8 ms·

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account m

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't just delegate to cloud providers the whole effort in preventing attacks, but just with everything production-grade, the average enterprise just isn't ready to deal with all the upfront cost to run your entire computing solution. Because it doesn't end with this type of mitigation and dependency. A similar argument could be made for not using proprietary chip designs made by cloud providers. Or any proprietary API solution for that matter. It really is a matter of convenience that a community solution might cover in the future, abstracting away fundamental building blocks every cloud provider must have (name resolution, network, storage and computing services) to provide such higher level functions without lock in. We are just not there yet.

codedokode 3y ago
There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.2.3.4/16. But ISPs do not want to adopt such protocol.
- HumblyTossed 3y ago
  I am pretty sure that protocol would be just as abused.
  - codedokode 3y ago
    How exactly? You can authenticate sender by sending a special confirmation token back.
    - sophacles 3y ago
      How does one get removed from the block list? Say some IoT device that half of households own gets compromised and turned into a giant botnet. The news gets out and everyone throws away that device. Now they are still blocked over a threat that doesn't exist anymore... doesn't seem like a good situation for anyone. I'd imagine that the website owners that want the attack stopped will soon want to figure out how to get traffic back since they need users to pay the bills. Whats to stop someone from just making an app that participates in an attack when connected to public(ish) wifi networks and participating in attacks long enough to get those all shut off from major sites? How does this stop entire ISPs from getting shut off when the attackers have managed to cycle through all the IP pools used for natting connections? (e.g. the Comcasts of the world that use cg-nat to multiplex very large numbers of people to very small numbers of IPs)?
      - grotorea 3y ago
        As much as I half-wish there was something like this, it does sound like email spam blacklists all over again.
      - codedokode 3y ago
        > How does one get removed from the block list? We can add an "accept" packet that lifts the ban. Also, how do you remove yourself from blacklist when banned by Google or Cloudflare? I guess here you use the same method. > Say some IoT device that half of households own gets compromised and turned into a giant botnet. The news gets out and everyone throws away that device. Now they are still blocked over a threat that doesn't exist anymore... doesn't seem like a good situation for anyone. Not my problem. Should have thought twice before buying a vulnerable device and helping criminals. As a solution they can buy a new IP address from their ISP.
- ilyt 3y ago
  What you say already exists, hell, you can use BGP to distribute ACLs But it costs space in the routing tables and that means replacing routers earlier. It's no wonder, especially if you multiply it by thousand customers. "block all traffic from outside from this IP" is significantly easier than "block all traffic from outside from this IP to this client". And you need to do it per ISP client, else it is ripe for abuse. And don't forget a lot of the traffic will come from "cloud" itself.
  - codedokode 3y ago
    > What you say already exists, hell, you can use BGP to distribute ACLs But you should own an AS for that? > But it costs space in the routing tables Not implementing my proposal leaves critical infrastructure unprotected from foreign attacks. Make larger routing tables. Also, instead of blocking single IPs one can block /8 or /16 subnets.
    - CountSessine 3y ago
      Make larger routing tables. Brilliant! Why didn’t we think of that?!? MOARE TCAMS!!!
      - codedokode 3y ago
        if Cloudflare can do this on commodity hardware (stop attacks and block thousands of IPs), then router manufacturers who have custom hardware can do much more. Also, in Russia for example, there is DPI inspection and recording of all Internet traffic and if it is possible in Russia, then West can probably do 10x more. Simply adding a blacklist on routers seems like an easy task compared to DPI inspection.
      - codedokode 3y ago
        This can be made on a paid basis. For example, for $1/month a customer gets a right to insert 1000 records (block up to 1000 networks or IPs) into blacklist on all Tier-1 ISPs. For $100/mo you can withstand an attack from 100 000 IPs which is more than enough and Cloudflare goes bankrupt.
- tsimionescu 3y ago
  So I can deny service to your site with a single packet, instead of having to bother with establishing a whole botnet? The current botnet customers would be the first to advocate for this new protocol!
  - alexfoo 3y ago
