9 ms·

Most security is based on the honor system

85 points by Aloha 5y ago

thaumasiotes 5y ago
From the 'segment of a realistic episode of a crime program': > “So it’s an inside job?!” > “No, the hacker got in by guessing one of the clerks’ passwords.” > “That’s not possible, we have a password security policy in place. Brute forcing that kind of thing would take hundreds of thousands of attempts.” > “Well, normally, yes, but the clerk was using the same password for her email, and that server got hacked, and a file with all the usernames and plaintext passwords got dumped.” > “But everyone knows user passwords need to be stored as one-way hashes so that getting the plaintext back out of them is impossible.” > “They were hashed, but only md5! The hackers just used a rainbow table to do the lookups.” A password security policy could have prevented that. ;p
- sokoloff 5y ago
  About half the Epic (electronic medical records) terminals I see have the password posted on the front of the terminal. Often in a nice, professional PTouch label (so presumably by IT).
  - thaumasiotes 5y ago
    That's a very effective defense against this attack. It's ineffective against someone walking up to the terminal.
    - loonster 5y ago
      It could be the 1st factor with the person only remembering a simple password to add to the end.
- aaron695 5y ago
  I think you are saying with a password security policy you couldn't rainbow table the md5 of the password following the policy? I'm not sure that's true anymore. Without salts (which the third party didn't have) I'd assume many passwords the human mind can remember within workable policy rules have been compromised. If the 3rd party had salted them, even with a common salt, the password policy probably would have worked though.
  - thaumasiotes 5y ago
    A rainbow table approach is easily defeated by length. Whether you can remember a password depends mostly on how often you use it. If you have to type it in every day, 30 random letters aren't difficult to remember. I can still tell you my first library card number just from the messages the library would leave when a book came in. 1000102772901.
    - aaron695 5y ago
      > A rainbow table approach is easily defeated by length. Only somewhat true. This XKCD is absolutely wrong - https://xkcd.com/936/ https://xkcd.com/936/ 10 billion MD5s a second should be easy. So the XKCD pass phrase goes from 550 years -> to one hour, on a normal GPU, for one person. Rainbow tables mean after that one hour on their gaming PC no one else has to do it. Start adding in other requirements to the pass phrase the hour goes up, and perhaps you have to rent some cloud time, but only one person once has to do it once. But, if you assume it's likely other sites use seeds, then rainbow tables are out, and length can matter again. And that's reasonable. You need to wreck as many points in the attackers chain as possible. That's the game.
      - thaumasiotes 5y ago
        > But, if you assume it's likely other sites use seeds, then rainbow tables are out, and length can matter again. I'm not sure what you're saying here. If by seeds you mean "salts", they're not relevant -- the whole point of a rainbow table is that you precalculate the hash of every possible password. If it's salted, you'll see the salt in the plaintext and just remove it. But a rainbow table for long passwords will develop pretty extreme storage requirements, and take a long time to compute.
        aaron695 5y ago
        > If by seeds you mean "salts" Yep > If it's salted, you'll see the salt in the plaintext and just remove it. No. You can't use rainbow tables on salted data. Maybe when a framework has a default common salt that people forget to change. > rainbow table for long passwords will develop pretty extreme storage requirements, Not really, that's the point of rainbow tables. They can be reasonable, they are not lookup tables. If you are looking at large ones, they can be compacted at the expense of time. For "CorrectHorseBatteryStaple" the rainbow table will not contain "sdfgnWlgiuwreFrglrkemnmZflgh". You map the chain to your search space. So after CorrectHorseBatteryStaple might be SimpleFineChairBook or S1mpleFineChairB00k or SimpleFine@ChairBook depending on your space.
disabled 5y ago
Yep. I am terrified for the people who are running open-source medical devices via community-based code and reversed-engineered medical devices. Something bad is bound to happen. Specifications and details here: https://openaps.readthedocs.io/en/latest/ https://openaps.readthedocs.io/en/latest/ The code is hosted on GitHub, and is against Microsoft's Terms and Conditions, for obvious reasons. Still, nothing is done about it.
