5 ms·
It's impossible to secure yourself against a devoted persistent threat group over the long term. The asymmetry of effort is not tractable to overcome. So they
by throwaway5752 6y ago
It's impossible to secure yourself against a devoted persistent threat group over the long term. The asymmetry of effort is not tractable to overcome.
So they can take your security seriously, but they will be hacked, or they have already.
- sounds 6y agoI think it is possible to secure yourself against a devoted, persistent threat group. I think it's expensive, but possible. Do you have data to back up your claim that no one, ever has ever successfully remained secure?
- not2b 6y agoNo one could possibly prove this kind of negative.
- snoshy 6y agoWhy not? All you have to do is point to one particular company whose systems have not been verifiably breached after having resisted actual attempts.
- someguydave 6y agomost attacker groups would be unlikely to share that result
- imoverclocked 6y agoChallenge accepted? Just because known attempts have failed doesn’t mean the unknown ones have too.
- WaitWaitWha 6y ago> one particular company whose systems have not been verifiably breached The unknown unknown. How can you be sure all the "resisted actual attempts" been even detected?
- deleted 6y ago[deleted]
- not2b 6y agoYou've changed the requirement. To prove a company hasn't been breached, you'd also have to prove that there hasn't been a breach that hasn't been detected (so breached, but not verified). Any given target might already be quietly owned by some state actor or corrupt insider with allies on the outside.
- justinclift 6y agoSeveral places probably would have met those goals... ... right up until the SolarWinds hack became public. The point being, provable "we've never been breached" seems to have a way of turning out to be wrong. :/
- swirepe 6y agoMy name is Ozymandias, King of Kings; Look on my Works, ye Mighty, and despair!
- rodgerd 6y agoWhat evidence do you have that anyone has?
- ikiris 6y agoWhen was the last time you heard of a google user data breach?
- rodgerd 6y agohttps://www.forbes.com/sites/kateoflahertyuk/2018/10/09/google-plus-breach-what-happened-who-was-impacted-and-how-to-delete-your-account/?sh=75faf8ef6491 https://www.forbes.com/sites/kateoflahertyuk/2018/10/09/goog... https://arstechnica.com/information-technology/2013/11/googlers-say-f-you-to-nsa-company-encrypts-internal-network/ https://arstechnica.com/information-technology/2013/11/googl... Maybe you should know literally anything about the topic at hand before making sweeping assertions? I realise that's asking a lot here at HN, but it would improve the site a lot.
- harrierpigeon 6y agohttps://en.wikipedia.org/wiki/2018_Google_data_breach https://en.wikipedia.org/wiki/2018_Google_data_breach https://www.express.co.uk/news/uk/1372333/Gmail-hacked-Google-down-latest-update-security-data-breach-server-error-news-vn https://www.express.co.uk/news/uk/1372333/Gmail-hacked-Googl... Not unheard of at Google, either.
- ziddoap 6y agoI don't think my post argues, or even attempts to argue, against your point. It was a light-hearted jest at the fact that this exact line is in every single breach notification I have read for the past few years. The more serious point I was alluding at was not "just don't get breached", it was that the "we care" line rings hollow after the 250th time reading it.
- throwaway5752 6y agoMy misread, apologies. I think the "we care" is a dodge around the reality that most are uncomfortable with, which is, "we make your data safe as possible but we will likely be hacked and you should compartmentalize your personal data accordingly with that expectation". But I am no good with marketing.
- pseudalopex 6y agoMost companies choose to collect data they don't have to.
- luser007 6y agoThey put all of their users eggs in one basket in the cloud. That makes for a very interesting target. They could have not done that. The users were probably unaware that their data was even placed on the cloud servers of some third party. Ubiquiti used to be cool. They've taken a nose dive in recent years in several ways: Firmware upgrade suddenly including telemetry by default, forcing people to use their NVR appliance instead of installing their software on their private servers, etc. Had Ubiquiti not moved people to "cloud solutions" an attacker would have to attack millions of peoples equipment. Now he only had to attack one providers network.
- unethical_ban 6y agoI heard rumors about the telemetry thing, but that is usually an overhyped concern - unless it is sending flow logs or something. When did they stop allowing people to use a private server for central management? I see Unifi still has a network controller.
- luser007 6y agoSorry for being obtuse - it wasn't my intention. I'm thinking of "Unifi Video" that is going out (EOL announced six months ago), where you could either buy their appliance OR download an official .deb package and install the NVR software on your own server. They replace that with "Unifi Protect" that comes ONLY as an NVR appliance. No more .deb packages. It also requires you to buy one of their other products (Cloud Key 2), IIRC.
- deleted 6y ago[deleted]