9 ms·
Ransomware is great. 1. Creates a huge financial incentive to try and break PGP encryption. 2. Pushes aside all of the lame corporate compliance "infosec" peo
by alrs 5y ago
Ransomware is great.
1. Creates a huge financial incentive to try and break PGP encryption.
2. Pushes aside all of the lame corporate compliance "infosec" people whose job it is get lied to about PCI compliance and bitch about version numbers that they don't understand.
3. Proves useless all of the "ex-special-forces" "red team" "master safecracker" Defcon LARPers.
4. Gives the insurance companies enough room to attribute attacks to nation-state actors, making them "acts of war," and thus uninsurable. If companies can't half-ass this stuff and let their insurer clean up the mess, they're going to stop half-assing this stuff.
5. Put an end to the "I dunno, I pulled it off Dockerhub" madness.
- megameter 5y agoAlso the most likely tonic to platform churn, reinvented wheels, codebase growth. The culture will flip towards lambasting anything that hasn't been put through the wringer as "untrustworthy".
- alrs 5y ago6. You used to need to wonder: Have I been hacked? How bad? Now you get an invoice day-of.
- api 5y agoItems 2 and 3 will increase massively as people who don't know what they're doing attempt to cover their butts.
- alrs 5y agoa steep climb in the short term that falls off a cliff in the not-so-short-term as those employers cease to exist.
- api 5y agoThat's not how the world works my friend.
- alrs 5y agoso long as encryption-as-we-know-it holds-up, there's no rescue for orgs that repeatedly get hit and can't get their backup strategy together. Sure, you make a regulatory mis-step and you have friends in high places, they will look the other way. This indeed, is how the world works. If your entire infrastructure is encrypted into a solid block of nothingness it doesn't matter if your dad is a senator, you're done.
- fouric 5y agoName a single company that has died due to data breaches. Meanwhile, I'll name a dozen that got breached/leaked data, and got away with it: Experian, Microsoft, Facebook, Google, Marriott, Yahoo, First American Financial Corporation, Deep Root Analytics, Court Ventures (a subsidiary of Experian), Capital One, Anthem. Go on, search "list of largest data breaches" and then see how many of those companies are still in business. It sure seems like large companies aren't suffering for their breaches.
- alrs 5y ago"breached data" doesn't matter to companies, as we've seen. "gone data" is an existential threat.
- fredgrott 5y agowhy do we need an incentive to break PGP? Let me explain, the basics: Any system that has a case where key collisions can occur less than random is the only incentive you need...large use of bitcoin ensures that case all by itself with the rule that you use a new key for every transaction. LEOs use this track down illicit money. crypto in practical terms is not secure in that the key collision when it occurs and it will unmasks you not directly but indirectly and the cost to do the work of that lowers as it ages and does not go up computation wise. It's somewhat perverse where when the world uses more bitcoin the more key collisions occur.
- alrs 5y agoIf you depend on PGP, knowing that there's an incentive to break it, and that people are actively trying to do so is good news. It's in your interest for it to be very well tested. "I can break PGP and spoof Debian packages" is an interesting conference talk. "I can break PGP and save your business $40m in ransomware costs and only charge you $10m" is a business.
- rawtxapp 5y agoYep, if the companies leak our sensitive data, they don't care, business as usual. Ransomware will force companies to finally take this seriously and I, for one, am thankful even if in the short term it's painful.
- lozf 5y agoIt's like "Little Bobby Tables" grew up, and is no longer content with just causing a little inconvenience.
- upofadown 5y agoI did some searching and didn't find anything about use of the OpenPGP standard in ransomware. It appears that ransomware creators don't care about interoperability, which makes sense for their biz. A doubt that anyone has ever been motivated to try to break an encryption method just because it was used in some particular ransomware. The methods used are generally not breakable, the mistakes come from stuff like leaving keys laying around in memory or even on the disk.
- meowface 5y agoI'm not sure how satirical the parent's comment was, but every single point is completely inaccurate, irrelevant, and/or nonsensical.
- Dah00n 5y agoHow so? Seems it's spot on. Since the birth of the internet companies haven't given a damn about leaks and there're no real consequences. Now they care because it hurts them instead of just us.
- meowface 5y agoI work in infosec and agree with the point that a lot of companies are overly lax, ignorant, and negligent about security. But I could probably write like a 10 page essay disputing all of those points. For a summarized version, I wrote some semi-relevant comments about this in another ransomware thread from the other day, so this is a lazy answer but you could Ctrl+F my username in https://news.ycombinator.com/item?id=27096137 https://news.ycombinator.com/item?id=27096137 Basically, I agree in general that a large percentage of the industry is a massive joke, but at the same time, I think in many cases there's more victim-blaming than is warranted. Ransomware isn't what it used to be. Being hit or ruined by a ransomware attack doesn't necessarily imply negligence or lack of care (even if a high percentage of the victims probably are negligent simply due to the high base rate of such companies).
- a1369209993 5y ago
- mhh__ 5y agoI'm not sure what point 3 refers to?
- alrs 5y ago#infosec "thought leaders" with a cool-sounding military history who purport to be able to do underwater lockpicking but can't put together a for loop. Their shtick exists to sell services to clients and to sell recent graduates on a Special Forces Awesome Security Career that in reality will be QA at best, corporate compliance at worst.
- benjohnson 5y ago6. Put and end to our data hording. Turns out I don't need to keep all the data we have because it's now a liability.