4 ms·
These attacks are getting more and more creative. I begin to think that there is no such thing as perfect security in a world that constantly demands new featur
by M4v3R 13y ago
These attacks are getting more and more creative. I begin to think that there is no such thing as perfect security in a world that constantly demands new features.
- talmand 13y agoThere is no such thing as perfect security.
- Dylan16807 13y agoYou can always turn the device off. It really is a matter of features and how they're implemented. Good luck picking a byte that can exploit a 7400.
- talmand 13y agoIf we're only talking about exploiting a device across a network, sure turn it off or disconnect it from the network. But there's more to security than that. One can always take the device and turn it on for oneself. If one can't exploit the device, one can resort to rubber-hose cryptanalysis.
- Dylan16807 13y agoWe are only talking about exploiting a device across a network.
- TeMPOraL 13y agoThen bridge the gap by infecting pendrives. That's how e.g. Stuxnet worked.
- Dylan16807 13y agoI don't understand what you're replying to. Physical access is a great way to bypass network security, but it has nothing to do with websites.
- TeMPOraL 13y ago"Exploiting device across network". Security doesn't exist in isolation. AKA. there's always a way.
- Dylan16807 13y agoIf you assume a specific target, there is always a way to get to them. If you're talking about making a browser secure against internet-based attacks, there is not always a way. This type of security is merely extremely, overwhelmingly difficult.
- Qantourisc 13y agoSure there is. An application/computer doesn't has to be insecure to work. It's just very hard to make no mistakes in complex machines and software.
- danielweber 13y agoGoogle "Users want and demand a rich computing experience." Back in the 90's a Microsoft person made that claim on comp.risks. It kind of became a joke to call every new attack a "rich computing experience."
- tptacek 13y agoDon't think about security that way; that kind of logic is misleading. Security is measured in dollars, in the sense of cost imposed on attackers. You're right that there's a constant tension between features and security.
- comrade_ogilvy 13y agoRight. To be more precise, security is a set of costs on web developers, web viewers, and attackers. There is no obviously correct way to balance all three, once you start seeing feasible removed/missing features that would be genuinely useful tallied as costs.