    Simple! To prevent it being abused easily you could make it so you would need to send a high number of those packets for a sustained period in order to activate the block.
    - simondotau 3y ago
      And there could be a short time limit on that block, perhaps one hour, but even 60 seconds would be enough to completely flip the script on a DDoS.
    - codedokode 3y ago
      You can only block access to your IP address, so you can ban someone from sending packets to you but not to anyone else. My proposal is well-thought and doesn't require any lists like Spamhaus that have vague policies for inclusion and charge money for removing. My proposal doesn't have any potential for misuse.
      - ComodoHacker 3y ago
        How can it protect from... botnets, where there are tens of thousands "someones"?
        codedokode 3y ago
        You can only ban packets coming to your IP. Botnet can only ban packets coming to its IP addresses.
      - plagiarist 3y ago
        Sorry, this is not well-thought and certainly has potential for abuse. This is on IP and not domain? What is the signing authority and cryptography mechanism preventing a spoofed request?
- 6510 3y ago
  I just imagined this: isp's could make a isp.com?target=yourwebsite.org/fromisp [slow] redirecting url. If you receive unusual amounts of requests from the isp you redirect it though their website. They can then ignore it until their server melts (which takes care of the problem) or take honorable action if one of their customers is compromised. The S stands for service after all.
  - oefrha 3y ago
    It appears you don’t understand DDoS at all. There aren’t humans sitting behind browsers or scripts using browser automation software. No one cares about less respects your “redirect” because no one’s reading your response. Most of the time the attacks aren’t even HTTP, they are just packet floods.
    - 6510 3y ago
      > It appears you don’t understand DDoS at all. I can confirm this. I see web pages talking about redirecting traffic to scrubbing centers.
- rootlocus 3y ago
  > Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.2.3.4/16. So, if my neighbour is infected and one of his devices is part of a botnet, I get blocked as well?
  - bee_rider 3y ago
    Block the whole country, then I guess you’ll see laws passed that IOT providers need to start updating at a better clip.
  - rcxdude 3y ago
    That already effectively happens in a lot of cases.
  - codedokode 3y ago
    Yes. Because blocking several extra users on a bad network that has several infected hosts and does nothing about it is better than being under attack.
- eptcyka 3y ago
  Do you know what the first D in DDoS attack stands for?
- toast0 3y ago
  If the source field in a packet reliably indicated the source of the packet and a given IP was sending you a lot of unwanted traffic, you'd ask their ISP to turn them off and the problem would be solved. Maybe one day BCP38 will be fully deployed and that will work. I also dream of a day where chargen servers are only a memory. Some newer protocols are designed to limit the potential of reflected responses. Null routing is available in some situations, but of course it's not very specific: hey upstreams (and maybe their upstreams), drop all packets to my specific IP. My understanding is null routing is often done via BGP, so all the things (nice and not) that come with that. Asking for deeper packet inspection than looking at the destination is asking for router ASICs to change their programing; it's unlikely to happen. Anyway, the distributed nature of DDoS means you'd need hundreds of thousands of rules, and nobody will be willing to add that. Null routing is effective, but of course it takes you IP offline. Often real traffic can be encouraged to move faster than attack traffic. Otherwise, the only solution is to have more input bandwidth than the attack and suck it up. Content networks are in a great position here, because they deliver a lot of traffic over symetric connections, they have a lot of spare inbound capacity.
  - codedokode 3y ago
    > If the source field in a packet reliably indicated the source of the packet and a given IP was sending you a lot of unwanted traffic, you'd ask their ISP to turn them off and the problem would be solved No. Your email will go straight into trash because ISP is not interested in doing something for people who don't pay them money. Also, even if they cooperate, it will take too much time. > Null routing is available Null routing means complying with criminals' demand (they want the site to become inaccessible). > it's unlikely to happen It will very likely happen if there will be a serious attack on Western infrastructure: for example, if there will be no electricity in a large city for several days, of if hospitals across the country won't work or something like this. Then the measures will be taken. Of course, while the victims are small non-critical businesses, nobody will care. > Otherwise, the only solution is to have more input bandwidth than the attack and suck it up. Content networks are in a great position here, because they deliver a lot of traffic over symetric connections, they have a lot of spare inbound capacity. So until my proposal is implemented the only solution is to pay protection money to unnecessary middlemen like Cloudflare.
