4 ms·
For those who are just being exposed to this stuff, This Is How They Tell Me the World Ends: The Cyberweapons Arms Race by Nicole Perlroth was an entertaining r
by mcoliver 5y ago
For those who are just being exposed to this stuff, This Is How They Tell Me the World Ends: The Cyberweapons Arms Race by Nicole Perlroth was an entertaining read that covers some of the history in this space.
- jrm4 5y agoMy most shocking takeaway from this book was certainly discovering the extent to which GOOGLE relied on outsourcing security. Google. Outsources. Security. The kind of thing that makes it seem miraculous that any of it is still standing.
- ma2rten 5y agoGoogle certainly does a lot of security in house.
- bhedgeoser 5y agoIt also stores passwords in plain text. I once got an email from them sayingthat their crawlers found my password somewhere online.
- hasty 5y agoThat doesn't mean it's stored in plain text. They could be storing a nice hash, and then when the crawler finds your email and password on some site some where, it could try to hash it as if you were logging in and see if it matches.
- jart 5y agoDo you know how computationally expensive it is to hash passwords?
- hasty 5y agoIt's computationally expensive to hash every single possible password, but given a proposed login/password combo, it's not expensive to check just the one. If Google, in crawling, finds a dump of several million accounts and their purported passwords, it's not a heavy lift to check each password.
- ummonk 5y agoSalting (which they absolutely should be doing precisely to make mass dictionary attacks computationally expensive) would make that infeasible. More likely they're just checking against the stolen passwords database whenever the user logs in, as passwords are typically submitted in plain text.
- hasty 5y agoSalting doesn't matter in this case. They're not finding a list of free-floating passwords and then seeing if anyone has that password; they're finding a list of accounts and associated passwords. So they only have to check that particular combination, just as they would for a regular login.
- ummonk 5y agoD’oh you’re right.
- pbhjpbhj 5y agoThat conclusion doesn't necessarily follow, fwiw. If you find a password list, then you hash all the passwords and see if any match the hashes you store, now you know if the password found online belonged to someone on your system but at no point did you keep your own system password in plaintext. Mind you with salt and pepper (roughly, ways to modify the hash and overcome rainbow tables) checking anything other than the very highest frequency passwords found would seem onerous.
- ummonk 5y agoThey're probably just checking against a stolen passwords list when the user logs in.
- silisili 5y agoThat I didn't know, interesting. That said, I cannot recall Google ever having a breach, a la Yahoo, Sony, and basically most other companies. Does that mean everyone else should use who Google is using?
- wolverine876 5y agoThey had breaches attributed to China and North Korea, IIRC. The former led to their exit from China.
- guiriduro 5y agoIts still standing precisely because the outsourced and likely compromised security is far more useful if it appears to be working than if it collapses in an act of digital vandalism.
- drexlspivey 5y agoI recommend the darknet diaries episode “The Athens Shadow Games” where the CIA murdered a Greek telecommunications engineer after their wiretapping of the whole Greek cabinate (including the Prime minister and his wife) was exposed.
- belter 5y agoEP 64: "The Athens Shadow Games" https://darknetdiaries.com/episode/64/ https://darknetdiaries.com/episode/64/