3 ms·

Identity providers, password managers, VPN companies, …. should never get hacked. They make their money from security products. I won’t use them if they are bre

by aborsy 3y ago

Identity providers, password managers, VPN companies, …. should never get hacked. They make their money from security products. I won’t use them if they are breached. They probably have deeper problems.

Veserv 3y ago
Why would you use them before they prove they can not be breached? The default assumption is that they can all be breached, the burden of proof is on them to prove they will not get compromised. It would only seem prudent to wait for positive proof of the extraordinary claim that they can not get hacked rather than extending the benefit of the doubt to serial incompetents.
- malux85 3y ago
  How do you prove that “they will not get compromised” when a breach can be caused by an unknown CVE in the future? That seems impossible to prove, I mean I understand you can patch, audit, encrypt, your way to a safer system, but proof (by definition) is a very high bar. What is an acceptable demonstration of proof given unknown future events? How does one define proof in the sense “will not get compromised” (future tense is used in your phrasing so a proof would have to include all possible future outcomes)
  - Veserv 3y ago
    The person I was responding to said these providers “should never get hacked”. Given that the default assumption is that systems are easily hacked, then logically such a requirement demands proof (in the sense of robust evidence) before acceptance that it is met. There is no sense in waiting for it to happen first when that is the default assumption. To go a step further, you can apply this to any acceptance criteria. What evidence is there that any of these systems meet any meaningful acceptance criteria. What evidence is there that Okta has systems that can protect billions of dollars worth of assets from the teams of professional and state attackers that currently target their systems? To then get to your direct question, if you really need “should never get hacked”, you could provide machine checked mathematical proofs of correctness, robust and exhaustive validations, and NSA penetration test reports showing zero identified vulnerabilities like what was done for the F-35. I mean, I guess that is only like 1000x better than prevailing commercial IT systems and not completely foolproof, but it is certainly a good starting point. You can probably think of some ways to evaluate even more robust security if you need more assurance than the US air force.
- StressedDev 3y ago
  Unfortunately, getting breached is not a sign a person or organization is incompetent. All getting breached means is someone decided to attack and organization and found one or more holes in the organizations services.
  - Veserv 3y ago
    Shooting a hole in a bulletproof vest with a slingshot is not a sign the bulletproof vest is garbage. All shooting a hole in a bulletproof vest with a slingshot means is someone decided to shoot a bulletproof vest with a slingshot and found one or more weak points in the bulletproof vest. Sounds pretty stupid, right? Okay, now replace slingshot with tank. Now it does not sound so stupid. Turns out you can learn something based on the effort needed to breach a defense. As it turns out, the entire commercial IT industry is basically incapable of stopping small teams of moderately skilled attackers as has been demonstrated to death. A team with just 1-2 M$ of resources is basically unstoppable even with 100 M$- 1 G$ budgets. That is the definition of gross inadequacy.
    - xctr94 3y ago
      ‘Click Here to Kill Everybody’ talks in great detail about the asymmetry of defending against attacks. We are in a timeline where this is getting worse over time. A 100x or even 1000x budget/effort is now required to defend against some attack vectors. This isn’t fair, but it’s the state if affairs. My point being: you’re right, but tanks are now orders of magnitude cheaper than anti-tank defenses.
      - AtlasBarfed 3y ago
        Is that why corp.it is replacing ssh with shit like teleport?
  - NicoJuicy 3y ago
    The only ones competent here are Cloudflare for detecting it earlier and informing Okta.
StressedDev 3y ago
Everyone will get hacked. It is obvious no one knows how to write completely secure software. It is also obvious no one knows how to never make operational mistakes, never misconfigure software, never forget to remove access, always rotate secrets, etc.
- aborsy 3y ago
  In fact, not everyone will get hacked. There are security mechanisms that could be used to significantly reduce the chance or increase the cost for the attackers, e.g., adding layers, sandboxing etc. The goal is not absolute security, rather practically secure systems against attackers with moderate resources. We can’t prove that a security company will not be breached. But once they have a significant breach, it might be time to move on. They likely have other problems. I’m looking at you LastPass! Okta holds the keys to the castle. It has had a security incidence in the past. A compromise of the Okta systems will have a huge impact on its users. The margin for error is small.
  - spicymaki 3y ago
    Who hasn't been hacked?
    - deleted 3y ago
      [deleted]
imiric 3y ago
Those services are honeypots by definition. It would be naive to think that they never get hacked. It's only a matter of time until they do. If they're competent and responsible enough they'll notice and disclose it publicly, but I reckon that most of them never do, precisely because people like you would stop using them. This is why anyone even slightly concerned about this should use offline, self-hosted, or self-built alternatives.
- quesera 3y ago
  > Those services are honeypots by definition A honeypot is a trap set to catch attackers. It does not include real data. https://en.wikipedia.org/wiki/Honeypot_(computing) https://en.wikipedia.org/wiki/Honeypot_(computing) Seeing this misuse a lot lately! These services are attractive targets, but they are not honeypots. Some of them might also run honeypots separately from their core service, but that is not under discussion presently.
  - raverbashing 3y ago
    Yeah funny how someone comes with an authoritative tone about how 'these are honeypots' and they don't even know the meaning of the word Says a lot about security discussions around
  - imiric 3y ago
    I'm aware of the definition. Whether the service is intentionally setup to attract attackers or not is irrelevant. Way to ignore my point, and nitpick about semantics.
    - carstenhag 3y ago
      Why not say "it's a pot of gold", "it's a treasure for attackers" or something like that? Honeypots being a trap is the common definition, and it's confusing when used otherwise
    - okeuro49 3y ago
      > Whether the service is intentionally setup to attract attackers or not is irrelevant No, this forms part of the definition.
high_5 3y ago
As the old saying goes, security is process, not a product. But since it's very hard, there is always temptation to lean on the latter, not the former.