- monocasa 5y ago
  I used to be terrified of that as well, until meeting many former medical device engineers in the Denver area who got out for moral reasons. However shit you think the community code is, the official code is probably worse. Like kills people and hide behind lawyers already worse. It's not uncommon for these engineers to have a 'if I am incapacitated, do not hook me up to these devices' card in their wallet like you'd normally see for alllergies for products they've worked on.
  - disabled 5y ago
    Just FYI, the European Union made such projects illegal as of 26 May 2021. See Medical Devices Regulation (MDR) EU 2017/745: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0745 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... Also, these projects were designed on purpose to circumvent or in some cases break the law, which is the wrong approach to medical device design. It's dangerous and designs kill, as you know. See this stipulation (and control/command + f = "commercial" in paper): 27) ‘making available on the market’ means any supply of a device, other than an investigational device, for distribution, consumption or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge; Also: 46) ‘investigational device’ means a device that is assessed in a clinical investigation Also: 1) ‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: — diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease, Also: (19) It is necessary to clarify that software in its own right, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device. The qualification of software, either as a device or an accessory, is independent of the software's location or the type of interconnection between the software and a device.
hncurious 5y ago
We are sitting ducks if you think about it. If a couple university researchers can get malicious code into the Linux kernel, just imagine what well funded state actors are doing? https://www.theverge.com/2021/4/22/22398156/university-minnesota-linux-kernal-ban-research https://www.theverge.com/2021/4/22/22398156/university-minne...
- Godel_unicode 5y ago
  Part of me wishes this test had gone on for longer, and had used several bugs of varying subtlety. I'm more interested in how long a supply chain bug can live than whether you can introduce one (because I've never questioned that possibility).
endisneigh 5y ago
When you get right down to it, civilization in general is based on the honor system.
- generalizations 5y ago
  Or just, "honor."
  - manbart 5y ago
    Qapla'!
throwaway0a5e 5y ago
You have to trust some people. Technical security reduces the number of people you need to trust and the extent you need to trust them.
- XorNot 5y ago
  The problem I've always found is the people who want to be the arbiters of trust (managers) are usually do technically incompetent or disinterested that they effectively aren't. I've held superuser root keys I shouldn't actually have so many times because the little who technically decide if I can use them refuse to learn how to grant and remove that permission.
kktkti9 5y ago
Duh; society is built on an honor system. We look away to “live our life” and tacitly believe others are behaving honorably. And they all do. Economists teach us inflation is good because if we increase worker buying power they might own more than the current landlords. Hedge funds short stocks 200% to crater companies and make a profit. Social media manipulates our biochemistry (arguably wasteful consumerism is built around this altogether.) We’re undermining the security of our habitat for future people through all of this. Everyone is acting honorably given our detailed history of being honorable people.
- voz_ 5y ago
  I notice a giant trend of new, throwaway, accounts quipping on here and on reddit about inflation. First order botting/targeting, or second order side-effects of shills hit by first order on another site?
  - kktkti9 5y ago
    Because you think you noticed a trend it means the first abstraction that pops into your head. Sure, that’s how it works. I’ve noticed a trend of people good at abstraction believing they know the state of all particles that ever were and ever will be, use emotional language to make routine cognitive moments giant feeling. Like that’s just how it is for all time, man.
  - Smithalicious 5y ago
    We have fostered a culture where it's not safe to hold controversial opinions under your own name. I don't think the inflation issue is sensitive enough where I am so I can come out and say that current US inflation policy is dreadful and will come to roost, but I would never give an opinion that I think could be used against me on my main account anywhere anymore. Not everyone who disagrees with you is a paid shill. No, I will go further and say very few people are actually paid shills, and I don't like this boogeyman (though sadly shills of course also exist).
