4 ms·

We need strong legal protections for security researchers. "Red teams" should be protected so long as they responsibly report their findings and they should be

We need strong legal protections for security researchers. "Red teams" should be protected so long as they responsibly report their findings and they should be given the benefit of the doubt. Security researchers should even be allowed to test the security of systems without permission. This is a matter of national security, and personal security. Why can't I personally test the security of my bank? Why can't I ask an organization I trust to test the security of my bank? Currently we threaten to jail security researches if they go so far as to press F12 and inspect the HTML source of a webpage. The personal data of half the nation is leaked twice a month. Companies have no financial incentive to build secure systems. Despite all this, we will be surprised when our critical infrastructure goes down and wonder "what more could we have done?" We sacrifice national security for the convenience of companies. Companies don't want researchers reporting the poor security of their systems. We allow companies to tightly control how their systems are tested, while also holding that companies are not liable for the security of their systems. When it comes to corporate security, they can have their cake and eat it too--they have authority over their systems but are not responsible / liable for their systems.

hypeatei 2y ago
German courts/laws seem to be very hostile to anyone exposing security flaws. I remember a story posted here where someone found a hard coded SQL connection string in decompiled code, connected to the server with it, and notified the company. Then, the company took the person to court (claiming something nonsensical about circumventing security) and the courts agreed. There was even people on HN siding with the courts that decompiling code and finding the key is circumventing their security which is madness.
Joker_vD 2y ago
> Why can't I personally test the security of my bank? For the same reason your bank can't test how well you store your PIN and secret phrase, I imagine. It's not in the contract between you and the bank, and the general law doesn't allow for it ("I was not trying to burgle that house, Your Honour, I was testing its security" — "That's a nice joke, mister, so I won't you hold in contempt of the court. Still, guilty, five years"). > Why can't I ask an organization I trust to test the security of my bank? For the same reason the bank can't ask an organization it trusts to test how well you store your PIN and secret phrase, I imagine: it's not in the contract. And good luck trying to find a bank that would agree to let you inspect their security.
- hypeatei 2y ago
  Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. I've seen this time and time again on HN. Making analogies that aren't clear doesn't result in useful discourse (people argue over the dumb analogies rather than the thing itself), kinda like I'm doing right now...
  - Joker_vD 2y ago
    > Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. Well, go write your congressman about it (or however it's done whenever you are), because it sure does look like the lawmakers and the courts do seem those two things to be kinda analogous; but I doubt that arguing in the HN comment section about laws has ever improved (or will ever improve) those laws.
  - robertlagrant 2y ago
    No, analogies are good. Calling them dumb instead of pointing out the difference is what's not useful.
    - hypeatei 2y ago
      Pointing out the difference? These two things (sending data over TCP/IP and testing physical locks on a house) are in two completely different realms.
      - robertlagrant 2y ago
        I don't know what "different realms" means. It's an analogy, so it won't be two identical things. The question is: why doesn't the comparison make sense?
  - deleted 2y ago
    [deleted]
- Buttons840 2y ago
  We need to include in this analogy that the bank is robbed every other week because they forgot to close the vault or they left a pile of cash sitting outside while they went to lunch. In such a situation if an upstanding citizen checks that the vault is actually locked--"did they remember to lock it today?"--the actions of that citizen don't concern me. But let's set the analogy aside. If companies want full control over their systems and who may test the security of those systems, that's fine with me, so long as their full control also comes with full liability. The problem is we currently give companies full control without any responsibility or liability.
robertlagrant 2y ago
> Why can't I personally test the security of my bank? I don't understand this perspective. What's the difference between tihs and being allowed to try and walk into all the back rooms of your bank and read everything you can? Or do you think you should be able to do that?
- ElevenLathe 2y ago
  Should I be prosecuted for walking up to my credit union after closing and trying to open the front door to see if it's really locked?
  - robertlagrant 2y ago
    No, just as you should be able to type your bank's URL in your browser even if they've taken the website down.
  - taeric 2y ago
    If you proceed into the building? Almost certainly. If you put the doors or windows through a stress test? Again, almost certainly.
    - Buttons840 2y ago
      What if you have money in the bank and the bank has been robbed thousands(!) of times because they forget to lock the windows. Assume nobody is going to do anything to make the bank change their window locking habits, or lack thereof. At this point in the analogy, do you personally believe it is worrisome if an upstanding citizen thinks "I wonder if they forgot to lock the windows again?", and they check to just to see. Is the solution in this scenario to harshly punish the citizen while doing nothing to the bank or their windows? (!): I say thousands because https://haveibeenpwned.com/ https://haveibeenpwned.com/ reports that my email address has appeared in almost 3,000 (three thousand!) data breaches.
      - taeric 2y ago

