5 ms·

One bit of binary thinking in cybersecurity that surprised me a lot is when DJB came out against the "principle of least privilege" (http://cr.yp.to/qmail/qmail

One bit of binary thinking in cybersecurity that surprised me a lot is when DJB came out against the "principle of least privilege" (http://cr.yp.to/qmail/qmailsec-20071101.pdf http://cr.yp.to/qmail/qmailsec-20071101.pdf) > I have become convinced that this “principle of least > privilege” is fundamentally wrong. Minimizing privilege > might reduce the damage done by some security holes but > almost never fixes the holes. Minimizing privilege is not > the same as minimizing the amount of trusted code, does not > have the same benefits as minimizing the amount of trusted > code, and does not move us any closer to a secure computer > system This is from almost 15 years ago, and it's possible I am misunderstanding him as I am far from a security expert, but I found it surprising. I wrote a bit about my surprise at the time: https://blog.reverberate.org/2007/11/djb-hating-on-principle-of-least.html https://blog.reverberate.org/2007/11/djb-hating-on-principle...

UncleMeat 5y ago
DJB is famously "extreme" in a lot of his positions and although his work is incredibly valuable is not a good representation of the typical beliefs of the community.
- teknopaul 5y ago
  Ask yourself if you use this principle IRL? Do you give your cleaner the house keys and make yourself scarce so they can work in peace or do you treat them like an evil maid and watch their every move? Which approach has better long term outcomes for your security?
  - haberman 5y ago
    Counterpoint: do you give a cleaner the key to the house, or do you hand them a box with your whole keyring, your website passwords, the combination to the safe in the bedroom, etc?
unethical_ban 5y ago
Yep. "It isn't the one solution, so it is worthless". Or even, "It isn't the best solution, so it is worthless". Defense in depth, people!
- teknopaul 5y ago
  word bro. I am sick of people telling me that sha1 is "insecure" . There are collisions out there but that does not mean if you use sha1sum for something that you app is insecure full stop.
  - anonydsfsfs 5y ago
    Same here, and I've found it's a good way to tell apart decent security researchers/consultants from those that just blindly run their tools and send the results. If I get a report that my app is vulnerable because it uses sha1, and it's obvious that collision resistance doesn't matter at all in the context where sha1 is used, then I know the reporter can be ignored.
OrvalWintermute 5y ago
That is an excellent comment by DJB, and one with which I concur. There is an inverse relationship with privilege minimization also, that many commodity operating systems require users to maintain a certain amount of privilege to effectively use the system. Reduction of privilege then results in a loss of functionality if there is not a replacing system. With things like high level privileges for admin, but not truly Forest Admin / Enterprise Admin, we only saw native fixes for this recently with the addition of JIT / JEA circa ~2017, or, use of 3rd party administration tools.
zmmmmm 5y ago
Sounds to me like his phrasing was poor and its a bit out of context. I think what he is getting at is he doesn't like it when people confuse minimisation of damage from security breaches with prevention of security breaches. Obviously you should have both, but don't pretend one is a substitute for the other. The way I read it, privilege minimisation is almost isomorphic with his actual principle "eliminating trusted code" ... if the code doesn't have access to a resource then it doesn't need to be trusted with that access. So perhaps he is railing against people who want to deploy code into fundamentally insecure contexts and then claim its OK because of protection through limits on privileges .... but he's saying it is always better to improve the fundamental architectural security and not put it in that context in the first place.
gnufx 5y ago
Least privilege implies ambient authority and the problems that brings. The capability security answer rejecting it is respectable enough isn't it (e.g. seL4, Fuschia recently)? I'm not sure that was what the quotation was about, but rejecting least privilege shouldn't be too surprising per se.

UncleMeat 5y ago

DJB is famously "extreme" in a lot of his positions and although his work is incredibly valuable is not a good representation of the typical beliefs of the community.

teknopaul 5y ago
Ask yourself if you use this principle IRL? Do you give your cleaner the house keys and make yourself scarce so they can work in peace or do you treat them like an evil maid and watch their every move? Which approach has better long term outcomes for your security?
- haberman 5y ago
  Counterpoint: do you give a cleaner the key to the house, or do you hand them a box with your whole keyring, your website passwords, the combination to the safe in the bedroom, etc?

unethical_ban 5y ago

Yep. "It isn't the one solution, so it is worthless". Or even, "It isn't the best solution, so it is worthless". Defense in depth, people!

teknopaul 5y ago
word bro. I am sick of people telling me that sha1 is "insecure" . There are collisions out there but that does not mean if you use sha1sum for something that you app is insecure full stop.
- anonydsfsfs 5y ago
  Same here, and I've found it's a good way to tell apart decent security researchers/consultants from those that just blindly run their tools and send the results. If I get a report that my app is vulnerable because it uses sha1, and it's obvious that collision resistance doesn't matter at all in the context where sha1 is used, then I know the reporter can be ignored.

OrvalWintermute 5y ago

That is an excellent comment by DJB, and one with which I concur. There is an inverse relationship with privilege minimization also, that many commodity operating systems require users to maintain a certain amount of privilege to effectively use the system. Reduction of privilege then results in a loss of functionality if there is not a replacing system. With things like high level privileges for admin, but not truly Forest Admin / Enterprise Admin, we only saw native fixes for this recently with the addition of JIT / JEA circa ~2017, or, use of 3rd party administration tools.

zmmmmm 5y ago

Sounds to me like his phrasing was poor and its a bit out of context. I think what he is getting at is he doesn't like it when people confuse minimisation of damage from security breaches with prevention of security breaches. Obviously you should have both, but don't pretend one is a substitute for the other. The way I read it, privilege minimisation is almost isomorphic with his actual principle "eliminating trusted code" ... if the code doesn't have access to a resource then it doesn't need to be trusted with that access. So perhaps he is railing against people who want to deploy code into fundamentally insecure contexts and then claim its OK because of protection through limits on privileges .... but he's saying it is always better to improve the fundamental architectural security and not put it in that context in the first place.

gnufx 5y ago

Least privilege implies ambient authority and the problems that brings. The capability security answer rejecting it is respectable enough isn't it (e.g. seL4, Fuschia recently)? I'm not sure that was what the quotation was about, but rejecting least privilege shouldn't be too surprising per se.