    - kktkti9 5y ago
austincheney 5y ago
Proper security is ensured by a validation process from a third party audit. That is expensive. For strictly internal scrutiny security is primarily the result of a proper risk analysis. Normally that means keep guessing until the software works enough and then refactor as necessary in response to some security apparatus far away from you. Same with accessibility, performance testing, and just about everything else beyond merely pushing content to screen.
rcurry 5y ago
Honestly. I miss the old days. I worked in intelligence at the tail end of the Cold War. We kept all our shit on paper, in a safe, and planted a couple of nice young Marines with guns in front of it. It worked well as a system - so well in fact that when the OPM got hacked and a bunch or people’s security clearance documents got leaked I was like “Well, thankfully my information couldn’t have gotten leaked, it’s on microfiche in a safe somewhere and I really doubt anyone would be stupid enough to scan all that shit into a computer.” Of course about eight months later I get a letter in the mail, lol. Yep, they put it in a computer after all, ha ha.
- deleted 5y ago
  [deleted]
- hamburgerwah 5y ago
  At the fall of the iron curtain we learned that the system you are nostalgically venerating was so thoroughly and systemically compromised by the soviets as to make those marines little more than little girls wielding daisies. The Roderick James Ramsay conviction is a good example where the breadth and depth of the penetration was so bad that we didn't even try to really get to the bottom of any of it to avoid embarrassment and political fallout. By way of example, Rod was able to facilitate hardware level duplication (and could have easily performed neutralization though he did not) of the Permissive Action Link nuclear keys in the active german theatre which were also in locked safes on one of the largest US bases in the world behind many, many layers of armed soldiers.
  - mikeodds 5y ago
    Do you have any recommended reading on this?
    - hamburgerwah 5y ago
      Three minutes to doomsday. There are many fabrications in it (it was written by an FBI agent after all) but most can be corrected by reviewing contemporary documentation connected with the trials.
betwixthewires 5y ago
Off topic but relevant, I wonder how many medium writers watched their readership decline and don't know that it is because medium now requires an account to read articles.
rhizome 5y ago
A couple of months ago I was in a Walmart...I think it was on a holiday, perhaps July 4...and I was having trouble getting help for something that was in a locked cabinet. I walked allll around the store looking for anybody to help me, and...I couldn't! So I went up to the self-checkout, where there are always at least two employees, and asked them if I could get some help. They went off for a minute and came back to tell me someone would meet me over there. Fine. When I got my item I told the employee, "you know, there's only like 5 people working here today, everybody in this store could just up and walk out with whatever they wanted. The 73 year old guy marking ppls receipts ain't gonna tackle anybody, and I wouldn't be surprised if the company tells you not to try to stop shoplifters anyway." She was not impressed by my powers of observation and ideas of economic self-interest.
- simmerup 5y ago
  What was she meant to say? ‘Yeah, go ahead and take it all’
  - rhizome 5y ago
    "Ha ha you're probably right."
- perl4ever 5y ago
  I like self checkouts. But I also think there should be a law that all these huge stores must staff every checkout line that they build, every hour they are open for business. That would be a job-creation bill. Years ago, I used to work a late shift, and go to a supermarket in the middle of the night that was open 24-hours. There wouldn't be a lot of customers, but there would predictably be a few, of which a couple would be buying a month's worth of groceries. And there would always be exactly one register open, and all the self-checkouts inactive. I'm sure management didn't care if people had to wait half an hour, because they figure if you're going to go to the store in the middle of the night, you'll put up with the wait, and they don't want to pay people extra for the night shift.
  - rlpb 5y ago
morninglight 5y ago