seanw444 3y ago
> Privacy, long term, will mean the fall of civilization. I'm curious about your rationalization for this. Lack of privacy will also mean the fall of civilization. Civilization is just doomed to fail at one point or another. All things come to an end.
- gchamonlive 3y ago
  This was me being sarcastic. Of course we need privacy, not because we have things to hide, but because individuality can only flourish without constant surveillance. Yes! All things come to an end and that is why some recent philosophers think that Plato was naive to think it could minimize or erradicate society rotting. This is where negative utilitarianism comes in, where the point of society is not to maximize happiness (and therefore prevent society from collapsing) but to minimize suffering (and therefore provide mechanisms to minimize damages from transitions between organization forms when society collapses). I have to refer you to Karl Popper's The Open Society for this, because needless to say this answer is very reductionist.
  - seanw444 3y ago
    Ah I just missed the sarcasm. Yeah, and when the sole goal is to minimize suffering, tyranny is introduced. "Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety."
- jorvi 3y ago
  This discussion is somewhat reminiscent of "Don't hex the water".. https://www.youtube.com/watch?v=Fzhkwyoe5vI https://www.youtube.com/watch?v=Fzhkwyoe5vI
_ea1k 3y ago
But that's exactly the problem, it shouldn't require a enterprise grade tool just to host a simple website on the internet. We've lost something due to our inability to stop attacks at the source and heavy overreliance on massive cloud providers to do it for us. 2FA and password managers didn't make us heavily reliant on massive companies.
- meowface 3y ago
  Yes, but if these cloud providers didn't exist eventually there'd be botnets that no site could protect against, rather than the status quo of at least some sites being able to resist them. The idea that the existence of cloud providers that can soak up a lot of traffic is making things worse by causing botnets to get more powerful just seems silly.
- gchamonlive 3y ago
  > 2FA and password managers didn't make us heavily reliant on massive companies. Retool: https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/ https://arstechnica.com/security/2023/09/how-google-authenti... Lastpass: https://news.ycombinator.com/item?id=34516275 https://news.ycombinator.com/item?id=34516275
  - rglullis 3y ago
    If Google Authenticator goes away, people will still be able to use 2FA (I for one use Aegis, it's available on F-droid and does everything I need, including encrypted backups) If Lastpass goes away, people will still be able to use keepass or any of the large number of open source password managers, some of them even with browser integrations. If I have a website that is frequently attacked by botnets and Cloudflare goes away, what can I use to replace it?
    - gchamonlive 3y ago
      I am sorry, but if your password manager goes away and you have no disaster recovery scenario planned you might not be able to just move to a competitor: https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650 My response was to illustrate how insidious big companies are. Of course nothing compares to the backbone of the web going down. If AWS North Virginia suffers widespread downtime to all its availability zones, much of the web will just go dark, no question about it.
starcraft2wol 3y ago
> Let's go back to username and password. 2FA forces scammers to up their game. Let's do it. It works for the website you're using right now. 2FA was in large part motivated by limiting bot accounts and getting customers phone number. I can't imagine how much productivity the economy loses every day due to 2FA.
- starcraft2wol 3y ago
  To add, password managers provide great coverage of almost every problem 2FA is. supposed to solve and it improves the workflow your grandma already know (writing passwords on a sheet). The only difference is Google doesn't get any money when you run a script on your own computer.
- master-lincoln 3y ago
  Is this sarcasm? If not please provide some more details on why you think "2FA was in large part motivated by limiting bot accounts and getting customers phone number". I never used a phone number for 2fa. Mostly TOTP. Bots could do that too. I don't see the connection. >I can't imagine how much productivity the economy loses every day due to 2FA. Is it really that much? Every few days I have to enter a 6 digit number I generate on a device I have with me all the time. Writing this comment took me as much time as using 2fa for a handful of services for a month.
  - starcraft2wol 3y ago
