solved problem and we should be looking to how and why this happened and prevent it in the future. Another angle: we're supposed to not do anything that requires any form of confidentiality online? can't book a doctors appointment, transfer money, send emails to family?

twelve40 10y ago
It's not defeatist, it's personal hygiene. Sure there are some convenience trade offs and edge cases, but things like Facebook, Dropbox, etc can almost assuredly be treated as "eventually public" no matter how many buttons and knobs they add. The sooner people realize it, the better.
- rmc 10y ago
  > Sure there are some convenience trade offs and edge cases Some convenience trade offs? You're suggesting that people don't use any modern bank, don't use any hospital, don't interact with any state body at all. Should we go live in a cabin in the woods?
  - tortasaur 10y ago
    It seems to me that what they're actually saying is to tread carefully when it comes to social media and cloud services.
- anigbrowl 10y ago
  What about people who want to communicate and socialize but want some privacy?
  - intrasight 10y ago
    Go for a hike in the woods with them
  - tortasaur 10y ago
    Signal.
nickpsecurity 10y ago
It's a realistic stance. What's possible or achievable is not what's commonly done. Even companies that know better or have staff often don't care enough to apply it. Malware with keyloggers and search functions hit computers regularly. The expectation should be, "If it's connected to Internet, treat it like it's public." It's why quite a few organizations still used air gapped systems, link/IP encryption between locations, and private, leased lines. A smaller number use more secure or just obscure endpoints that can't execute the programs malware authors write. You don't read about such people in the news getting hit by malware or hackers. They can be hit, esp by high-strength attackers, but it's just rare because they don't trust the Internet, Windows, etc in how they do IT.
- cm2187 10y ago
  This is such a statement of failure of the IT industry as a whole. And I think it's right. None of the large OS are fit for purpose. And it's about time that regulators start protecting unsuspecting consumers from unscrupulous incompetent fly-by-night developpers like the ones behind this website.
  - nickpsecurity 10y ago
    I wrote a quick rundown of it on Schneier's blog discussing liability: https://www.schneier.com/blog/archives/2011/09/an_interesting.html#c595111 https://www.schneier.com/blog/archives/2011/09/an_interestin... Idea being we just combine the right features, often standardized in libraries, with the most cost-effective of assurance activities proven to work. I gave a list of the latter to pick and choose from in another discussion: https://news.ycombinator.com/item?id=10734477 https://news.ycombinator.com/item?id=10734477 Cleanroom methodology with safer languages with test-case generation, battle-tested libraries for common risk areas (esp web attacks or crypto), automation of parsing/protocol handling, static analysis to eliminate common issues, and basic code review would knock out vast majority of code-injections.
- wepple 10y ago
  I think I mostly agree with what you're saying. I'm under no illusion that things can actually be secured; I don't own a single device that I'm not even slightly suspicious is running malicious code or otherwise leaking information I'm not aware of. Whether by negligence or purely the asynchronous nature of attack. But is it productive for us to declare everything unsafe and somewhat give up believing we can build and use safe platforms? I think there's a balance somewhere. I (to give a rather crude example, apologies) would never take a nude photograph of my partner on a digital camera because it's an unacceptable risk. But I'll share fairly personal thoughts knowing that they may come back to embarass me one day. I want to put the pressure on companies who make such bold claims about their "military grade encryption" to face bankruptcy and shame when it's proven they're full of lies and negligence; if we just assume everything can be attacked with an LFI, it seems we've stopped caring about trying. Caveat: I still haven't had breakfast, I don't have my best thinking cap on right now, but that's my gut instinct.
chriswarbo 10y ago
The reason you can transfer money online is because banks and payment providers are insured, so when things go wrong you can (usually) get your money back. Online banking doesn't implement security features to make things safe; it's to make the insurance cheaper.
- snoman 10y ago
  Yes, and the insurance is cheaper because the probability of things going wrong is lower. Transitively, they are doing it to make things safe.
mathgenius 10y ago
This is a dark thought, but your country may one day slip into becoming a totalitarian state, where the data of private companies is appropriated by the powers that be.
pessimizer 10y ago
> we're supposed to not do anything that requires any form of confidentiality online? can't book a doctors appointment, transfer money, send emails to family? You probably won't want to do any of this stuff outdoors in 10 more years, or indoors around a smartphone, television set, refrigerator, or any object with flashing LEDs on it. As a combined network, smart audio coverage can be made to be so complete that incomplete areas will arouse suspicion. Registering on (or even visiting) an internet site is just slightly different than signing a contract (and in some opinions, legally equivalent.) If you had to sign a form with your address to visit a prostitute, and you couldn't even open the door without it recording your license plate number - what kind of expectation of privacy could you reasonably have?

