Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3123

Re: Is computer security culture simply broken?

Show all headers | View raw

On 2014-05-25, David Harmon wrote:
> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
> <rsw@therandymon.com> wrote,
>>From the «type loudly so the NSA can hear you» department:
>>Title: Everything is broken
>>Author: gerty@pipedot.org
>>Date: Sat, 24 May 2014 13:40:54 -0400
>>Link: http://pipedot.org/story/2014-05-24/everything-is-broken
>>
>>Journalist Quinn Norton writes[1] on the broken culture of computer security.
>>From complex software flawed with 0-days to human error and general culture
>>prone to feeling powerless, she explains how security is currently just a
>>mirage.Is computer security really just a wishful dream?
>>
>>Links:
>>[1]: https://medium.com/message/81e5f33a24e1 (link)
>
> Journalist Jon Evans agrees.  "Online security is a horrifying
> nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
> X.509. Whatever security cataclysm erupts next, probably in weeks or
> even days. We seem to be trapped in a vicious cycle of cascading
> security disasters that just keep getting worse."
>
> http://techcrunch.com/2014/05/24/the-internet-is-burning/

It really is.  Password handling in particular is terrible.  Every
time we hear about a company's site being breached, it turns out
they were doing really stupid things with passwords.

I recently inherited a project involving a web application with a
database back end.  The guy working on it before me was actually
storing plain text passwords in the users table directly.  There was
also an admin account called 'test' with the password -- you guessed
it -- 'test'.

I don't understand why no one can do this properly.  Salt and hash,
it's really not that hard!

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web