The Honor System hasn't broken down. The problem is poorly applied technology that allows a small number of security breakdowns to be amplified. The occasional bad apple has always existed, but current technology allows a miscreant to reign havoc on a global population. In a previous age, human activity was siloed out of necessity. The affects of a security breakdown were thus localized to a small population. Technology allows business and government to save a few pennies by aggregating all the little silos into a few gigantic pools. One break in, and millions pay the price.
- malwarebytess 5y ago
  Huh. Never heard it put this way but of course you are right. Phrased this way the solution seems pretty clear -- we need to decentralize personal information out of these 3rd party databases. No amount of security is ever going to prevent a leak at some point so it's insane to keep creating these massive databases; and every time we ratchet up the security we're actually handing power over to the State and multi-national corporations.
  - MichaelZuo 5y ago
    And how would you link these ‘decentralized databases’ together without recreating a “massive database’ ? Or do you mean destroying the current ‘massive databases’ permanently?
- _wldu 5y ago
  Data aggregation is similar to the encryption backdoor problem in computer science. This is sometimes referred to as the 'exceptional access system' problem. It is impossible to build such a system and then to ensure it is not abused or misused. The best example of this is trying to build a system that allows law enforcement to read private data. There's no way to ensure that only law enforcement (and none other) does that. Keys Under Doormats - https://www.schneier.com/wp-content/uploads/2016/09/paper-keys-under-doormats-CSAIL.pdf https://www.schneier.com/wp-content/uploads/2016/09/paper-ke...
taeric 5y ago
Safety is also largely on the honor system. Not much to stop idiocy on the roads. Now, you have legal recourse against local actors. That keeps a lot of folks acting well. But "trusting trust" is a chain that ultimately perpetuates itself.
mikewarot 5y ago
The main point of the article seems to be that reducing attack surfaces, by corporate policy, doesn't actually work. I'd argue that the real "honor system" is that executables will do what you expect, and nothing more, on behalf of a user.
aaron695 5y ago
> “Yes, well, I’m not positive on this, but one of the employees might have had too many devices and brought in a wireless hub from home, which wasn’t secured. The range of the hub reached across the street.” > “Why didn’t anyone remove that device?!” The correct answer is - "why didn't anyone fix this issue for the employee?" It's also not, a wireless toaster is not required, because complex as computers are, humans are worse, it's you that's wrong if you want to second guess every employee. Cost it up and give the $ figure to the manager if it's too hard to help them within current policy. This part of the breach was the IT departments fault if you want to assign blame. But just like people reuse emails and passwords because life is already too hard, IT departments also have hard jobs to do. I wouldn't call it a 'Honor System' as such.
jdbernard 5y ago
I had a really hard time getting past this in the article: > Not so, as the average programmer is trained not as an operator of simple input-output machines but as a Computer Scientist. And Computer Scientists are very clever. They’ve spent a lot of time and effort in figuring out how to successfully design complex applications. > They also have to justify the forty hours a week they sit at their desks. It simply wouldn’t be feasible for a team of four programmers to finish a six-month project in two weeks. The entire management schedule would be thrown off. > So, we have people specializing in complex systems with a vested interest in taking a large amount of time to create something. They’re faced with a simple problem. Clearly, the goal is to fit the problem into the system and time available, which necessitates taking the simple problem and making it more complex I almost don't even know what to say in response to this. It is such an incorrect, uncharitable, foolish view of the situation that I can't take anything else in this essay seriously. Not to say that these tendencies don't exist, but to take that as your assumption for the whole industry? If it's so simple, start a company, do it right, and put the rest of us out of business.
whydoyoucare 5y ago
Talking of "honor" and "security" in the same breath reminds me of Ken Thompsons seminal Turing Award Lecture "Reflections on Trusting Trust" [1] [1] https://dl.acm.org/doi/10.1145/358198.358210 https://dl.acm.org/doi/10.1145/358198.358210

