4 ms·

Cryptography can and should be done on hardware tokens that should directly be reported as stolen. A video call with email/phone is easy to fake. I work with p

Cryptography can and should be done on hardware tokens that should directly be reported as stolen. A video call with email/phone is easy to fake. I work with people who all have hardware crypto, you are right that we do not have the organizational knowledge to verify everything with crypto. Even if the tech is 60% there.

YetAnotherNick 3y ago
Most company only allows logging in email in work devices, which is as easy to report stolen. What other kind of verification are we talking about which standard email DKIM doesn't have.
- acdha 3y ago
  Email means I got access to your device or something you’ve configured to be able to send email, which is probably a lot of servers unless you have an entire domain dedicated to financial messages everyone knows not to trust any other domains. A message signature means I got you to do something like tap a Yubikey and enter a PIN, touch a fingerprint sensor, etc. That can still be socially engineered, of course, but it can’t happen by accident and you could add some safeguards against routine by having a dedicated “major transactions” key used only for that purpose to add a physical speed bump. The problem is that “ignore my gmail, I list my phone” will defeat that training more often than we’d like, so you really need to have process safeguards which make it a requirement and management backing to say even the CEO will follow the lost device process rather than asking someone to bypass process, and that has to be so carefully enshrined that nobody questions whether their job is on the line if they tell the real CFO that they can’t bypass the process.
  - YetAnotherNick 3y ago
    > Yubikey and enter a PIN, touch a fingerprint sensor, etc Laptops and mobiles have all the same sensors. Most big companies have organization wide password, fingerprint and auto screen turn off requirement. Obviously not all companies follows good security practices or doesn't give secure devices(with sensors and encryption), but if that is the case Yubikey isn't going to save them.
- ghaff 3y ago
  I expect that most work emails are accessed from personally-owned phones.

YetAnotherNick 3y ago

Most company only allows logging in email in work devices, which is as easy to report stolen. What other kind of verification are we talking about which standard email DKIM doesn't have.

acdha 3y ago
Email means I got access to your device or something you’ve configured to be able to send email, which is probably a lot of servers unless you have an entire domain dedicated to financial messages everyone knows not to trust any other domains. A message signature means I got you to do something like tap a Yubikey and enter a PIN, touch a fingerprint sensor, etc. That can still be socially engineered, of course, but it can’t happen by accident and you could add some safeguards against routine by having a dedicated “major transactions” key used only for that purpose to add a physical speed bump. The problem is that “ignore my gmail, I list my phone” will defeat that training more often than we’d like, so you really need to have process safeguards which make it a requirement and management backing to say even the CEO will follow the lost device process rather than asking someone to bypass process, and that has to be so carefully enshrined that nobody questions whether their job is on the line if they tell the real CFO that they can’t bypass the process.
- YetAnotherNick 3y ago
  > Yubikey and enter a PIN, touch a fingerprint sensor, etc Laptops and mobiles have all the same sensors. Most big companies have organization wide password, fingerprint and auto screen turn off requirement. Obviously not all companies follows good security practices or doesn't give secure devices(with sensors and encryption), but if that is the case Yubikey isn't going to save them.
ghaff 3y ago
I expect that most work emails are accessed from personally-owned phones.