10 ms·

I disagree. Centralizing the data and the access control would only create more issues. If somebody got into your account they'd have the keys to your life. We

I disagree. Centralizing the data and the access control would only create more issues. If somebody got into your account they'd have the keys to your life. We need to embrace decentralizing data and access control along with healthy security habits like proper secret generation and frequent rotation.

will_hughes 9y ago
> along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely. Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.
- tylersmith 9y ago
  As people continue to get their money stolen they'll slowly come around to utilizing good security.
  - groby_b 9y ago
    No, they won't. They'll stop using tech as much as they can. That's basic UX. If you make the experience shitty, people will avoid it. No amount of experts waving their hands wildly will help that. If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. "Because I said so" doesn't work on kids, it sure as heck doesn't work on adults.
    - tylersmith 9y ago
      > No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option. > If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. Who said we won't? Seat belts were also avoided for a long time but eventually people have realized they're a good idea.
      - groby_b 9y ago
        > Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
        tylersmith 9y ago
        Firstly, thanks for the discussion. I enjoy it. I was not around in the 80s, but I know that campaigns to support seat belts and the potential outcomes of not doing so had eventually gotten people to be much more careful. Regarding devices, things like the Ledger or Trezor Bitcoin wallets could easily be adapted to allow users to control their own data securely and simply. There's no reason end users need to understand what's going on in the background. They just know you have a secure usb device you use to authenticate yourself.
        will_hughes 9y ago
        "could easily be adapted to allow users to control their own data securely and simply" If you can solve the UX problems associated with those, you'll win a lot of praise. To be clear, even something as simple as contactless payment/transit cards are still too difficult for many people to manage. I had to physically take a wireless payment terminal out of a taxi driver's hands when he insisted on trying to do a contactless payment by taking the card in one hand, the reader in the other, and then as if he were playing a game of 'slap', slapping the credit card against the terminal and then immedidately pulling it back up and away. He repeated this several times, cursing each time the terminal displayed the message 'Read Error'. I've repeatedly seen people of all ages: try to press contactless cards against screens, wave cards back and forth at varying distances from the reader, and all manner of other behaviors. And we're talking with basic cards that have no option for input here. Key rotation that requires installing software, using a computer, etc - it's all going to be far too complex for many to understand.
hvidgaard 9y ago
NemId, as it is called in Denmark, is a paper card with many one time keys, or a dongle that creates a new key every so often. Every time you login, or perform a transaction in the online banking, you need a new and different key. If they get access to your keys, which would probably be because you did something stupid like taking a picture of the card, you can revoke access, and there is a paper trail of every single time the adversary impersonated you. How is that worse?
- tylersmith 9y ago
  I'm not familiar with the system but centralizing critical data is strictly less ideal than decentralizing it. If your key seed or the central server are compromised everything is compromised. Revoking keys is great but doesn't help after they've given full access.
  - jon_richards 9y ago
    >Revoking keys is great but doesn't help after they've given full access. That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
    - tylersmith 9y ago
      Only once you've noticed it. Automated systems could be used but there's always the potential for large impacts before automated systems recognize the issue. And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
      - jon_richards 9y ago
        >Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.
zo1 9y ago
This is essentially a new form of luddism. The world is moving forward, with systems evolving by consolidating, grouping and analyzing every aspect of us, our world, and the things we do. Centralization is the answer to so many of our world's ills. Everything from crime, to poverty, to inequality, to disaster-relief. You name it, they can all benefit from a centralized store of all of humanity's knowledge. That is the entire point of the web: connected and cross-referenced knowledge. Fighting that is fighting progress due to fear. And blanketly decrying "centralization" of data because of the fear that it may get lost doesn't address the problems. We should move our society forward, but we should do it while solving the individual security concerns piecemeal and as they happen.
- deleted 9y ago
  [deleted]
Spivak 9y ago
In just the same way that if someone compromises your email they can probably take control of all of your online accounts. If you have to have many accounts to access government services people are just going to use the same password for all of them and never rotate them. A single authentication service used by all gov't services would be a huge gain for security.

will_hughes 9y ago

> along with healthy security habits like proper secret generation and frequent rotation. While having the populace in general be security aware would be a great thing, it's barely possible to get them to do even basic shit like not putting credit card numbers and other secret information into an email and sending it to anyone who asks nicely. Educating people on why 'healthy security habits' and 'key rotation' doesn't mean locking the front door and hanging their housekeys differently is pretty much a non-starter.

