3 ms·

Why do i need to provide you data? If i were to hack your email account there is no way i'd use the web interface to trawl through them one-by-one. Initial hac

Why do i need to provide you data? If i were to hack your email account there is no way i'd use the web interface to trawl through them one-by-one. Initial hack->Gains credentials->Pull down everything imap/pop->Load that shit into thunderbird on a dedicated vm->And we're away

JabavuAdams 15y ago
> If i were to hack your email account there is no way i'd use the web interface to trawl through them one-by-one. Well, I don't doubt that. I'm just wondering how well "what I would do" generalizes, here.
jodrellblank 15y ago
Why do i need to provide you data? You pulled a statement about behaviour out of thin air, and it wont hold up to scrutiny. Now its being scrutinised, you are dodging it. 1) What percentage of all hackers count as "hackers with a brain"? 2) How do you know most or all "hackers with a brain" would not be caught by this, without generalising from your example of one (you)? 3) Since both of the above are unknown, how can you use those as arguments to justify this being an ineffective precaution?
- idonthack 15y ago
  >You pulled a statement about behaviour out of thin air, and it wont hold up to scrutiny. Now its being scrutinised, you are dodging it. Why does the most obvious and logical course of events require justification? "Most hackers breathe constantly." "Do you have data to support that?" Maybe you're right. Maybe this "canary" is extremely effective. Maybe everyone who makes a living by breaking security also happens to be dumb enough that they fail to take the most basic precautions to protect themselves. Even if that's true, there are still more effective solutions that should be used instead of this "canary".
  - mootothemax 15y ago
    Why does the most obvious and logical course of events require justification? Obviously because what you've written is non-obvious ;) Enough people "hack" by using simple password-reset forms[1]. Whilst I have no doubt that there are plenty of worringly-competent hackers out there, I'd bet that there are also lots of less competent hackers. Taking this through to its logical conclusion: I'd rather know about some of them than give up and know about none of them. [1] http://en.wikipedia.org/wiki/Sarah_Palin_email_hack http://en.wikipedia.org/wiki/Sarah_Palin_email_hack
  - jodrellblank 15y ago
    Why does the most obvious and logical course of events require justification? It doesn't. Your claim does. The easiest way to "hack" is to install a script and run it, e.g. a traffic sniffer, a wifi encryption breaker, Firesheep, or any one of many vulnerability scan/exploiters. Or to look over someone's shoulder as they type a password in, or to walk up when they step away from their computer for a moment. None of that needs any hacking chops or brains. Most exploits by volume are going to be like these because these are easiest. The next most easy way is to do phishing scams, it needs some chops to fake login forms and bulk email, but it's not massively complex. The hardest way is to understand and find flaws in a system and then exploit them. This is likely to be most successful, but due to the knowledge, effort and skill and sustained interest required, to be the least common by volume. And then above that, people who do the last one "for a living". A canary that squawks against "I made a mistake and some opportunist got into my email" is more likely to go off, and more likely to be useful, than a canary that squawks against "a skilled hacker targetted me and got through Google's security". Metalfrog's claim is that it is more likely that a real hacker would get in, be taking precautions against honeypots, and the canary would be useless. I think it much more likely that an opportunist would be getting in and a skilled hacker targetting something more important instead, and that the canary stands a slim chance of being useful instead of zero chance.

JabavuAdams 15y ago

> If i were to hack your email account there is no way i'd use the web interface to trawl through them one-by-one. Well, I don't doubt that. I'm just wondering how well "what I would do" generalizes, here.

jodrellblank 15y ago

Why do i need to provide you data? You pulled a statement about behaviour out of thin air, and it wont hold up to scrutiny. Now its being scrutinised, you are dodging it. 1) What percentage of all hackers count as "hackers with a brain"? 2) How do you know most or all "hackers with a brain" would not be caught by this, without generalising from your example of one (you)? 3) Since both of the above are unknown, how can you use those as arguments to justify this being an ineffective precaution?

idonthack 15y ago
>You pulled a statement about behaviour out of thin air, and it wont hold up to scrutiny. Now its being scrutinised, you are dodging it. Why does the most obvious and logical course of events require justification? "Most hackers breathe constantly." "Do you have data to support that?" Maybe you're right. Maybe this "canary" is extremely effective. Maybe everyone who makes a living by breaking security also happens to be dumb enough that they fail to take the most basic precautions to protect themselves. Even if that's true, there are still more effective solutions that should be used instead of this "canary".
- mootothemax 15y ago
  Why does the most obvious and logical course of events require justification? Obviously because what you've written is non-obvious ;) Enough people "hack" by using simple password-reset forms[1]. Whilst I have no doubt that there are plenty of worringly-competent hackers out there, I'd bet that there are also lots of less competent hackers. Taking this through to its logical conclusion: I'd rather know about some of them than give up and know about none of them. [1] http://en.wikipedia.org/wiki/Sarah_Palin_email_hack http://en.wikipedia.org/wiki/Sarah_Palin_email_hack
- jodrellblank 15y ago
  Why does the most obvious and logical course of events require justification? It doesn't. Your claim does. The easiest way to "hack" is to install a script and run it, e.g. a traffic sniffer, a wifi encryption breaker, Firesheep, or any one of many vulnerability scan/exploiters. Or to look over someone's shoulder as they type a password in, or to walk up when they step away from their computer for a moment. None of that needs any hacking chops or brains. Most exploits by volume are going to be like these because these are easiest. The next most easy way is to do phishing scams, it needs some chops to fake login forms and bulk email, but it's not massively complex. The hardest way is to understand and find flaws in a system and then exploit them. This is likely to be most successful, but due to the knowledge, effort and skill and sustained interest required, to be the least common by volume. And then above that, people who do the last one "for a living". A canary that squawks against "I made a mistake and some opportunist got into my email" is more likely to go off, and more likely to be useful, than a canary that squawks against "a skilled hacker targetted me and got through Google's security". Metalfrog's claim is that it is more likely that a real hacker would get in, be taking precautions against honeypots, and the canary would be useless. I think it much more likely that an opportunist would be getting in and a skilled hacker targetting something more important instead, and that the canary stands a slim chance of being useful instead of zero chance.