5 ms·

Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. That

by xoa 3y ago

Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. That it gets pushed an astonishingly high number of times on technical forums kind of illustrates though how little critical thinking even people who should know better do sometimes I guess. And I suppose how fractally wrong it is can be a good starter for discussion. Edit: commenting about downvotes is almost always pointless. But pointing out the truth about this comic always gets lots of commentless downvotes, and so this time I want to say that you people are wrong, and you are actively misinforming people. Security is about economics, increasing the time/cost for attackers vs defenders. Additionally, different security measures are about specific threat models. Encryption is entirely orthogonal to physical attacks, which are addressed by physical defenses. But physical attacks are much more expensive and riskier, if they're possible at all, vs electronic. And encryption still yields the important value of knowing you were attacked at all. If you are going through an airport and they demand your password at gunpoint, you can surrender it right away and you've lost nothing, but now you also know they were interested and all the data is likely compromised. Whereas if it was all unencrypted, they could have just quickly and transparently copied it all off, added a root kit, etc with you never being the wiser. But in much of the world, official services threatening you physically isn't legal. And if it's criminals, how often is the "lead pipe" a thing vs "we stole this from some tourist and we don't even know who it belongs to" or the like? XKCD is rightfully popular. But this comic is shallow and bad. It shouldn't be held up as at all valuable in security discussions on HN or anywhere else.

lukevp 3y ago
Perhaps you could take this opportunity where you’ve gotten the attention of an audience to, instead of criticize, educate us? I don’t see what’s wrong with this comic at all. It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Perhaps you think the link was to a different comic (maybe the entropy one about the horses and the batteries) and didn’t actually click it?
- xoa 3y ago
  Sorry, I just edited to add that. But >I don’t see what’s wrong with this comic at all. Everything is wrong with that comic. >It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. Can they? Please take a moment to actually think about this. What if they stole the laptop out of my car while I'm traveling? How do they even find me? Is it worth them sending a warm body and paying for airfare to follow me home if they do? How do they keep me from shooting them when they break into my house or attack me to torture me? Or my friends or family from shooting them? How do they evade law enforcement? Again, is all this worth it? And how am I worse off if I instantly give the password vs if it was plain text and they never had to let me know at all? What does encryption have to do with physical attacks? It's completely stupid. Seriously, if you think this is correct take it to the logical conclusion: why bother wish any password beyond abc123? After all, they can "just" torture you for it right? Why bother with HTTPS? Attackers can "just" torture bank IT for the accounts anyway right? Except obviously that's not how it works. >They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Again, no they generally cannot. It's impossible to be secure against an omniscient attacker with infinite resources, but IRL there is no such thing. Not even the biggest most powerful security agencies. If the cost of attacking is higher than the value of whatever it is, the security is good. Forcing attackers away from cheap, undetectable attacks into expensive, noisy attacks is what it's all about! This comic pushes one of the most fundamental misconceptions about security, and in a doomer despair sort of way. "Why bother taking any steps, the CIA/KGB/whomever can still get you!" is not a reasonable message or argument. Edit: another real common flaw in thinking about security is inventing fanciful threat models vs real ones, which is bad because it can mean poor allocation of limited resources. It happens a lot in certain parts of the gun community for example, egged on of course by those with things to sell: people worried about defending their homes might spend 4, even 5 figures on firearms, yet then also have a crummy door and lock that would take approximately 3.8 seconds to kick in. It would be much more effective and have higher ROI to invest much less money in basic physical security first. Decent frame/door/bolt, shatter resistant first floor windows (or film on the windows), cosmetic but spiky bush beneath them, etc won't keep out determined attackers. But most likely attackers aren't determined. They aren't after "you" they're after "someone", low hanging fruit. You don't have to be Fort Knox, you just need to be enough of a pain that police are more likely to show up in time and make it not worth it. Or enough of a pain that they go next door as cold as that is to say. It's another sort of "preoptimization is the root of all evil", focusing on outliers vs the common case.
12345hn6789 3y ago
Double check you didn't get redirected to the wrong comic. The one the parent commented is absolutely correct.
lxgr 3y ago
I think you're reading things into the comic that I'd argue are not there: Nowhere is Randall saying that the crowbar is the only or the most likely attack scenario to worry about. He's simply mentioning that it's there and worth keeping in mind, especially when going overboard with other security measures not appropriate in the threat model.
ajonit 3y ago
My understanding of this XKCD: It’s a subtle yet poignant reminder that our inclination, as tech-savvy individuals, is often to envision sophisticated technical exploits when considering hacking scenarios. However, the stark reality is that, in the vast majority of cases, both individuals and organizations fall prey to breaches not through intricate code manipulation, but rather via the art of social engineering. (beating the sh*t out of someone can be thought as an extreme form of social eng.) This comic underscores the importance of understanding and mitigating the very human vulnerabilities that persist at the heart of cybersecurity.
thefz 3y ago
> Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. Not few, it's pretentious most of the times. I am with you on the criticism, XKCD is the loud, smart-ass kid in the room that everyone thinks is smart because he's using big words.

