4 ms·
Rhetorical question: If a YouTube video can show how to bypass it, does it really count as a "secure" system?
by gregmac 7y ago
Rhetorical question: If a YouTube video can show how to bypass it, does it really count as a "secure" system?
- EnFinlay 7y agoI would say yes, since "secure" is a spectrum and there's nothing about a YouTube video that means the information is lower quality or less valuable than any other source.
- philipov 7y agoRhetorical answer: If you can secure a system through legislation, it is no longer necessary to secure it through engineering.
- JoshTriplett 7y agoThat's certainly the (false) belief under which many legislative and governmental bodies operate.
- jegs 7y agoI don't think they believe it either. It's just easier to treat people as criminals by default. Why go through the effort of engineering things properly when you can have 10+ cops break down your door and shoot your dog?
- lone_haxx0r 7y agoYou're overestimating the cognitive ability of the average lawmaker. They probably don't even stop to think about what security measures can be taken to prevent being pwned.
- whatshisface 7y agoIt's a true belief for companies like Equifax, who can offload all of the liability so long as it's the criminal that is guilty instead of them. For Equifax, securing reads is worth very little because as long as they can A. stop competitors from using their data and B. have no liability all of their needs are met.
- diminoten 7y agoIsn't that how most home door locks work, though? Let's not throw out the baby with the bath water here, it's pretty helpful to have legal deterrents to amoral actions...
- JoshTriplett 7y ago> Isn't that how most home door locks work, though? Not at all. Short of building a fortress, you won't stop someone determined to get inside, but you can make it sufficiently difficult that they're more likely to be noticed, or more likely to seek out an easier alternative. > it's pretty helpful to have legal deterrents to amoral actions... Nobody is suggesting otherwise; rather, the issue is that legislating against something doesn't stop it from happening, and therefore you do still need to secure against it as part of your threat model. Furthermore, laws tend to paint with a very broad brush; changing a number in a URL isn't "hacking", for instance. Laws should work with technical measures. Climbing a fence makes it much more obvious that you're trespassing.
- diminoten 7y agoWait, "Not at all"? Yes, it very much is, what you just said is literally the explanation I would give if someone asked me to explain why a front door lock is a legislative protection, not an actual security feature... Legislation meaning you don't need to defend against it is actually quite real in meat space (and quite effective), so pretending like it's universally a bad idea is incongruous with your own facts.
- testvox 7y agoMost people do not live in houses that I would call "secure systems". The reason locks in residential homes are not that sophisticated is because it's not worth the cost to make them secure when there is still going to be a glass window right next to it.
- gruez 7y agorussia/china/north korea/iran don't follow US legislation.
- jedberg 7y agoI believe "secure system" is shorthand for "a system intended to be secure".
- jdboyd 7y agoGood luck explaining that to their robots that don't know how to listen and aren't too think logically.