85 points by Aloha 5y ago

From the 'segment of a realistic episode of a crime program': > “So it’s an inside job?!” > “No, the hacker got in by guessing one of the clerks’ passwords.” > “That’s not possible, we have a password security policy in place. Brute forcing that kind of thing would take hundreds of thousands of attempts.” > “Well, normally, yes, but the clerk was using the same password for her email, and that server got hacked, and a file with all the usernames and plaintext passwords got dumped.” > “But everyone knows user passwords need to be stored as one-way hashes so that getting the plaintext back out of them is impossible.” > “They were hashed, but only md5! The hackers just used a rainbow table to do the lookups.” A password security policy could have prevented that. ;p

sokoloff 5y ago
About half the Epic (electronic medical records) terminals I see have the password posted on the front of the terminal. Often in a nice, professional PTouch label (so presumably by IT).
- thaumasiotes 5y ago
  That's a very effective defense against this attack. It's ineffective against someone walking up to the terminal.
  - loonster 5y ago
    It could be the 1st factor with the person only remembering a simple password to add to the end.
aaron695 5y ago
I think you are saying with a password security policy you couldn't rainbow table the md5 of the password following the policy? I'm not sure that's true anymore. Without salts (which the third party didn't have) I'd assume many passwords the human mind can remember within workable policy rules have been compromised. If the 3rd party had salted them, even with a common salt, the password policy probably would have worked though.
- thaumasiotes 5y ago
  A rainbow table approach is easily defeated by length. Whether you can remember a password depends mostly on how often you use it. If you have to type it in every day, 30 random letters aren't difficult to remember. I can still tell you my first library card number just from the messages the library would leave when a book came in. 1000102772901.
  - aaron695 5y ago
    > A rainbow table approach is easily defeated by length. Only somewhat true. This XKCD is absolutely wrong - https://xkcd.com/936/ https://xkcd.com/936/ 10 billion MD5s a second should be easy. So the XKCD pass phrase goes from 550 years -> to one hour, on a normal GPU, for one person. Rainbow tables mean after that one hour on their gaming PC no one else has to do it. Start adding in other requirements to the pass phrase the hour goes up, and perhaps you have to rent some cloud time, but only one person once has to do it once. But, if you assume it's likely other sites use seeds, then rainbow tables are out, and length can matter again. And that's reasonable. You need to wreck as many points in the attackers chain as possible. That's the game.
    - thaumasiotes 5y ago
      > But, if you assume it's likely other sites use seeds, then rainbow tables are out, and length can matter again. I'm not sure what you're saying here. If by seeds you mean "salts", they're not relevant -- the whole point of a rainbow table is that you precalculate the hash of every possible password. If it's salted, you'll see the salt in the plaintext and just remove it. But a rainbow table for long passwords will develop pretty extreme storage requirements, and take a long time to compute.
      - aaron695 5y ago
        > If by seeds you mean "salts" Yep > If it's salted, you'll see the salt in the plaintext and just remove it. No. You can't use rainbow tables on salted data. Maybe when a framework has a default common salt that people forget to change. > rainbow table for long passwords will develop pretty extreme storage requirements, Not really, that's the point of rainbow tables. They can be reasonable, they are not lookup tables. If you are looking at large ones, they can be compacted at the expense of time. For "CorrectHorseBatteryStaple" the rainbow table will not contain "sdfgnWlgiuwreFrglrkemnmZflgh". You map the chain to your search space. So after CorrectHorseBatteryStaple might be SimpleFineChairBook or S1mpleFineChairB00k or SimpleFine@ChairBook depending on your space.

disabled 5y ago

Yep. I am terrified for the people who are running open-source medical devices via community-based code and reversed-engineered medical devices. Something bad is bound to happen. Specifications and details here: https://openaps.readthedocs.io/en/latest/ https://openaps.readthedocs.io/en/latest/ The code is hosted on GitHub, and is against Microsoft's Terms and Conditions, for obvious reasons. Still, nothing is done about it.

monocasa 5y ago
I used to be terrified of that as well, until meeting many former medical device engineers in the Denver area who got out for moral reasons. However shit you think the community code is, the official code is probably worse. Like kills people and hide behind lawyers already worse. It's not uncommon for these engineers to have a 'if I am incapacitated, do not hook me up to these devices' card in their wallet like you'd normally see for alllergies for products they've worked on.
- disabled 5y ago
  Just FYI, the European Union made such projects illegal as of 26 May 2021. See Medical Devices Regulation (MDR) EU 2017/745: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32017R0745 https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE... Also, these projects were designed on purpose to circumvent or in some cases break the law, which is the wrong approach to medical device design. It's dangerous and designs kill, as you know. See this stipulation (and control/command + f = "commercial" in paper): 27) ‘making available on the market’ means any supply of a device, other than an investigational device, for distribution, consumption or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge; Also: 46) ‘investigational device’ means a device that is assessed in a clinical investigation Also: 1) ‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes: — diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease, Also: (19) It is necessary to clarify that software in its own right, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device. The qualification of software, either as a device or an accessory, is independent of the software's location or the type of interconnection between the software and a device.

hncurious 5y ago

We are sitting ducks if you think about it. If a couple university researchers can get malicious code into the Linux kernel, just imagine what well funded state actors are doing? https://www.theverge.com/2021/4/22/22398156/university-minnesota-linux-kernal-ban-research https://www.theverge.com/2021/4/22/22398156/university-minne...

Godel_unicode 5y ago
Part of me wishes this test had gone on for longer, and had used several bugs of varying subtlety. I'm more interested in how long a supply chain bug can live than whether you can introduce one (because I've never questioned that possibility).

endisneigh 5y ago

When you get right down to it, civilization in general is based on the honor system.

generalizations 5y ago
Or just, "honor."
- manbart 5y ago
  Qapla'!

throwaway0a5e 5y ago

You have to trust some people. Technical security reduces the number of people you need to trust and the extent you need to trust them.

