3 ms·

>prompted the FBI to issue a public service announcement in late 2020 urging users of smarthome security cameras to use unique passwords From a tech point of v

by xoa 4y ago

>prompted the FBI to issue a public service announcement in late 2020 urging users of smarthome security cameras to use unique passwords From a tech point of view, first in the medium term I first look forward to the long, long, loooonnnng awaited day when this entire class of attacks finally vanishes along with the madness of shared symmetric authentication in favor of proper public key systems. A solid decade and a half or more after smartcards and browser certs might have made it possible if things had taken a different path, the Passkey/Webauthn/FIDO2 ecosystem finally seems to be hitting the tipping point and accelerating towards critical mass. It shouldn't be necessary for anyone to remember more than one or two decent passwords/PINs, and all the actual unique random key generation should get taken care of automatically and with zero concerns about far side security. All other issues aside, it'll be great when this is just, there, and the entire concept of "default passwords" doesn't exist because to setup an account at all requires initialization with a proper key. Second though stories like this also to me at least have helped a bit in terms of motivation/justification for taking IOT security seriously and advocating for that to colleagues and family. Like a lot of human<>tech interface stuff sometimes it feels really hard, because the deliverable is mostly "nothing happens". It's hard to prove a negative, and since for now some security efforts require extra money, time, and/or convenience tradeoffs, "is this all really worth it" does come up (and probably always will). And it can also be hard to be sure if what you've done is enough before it gets put to the test. It takes some level of stochastic belief, of "faith" even that yes, security, redundancy, decentralization and backups etc really does matter in the modern world, like it or not. A certain degree of paranoia isn't unreasonable because a certain percentage of humanity really is out to get us. And the internet means that a tiny percentage can reach out and affect other humans far away.

mattwilsonn888 4y ago
Thanks for writing that. I just wanted to add on to your last point and better justify it. > A certain degree of paranoia isn't unreasonable because a certain percentage of humanity really is out to get us. And the internet means that a tiny percentage can reach out and affect other humans far away. It is true that better systems will make rare but terrible incidents less likely, but in this case, better IoT which is easier to secure and remain self-sovereign over actually expands what people are willing to use IoT for. I imagine there are a swath of compelling avenues ready to be developed if not for the warranted hesitancy of anyone managing the security of these systems. Sure, the security now isn't terrible or problematic if used right, but when the security is robust, simple and dead-easy then the innovation up top gets uncapped.
jjoonathan 4y ago
> Passkey/Webauthn/FIDO2 ecosystem finally seems to be hitting the tipping point Where N is the number of services the key unlocks, is there a O(1) migration story yet?
- xoa 4y ago
  >Where N is the number of services the key unlocks, is there a O(1) migration story yet? I'm not 100% sure I'm interpreting what you meant by this correctly, but if you're saying essentially "is there a single click button that will change all my existing accounts over" the answer is a mixture of "no of course" and "there wouldn't be one answer anyway". I mean, there are still plenty of people who don't even use password managers or have any real formal list of services at all. How would you expect there to be any automated migration there? And even with a password manager it'd still be pretty complex to manage some sort of automated switchover given the diversity of credentials and back ends (remember we're not just dealing with websites), even beyond user interaction being required for each use of many hardware key systems (which is indeed good security practice). However I don't think that matters much having already been through a service migration ages ago with the rise of password managers themselves (and being a fairly early adopter). What happened there (or for email migrations for that matter) was a basic piecemeal/spread-it-out approach. A handful of critical services got changed right away, and then over time I switched others from using old bad passwords of a small set to being listed/managed by password manager(s) whenever I accessed them. The most frequently accessed happened the quickest, others eventually, and I made some systematic effort to get some of the long tail I cared about while just abandoning a few of the very oldest. As it becomes more universal and everyone gets comfortable with it being battle tested, kinks worked out, rich ecosystems etc, I suspect we'll then start to see sites actively prompting/requiring people to add or switch, which will then happen naturally in the course of normal usage. I currently have almost 1000 items in my password manager (though granted not all of them are passwords) which is intimidating on the face of it, but previous experience tells me it won't actually be a big deal. A few dozen already have keys registered, and over time that will naturally increase as services/systems add support. Well before this time in 2032 I expect everything to be switched that's still actively maintained. Even IRC allowed moving to using client certs instead of passwords a while ago!

by xoa 4y ago

mattwilsonn888 4y ago

Thanks for writing that. I just wanted to add on to your last point and better justify it. > A certain degree of paranoia isn't unreasonable because a certain percentage of humanity really is out to get us. And the internet means that a tiny percentage can reach out and affect other humans far away. It is true that better systems will make rare but terrible incidents less likely, but in this case, better IoT which is easier to secure and remain self-sovereign over actually expands what people are willing to use IoT for. I imagine there are a swath of compelling avenues ready to be developed if not for the warranted hesitancy of anyone managing the security of these systems. Sure, the security now isn't terrible or problematic if used right, but when the security is robust, simple and dead-easy then the innovation up top gets uncapped.

jjoonathan 4y ago

> Passkey/Webauthn/FIDO2 ecosystem finally seems to be hitting the tipping point Where N is the number of services the key unlocks, is there a O(1) migration story yet?

xoa 4y ago
>Where N is the number of services the key unlocks, is there a O(1) migration story yet? I'm not 100% sure I'm interpreting what you meant by this correctly, but if you're saying essentially "is there a single click button that will change all my existing accounts over" the answer is a mixture of "no of course" and "there wouldn't be one answer anyway". I mean, there are still plenty of people who don't even use password managers or have any real formal list of services at all. How would you expect there to be any automated migration there? And even with a password manager it'd still be pretty complex to manage some sort of automated switchover given the diversity of credentials and back ends (remember we're not just dealing with websites), even beyond user interaction being required for each use of many hardware key systems (which is indeed good security practice). However I don't think that matters much having already been through a service migration ages ago with the rise of password managers themselves (and being a fairly early adopter). What happened there (or for email migrations for that matter) was a basic piecemeal/spread-it-out approach. A handful of critical services got changed right away, and then over time I switched others from using old bad passwords of a small set to being listed/managed by password manager(s) whenever I accessed them. The most frequently accessed happened the quickest, others eventually, and I made some systematic effort to get some of the long tail I cared about while just abandoning a few of the very oldest. As it becomes more universal and everyone gets comfortable with it being battle tested, kinks worked out, rich ecosystems etc, I suspect we'll then start to see sites actively prompting/requiring people to add or switch, which will then happen naturally in the course of normal usage. I currently have almost 1000 items in my password manager (though granted not all of them are passwords) which is intimidating on the face of it, but previous experience tells me it won't actually be a big deal. A few dozen already have keys registered, and over time that will naturally increase as services/systems add support. Well before this time in 2032 I expect everything to be switched that's still actively maintained. Even IRC allowed moving to using client certs instead of passwords a while ago!