tylersmith 9y ago
As people continue to get their money stolen they'll slowly come around to utilizing good security.
- groby_b 9y ago
  No, they won't. They'll stop using tech as much as they can. That's basic UX. If you make the experience shitty, people will avoid it. No amount of experts waving their hands wildly will help that. If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. "Because I said so" doesn't work on kids, it sure as heck doesn't work on adults.
  - tylersmith 9y ago
    > No, they won't. They'll stop using tech as much as they can. That's doubtful, especially as technology becomes increasingly ubiquitous. For systems like SS force users to use it so opting out isn't currently even an option. > If you can't wrap up your healthy habits and your key rotation in a simple device/card/whatnot that people can carry around and use just like a key, your security measures have already failed. Who said we won't? Seat belts were also avoided for a long time but eventually people have realized they're a good idea.
    - groby_b 9y ago
      > Seat belts were also avoided for a long time but eventually people have realized they're a good idea. I take it, then, you were not around in the 80s :) People did not "realize" seatbelts are a good idea. We made people wear seatbelts, using quite draconian laws and relentless PR. > Who said we won't? [... wrap security habits into a handy device] You'll have to explain to me how that jives with your idea of decentralizing data and access control. A key/security device will need to be manufactured - and there are only a few commercial entitites that can and/or will do that. And if you think they won't centralize key management, I admire your optimism.
      - tylersmith 9y ago
        Firstly, thanks for the discussion. I enjoy it. I was not around in the 80s, but I know that campaigns to support seat belts and the potential outcomes of not doing so had eventually gotten people to be much more careful. Regarding devices, things like the Ledger or Trezor Bitcoin wallets could easily be adapted to allow users to control their own data securely and simply. There's no reason end users need to understand what's going on in the background. They just know you have a secure usb device you use to authenticate yourself.
        will_hughes 9y ago
        "could easily be adapted to allow users to control their own data securely and simply" If you can solve the UX problems associated with those, you'll win a lot of praise. To be clear, even something as simple as contactless payment/transit cards are still too difficult for many people to manage. I had to physically take a wireless payment terminal out of a taxi driver's hands when he insisted on trying to do a contactless payment by taking the card in one hand, the reader in the other, and then as if he were playing a game of 'slap', slapping the credit card against the terminal and then immedidately pulling it back up and away. He repeated this several times, cursing each time the terminal displayed the message 'Read Error'. I've repeatedly seen people of all ages: try to press contactless cards against screens, wave cards back and forth at varying distances from the reader, and all manner of other behaviors. And we're talking with basic cards that have no option for input here. Key rotation that requires installing software, using a computer, etc - it's all going to be far too complex for many to understand.

hvidgaard 9y ago

NemId, as it is called in Denmark, is a paper card with many one time keys, or a dongle that creates a new key every so often. Every time you login, or perform a transaction in the online banking, you need a new and different key. If they get access to your keys, which would probably be because you did something stupid like taking a picture of the card, you can revoke access, and there is a paper trail of every single time the adversary impersonated you. How is that worse?

tylersmith 9y ago
I'm not familiar with the system but centralizing critical data is strictly less ideal than decentralizing it. If your key seed or the central server are compromised everything is compromised. Revoking keys is great but doesn't help after they've given full access.
- jon_richards 9y ago
  >Revoking keys is great but doesn't help after they've given full access. That's true in a lot of infosec, but in identification, you can revoke everything and wait for meat-space verification to start again.
  - tylersmith 9y ago
    Only once you've noticed it. Automated systems could be used but there's always the potential for large impacts before automated systems recognize the issue. And if the keys are ID related you can easily revoke it. You can't revoke a SSN, fingerprint, DNA, or a face scan.
    - jon_richards 9y ago
      >Typically the SS number is used for identification, and you have password + one-time code on top of that. Isn't that what this was addressing? The attacker has to get both your password and one-time codes before you change either. All the ID related stuff is used like usernames, not keys. If an attacker does get both, you presumably go in to a government office, have your fingerprints taken, choose a new password, and get given a new set of codes.

zo1 9y ago

This is essentially a new form of luddism. The world is moving forward, with systems evolving by consolidating, grouping and analyzing every aspect of us, our world, and the things we do. Centralization is the answer to so many of our world's ills. Everything from crime, to poverty, to inequality, to disaster-relief. You name it, they can all benefit from a centralized store of all of humanity's knowledge. That is the entire point of the web: connected and cross-referenced knowledge. Fighting that is fighting progress due to fear. And blanketly decrying "centralization" of data because of the fear that it may get lost doesn't address the problems. We should move our society forward, but we should do it while solving the individual security concerns piecemeal and as they happen.

deleted 9y ago
[deleted]

Spivak 9y ago

In just the same way that if someone compromises your email they can probably take control of all of your online accounts. If you have to have many accounts to access government services people are just going to use the same password for all of them and never rotate them. A single authentication service used by all gov't services would be a huge gain for security.