5 ms·
In any serious security design, "the attacker probably won't do that" would and should be shot down immediately. If your security strategy is hoping that an att
by awsthro00945 5y ago
In any serious security design, "the attacker probably won't do that" would and should be shot down immediately. If your security strategy is hoping that an attacker will be kind enough to not exploit your open vulnerability, you've already failed at threat modeling and at security.
If an attacker can do it, you must assume they will do it. Because they will. That should be the starting point for any threat model.
- smegsicle 5y ago"the attacker probably won't intercept the mail and install rootkits on brand new hardware" "the attacker probably won't read my password through the wall from the radiation off my keyboard" if your starting point is APT-level adversary then you might as well give up
- lamontcg 5y agoWhat brand of locks do you have on your doors at home and does the lockpicking lawyer have a video of going through them in a few seconds?
- nyolfen 5y agothat's cool man, i'm still going to block the 99.9999% of attackers that don't own my isp. you are conflating "bad idea in extremely exotic scenario" with "counterproductive"; ever heard of defense in depth?
- deleted 5y ago[deleted]