3 ms·

Yes, it literally would have since they found out who she was by looking through her phone after kidnapping her for an unrelated death of a cartel member. Try

by monochr 12y ago

Yes, it literally would have since they found out who she was by looking through her phone after kidnapping her for an unrelated death of a cartel member. Try and read the article before you comment.

coldtea 12y ago
Yeah, I read TFA. And since I follow those stories for years, what I wanted to say was that the fact that this particular instance happened in this way doesn't mean it's the only way this thing can happen. It's naive to think so. The reward and their "research facilities" would have gotten to her sooner or later. You do know that they also employ very talented hackers (of the Kevin Mittnick sense)? And that of course anybody who knew her identity could have snitched sooner or later? It was just a matter of how badly they wanted to get to her...
- monochr 12y ago
  Even if a system can fail in many ways you still should make every failure mode as difficult as possible. What you're saying makes as much sense as not improving seat belts in cars because the airbags might fail and you would still die.
  - coldtea 12y ago
    That assumes equal probability of those events, which is not in the least the case. It's more not like not improving anti-bacterial coating in car seats, when there are 200+ others way you can die in a car.
girvo 12y ago
Read the article yourself, that is quite possibly disinformation. The situation over there is very complex, and nothing is pure truth. Unless she practiced OPSEC above and beyond what most untrained people are capable of, it was always a high risk that it'd end this way. I've got nothing but respect for her. Her execution and the violence and organised crime is abhorrent. I wish there was something I could do.
- vacri 12y ago
  Unless she practiced OPSEC above and beyond what most untrained people are capable of Even security researchers don't practice it to that level. I went to a security conference last year, and one of the speakers was talking about his wifi sniffing box. Time came to demo how it worked... and it turns out that the wifi for the venue had crashed, and the security delegates in the main conference room behind him all attached to his box for net access - he was able to demo skimming hundreds of accounts, apparently. There was another speaker who mentioned that the security industry throws up so many 'best practice' recommendations that even security specialists can't cover them all.
cynicalkane 12y ago
So in your theory, bloodthirsty murdering cartels are going to kidnap people, but let them go if they hit the panic encryption button on their phones or happen to be using a secret password. This is an interesting view of how drug cartels work. Personally, I don't know what the penalty for "contempt of drug cartel that just kidnapped you" is, but it seems unlikely to lead to a positive outcome.
- monochr 12y ago
  https://www.usenix.org/legacy/event/hotsec08/tech/full_papers/clark/clark_html/ https://www.usenix.org/legacy/event/hotsec08/tech/full_paper... 3.1 Security Assumptions Our threat model is based on four pragmatic assumptions. Kerckhoffs' principle: The details of the authentication system that is in place is public information and known to all participants, including Oscar. Alice and Bob retain a shared secret (e.g., a password or set of passwords) that is both private and the foundation upon which the security of the system rests. Observational principle: Alice communicates with Bob over a semi-private channel that can be observed by Oscar prior to the password being secured (i.e., encrypted or hashed). Namely, Oscar can observe the password(s) used by Alice and could even enter in Alice's password himself, after coercing her into revealing it. Iteration principle: Unless explicitly prevented by the underlying system, Oscar is not bound to a single instance of coercion against Alice. He may force Alice to authenticate multiple times. Combined with the observational principle (Assumption 2), Oscar can force Alice to use a different password each time. Forced-randomization principle: Oscar can choose to eliminate any strategy Alice may employ through the order in which she reveals the passwords she knows. For example, Oscar may force Alice into writing down a set of passwords so that he can randomly choose the order in which to iterate through them. The assumption is that this option is available to Oscar, not that he will necessarily employ it.
- chaostheory 12y ago
  Didn't they let the other medical workers go?
- icpmacdo 12y ago
  It would be interesting if you could have 2 codes to two different user accounts on the phone so she could give them the passcode "5555" and have it link to a harmless twitter/FB and then have another one to use for a private user account.
x0x0 12y ago
how in the hell would a password have helped? The sort of people who kidnap folks and shoot them in the head won't hesitate to cut a finger off or use 120v to ask your password.

