5 ms·

For "professional" stuff, yes, it matters. Cyber criminals follow patterns, starting with very low-effort trolling for new services without much defenses. Bots

For "professional" stuff, yes, it matters. Cyber criminals follow patterns, starting with very low-effort trolling for new services without much defenses. Bots scan the internet for open services, enumerate them, and try to gain access. If they find some, they will use a tiny amount of effort to see if the target might be worth exploring. If it seems profitable, the cybercriminal will spend more effort on things like account enumeration, login brute force, scanning for commonly exploitable methods, phishing. The more they find, the more they're willing to invest in exploiting it. But a bot can perform a ransomware hijacking of a newly detected open service all on its own, so it doesn't take much. Simple mitigations can be very effective in holding back their interest. Captchas, rate limiters, error pages with no information leakage, block lists of low-reputation IPs, or outright blocks of countries you don't do business with. They make the difference between 50k login attempts per minute, or crickets. Don't use port knocking tho. It technically works, but is embarrassing, like a grown man in a trilby. Something else (like rate limiting combined with certificate auth) will be more effective and less weird.

0cf8612b2e1e 3y ago
Why the distaste for port knocking? It seems like it would reduce untargetted attacks to zero.
- IcePic 3y ago
  My guess is that it is a sort of knee-jerk reaction. Just like the xkcd about CorrectBatteryHorseStaple, where there is a huge difference if the attacker knows for certain that everyones password is Four English Words From The Dictionary, or if you use those four words on a "anything 8 chars or longer works fine" system. If you know a site has a 4-words policy, the xkcd pw has very low entropy, but if you use this strategy on a "any pw goes" site, a bruteforcer would have to test all lengths upto 25 chars before finding yours (sort of). So in the port-knock case, it is probably a rather poor method in the specific case that I am on some remote network, and the evil 3rd party is actively sniffing my traffic from my client to my server and can record the knocks. If I have a simplistic knock sequence and they sniff it, they can replay it and get access to my https. But, if we are talking about some 3rd party that only knows a service may be up on the host newly.minted.cert.ccTLD, then it is FAR less likely that they can ALSO sniff my port knocking sequence and start abusing my new TLS service. The chances become almost ridiculously low for this to occur. So I agree that simplistic port knocking is sort of bad in the long run for cases like "I am often on a hostile network but still want to talk to my home server securely" but would work wonders for "soon after the cert is signed, someone scans my TLS boxes ip".
  - RunningDroid 3y ago
    > If I have a simplistic knock sequence and they sniff it, they can replay it and get access to my https. Somewhat related, I've never set up port knocking but I've been wondering how hard it would be to set up TOTP-flavored port knocking. The basic idea would be to select the pattern of "knocks" the same way TOTP generates a code, I'm not sure how much it would improve things though.
  - ylere 3y ago
    > If you know a site has a 4-words policy, the xkcd pw has very low entropy, but if you use this strategy on a "any pw goes" site, a bruteforcer would have to test all lengths upto 25 chars before finding yours (sort of). How so? Iirc, the entropy calculations assume that the attacked is aware passphrases are used. The eff-long word list often used for xkcd-style passphrases has 7776 words. So on average it would take 7776^4/2 attempts to guess one (randomly generated) 4-word passphrase, comparable to a truly random 8-9 character password with special chars. As the comic points out, people tend to be pretty bad at remembering random sequences of characters and therefore often often use combinations of common words and apply non-random substitutions and patterns, resulting in much lower entropy for those passwords. Of course, everyone should use a password manager in the first place, but for cases where people don't or they need to reliably remember it (master passwords and critical ones), xkcd-style passphrases are a good and secure option.
    - mediumsmart 3y ago
      And then comes the rails/whathaveyou tutorial for authentication permitting a reasonable min 5 char password and max 256 char username limit example.
- e40 3y ago
  It’s crazy to me how much people dislike port knocking. Been using it for a long time and it is invaluable.
  - 0cf8612b2e1e 3y ago
    What do you use to configure it? I have been thinking of running it on my servers just to minimize log noise.
    - e40 3y ago
      We install it from source[1] on our firewalls and use really long passwords stored in 1Password and I use the Homebrew 1Password CLI (`op`) to script the knocking when I start my day. [1] https://www.cipherdyne.org/fwknop/download/ https://www.cipherdyne.org/fwknop/download/
- 0xbadcafebee 3y ago
  So would using pigeons to send texts. It's weird, it's not a standard, it's vulnerable to attacks. We have standards that fix the problem that aren't purely security by obscurity.
orev 3y ago
I can’t believe people still mention port knocking when single packet authorization has been around for almost as long and has none of the drawbacks of regular port knocking. Anyone even thinking about port knocking should look at fwknop.