    > ? Every few days I have to enter a 6 digit number I generate on a device I have with me all the time. I use more than one service a day, and some infrequently, so for me about every day I have a minute or two where I try to login, need to find my phone (it's not predictable when it will ask), and then type it in. This happens to every person several times a day! I also now must carry a smart phone with me to participate in society. But the main drag is that when people lose or break their phones the response is: "just don't do that" and the consequences range from losing your account to calling customer service. > Mostly TOTP. Bots could do that too. I don't see the connection. Most people using 2FA do not use TOTP, they use a phone number. Bots could use TOTP, it's more infrastructure, and it's a proof of work function for them to login.
tristan9 3y ago
> just with everything production-grade, the average enterprise just isn't ready to deal with all the upfront cost to run your entire computing solution That’s not a fair point. We’re not even trying to make the internet safe. There is zero (0) actions being taken to stop this madness. If you run a large website, you still regularly see attacks from routers compromised 3, 4, 5 years ago. Or how a mere few days of poking around smartly is still enough to this day to find enough open DNS resolvers to launch >500Gbps attacks with one or two computers. Why are these threats allowed to still exist? The only ones attempting something are governments shutting down booters (DDoS-as-a-service platforms). But that’s treating symptoms, not causes. We will eventually need to do something, or it will be impossible to run a website that can’t be kicked down for free by the next bored skid. Just like paying protection fees to the mafia was a status quo, this also is just that. A status quo, not an inevitability. The solution is to finally hold accountable attack origins (ISPs, mostly), so that monitoring their egress becomes something they have an incentive to do.
- Analemma_ 3y ago
  I don't think it's true that 0 actions are being taken. When new vectors for amplification attacks are found, they get patched - you can't do NTP amplification attacks on modern NTP servers anymore, for example. But it takes a long time for the entire world to upgrade and just a handful of open vulnerable servers to launch attacks. And in the meantime people are always looking for new amplification vectors. > The solution is to finally hold accountable attack origins (ISPs, mostly), so that monitoring their egress becomes something they have an incentive to do. Be careful what you wish for. The sort of centralized C&C infrastructure and "list of bad actors everybody has to de-peer" that you would need to this effectively would we a wonderful juicy target for governments to go, "hey, add [this site we don't like] to the list, or go to prison".
  - tristan9 3y ago
    IP reputation is already a thing. And plenty enough ASNs are well-known for willfully hosting C2 servers and spam, DoS, etc sources…
  - 3y ago
lxgr 3y ago
That's not a valid comparison, since there are various effective decentralized 2FA methods available – unlike for DDoS protection.
paganel 3y ago
Yes, what the OP is saying is related to one of the paradoxes of security/defence, i.e. the fact that the more one increases its defences (like Google is doing) then the more said increase of defences also pushes one's adversary to increase its offence capabilities. Which is to say that Google playing it safer and safer actually causes their potential adversaries to become stronger and stronger. You can see those paradoxes at play throughout the corporate world and especially when it comes to actual combat/war (to which actual combat/war these DOSes might actually be connected). For example the fact that Israel was relatively successful in implementing its Iron Dome shield only incentivised their adversaries to get hold of even more rockets, so that the sheer number of rockets alone would be able to overwhelm said Iron Dome. That's how Hamas got to firing ~4,000 rockets in one single day recently, that number was out of their league several years ago when Iron Dome was not yet functional.
- myth_drannon 3y ago
  It's the opposite, the number of rocket was growing and hence the Iron Dome was developed. The Israelis saw the writing on the wall and acted accordingly. The laser system will be operational soon and then it will cost 1$ per shot.
  - paganel 3y ago
    Unless it's cloudy outside.
unethical_ban 3y ago
None of your examples are valid, IMO. Procuring and operating the infrastructure to mitigate this kind of attack costs many many thousands of dollars or requires becoming part of the Cloudflare/AWS/Google hive. Joe Schmo can set up a TOTP server, run keepass/bitwarden and use letsencrypt for free (or another SSL provider for cheap). The lament from parent is that running a simple blog reliably shouldn't require being inside Cloudflare's castle walls or building your own castle. --- My personal observation is that simple websites should continue operating HTTP1!

