5 ms·

Here's what I'm sad about. Does every single web and mobile app that gets made by anyone these days now require an extensive knowledge of how to do security ri

by PakG1 13y ago

Here's what I'm sad about. Does every single web and mobile app that gets made by anyone these days now require an extensive knowledge of how to do security right? If so, that sucks, given how big the field is. Or do we all need to go and hire tptacek for a quarterly security audit? I imagine that can get quite expensive. It really gets in the way of just making things and putting them up; I think kind of kills the spirit of creation and entrepreneurship. :( I mean, it's great for people who are truly interested in security, but what if you're not? Are you doomed to fail at the startup game if you don't know security well?

Everlag 13y ago
According to wikipedia this company has 300 million users each paying some form of currency every month. Is it that much to ask that a company that large performs a security audit quarterly?
- PakG1 13y ago
  Fair enough, but I'm asking about side projects.
mikeash 13y ago
When in doubt, don't reinvent the wheel. If TLS covers your use case, use TLS. Unfortunately, it appears that you are not at all doomed if you don't know security well. I say "unfortunately" because I'd rather have fewer secure products than the massive array of insecure products we enjoy today.
- emn13 13y ago
  And I think a large part of that is because of the unbelievably irresponsible legislation on the matter - where the punishment for "hacking" is often punitive, but the punishment for negligence is often non-existent. I think it's kind of like cars and the corresponding (lack of) traffic & vehicle safety rules a century ago: right now it's everybody for themselves, but what you really need are rules that encourage those in a position to cause improvement to actually improve. Developers like us and firms that employ them need to be liable for security exploits - preferably with good enforcement with many small fines rather than a few "examples" that get the book thrown at them. And hackers, even if dubiously motivated, shouldn't be driven underground by punitive measures because that causes a really unhealthy head-in-the-sand dynamic.
sthatipamala 13y ago
I've been told to just use NaCl (http://nacl.cr.yp.to/ http://nacl.cr.yp.to/) and its related libraries in other languages. Apparently it "just works" for most basic crypto. What's harder is systems security, which you can't just abstract away into a library.
- riquito 13y ago
  Does NaCL automagically solves the problem of streaming encrypted data? I don't think so. You still have to know quite a lot to not mess up.
  - tptacek 13y ago
    Yes, NaCl automagically solves this problem. No, you don't have to know anything not to mess NaCl up. That is the premise of the library.
devx 13y ago
I sure hope so. Whoever does security right has a competitive advantage in my book.
- ygra 13y ago
  I guess for most users good UX or a service they want to use trumps security most of the time.
jzzskijj 13y ago
On the other hand it depends on how you "market" your product. Interestingly WhatsApp doesn't seem to mention their software to be secure on their web page. Yes, it says "Simple. Personal. Real time messaging." People can argue that personal is a guarantee of secure implementation, but there is no claim of extensive security audits or super ciphers. Maybe it is people's false expectations, that what ever I send with my smartphone is secure.
- Al-Khwarizmi 13y ago
  Until mid 2012, WhatsApp didn't even have any encryption: https://www.demworks.org/blog/2013/05/instant-messaging-smartphones-whatsapps-lack-security https://www.demworks.org/blog/2013/05/instant-messaging-smar... So yes, clearly security is just not a priority for that product.
venomsnake 13y ago
Actually doing good enough security* is fairly easy even if you don't know how crypto works. You just have to remember few important axioms: 1. You are not smart enough, so don't try to be clever. 2. Use off the shelf audited tools, implementations and protocols. And that is ... while I admit that there is chance for "any crypto product/expert to be compromised" I distrust my brain to get everything right way more than that. *Disclaimer - good enough for ensuring sexted stuff remains private, not good enough for nuclear launch codes.
MarkMc 13y ago
> Are you doomed to fail at the startup game if you don't know security well? Absolutely not. WhatsApp has a history of poor security yet it is a wildly successful startup.
dspillett 13y ago
> Does every single web and mobile app that gets made by anyone these days now require an extensive knowledge of how to do security right? Everyone should know the basics, and should know enough to know when to consult someone else or learn the not-so-basics. They should also know the key rules: * Security should never be an afterthought unless you are doing proof-of-concept development and even then as soon as you move from PoC to prototype/alpha then relevant security should be baked in to the design * Relevant is the key word above. Everyone should know when security is needed/desirable. Not being aware that bad security is a problem is not acceptable these days, if it ever was * Don't try be clever and roll your own * Don't be lazy or NIHy and roll your own because you have trouble integrating with something else * Get someone else to review the design and code occasionally, how-ever informally - mistakes will be made, particularly in security, and finding your own is sometimes more difficult than finding someone else's. Also your users won't find security issues like they will easily spot functionality ones. * Don't claim any security claim that you can't definitively back up. You make the rest of us developers look bad when you get called out on the matter. * Better still, make sure that your users know where your security is intentionally lacking ("this is not designed as an NSA secure service, we do not encrypt data server-side, if you are storing a secure document here encrypt before sending" or such). * Absolutely everyone who implements something that needs to authenticate a user needs to know what good password handling is, even if you use third party services for authentication you need to understand what is going on in order to judge if a given third party is good enough at what they do. > It really gets in the way of just making things and putting them up; I think kind of kills the spirit of creation and entrepreneurship. If what someone is just putting up" is something that holds personal or otherwise sensitive data, then I don't think this is a bad thing. If they are collecting that sort of thing (actively or passively) then they should be careful about it or should reconsider doing it at all (or should warn their users that what they are "just putting out there" is not production ready yet so may not be secure). Of course if you are not doing anything with sensitive data these requirements reduce greatly. If you are doing anything that require authentication then you still need proper auth handling code no matter what though. > Are you doomed to fail at the startup game if you don't know security well? If your startup handles personal or otherwise sensitive data you should be, if by "startup" you mean that you intend to make a living (or just make a name) with what you are doing. This sounds harsh, but that is just the way it is. The world is harsh.
soci 13y ago
Every single business doing really good needs to take great attention to security (as well to other areas). But, if you are a startup, just starting I mean, I don't think you need to be a security guru at all. Whatsapp started sending messages in plain text and look how many users they got. That's because users didn't matter about security until the company was so big that security became a real threat.