0cf8612b2e1e 3y ago

Why the distaste for port knocking? It seems like it would reduce untargetted attacks to zero.

IcePic 3y ago
My guess is that it is a sort of knee-jerk reaction. Just like the xkcd about CorrectBatteryHorseStaple, where there is a huge difference if the attacker knows for certain that everyones password is Four English Words From The Dictionary, or if you use those four words on a "anything 8 chars or longer works fine" system. If you know a site has a 4-words policy, the xkcd pw has very low entropy, but if you use this strategy on a "any pw goes" site, a bruteforcer would have to test all lengths upto 25 chars before finding yours (sort of). So in the port-knock case, it is probably a rather poor method in the specific case that I am on some remote network, and the evil 3rd party is actively sniffing my traffic from my client to my server and can record the knocks. If I have a simplistic knock sequence and they sniff it, they can replay it and get access to my https. But, if we are talking about some 3rd party that only knows a service may be up on the host newly.minted.cert.ccTLD, then it is FAR less likely that they can ALSO sniff my port knocking sequence and start abusing my new TLS service. The chances become almost ridiculously low for this to occur. So I agree that simplistic port knocking is sort of bad in the long run for cases like "I am often on a hostile network but still want to talk to my home server securely" but would work wonders for "soon after the cert is signed, someone scans my TLS boxes ip".
- RunningDroid 3y ago
  > If I have a simplistic knock sequence and they sniff it, they can replay it and get access to my https. Somewhat related, I've never set up port knocking but I've been wondering how hard it would be to set up TOTP-flavored port knocking. The basic idea would be to select the pattern of "knocks" the same way TOTP generates a code, I'm not sure how much it would improve things though.
- ylere 3y ago
  > If you know a site has a 4-words policy, the xkcd pw has very low entropy, but if you use this strategy on a "any pw goes" site, a bruteforcer would have to test all lengths upto 25 chars before finding yours (sort of). How so? Iirc, the entropy calculations assume that the attacked is aware passphrases are used. The eff-long word list often used for xkcd-style passphrases has 7776 words. So on average it would take 7776^4/2 attempts to guess one (randomly generated) 4-word passphrase, comparable to a truly random 8-9 character password with special chars. As the comic points out, people tend to be pretty bad at remembering random sequences of characters and therefore often often use combinations of common words and apply non-random substitutions and patterns, resulting in much lower entropy for those passwords. Of course, everyone should use a password manager in the first place, but for cases where people don't or they need to reliably remember it (master passwords and critical ones), xkcd-style passphrases are a good and secure option.
  - mediumsmart 3y ago
    And then comes the rails/whathaveyou tutorial for authentication permitting a reasonable min 5 char password and max 256 char username limit example.
e40 3y ago
It’s crazy to me how much people dislike port knocking. Been using it for a long time and it is invaluable.
- 0cf8612b2e1e 3y ago
  What do you use to configure it? I have been thinking of running it on my servers just to minimize log noise.
  - e40 3y ago
    We install it from source[1] on our firewalls and use really long passwords stored in 1Password and I use the Homebrew 1Password CLI (`op`) to script the knocking when I start my day. [1] https://www.cipherdyne.org/fwknop/download/ https://www.cipherdyne.org/fwknop/download/
0xbadcafebee 3y ago
So would using pigeons to send texts. It's weird, it's not a standard, it's vulnerable to attacks. We have standards that fix the problem that aren't purely security by obscurity.

orev 3y ago

I can’t believe people still mention port knocking when single packet authorization has been around for almost as long and has none of the drawbacks of regular port knocking. Anyone even thinking about port knocking should look at fwknop.