by monochr 12y ago

Yes, it literally would have since they found out who she was by looking through her phone after kidnapping her for an unrelated death of a cartel member. Try and read the article before you comment.

coldtea 12y ago

Yeah, I read TFA. And since I follow those stories for years, what I wanted to say was that the fact that this particular instance happened in this way doesn't mean it's the only way this thing can happen. It's naive to think so. The reward and their "research facilities" would have gotten to her sooner or later. You do know that they also employ very talented hackers (of the Kevin Mittnick sense)? And that of course anybody who knew her identity could have snitched sooner or later? It was just a matter of how badly they wanted to get to her...

monochr 12y ago
Even if a system can fail in many ways you still should make every failure mode as difficult as possible. What you're saying makes as much sense as not improving seat belts in cars because the airbags might fail and you would still die.
- coldtea 12y ago
  That assumes equal probability of those events, which is not in the least the case. It's more not like not improving anti-bacterial coating in car seats, when there are 200+ others way you can die in a car.

girvo 12y ago

Read the article yourself, that is quite possibly disinformation. The situation over there is very complex, and nothing is pure truth. Unless she practiced OPSEC above and beyond what most untrained people are capable of, it was always a high risk that it'd end this way. I've got nothing but respect for her. Her execution and the violence and organised crime is abhorrent. I wish there was something I could do.

vacri 12y ago
Unless she practiced OPSEC above and beyond what most untrained people are capable of Even security researchers don't practice it to that level. I went to a security conference last year, and one of the speakers was talking about his wifi sniffing box. Time came to demo how it worked... and it turns out that the wifi for the venue had crashed, and the security delegates in the main conference room behind him all attached to his box for net access - he was able to demo skimming hundreds of accounts, apparently. There was another speaker who mentioned that the security industry throws up so many 'best practice' recommendations that even security specialists can't cover them all.

cynicalkane 12y ago

So in your theory, bloodthirsty murdering cartels are going to kidnap people, but let them go if they hit the panic encryption button on their phones or happen to be using a secret password. This is an interesting view of how drug cartels work. Personally, I don't know what the penalty for "contempt of drug cartel that just kidnapped you" is, but it seems unlikely to lead to a positive outcome.

monochr 12y ago
https://www.usenix.org/legacy/event/hotsec08/tech/full_papers/clark/clark_html/ https://www.usenix.org/legacy/event/hotsec08/tech/full_paper... 3.1 Security Assumptions Our threat model is based on four pragmatic assumptions. Kerckhoffs' principle: The details of the authentication system that is in place is public information and known to all participants, including Oscar. Alice and Bob retain a shared secret (e.g., a password or set of passwords) that is both private and the foundation upon which the security of the system rests. Observational principle: Alice communicates with Bob over a semi-private channel that can be observed by Oscar prior to the password being secured (i.e., encrypted or hashed). Namely, Oscar can observe the password(s) used by Alice and could even enter in Alice's password himself, after coercing her into revealing it. Iteration principle: Unless explicitly prevented by the underlying system, Oscar is not bound to a single instance of coercion against Alice. He may force Alice to authenticate multiple times. Combined with the observational principle (Assumption 2), Oscar can force Alice to use a different password each time. Forced-randomization principle: Oscar can choose to eliminate any strategy Alice may employ through the order in which she reveals the passwords she knows. For example, Oscar may force Alice into writing down a set of passwords so that he can randomly choose the order in which to iterate through them. The assumption is that this option is available to Oscar, not that he will necessarily employ it.
chaostheory 12y ago
Didn't they let the other medical workers go?
icpmacdo 12y ago
It would be interesting if you could have 2 codes to two different user accounts on the phone so she could give them the passcode "5555" and have it link to a harmless twitter/FB and then have another one to use for a private user account.

x0x0 12y ago

how in the hell would a password have helped? The sort of people who kidnap folks and shoot them in the head won't hesitate to cut a finger off or use 120v to ask your password.