codedokode 3y ago

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.2.3.4/16. But ISPs do not want to adopt such protocol.

HumblyTossed 3y ago
I am pretty sure that protocol would be just as abused.
- codedokode 3y ago
  How exactly? You can authenticate sender by sending a special confirmation token back.
  - sophacles 3y ago
    How does one get removed from the block list? Say some IoT device that half of households own gets compromised and turned into a giant botnet. The news gets out and everyone throws away that device. Now they are still blocked over a threat that doesn't exist anymore... doesn't seem like a good situation for anyone. I'd imagine that the website owners that want the attack stopped will soon want to figure out how to get traffic back since they need users to pay the bills. Whats to stop someone from just making an app that participates in an attack when connected to public(ish) wifi networks and participating in attacks long enough to get those all shut off from major sites? How does this stop entire ISPs from getting shut off when the attackers have managed to cycle through all the IP pools used for natting connections? (e.g. the Comcasts of the world that use cg-nat to multiplex very large numbers of people to very small numbers of IPs)?
    - grotorea 3y ago
      As much as I half-wish there was something like this, it does sound like email spam blacklists all over again.
    - codedokode 3y ago
      > How does one get removed from the block list? We can add an "accept" packet that lifts the ban. Also, how do you remove yourself from blacklist when banned by Google or Cloudflare? I guess here you use the same method. > Say some IoT device that half of households own gets compromised and turned into a giant botnet. The news gets out and everyone throws away that device. Now they are still blocked over a threat that doesn't exist anymore... doesn't seem like a good situation for anyone. Not my problem. Should have thought twice before buying a vulnerable device and helping criminals. As a solution they can buy a new IP address from their ISP.
ilyt 3y ago
What you say already exists, hell, you can use BGP to distribute ACLs But it costs space in the routing tables and that means replacing routers earlier. It's no wonder, especially if you multiply it by thousand customers. "block all traffic from outside from this IP" is significantly easier than "block all traffic from outside from this IP to this client". And you need to do it per ISP client, else it is ripe for abuse. And don't forget a lot of the traffic will come from "cloud" itself.
- codedokode 3y ago
  > What you say already exists, hell, you can use BGP to distribute ACLs But you should own an AS for that? > But it costs space in the routing tables Not implementing my proposal leaves critical infrastructure unprotected from foreign attacks. Make larger routing tables. Also, instead of blocking single IPs one can block /8 or /16 subnets.
  - CountSessine 3y ago
    Make larger routing tables. Brilliant! Why didn’t we think of that?!? MOARE TCAMS!!!
    - codedokode 3y ago
      if Cloudflare can do this on commodity hardware (stop attacks and block thousands of IPs), then router manufacturers who have custom hardware can do much more. Also, in Russia for example, there is DPI inspection and recording of all Internet traffic and if it is possible in Russia, then West can probably do 10x more. Simply adding a blacklist on routers seems like an easy task compared to DPI inspection.
    - codedokode 3y ago
      This can be made on a paid basis. For example, for $1/month a customer gets a right to insert 1000 records (block up to 1000 networks or IPs) into blacklist on all Tier-1 ISPs. For $100/mo you can withstand an attack from 100 000 IPs which is more than enough and Cloudflare goes bankrupt.
tsimionescu 3y ago
So I can deny service to your site with a single packet, instead of having to bother with establishing a whole botnet? The current botnet customers would be the first to advocate for this new protocol!
- alexfoo 3y ago
  Simple! To prevent it being abused easily you could make it so you would need to send a high number of those packets for a sustained period in order to activate the block.
  - simondotau 3y ago
    And there could be a short time limit on that block, perhaps one hour, but even 60 seconds would be enough to completely flip the script on a DDoS.
  - codedokode 3y ago
    You can only block access to your IP address, so you can ban someone from sending packets to you but not to anyone else. My proposal is well-thought and doesn't require any lists like Spamhaus that have vague policies for inclusion and charge money for removing. My proposal doesn't have any potential for misuse.