by aborsy 3y ago

Veserv 3y ago

Why would you use them before they prove they can not be breached? The default assumption is that they can all be breached, the burden of proof is on them to prove they will not get compromised. It would only seem prudent to wait for positive proof of the extraordinary claim that they can not get hacked rather than extending the benefit of the doubt to serial incompetents.

malux85 3y ago
How do you prove that “they will not get compromised” when a breach can be caused by an unknown CVE in the future? That seems impossible to prove, I mean I understand you can patch, audit, encrypt, your way to a safer system, but proof (by definition) is a very high bar. What is an acceptable demonstration of proof given unknown future events? How does one define proof in the sense “will not get compromised” (future tense is used in your phrasing so a proof would have to include all possible future outcomes)
- Veserv 3y ago
  The person I was responding to said these providers “should never get hacked”. Given that the default assumption is that systems are easily hacked, then logically such a requirement demands proof (in the sense of robust evidence) before acceptance that it is met. There is no sense in waiting for it to happen first when that is the default assumption. To go a step further, you can apply this to any acceptance criteria. What evidence is there that any of these systems meet any meaningful acceptance criteria. What evidence is there that Okta has systems that can protect billions of dollars worth of assets from the teams of professional and state attackers that currently target their systems? To then get to your direct question, if you really need “should never get hacked”, you could provide machine checked mathematical proofs of correctness, robust and exhaustive validations, and NSA penetration test reports showing zero identified vulnerabilities like what was done for the F-35. I mean, I guess that is only like 1000x better than prevailing commercial IT systems and not completely foolproof, but it is certainly a good starting point. You can probably think of some ways to evaluate even more robust security if you need more assurance than the US air force.
StressedDev 3y ago
Unfortunately, getting breached is not a sign a person or organization is incompetent. All getting breached means is someone decided to attack and organization and found one or more holes in the organizations services.
- Veserv 3y ago
  Shooting a hole in a bulletproof vest with a slingshot is not a sign the bulletproof vest is garbage. All shooting a hole in a bulletproof vest with a slingshot means is someone decided to shoot a bulletproof vest with a slingshot and found one or more weak points in the bulletproof vest. Sounds pretty stupid, right? Okay, now replace slingshot with tank. Now it does not sound so stupid. Turns out you can learn something based on the effort needed to breach a defense. As it turns out, the entire commercial IT industry is basically incapable of stopping small teams of moderately skilled attackers as has been demonstrated to death. A team with just 1-2 M$ of resources is basically unstoppable even with 100 M$- 1 G$ budgets. That is the definition of gross inadequacy.
  - xctr94 3y ago
    ‘Click Here to Kill Everybody’ talks in great detail about the asymmetry of defending against attacks. We are in a timeline where this is getting worse over time. A 100x or even 1000x budget/effort is now required to defend against some attack vectors. This isn’t fair, but it’s the state if affairs. My point being: you’re right, but tanks are now orders of magnitude cheaper than anti-tank defenses.
    - AtlasBarfed 3y ago
      Is that why corp.it is replacing ssh with shit like teleport?
- NicoJuicy 3y ago
  The only ones competent here are Cloudflare for detecting it earlier and informing Okta.

StressedDev 3y ago

Everyone will get hacked. It is obvious no one knows how to write completely secure software. It is also obvious no one knows how to never make operational mistakes, never misconfigure software, never forget to remove access, always rotate secrets, etc.

aborsy 3y ago
In fact, not everyone will get hacked. There are security mechanisms that could be used to significantly reduce the chance or increase the cost for the attackers, e.g., adding layers, sandboxing etc. The goal is not absolute security, rather practically secure systems against attackers with moderate resources. We can’t prove that a security company will not be breached. But once they have a significant breach, it might be time to move on. They likely have other problems. I’m looking at you LastPass! Okta holds the keys to the castle. It has had a security incidence in the past. A compromise of the Okta systems will have a huge impact on its users. The margin for error is small.
- spicymaki 3y ago
  Who hasn't been hacked?
  - deleted 3y ago
    [deleted]

imiric 3y ago

Those services are honeypots by definition. It would be naive to think that they never get hacked. It's only a matter of time until they do. If they're competent and responsible enough they'll notice and disclose it publicly, but I reckon that most of them never do, precisely because people like you would stop using them. This is why anyone even slightly concerned about this should use offline, self-hosted, or self-built alternatives.

quesera 3y ago
> Those services are honeypots by definition A honeypot is a trap set to catch attackers. It does not include real data. https://en.wikipedia.org/wiki/Honeypot_(computing) https://en.wikipedia.org/wiki/Honeypot_(computing) Seeing this misuse a lot lately! These services are attractive targets, but they are not honeypots. Some of them might also run honeypots separately from their core service, but that is not under discussion presently.
- raverbashing 3y ago
  Yeah funny how someone comes with an authoritative tone about how 'these are honeypots' and they don't even know the meaning of the word Says a lot about security discussions around
- imiric 3y ago
  I'm aware of the definition. Whether the service is intentionally setup to attract attackers or not is irrelevant. Way to ignore my point, and nitpick about semantics.
  - carstenhag 3y ago
    Why not say "it's a pot of gold", "it's a treasure for attackers" or something like that? Honeypots being a trap is the common definition, and it's confusing when used otherwise
  - okeuro49 3y ago
    > Whether the service is intentionally setup to attract attackers or not is irrelevant No, this forms part of the definition.

high_5 3y ago

As the old saying goes, security is process, not a product. But since it's very hard, there is always temptation to lean on the latter, not the former.