XorNot 5y ago
The problem I've always found is the people who want to be the arbiters of trust (managers) are usually do technically incompetent or disinterested that they effectively aren't. I've held superuser root keys I shouldn't actually have so many times because the little who technically decide if I can use them refuse to learn how to grant and remove that permission.

kktkti9 5y ago

Duh; society is built on an honor system. We look away to “live our life” and tacitly believe others are behaving honorably. And they all do. Economists teach us inflation is good because if we increase worker buying power they might own more than the current landlords. Hedge funds short stocks 200% to crater companies and make a profit. Social media manipulates our biochemistry (arguably wasteful consumerism is built around this altogether.) We’re undermining the security of our habitat for future people through all of this. Everyone is acting honorably given our detailed history of being honorable people.

voz_ 5y ago
I notice a giant trend of new, throwaway, accounts quipping on here and on reddit about inflation. First order botting/targeting, or second order side-effects of shills hit by first order on another site?
- kktkti9 5y ago
  Because you think you noticed a trend it means the first abstraction that pops into your head. Sure, that’s how it works. I’ve noticed a trend of people good at abstraction believing they know the state of all particles that ever were and ever will be, use emotional language to make routine cognitive moments giant feeling. Like that’s just how it is for all time, man.
- Smithalicious 5y ago
  We have fostered a culture where it's not safe to hold controversial opinions under your own name. I don't think the inflation issue is sensitive enough where I am so I can come out and say that current US inflation policy is dreadful and will come to roost, but I would never give an opinion that I think could be used against me on my main account anywhere anymore. Not everyone who disagrees with you is a paid shill. No, I will go further and say very few people are actually paid shills, and I don't like this boogeyman (though sadly shills of course also exist).
  - kktkti9 5y ago

austincheney 5y ago

Proper security is ensured by a validation process from a third party audit. That is expensive. For strictly internal scrutiny security is primarily the result of a proper risk analysis. Normally that means keep guessing until the software works enough and then refactor as necessary in response to some security apparatus far away from you. Same with accessibility, performance testing, and just about everything else beyond merely pushing content to screen.

rcurry 5y ago

Honestly. I miss the old days. I worked in intelligence at the tail end of the Cold War. We kept all our shit on paper, in a safe, and planted a couple of nice young Marines with guns in front of it. It worked well as a system - so well in fact that when the OPM got hacked and a bunch or people’s security clearance documents got leaked I was like “Well, thankfully my information couldn’t have gotten leaked, it’s on microfiche in a safe somewhere and I really doubt anyone would be stupid enough to scan all that shit into a computer.” Of course about eight months later I get a letter in the mail, lol. Yep, they put it in a computer after all, ha ha.

deleted 5y ago
[deleted]
hamburgerwah 5y ago
At the fall of the iron curtain we learned that the system you are nostalgically venerating was so thoroughly and systemically compromised by the soviets as to make those marines little more than little girls wielding daisies. The Roderick James Ramsay conviction is a good example where the breadth and depth of the penetration was so bad that we didn't even try to really get to the bottom of any of it to avoid embarrassment and political fallout. By way of example, Rod was able to facilitate hardware level duplication (and could have easily performed neutralization though he did not) of the Permissive Action Link nuclear keys in the active german theatre which were also in locked safes on one of the largest US bases in the world behind many, many layers of armed soldiers.
- mikeodds 5y ago
  Do you have any recommended reading on this?
  - hamburgerwah 5y ago
    Three minutes to doomsday. There are many fabrications in it (it was written by an FBI agent after all) but most can be corrected by reviewing contemporary documentation connected with the trials.

betwixthewires 5y ago

Off topic but relevant, I wonder how many medium writers watched their readership decline and don't know that it is because medium now requires an account to read articles.

rhizome 5y ago

A couple of months ago I was in a Walmart...I think it was on a holiday, perhaps July 4...and I was having trouble getting help for something that was in a locked cabinet. I walked allll around the store looking for anybody to help me, and...I couldn't! So I went up to the self-checkout, where there are always at least two employees, and asked them if I could get some help. They went off for a minute and came back to tell me someone would meet me over there. Fine. When I got my item I told the employee, "you know, there's only like 5 people working here today, everybody in this store could just up and walk out with whatever they wanted. The 73 year old guy marking ppls receipts ain't gonna tackle anybody, and I wouldn't be surprised if the company tells you not to try to stop shoplifters anyway." She was not impressed by my powers of observation and ideas of economic self-interest.

