5 ms·

IT has always been a spectrum with security at one end and convenience at the other. There is no recent trend that’s changed that. That’s just how life works.

by hnlmorg 3mo ago

KerrAvon 3mo ago
"Better things aren't possible" is a terrible outlook. There have been real improvements in this space, such as passkeys, and recognition that some of this stuff, like frequent password changes, is counterproductive.
- hnlmorg 3mo ago
  > Better things aren't possible Literally no one in security thinks this.
- dotancohen 3mo ago
  In what way are Passkeys, as implemented (not theoretical benefits), better than passwords? Better: not in a single metric but rather as a complete measure of both preventing unauthorized access to a resource and also _enabling_ authorised access to that same resource.
  - Marsymars 3mo ago
    They're better for both parties with the subset of providers who require one of either SMS 2FA or passkeys.
  - wolvoleo 3mo ago
    They're better in some ways. They don't rely on a secret with low entropy which is really brute forceable. They can't be used on a phishing site because the URL is part of the secret. Even when you authenticate to a fake site you don't give them the ability to authenticate as you until you change the secret (like you do when you give them your password) They also have 2fa built in. No need for a separate app, entering codes whatever.
    - dotancohen 3mo ago
      That's why I mentioned "and also enabling authorised access to that same resource". Passkeys are great at preventing unauthorized access. But that comes at the expense of preventing authorised access. For example, using another device or even moving to another device. Replacing a stolen or damaged device is also nearly impossible with a reasonable quantity of Passkeys.
      - wolvoleo 3mo ago
        Well that's why they can sync between devices. I don't really see the problem. Even if you don't like to rely on big tech (google/apple), I don't either, there are many options now for full FOSS implementations like bitwarden and KeepassXC. If you use a yubikey as a passkey then yes, that's not a great option also because most services don't allow you to enroll more than one passkey. But with bitwarden that doesn't matter.
        dotancohen 3mo ago
        KeepassXC now supports Passkeys? All right then, I accept that argument. I do use Keepass and compatible programs.
        wolvoleo 3mo ago
        Yes! Though on Android you need the app KeePassDX to read them, I was mistaken about the name.
        TeMPOraL 3mo ago
        > Well that's why they can sync between devices. I don't really see the problem. How do you sync passkeys to someone else's phone to authorize them to act in your name? This is the basic use case, very common in the physical world, that security industry refuses to accept exists. Passwords have this capability by nature. > because most services don't allow you to enroll more than one passkey Which is dumb and part of what makes passkeys not just useless, but dangerously so. Same story with 2FA, and the many services that only allow you to have one registered authenticator app at the time.
- Gormo 3mo ago
  > There have been real improvements in this space, such as passkeys Passkeys are not an improvement. The way they're being implemented entrenches middlemen into auth flows in a way that reduces users' security in a broader sense, while being just as susceptible to compromise as any other form of credential.
TeMPOraL 3mo ago
Right, but security maximalist are running the asylum now, and they try to sell everyone the lie that more security is possible. Also, the original sin: framing it as "security" vs. "convenience". It's not. The other end of the spectrum is utility - as in, maximally secure computing device is an inert rock. More security means less utility - reduced functionality, constrained capability, reasonable use cases no longer possible. It means manual process where previously automation or batching was possible. It means more electricity, more compute, more money spent. It means more user time and therefore more human lives wasted. This ultimate non-renewable resource is what we're trading off when we accept even more security. This trade-off needs to be respected much more than it is.
- hnlmorg 3mo ago
  > Right, but security maximalist are running the asylum now, and they try to sell everyone the lie that more security is possible. That’s not what’s happening. Here you have security used as an excuse for vendor lock ins. Just like AI is used as an excuse for layoffs. But you shouldn’t confuse actual security with BS like this.
- Gormo 3mo ago
  > It means more electricity, more compute, more money spent. And it means more middlemen mediating people's access to their own tools.
wolvoleo 3mo ago
Yes but the balance has shifted a lot. I remember working at a major company where important systems had an admin password of "<company name>123". That was stupid. I asked to change it but the answer was no because too many people would have to be told the new password. That was too much in favour of convenience and I'm surprised they never got pwned in the worst way. These days the balance has swung way too much in favour of security though. Even when it concerns assets that have no value.
- hnlmorg 3mo ago
  Given cyber attacks are more rampant than ever, it’s hard to argue that security has gone too far the other way.
  - wolvoleo 3mo ago
    Shifting the balance towards security doesn't always improve the overall security stance. What you get is people getting sick of all the stupid hurdles and working around it. Using shadow IT. I find myself doing that too. For example, I was at a highly secured facility one time as a vendor to do a software upgrade. Blocked USB ports, severely reduced internet access etc. So I couldn't do the upgrade, I wasn't even allowed near the server. Nor could I connect my laptop to their network. All sensible precautions but how do I then upgrade the server software? So what happened? Someone from IT came and said: "Oh yeah that always happens, just give me a USB stick and I'll stick it in the server". Which he did, no virus checking etc. This is the problem with processes that are too strict. They leave out usecases (often under a misguided "80/20 pareto" rule) and then people will figure out their workaround in unpredictable ways which you have no control over. And most of the big hacks now are because of the move to cloud SaaS, especially salesforce instances are constantly being hit. Simply applying RBAC rules would fix that and not even interfere with anyone's job because the idea of RBAC is making sure that everyone can do just what they need to do their job and nothing more. But nothing LESS either. And of course some monitoring. If a local callcenter agent suddenly starts accessing 10.000 accounts per day instead of 20 a day, then yeah really you should be on the ball.
    - 3mo ago

IT has always been a spectrum with security at one end and convenience at the other. There is no recent trend that’s changed that. That’s just how life works.

by hnlmorg 3mo ago

IT has always been a spectrum with security at one end and convenience at the other. There is no recent trend that’s changed that. That’s just how life works.

