6 ms·

RE: social engineering, as long as a human is involved somewhere, the system can be compromised. IT security is a very depressing field because of this fact.

RE: social engineering, as long as a human is involved somewhere, the system can be compromised. IT security is a very depressing field because of this fact. I also hope these incidents remind people of how little control you really have over your online identity. We're all just IDs in a database somewhere, waiting to be impersonated. Decentralization is the only solution for this IMO.

irjustin 6y ago
Honest question, how do I recover a lost identity? The reason why this attack worked is primarily because of a recovery system. I agree this is a significant vector, but I can't see how decentralized solves this? At the moment with blockchain wallets, once you've lost your private key, you're screwed. There is no recovery. So, I'm all for decentralized but if it is truly my identity, I need a way back if I lose it. Not sure how to solve that vector even in a decentralized case. Do I need to upload my identity to specific 'verifiers'?
- dogfoods 6y ago
  You need to stop thinking identity singular, and identity as valuable. Have many and treat them as disposable. Of course you can't do this on the 2020 web that consists of four websites filled with screenshots of each other, but that's just one of the many reasons to burn those websites to the ground and resist any attempts to remake them. And it turns out your parents were right about not using your real name on the Internet. Social media and their consequences have been a disaster for the human race.
  - irjustin 6y ago
    But that's not really identity then right? That just becomes my hnews/reddit username that's unverified. I read @elonmusk because I trust it's him and I'm interested in what he says. Personally, I genuinely like Starship + Starlink updates... I ignore most the other stuff. But still, I want to see those awesome rocket tweets! So, I want to know what he says. He can change his username because it got hacked/whatever... but then I personally have to see what he changed it to... how do I know that he is the one who changed it? how do i know it's not some rando dude impersonating him?
    - dogfoods 6y ago
      Your hnews username is an identity. A small, weak, and reasonably disposable one, that you can have many of. Why do you want to use your God damn real name on the Internet unless you are a public person already? What do you have to gain? Hate mail, Death threats and calls for your firing? I've always wanted more of those. You do not WANT to be verified. Verified is a euphemism for doxxed. You could trust it was Elon because it's published on his own website instead of on the worst thing to happen to human communication since writing was invented (I.e., Twitter) For other cases we can evaluate merit based on previous performance and character of published material instead of "identity". I do not care who is behind a pseudonymous blog if the blog is good.
      - duckmysick 6y ago
        How can we evaluate previous performance of (new) disposable accounts?
        emikulic 6y ago
        With our own reading and critical thinking abilities.
- pcmonk 6y ago
  The most natural solution for most people is to give shards of your key to various friends/family that you trust not to collude and reconstitute your key (or be socially engineered -- make them talk with you on video chat or something). Require 5 out of the 9 shards to reconstitute it. Obviously you can scale up your security according to the value of your account and your threat model.
  - irjustin 6y ago
    That's a great method for preventing loss as opposed to allowing recovery. We need to keep the conversation in recovery because eventually it'll happen. Your 5/9 people could have n+1 unwilling parties where n is the losable amount. It is unrealistic to say it will _never_ happen. When my identity is lost... is it lost for good? how do i recover? If it's lost for good, and i make a new 'identity' then what is my 'identity'... is it just... my reddit username?
- phasnox 6y ago
  What about having a revocation key? Or something similar.
  - irjustin 6y ago
    What if I lose that key? lose the laptop? data source gets corrupt. Give enough people using the system, it's not if, it's when. So how do I recover?
- gnopgnip 6y ago
  Is there an indication that this was done through a recovery system rather on many individual accounts than a compromised admin account?
creato 6y ago
Often, what people think is "good customer service" really means "allowing me to socially engineer you". I don't think there is any solution to this. "Decentralization" in this context seems equivalent to a centralized system that simply gives up on any ability to recover accounts. Whoever owns the authentication details of an account is the owner, period. If you lose the password or the account gets hacked and stolen from you, tough shit. Start a new account. I think the real solution is that social media should simply be valued lower. No one should care if their Twitter account gets hacked. The fact that politicians and important people use it in an official capacity is the problem that needs fixing.
- irjustin 6y ago
  > The fact that politicians and important people use it in an official capacity is the problem that needs fixing. I don't disagree, but with what? It's easy to say this is 'wrong/broken', but I don't see a great fix other than people 'rolling their own solution' and that's not realistic.
  - creato 6y ago
    I don't think a replacement is needed. If your communication is important to a lot of people, it shouldn't be just immediately jammed into 280 characters using your thumbs while sitting on the toilet or whatever. Post it on congress.gov using some inefficient boring process or whatever the official communication method of your role is.
  - thundergolfer 6y ago
    Pass regulation that puts in a place a federated messaging infrastructure, so that Twitter users can subscribe to messaging from Government official that sends out messages via an external system.
    - zhte415 6y ago
      Like... email?
- 6y ago

irjustin 6y ago

Honest question, how do I recover a lost identity? The reason why this attack worked is primarily because of a recovery system. I agree this is a significant vector, but I can't see how decentralized solves this? At the moment with blockchain wallets, once you've lost your private key, you're screwed. There is no recovery. So, I'm all for decentralized but if it is truly my identity, I need a way back if I lose it. Not sure how to solve that vector even in a decentralized case. Do I need to upload my identity to specific 'verifiers'?