simmerup 5y ago
What was she meant to say? ‘Yeah, go ahead and take it all’
- rhizome 5y ago
  "Ha ha you're probably right."
perl4ever 5y ago
I like self checkouts. But I also think there should be a law that all these huge stores must staff every checkout line that they build, every hour they are open for business. That would be a job-creation bill. Years ago, I used to work a late shift, and go to a supermarket in the middle of the night that was open 24-hours. There wouldn't be a lot of customers, but there would predictably be a few, of which a couple would be buying a month's worth of groceries. And there would always be exactly one register open, and all the self-checkouts inactive. I'm sure management didn't care if people had to wait half an hour, because they figure if you're going to go to the store in the middle of the night, you'll put up with the wait, and they don't want to pay people extra for the night shift.
- rlpb 5y ago

morninglight 5y ago

The Honor System hasn't broken down. The problem is poorly applied technology that allows a small number of security breakdowns to be amplified. The occasional bad apple has always existed, but current technology allows a miscreant to reign havoc on a global population. In a previous age, human activity was siloed out of necessity. The affects of a security breakdown were thus localized to a small population. Technology allows business and government to save a few pennies by aggregating all the little silos into a few gigantic pools. One break in, and millions pay the price.

malwarebytess 5y ago
Huh. Never heard it put this way but of course you are right. Phrased this way the solution seems pretty clear -- we need to decentralize personal information out of these 3rd party databases. No amount of security is ever going to prevent a leak at some point so it's insane to keep creating these massive databases; and every time we ratchet up the security we're actually handing power over to the State and multi-national corporations.
- MichaelZuo 5y ago
  And how would you link these ‘decentralized databases’ together without recreating a “massive database’ ? Or do you mean destroying the current ‘massive databases’ permanently?
_wldu 5y ago
Data aggregation is similar to the encryption backdoor problem in computer science. This is sometimes referred to as the 'exceptional access system' problem. It is impossible to build such a system and then to ensure it is not abused or misused. The best example of this is trying to build a system that allows law enforcement to read private data. There's no way to ensure that only law enforcement (and none other) does that. Keys Under Doormats - https://www.schneier.com/wp-content/uploads/2016/09/paper-keys-under-doormats-CSAIL.pdf https://www.schneier.com/wp-content/uploads/2016/09/paper-ke...

taeric 5y ago

Safety is also largely on the honor system. Not much to stop idiocy on the roads. Now, you have legal recourse against local actors. That keeps a lot of folks acting well. But "trusting trust" is a chain that ultimately perpetuates itself.

mikewarot 5y ago

The main point of the article seems to be that reducing attack surfaces, by corporate policy, doesn't actually work. I'd argue that the real "honor system" is that executables will do what you expect, and nothing more, on behalf of a user.

aaron695 5y ago

> “Yes, well, I’m not positive on this, but one of the employees might have had too many devices and brought in a wireless hub from home, which wasn’t secured. The range of the hub reached across the street.” > “Why didn’t anyone remove that device?!” The correct answer is - "why didn't anyone fix this issue for the employee?" It's also not, a wireless toaster is not required, because complex as computers are, humans are worse, it's you that's wrong if you want to second guess every employee. Cost it up and give the $ figure to the manager if it's too hard to help them within current policy. This part of the breach was the IT departments fault if you want to assign blame. But just like people reuse emails and passwords because life is already too hard, IT departments also have hard jobs to do. I wouldn't call it a 'Honor System' as such.

jdbernard 5y ago

I had a really hard time getting past this in the article: > Not so, as the average programmer is trained not as an operator of simple input-output machines but as a Computer Scientist. And Computer Scientists are very clever. They’ve spent a lot of time and effort in figuring out how to successfully design complex applications. > They also have to justify the forty hours a week they sit at their desks. It simply wouldn’t be feasible for a team of four programmers to finish a six-month project in two weeks. The entire management schedule would be thrown off. > So, we have people specializing in complex systems with a vested interest in taking a large amount of time to create something. They’re faced with a simple problem. Clearly, the goal is to fit the problem into the system and time available, which necessitates taking the simple problem and making it more complex I almost don't even know what to say in response to this. It is such an incorrect, uncharitable, foolish view of the situation that I can't take anything else in this essay seriously. Not to say that these tendencies don't exist, but to take that as your assumption for the whole industry? If it's so simple, start a company, do it right, and put the rest of us out of business.

whydoyoucare 5y ago

Talking of "honor" and "security" in the same breath reminds me of Ken Thompsons seminal Turing Award Lecture "Reflections on Trusting Trust" [1] [1] https://dl.acm.org/doi/10.1145/358198.358210 https://dl.acm.org/doi/10.1145/358198.358210