KerrAvon 3mo ago

"Better things aren't possible" is a terrible outlook. There have been real improvements in this space, such as passkeys, and recognition that some of this stuff, like frequent password changes, is counterproductive.

hnlmorg 3mo ago
> Better things aren't possible Literally no one in security thinks this.
dotancohen 3mo ago
In what way are Passkeys, as implemented (not theoretical benefits), better than passwords? Better: not in a single metric but rather as a complete measure of both preventing unauthorized access to a resource and also _enabling_ authorised access to that same resource.
- Marsymars 3mo ago
  They're better for both parties with the subset of providers who require one of either SMS 2FA or passkeys.
- wolvoleo 3mo ago
  They're better in some ways. They don't rely on a secret with low entropy which is really brute forceable. They can't be used on a phishing site because the URL is part of the secret. Even when you authenticate to a fake site you don't give them the ability to authenticate as you until you change the secret (like you do when you give them your password) They also have 2fa built in. No need for a separate app, entering codes whatever.
  - dotancohen 3mo ago
    That's why I mentioned "and also enabling authorised access to that same resource". Passkeys are great at preventing unauthorized access. But that comes at the expense of preventing authorised access. For example, using another device or even moving to another device. Replacing a stolen or damaged device is also nearly impossible with a reasonable quantity of Passkeys.
    - wolvoleo 3mo ago
      Well that's why they can sync between devices. I don't really see the problem. Even if you don't like to rely on big tech (google/apple), I don't either, there are many options now for full FOSS implementations like bitwarden and KeepassXC. If you use a yubikey as a passkey then yes, that's not a great option also because most services don't allow you to enroll more than one passkey. But with bitwarden that doesn't matter.
      - dotancohen 3mo ago
        KeepassXC now supports Passkeys? All right then, I accept that argument. I do use Keepass and compatible programs.
        wolvoleo 3mo ago
        Yes! Though on Android you need the app KeePassDX to read them, I was mistaken about the name.
      - TeMPOraL 3mo ago
        > Well that's why they can sync between devices. I don't really see the problem. How do you sync passkeys to someone else's phone to authorize them to act in your name? This is the basic use case, very common in the physical world, that security industry refuses to accept exists. Passwords have this capability by nature. > because most services don't allow you to enroll more than one passkey Which is dumb and part of what makes passkeys not just useless, but dangerously so. Same story with 2FA, and the many services that only allow you to have one registered authenticator app at the time.
Gormo 3mo ago
> There have been real improvements in this space, such as passkeys Passkeys are not an improvement. The way they're being implemented entrenches middlemen into auth flows in a way that reduces users' security in a broader sense, while being just as susceptible to compromise as any other form of credential.

TeMPOraL 3mo ago

Right, but security maximalist are running the asylum now, and they try to sell everyone the lie that more security is possible. Also, the original sin: framing it as "security" vs. "convenience". It's not. The other end of the spectrum is utility - as in, maximally secure computing device is an inert rock. More security means less utility - reduced functionality, constrained capability, reasonable use cases no longer possible. It means manual process where previously automation or batching was possible. It means more electricity, more compute, more money spent. It means more user time and therefore more human lives wasted. This ultimate non-renewable resource is what we're trading off when we accept even more security. This trade-off needs to be respected much more than it is.

hnlmorg 3mo ago
> Right, but security maximalist are running the asylum now, and they try to sell everyone the lie that more security is possible. That’s not what’s happening. Here you have security used as an excuse for vendor lock ins. Just like AI is used as an excuse for layoffs. But you shouldn’t confuse actual security with BS like this.
Gormo 3mo ago
> It means more electricity, more compute, more money spent. And it means more middlemen mediating people's access to their own tools.

wolvoleo 3mo ago

Yes but the balance has shifted a lot. I remember working at a major company where important systems had an admin password of "<company name>123". That was stupid. I asked to change it but the answer was no because too many people would have to be told the new password. That was too much in favour of convenience and I'm surprised they never got pwned in the worst way. These days the balance has swung way too much in favour of security though. Even when it concerns assets that have no value.

hnlmorg 3mo ago
Given cyber attacks are more rampant than ever, it’s hard to argue that security has gone too far the other way.
- wolvoleo 3mo ago
  Shifting the balance towards security doesn't always improve the overall security stance. What you get is people getting sick of all the stupid hurdles and working around it. Using shadow IT. I find myself doing that too. For example, I was at a highly secured facility one time as a vendor to do a software upgrade. Blocked USB ports, severely reduced internet access etc. So I couldn't do the upgrade, I wasn't even allowed near the server. Nor could I connect my laptop to their network. All sensible precautions but how do I then upgrade the server software? So what happened? Someone from IT came and said: "Oh yeah that always happens, just give me a USB stick and I'll stick it in the server". Which he did, no virus checking etc. This is the problem with processes that are too strict. They leave out usecases (often under a misguided "80/20 pareto" rule) and then people will figure out their workaround in unpredictable ways which you have no control over. And most of the big hacks now are because of the move to cloud SaaS, especially salesforce instances are constantly being hit. Simply applying RBAC rules would fix that and not even interfere with anyone's job because the idea of RBAC is making sure that everyone can do just what they need to do their job and nothing more. But nothing LESS either. And of course some monitoring. If a local callcenter agent suddenly starts accessing 10.000 accounts per day instead of 20 a day, then yeah really you should be on the ball.
  - 3mo ago