    - ComodoHacker 3y ago
      How can it protect from... botnets, where there are tens of thousands "someones"?
      - codedokode 3y ago
        You can only ban packets coming to your IP. Botnet can only ban packets coming to its IP addresses.
    - plagiarist 3y ago
      Sorry, this is not well-thought and certainly has potential for abuse. This is on IP and not domain? What is the signing authority and cryptography mechanism preventing a spoofed request?
6510 3y ago
I just imagined this: isp's could make a isp.com?target=yourwebsite.org/fromisp [slow] redirecting url. If you receive unusual amounts of requests from the isp you redirect it though their website. They can then ignore it until their server melts (which takes care of the problem) or take honorable action if one of their customers is compromised. The S stands for service after all.
- oefrha 3y ago
  It appears you don’t understand DDoS at all. There aren’t humans sitting behind browsers or scripts using browser automation software. No one cares about less respects your “redirect” because no one’s reading your response. Most of the time the attacks aren’t even HTTP, they are just packet floods.
  - 6510 3y ago
    > It appears you don’t understand DDoS at all. I can confirm this. I see web pages talking about redirecting traffic to scrubbing centers.
rootlocus 3y ago
> Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.2.3.4/16. So, if my neighbour is infected and one of his devices is part of a botnet, I get blocked as well?
- bee_rider 3y ago
  Block the whole country, then I guess you’ll see laws passed that IOT providers need to start updating at a better clip.
- rcxdude 3y ago
  That already effectively happens in a lot of cases.
- codedokode 3y ago
  Yes. Because blocking several extra users on a bad network that has several infected hosts and does nothing about it is better than being under attack.
eptcyka 3y ago
Do you know what the first D in DDoS attack stands for?
toast0 3y ago
If the source field in a packet reliably indicated the source of the packet and a given IP was sending you a lot of unwanted traffic, you'd ask their ISP to turn them off and the problem would be solved. Maybe one day BCP38 will be fully deployed and that will work. I also dream of a day where chargen servers are only a memory. Some newer protocols are designed to limit the potential of reflected responses. Null routing is available in some situations, but of course it's not very specific: hey upstreams (and maybe their upstreams), drop all packets to my specific IP. My understanding is null routing is often done via BGP, so all the things (nice and not) that come with that. Asking for deeper packet inspection than looking at the destination is asking for router ASICs to change their programing; it's unlikely to happen. Anyway, the distributed nature of DDoS means you'd need hundreds of thousands of rules, and nobody will be willing to add that. Null routing is effective, but of course it takes you IP offline. Often real traffic can be encouraged to move faster than attack traffic. Otherwise, the only solution is to have more input bandwidth than the attack and suck it up. Content networks are in a great position here, because they deliver a lot of traffic over symetric connections, they have a lot of spare inbound capacity.
- codedokode 3y ago
  > If the source field in a packet reliably indicated the source of the packet and a given IP was sending you a lot of unwanted traffic, you'd ask their ISP to turn them off and the problem would be solved No. Your email will go straight into trash because ISP is not interested in doing something for people who don't pay them money. Also, even if they cooperate, it will take too much time. > Null routing is available Null routing means complying with criminals' demand (they want the site to become inaccessible). > it's unlikely to happen It will very likely happen if there will be a serious attack on Western infrastructure: for example, if there will be no electricity in a large city for several days, of if hospitals across the country won't work or something like this. Then the measures will be taken. Of course, while the victims are small non-critical businesses, nobody will care. > Otherwise, the only solution is to have more input bandwidth than the attack and suck it up. Content networks are in a great position here, because they deliver a lot of traffic over symetric connections, they have a lot of spare inbound capacity. So until my proposal is implemented the only solution is to pay protection money to unnecessary middlemen like Cloudflare.