by PakG1 13y ago

Everlag 13y ago

According to wikipedia this company has 300 million users each paying some form of currency every month. Is it that much to ask that a company that large performs a security audit quarterly?

PakG1 13y ago
Fair enough, but I'm asking about side projects.

mikeash 13y ago

When in doubt, don't reinvent the wheel. If TLS covers your use case, use TLS. Unfortunately, it appears that you are not at all doomed if you don't know security well. I say "unfortunately" because I'd rather have fewer secure products than the massive array of insecure products we enjoy today.

emn13 13y ago
And I think a large part of that is because of the unbelievably irresponsible legislation on the matter - where the punishment for "hacking" is often punitive, but the punishment for negligence is often non-existent. I think it's kind of like cars and the corresponding (lack of) traffic & vehicle safety rules a century ago: right now it's everybody for themselves, but what you really need are rules that encourage those in a position to cause improvement to actually improve. Developers like us and firms that employ them need to be liable for security exploits - preferably with good enforcement with many small fines rather than a few "examples" that get the book thrown at them. And hackers, even if dubiously motivated, shouldn't be driven underground by punitive measures because that causes a really unhealthy head-in-the-sand dynamic.

sthatipamala 13y ago

I've been told to just use NaCl (http://nacl.cr.yp.to/ http://nacl.cr.yp.to/) and its related libraries in other languages. Apparently it "just works" for most basic crypto. What's harder is systems security, which you can't just abstract away into a library.

riquito 13y ago
Does NaCL automagically solves the problem of streaming encrypted data? I don't think so. You still have to know quite a lot to not mess up.
- tptacek 13y ago
  Yes, NaCl automagically solves this problem. No, you don't have to know anything not to mess NaCl up. That is the premise of the library.

