3 ms·
The VPNMentor krewe carried out responsible disclosure according to the upstream blog post. That's good. Whatever happened to Defense in Depth? All secrets (y
by OliverJones 7y ago
The VPNMentor krewe carried out responsible disclosure according to the upstream blog post. That's good.
Whatever happened to Defense in Depth?
All secrets (yes, all secrets) eventually leak ... so
1. Perimeter security should be good.
2. The body of secrets behind any given perimeter should be small, so fewer secrets leak in case of a perimeter breach.
3. Breaches and leaks (data exfiltration) should be detectable, and actually detected.
4. Corrupting the body of secrets by inserting or changing them should be defended against rigorously.
5. The secrets themselves should have limited utility. Securely hashed passwords are a good example.
6. The secrets should have limited useful lifetime. Credit cards can be replaced, so they meet this criterion. Fingerprints... their useful lifetime is the same as the subject's lifetime; not so good.
Not even state actors with unlimited talent and funding (hi, NSA!) can prevent secrets from leaking. So why don't more secret-gathering organizations do steps 2-6, or at least try to do them?
This Suprema outfit has a lot of business in Europe. It seems likely they will be severely punished by GDPR enforcement.