dogfoods 6y ago
You need to stop thinking identity singular, and identity as valuable. Have many and treat them as disposable. Of course you can't do this on the 2020 web that consists of four websites filled with screenshots of each other, but that's just one of the many reasons to burn those websites to the ground and resist any attempts to remake them. And it turns out your parents were right about not using your real name on the Internet. Social media and their consequences have been a disaster for the human race.
- irjustin 6y ago
  But that's not really identity then right? That just becomes my hnews/reddit username that's unverified. I read @elonmusk because I trust it's him and I'm interested in what he says. Personally, I genuinely like Starship + Starlink updates... I ignore most the other stuff. But still, I want to see those awesome rocket tweets! So, I want to know what he says. He can change his username because it got hacked/whatever... but then I personally have to see what he changed it to... how do I know that he is the one who changed it? how do i know it's not some rando dude impersonating him?
  - dogfoods 6y ago
    Your hnews username is an identity. A small, weak, and reasonably disposable one, that you can have many of. Why do you want to use your God damn real name on the Internet unless you are a public person already? What do you have to gain? Hate mail, Death threats and calls for your firing? I've always wanted more of those. You do not WANT to be verified. Verified is a euphemism for doxxed. You could trust it was Elon because it's published on his own website instead of on the worst thing to happen to human communication since writing was invented (I.e., Twitter) For other cases we can evaluate merit based on previous performance and character of published material instead of "identity". I do not care who is behind a pseudonymous blog if the blog is good.
    - duckmysick 6y ago
      How can we evaluate previous performance of (new) disposable accounts?
      - emikulic 6y ago
        With our own reading and critical thinking abilities.
pcmonk 6y ago
The most natural solution for most people is to give shards of your key to various friends/family that you trust not to collude and reconstitute your key (or be socially engineered -- make them talk with you on video chat or something). Require 5 out of the 9 shards to reconstitute it. Obviously you can scale up your security according to the value of your account and your threat model.
- irjustin 6y ago
  That's a great method for preventing loss as opposed to allowing recovery. We need to keep the conversation in recovery because eventually it'll happen. Your 5/9 people could have n+1 unwilling parties where n is the losable amount. It is unrealistic to say it will _never_ happen. When my identity is lost... is it lost for good? how do i recover? If it's lost for good, and i make a new 'identity' then what is my 'identity'... is it just... my reddit username?
phasnox 6y ago
What about having a revocation key? Or something similar.
- irjustin 6y ago
  What if I lose that key? lose the laptop? data source gets corrupt. Give enough people using the system, it's not if, it's when. So how do I recover?
gnopgnip 6y ago
Is there an indication that this was done through a recovery system rather on many individual accounts than a compromised admin account?

creato 6y ago

Often, what people think is "good customer service" really means "allowing me to socially engineer you". I don't think there is any solution to this. "Decentralization" in this context seems equivalent to a centralized system that simply gives up on any ability to recover accounts. Whoever owns the authentication details of an account is the owner, period. If you lose the password or the account gets hacked and stolen from you, tough shit. Start a new account. I think the real solution is that social media should simply be valued lower. No one should care if their Twitter account gets hacked. The fact that politicians and important people use it in an official capacity is the problem that needs fixing.

irjustin 6y ago
> The fact that politicians and important people use it in an official capacity is the problem that needs fixing. I don't disagree, but with what? It's easy to say this is 'wrong/broken', but I don't see a great fix other than people 'rolling their own solution' and that's not realistic.
- creato 6y ago
  I don't think a replacement is needed. If your communication is important to a lot of people, it shouldn't be just immediately jammed into 280 characters using your thumbs while sitting on the toilet or whatever. Post it on congress.gov using some inefficient boring process or whatever the official communication method of your role is.
- thundergolfer 6y ago
  Pass regulation that puts in a place a federated messaging infrastructure, so that Twitter users can subscribe to messaging from Government official that sends out messages via an external system.
  - zhte415 6y ago
    Like... email?
6y ago