by wepple 10y ago

twelve40 10y ago

It's not defeatist, it's personal hygiene. Sure there are some convenience trade offs and edge cases, but things like Facebook, Dropbox, etc can almost assuredly be treated as "eventually public" no matter how many buttons and knobs they add. The sooner people realize it, the better.

rmc 10y ago
> Sure there are some convenience trade offs and edge cases Some convenience trade offs? You're suggesting that people don't use any modern bank, don't use any hospital, don't interact with any state body at all. Should we go live in a cabin in the woods?
- tortasaur 10y ago
  It seems to me that what they're actually saying is to tread carefully when it comes to social media and cloud services.
anigbrowl 10y ago
What about people who want to communicate and socialize but want some privacy?
- intrasight 10y ago
  Go for a hike in the woods with them
- tortasaur 10y ago
  Signal.

nickpsecurity 10y ago

It's a realistic stance. What's possible or achievable is not what's commonly done. Even companies that know better or have staff often don't care enough to apply it. Malware with keyloggers and search functions hit computers regularly. The expectation should be, "If it's connected to Internet, treat it like it's public." It's why quite a few organizations still used air gapped systems, link/IP encryption between locations, and private, leased lines. A smaller number use more secure or just obscure endpoints that can't execute the programs malware authors write. You don't read about such people in the news getting hit by malware or hackers. They can be hit, esp by high-strength attackers, but it's just rare because they don't trust the Internet, Windows, etc in how they do IT.

cm2187 10y ago
This is such a statement of failure of the IT industry as a whole. And I think it's right. None of the large OS are fit for purpose. And it's about time that regulators start protecting unsuspecting consumers from unscrupulous incompetent fly-by-night developpers like the ones behind this website.
- nickpsecurity 10y ago
  I wrote a quick rundown of it on Schneier's blog discussing liability: https://www.schneier.com/blog/archives/2011/09/an_interesting.html#c595111 https://www.schneier.com/blog/archives/2011/09/an_interestin... Idea being we just combine the right features, often standardized in libraries, with the most cost-effective of assurance activities proven to work. I gave a list of the latter to pick and choose from in another discussion: https://news.ycombinator.com/item?id=10734477 https://news.ycombinator.com/item?id=10734477 Cleanroom methodology with safer languages with test-case generation, battle-tested libraries for common risk areas (esp web attacks or crypto), automation of parsing/protocol handling, static analysis to eliminate common issues, and basic code review would knock out vast majority of code-injections.
wepple 10y ago
I think I mostly agree with what you're saying. I'm under no illusion that things can actually be secured; I don't own a single device that I'm not even slightly suspicious is running malicious code or otherwise leaking information I'm not aware of. Whether by negligence or purely the asynchronous nature of attack. But is it productive for us to declare everything unsafe and somewhat give up believing we can build and use safe platforms? I think there's a balance somewhere. I (to give a rather crude example, apologies) would never take a nude photograph of my partner on a digital camera because it's an unacceptable risk. But I'll share fairly personal thoughts knowing that they may come back to embarass me one day. I want to put the pressure on companies who make such bold claims about their "military grade encryption" to face bankruptcy and shame when it's proven they're full of lies and negligence; if we just assume everything can be attacked with an LFI, it seems we've stopped caring about trying. Caveat: I still haven't had breakfast, I don't have my best thinking cap on right now, but that's my gut instinct.

chriswarbo 10y ago

The reason you can transfer money online is because banks and payment providers are insured, so when things go wrong you can (usually) get your money back. Online banking doesn't implement security features to make things safe; it's to make the insurance cheaper.

snoman 10y ago
Yes, and the insurance is cheaper because the probability of things going wrong is lower. Transitively, they are doing it to make things safe.

mathgenius 10y ago

This is a dark thought, but your country may one day slip into becoming a totalitarian state, where the data of private companies is appropriated by the powers that be.

pessimizer 10y ago

> we're supposed to not do anything that requires any form of confidentiality online? can't book a doctors appointment, transfer money, send emails to family? You probably won't want to do any of this stuff outdoors in 10 more years, or indoors around a smartphone, television set, refrigerator, or any object with flashing LEDs on it. As a combined network, smart audio coverage can be made to be so complete that incomplete areas will arouse suspicion. Registering on (or even visiting) an internet site is just slightly different than signing a contract (and in some opinions, legally equivalent.) If you had to sign a form with your address to visit a prostitute, and you couldn't even open the door without it recording your license plate number - what kind of expectation of privacy could you reasonably have?