seanw444 3y ago

> Privacy, long term, will mean the fall of civilization. I'm curious about your rationalization for this. Lack of privacy will also mean the fall of civilization. Civilization is just doomed to fail at one point or another. All things come to an end.

gchamonlive 3y ago
This was me being sarcastic. Of course we need privacy, not because we have things to hide, but because individuality can only flourish without constant surveillance. Yes! All things come to an end and that is why some recent philosophers think that Plato was naive to think it could minimize or erradicate society rotting. This is where negative utilitarianism comes in, where the point of society is not to maximize happiness (and therefore prevent society from collapsing) but to minimize suffering (and therefore provide mechanisms to minimize damages from transitions between organization forms when society collapses). I have to refer you to Karl Popper's The Open Society for this, because needless to say this answer is very reductionist.
- seanw444 3y ago
  Ah I just missed the sarcasm. Yeah, and when the sole goal is to minimize suffering, tyranny is introduced. "Those who would give up essential liberty, to purchase a little temporary safety, deserve neither liberty nor safety."
jorvi 3y ago
This discussion is somewhat reminiscent of "Don't hex the water".. https://www.youtube.com/watch?v=Fzhkwyoe5vI https://www.youtube.com/watch?v=Fzhkwyoe5vI

_ea1k 3y ago

But that's exactly the problem, it shouldn't require a enterprise grade tool just to host a simple website on the internet. We've lost something due to our inability to stop attacks at the source and heavy overreliance on massive cloud providers to do it for us. 2FA and password managers didn't make us heavily reliant on massive companies.

meowface 3y ago
Yes, but if these cloud providers didn't exist eventually there'd be botnets that no site could protect against, rather than the status quo of at least some sites being able to resist them. The idea that the existence of cloud providers that can soak up a lot of traffic is making things worse by causing botnets to get more powerful just seems silly.
gchamonlive 3y ago
> 2FA and password managers didn't make us heavily reliant on massive companies. Retool: https://arstechnica.com/security/2023/09/how-google-authenticator-gave-attackers-one-companys-keys-to-the-kingdom/ https://arstechnica.com/security/2023/09/how-google-authenti... Lastpass: https://news.ycombinator.com/item?id=34516275 https://news.ycombinator.com/item?id=34516275
- rglullis 3y ago
  If Google Authenticator goes away, people will still be able to use 2FA (I for one use Aegis, it's available on F-droid and does everything I need, including encrypted backups) If Lastpass goes away, people will still be able to use keepass or any of the large number of open source password managers, some of them even with browser integrations. If I have a website that is frequently attacked by botnets and Cloudflare goes away, what can I use to replace it?
  - gchamonlive 3y ago
    I am sorry, but if your password manager goes away and you have no disaster recovery scenario planned you might not be able to just move to a competitor: https://news.ycombinator.com/item?id=31652650 https://news.ycombinator.com/item?id=31652650 My response was to illustrate how insidious big companies are. Of course nothing compares to the backbone of the web going down. If AWS North Virginia suffers widespread downtime to all its availability zones, much of the web will just go dark, no question about it.

starcraft2wol 3y ago

> Let's go back to username and password. 2FA forces scammers to up their game. Let's do it. It works for the website you're using right now. 2FA was in large part motivated by limiting bot accounts and getting customers phone number. I can't imagine how much productivity the economy loses every day due to 2FA.

starcraft2wol 3y ago
To add, password managers provide great coverage of almost every problem 2FA is. supposed to solve and it improves the workflow your grandma already know (writing passwords on a sheet). The only difference is Google doesn't get any money when you run a script on your own computer.
master-lincoln 3y ago
Is this sarcasm? If not please provide some more details on why you think "2FA was in large part motivated by limiting bot accounts and getting customers phone number". I never used a phone number for 2fa. Mostly TOTP. Bots could do that too. I don't see the connection. >I can't imagine how much productivity the economy loses every day due to 2FA. Is it really that much? Every few days I have to enter a 6 digit number I generate on a device I have with me all the time. Writing this comment took me as much time as using 2fa for a handful of services for a month.
- starcraft2wol 3y ago
  > ? Every few days I have to enter a 6 digit number I generate on a device I have with me all the time. I use more than one service a day, and some infrequently, so for me about every day I have a minute or two where I try to login, need to find my phone (it's not predictable when it will ask), and then type it in. This happens to every person several times a day! I also now must carry a smart phone with me to participate in society. But the main drag is that when people lose or break their phones the response is: "just don't do that" and the consequences range from losing your account to calling customer service. > Mostly TOTP. Bots could do that too. I don't see the connection. Most people using 2FA do not use TOTP, they use a phone number. Bots could use TOTP, it's more infrastructure, and it's a proof of work function for them to login.