hypeatei 2y ago

German courts/laws seem to be very hostile to anyone exposing security flaws. I remember a story posted here where someone found a hard coded SQL connection string in decompiled code, connected to the server with it, and notified the company. Then, the company took the person to court (claiming something nonsensical about circumventing security) and the courts agreed. There was even people on HN siding with the courts that decompiling code and finding the key is circumventing their security which is madness.

Joker_vD 2y ago

> Why can't I personally test the security of my bank? For the same reason your bank can't test how well you store your PIN and secret phrase, I imagine. It's not in the contract between you and the bank, and the general law doesn't allow for it ("I was not trying to burgle that house, Your Honour, I was testing its security" — "That's a nice joke, mister, so I won't you hold in contempt of the court. Still, guilty, five years"). > Why can't I ask an organization I trust to test the security of my bank? For the same reason the bank can't ask an organization it trusts to test how well you store your PIN and secret phrase, I imagine: it's not in the contract. And good luck trying to find a bank that would agree to let you inspect their security.

hypeatei 2y ago
Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. I've seen this time and time again on HN. Making analogies that aren't clear doesn't result in useful discourse (people argue over the dumb analogies rather than the thing itself), kinda like I'm doing right now...
- Joker_vD 2y ago
  > Trying locks on a house vs. sending payloads to an internet exposed server are not analogous. Well, go write your congressman about it (or however it's done whenever you are), because it sure does look like the lawmakers and the courts do seem those two things to be kinda analogous; but I doubt that arguing in the HN comment section about laws has ever improved (or will ever improve) those laws.
- robertlagrant 2y ago
  No, analogies are good. Calling them dumb instead of pointing out the difference is what's not useful.
  - hypeatei 2y ago
    Pointing out the difference? These two things (sending data over TCP/IP and testing physical locks on a house) are in two completely different realms.
    - robertlagrant 2y ago
      I don't know what "different realms" means. It's an analogy, so it won't be two identical things. The question is: why doesn't the comparison make sense?
- deleted 2y ago
  [deleted]
Buttons840 2y ago
We need to include in this analogy that the bank is robbed every other week because they forgot to close the vault or they left a pile of cash sitting outside while they went to lunch. In such a situation if an upstanding citizen checks that the vault is actually locked--"did they remember to lock it today?"--the actions of that citizen don't concern me. But let's set the analogy aside. If companies want full control over their systems and who may test the security of those systems, that's fine with me, so long as their full control also comes with full liability. The problem is we currently give companies full control without any responsibility or liability.

robertlagrant 2y ago

> Why can't I personally test the security of my bank? I don't understand this perspective. What's the difference between tihs and being allowed to try and walk into all the back rooms of your bank and read everything you can? Or do you think you should be able to do that?

ElevenLathe 2y ago
Should I be prosecuted for walking up to my credit union after closing and trying to open the front door to see if it's really locked?
- robertlagrant 2y ago
  No, just as you should be able to type your bank's URL in your browser even if they've taken the website down.
- taeric 2y ago
  If you proceed into the building? Almost certainly. If you put the doors or windows through a stress test? Again, almost certainly.
  - Buttons840 2y ago
    What if you have money in the bank and the bank has been robbed thousands(!) of times because they forget to lock the windows. Assume nobody is going to do anything to make the bank change their window locking habits, or lack thereof. At this point in the analogy, do you personally believe it is worrisome if an upstanding citizen thinks "I wonder if they forgot to lock the windows again?", and they check to just to see. Is the solution in this scenario to harshly punish the citizen while doing nothing to the bank or their windows? (!): I say thousands because https://haveibeenpwned.com/ https://haveibeenpwned.com/ reports that my email address has appeared in almost 3,000 (three thousand!) data breaches.
    - taeric 2y ago