devx 13y ago

I sure hope so. Whoever does security right has a competitive advantage in my book.

ygra 13y ago
I guess for most users good UX or a service they want to use trumps security most of the time.

jzzskijj 13y ago

On the other hand it depends on how you "market" your product. Interestingly WhatsApp doesn't seem to mention their software to be secure on their web page. Yes, it says "Simple. Personal. Real time messaging." People can argue that personal is a guarantee of secure implementation, but there is no claim of extensive security audits or super ciphers. Maybe it is people's false expectations, that what ever I send with my smartphone is secure.

Al-Khwarizmi 13y ago
Until mid 2012, WhatsApp didn't even have any encryption: https://www.demworks.org/blog/2013/05/instant-messaging-smartphones-whatsapps-lack-security https://www.demworks.org/blog/2013/05/instant-messaging-smar... So yes, clearly security is just not a priority for that product.

venomsnake 13y ago

Actually doing good enough security* is fairly easy even if you don't know how crypto works. You just have to remember few important axioms: 1. You are not smart enough, so don't try to be clever. 2. Use off the shelf audited tools, implementations and protocols. And that is ... while I admit that there is chance for "any crypto product/expert to be compromised" I distrust my brain to get everything right way more than that. *Disclaimer - good enough for ensuring sexted stuff remains private, not good enough for nuclear launch codes.

MarkMc 13y ago

> Are you doomed to fail at the startup game if you don't know security well? Absolutely not. WhatsApp has a history of poor security yet it is a wildly successful startup.

dspillett 13y ago

> Does every single web and mobile app that gets made by anyone these days now require an extensive knowledge of how to do security right? Everyone should know the basics, and should know enough to know when to consult someone else or learn the not-so-basics. They should also know the key rules: * Security should never be an afterthought unless you are doing proof-of-concept development and even then as soon as you move from PoC to prototype/alpha then relevant security should be baked in to the design * Relevant is the key word above. Everyone should know when security is needed/desirable. Not being aware that bad security is a problem is not acceptable these days, if it ever was * Don't try be clever and roll your own * Don't be lazy or NIHy and roll your own because you have trouble integrating with something else * Get someone else to review the design and code occasionally, how-ever informally - mistakes will be made, particularly in security, and finding your own is sometimes more difficult than finding someone else's. Also your users won't find security issues like they will easily spot functionality ones. * Don't claim any security claim that you can't definitively back up. You make the rest of us developers look bad when you get called out on the matter. * Better still, make sure that your users know where your security is intentionally lacking ("this is not designed as an NSA secure service, we do not encrypt data server-side, if you are storing a secure document here encrypt before sending" or such). * Absolutely everyone who implements something that needs to authenticate a user needs to know what good password handling is, even if you use third party services for authentication you need to understand what is going on in order to judge if a given third party is good enough at what they do. > It really gets in the way of just making things and putting them up; I think kind of kills the spirit of creation and entrepreneurship. If what someone is just putting up" is something that holds personal or otherwise sensitive data, then I don't think this is a bad thing. If they are collecting that sort of thing (actively or passively) then they should be careful about it or should reconsider doing it at all (or should warn their users that what they are "just putting out there" is not production ready yet so may not be secure). Of course if you are not doing anything with sensitive data these requirements reduce greatly. If you are doing anything that require authentication then you still need proper auth handling code no matter what though. > Are you doomed to fail at the startup game if you don't know security well? If your startup handles personal or otherwise sensitive data you should be, if by "startup" you mean that you intend to make a living (or just make a name) with what you are doing. This sounds harsh, but that is just the way it is. The world is harsh.

soci 13y ago

Every single business doing really good needs to take great attention to security (as well to other areas). But, if you are a startup, just starting I mean, I don't think you need to be a security guru at all. Whatsapp started sending messages in plain text and look how many users they got. That's because users didn't matter about security until the company was so big that security became a real threat.