tristan9 3y ago

> just with everything production-grade, the average enterprise just isn't ready to deal with all the upfront cost to run your entire computing solution That’s not a fair point. We’re not even trying to make the internet safe. There is zero (0) actions being taken to stop this madness. If you run a large website, you still regularly see attacks from routers compromised 3, 4, 5 years ago. Or how a mere few days of poking around smartly is still enough to this day to find enough open DNS resolvers to launch >500Gbps attacks with one or two computers. Why are these threats allowed to still exist? The only ones attempting something are governments shutting down booters (DDoS-as-a-service platforms). But that’s treating symptoms, not causes. We will eventually need to do something, or it will be impossible to run a website that can’t be kicked down for free by the next bored skid. Just like paying protection fees to the mafia was a status quo, this also is just that. A status quo, not an inevitability. The solution is to finally hold accountable attack origins (ISPs, mostly), so that monitoring their egress becomes something they have an incentive to do.

Analemma_ 3y ago
I don't think it's true that 0 actions are being taken. When new vectors for amplification attacks are found, they get patched - you can't do NTP amplification attacks on modern NTP servers anymore, for example. But it takes a long time for the entire world to upgrade and just a handful of open vulnerable servers to launch attacks. And in the meantime people are always looking for new amplification vectors. > The solution is to finally hold accountable attack origins (ISPs, mostly), so that monitoring their egress becomes something they have an incentive to do. Be careful what you wish for. The sort of centralized C&C infrastructure and "list of bad actors everybody has to de-peer" that you would need to this effectively would we a wonderful juicy target for governments to go, "hey, add [this site we don't like] to the list, or go to prison".
- tristan9 3y ago
  IP reputation is already a thing. And plenty enough ASNs are well-known for willfully hosting C2 servers and spam, DoS, etc sources…
- 3y ago

lxgr 3y ago

That's not a valid comparison, since there are various effective decentralized 2FA methods available – unlike for DDoS protection.

paganel 3y ago

Yes, what the OP is saying is related to one of the paradoxes of security/defence, i.e. the fact that the more one increases its defences (like Google is doing) then the more said increase of defences also pushes one's adversary to increase its offence capabilities. Which is to say that Google playing it safer and safer actually causes their potential adversaries to become stronger and stronger. You can see those paradoxes at play throughout the corporate world and especially when it comes to actual combat/war (to which actual combat/war these DOSes might actually be connected). For example the fact that Israel was relatively successful in implementing its Iron Dome shield only incentivised their adversaries to get hold of even more rockets, so that the sheer number of rockets alone would be able to overwhelm said Iron Dome. That's how Hamas got to firing ~4,000 rockets in one single day recently, that number was out of their league several years ago when Iron Dome was not yet functional.

myth_drannon 3y ago
It's the opposite, the number of rocket was growing and hence the Iron Dome was developed. The Israelis saw the writing on the wall and acted accordingly. The laser system will be operational soon and then it will cost 1$ per shot.
- paganel 3y ago
  Unless it's cloudy outside.

unethical_ban 3y ago

None of your examples are valid, IMO. Procuring and operating the infrastructure to mitigate this kind of attack costs many many thousands of dollars or requires becoming part of the Cloudflare/AWS/Google hive. Joe Schmo can set up a TOTP server, run keepass/bitwarden and use letsencrypt for free (or another SSL provider for cheap). The lament from parent is that running a simple blog reliably shouldn't require being inside Cloudflare's castle walls or building your own castle. --- My personal observation is that simple websites should continue operating HTTP1!