by xoa 3y ago

lukevp 3y ago

Perhaps you could take this opportunity where you’ve gotten the attention of an audience to, instead of criticize, educate us? I don’t see what’s wrong with this comic at all. It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Perhaps you think the link was to a different comic (maybe the entropy one about the horses and the batteries) and didn’t actually click it?

xoa 3y ago
Sorry, I just edited to add that. But >I don’t see what’s wrong with this comic at all. Everything is wrong with that comic. >It’s saying that if someone really wants to get into your laptop, they can torture you for your credentials. Can they? Please take a moment to actually think about this. What if they stole the laptop out of my car while I'm traveling? How do they even find me? Is it worth them sending a warm body and paying for airfare to follow me home if they do? How do they keep me from shooting them when they break into my house or attack me to torture me? Or my friends or family from shooting them? How do they evade law enforcement? Again, is all this worth it? And how am I worse off if I instantly give the password vs if it was plain text and they never had to let me know at all? What does encryption have to do with physical attacks? It's completely stupid. Seriously, if you think this is correct take it to the logical conclusion: why bother wish any password beyond abc123? After all, they can "just" torture you for it right? Why bother with HTTPS? Attackers can "just" torture bank IT for the accounts anyway right? Except obviously that's not how it works. >They could similarly ransom/blackmail you or any number of other approaches that don’t involve attempting a brute force decryption. Again, no they generally cannot. It's impossible to be secure against an omniscient attacker with infinite resources, but IRL there is no such thing. Not even the biggest most powerful security agencies. If the cost of attacking is higher than the value of whatever it is, the security is good. Forcing attackers away from cheap, undetectable attacks into expensive, noisy attacks is what it's all about! This comic pushes one of the most fundamental misconceptions about security, and in a doomer despair sort of way. "Why bother taking any steps, the CIA/KGB/whomever can still get you!" is not a reasonable message or argument. Edit: another real common flaw in thinking about security is inventing fanciful threat models vs real ones, which is bad because it can mean poor allocation of limited resources. It happens a lot in certain parts of the gun community for example, egged on of course by those with things to sell: people worried about defending their homes might spend 4, even 5 figures on firearms, yet then also have a crummy door and lock that would take approximately 3.8 seconds to kick in. It would be much more effective and have higher ROI to invest much less money in basic physical security first. Decent frame/door/bolt, shatter resistant first floor windows (or film on the windows), cosmetic but spiky bush beneath them, etc won't keep out determined attackers. But most likely attackers aren't determined. They aren't after "you" they're after "someone", low hanging fruit. You don't have to be Fort Knox, you just need to be enough of a pain that police are more likely to show up in time and make it not worth it. Or enough of a pain that they go next door as cold as that is to say. It's another sort of "preoptimization is the root of all evil", focusing on outliers vs the common case.

12345hn6789 3y ago

Double check you didn't get redirected to the wrong comic. The one the parent commented is absolutely correct.

lxgr 3y ago

I think you're reading things into the comic that I'd argue are not there: Nowhere is Randall saying that the crowbar is the only or the most likely attack scenario to worry about. He's simply mentioning that it's there and worth keeping in mind, especially when going overboard with other security measures not appropriate in the threat model.

ajonit 3y ago

My understanding of this XKCD: It’s a subtle yet poignant reminder that our inclination, as tech-savvy individuals, is often to envision sophisticated technical exploits when considering hacking scenarios. However, the stark reality is that, in the vast majority of cases, both individuals and organizations fall prey to breaches not through intricate code manipulation, but rather via the art of social engineering. (beating the sh*t out of someone can be thought as an extreme form of social eng.) This comic underscores the importance of understanding and mitigating the very human vulnerabilities that persist at the heart of cybersecurity.

thefz 3y ago

> Obligatory: that comic is one of the few (only?) times Mr Munroe got a topic completely, absolutely and utterly wrong and made a really, really bad comic. Not few, it's pretentious most of the times. I am with you on the criticism, XKCD is the loud, smart-ass kid in the room that everyone thinks is smart because he's using big words.