Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3109 > unrolled thread

Is computer security culture simply broken?

Back to article view | Back to comp.misc

Contents

  Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
    Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
      Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
        Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
          Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
            Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
              Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
          Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
            Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
              Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
            Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
              Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
                Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                  Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                  Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
          Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

#3109 — Is computer security culture simply broken?

From the «type loudly so the NSA can hear you» department:
Title: Everything is broken
Author: gerty@pipedot.org
Date: Sat, 24 May 2014 13:40:54 -0400
Link: http://pipedot.org/story/2014-05-24/everything-is-broken

Journalist Quinn Norton writes[1] on the broken culture of computer security.
From complex software flawed with 0-days to human error and general culture
prone to feeling powerless, she explains how security is currently just a
mirage.Is computer security really just a wishful dream?

Links:
[1]: https://medium.com/message/81e5f33a24e1 (link)

[toc] | [next] | [standalone]

#3121

On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
<rsw@therandymon.com> wrote,
>From the «type loudly so the NSA can hear you» department:
>Title: Everything is broken
>Author: gerty@pipedot.org
>Date: Sat, 24 May 2014 13:40:54 -0400
>Link: http://pipedot.org/story/2014-05-24/everything-is-broken
>
>Journalist Quinn Norton writes[1] on the broken culture of computer security.
>From complex software flawed with 0-days to human error and general culture
>prone to feeling powerless, she explains how security is currently just a
>mirage.Is computer security really just a wishful dream?
>
>Links:
>[1]: https://medium.com/message/81e5f33a24e1 (link)

Journalist Jon Evans agrees.  "Online security is a horrifying
nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
X.509. Whatever security cataclysm erupts next, probably in weeks or
even days. We seem to be trapped in a vicious cycle of cascading
security disasters that just keep getting worse."

http://techcrunch.com/2014/05/24/the-internet-is-burning/

[toc] | [prev] | [next] | [standalone]

#3123

On 2014-05-25, David Harmon wrote:
> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
> <rsw@therandymon.com> wrote,
>>From the «type loudly so the NSA can hear you» department:
>>Title: Everything is broken
>>Author: gerty@pipedot.org
>>Date: Sat, 24 May 2014 13:40:54 -0400
>>Link: http://pipedot.org/story/2014-05-24/everything-is-broken
>>
>>Journalist Quinn Norton writes[1] on the broken culture of computer security.
>>From complex software flawed with 0-days to human error and general culture
>>prone to feeling powerless, she explains how security is currently just a
>>mirage.Is computer security really just a wishful dream?
>>
>>Links:
>>[1]: https://medium.com/message/81e5f33a24e1 (link)
>
> Journalist Jon Evans agrees.  "Online security is a horrifying
> nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
> X.509. Whatever security cataclysm erupts next, probably in weeks or
> even days. We seem to be trapped in a vicious cycle of cascading
> security disasters that just keep getting worse."
>
> http://techcrunch.com/2014/05/24/the-internet-is-burning/

It really is.  Password handling in particular is terrible.  Every
time we hear about a company's site being breached, it turns out
they were doing really stupid things with passwords.

I recently inherited a project involving a web application with a
database back end.  The guy working on it before me was actually
storing plain text passwords in the users table directly.  There was
also an admin account called 'test' with the password -- you guessed
it -- 'test'.

I don't understand why no one can do this properly.  Salt and hash,
it's really not that hard!

[toc] | [prev] | [next] | [standalone]

#3125

On 25/05/2014 5:13 PM, Randy Westlund wrote:
> On 2014-05-25, David Harmon wrote:
>> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
>> <rsw@therandymon.com> wrote,
>> >From the «type loudly so the NSA can hear you» department:
>>> Title: Everything is broken
>>> Author: gerty@pipedot.org
>>> Date: Sat, 24 May 2014 13:40:54 -0400
>>> Link: http://pipedot.org/story/2014-05-24/everything-is-broken
>>>
>>> Journalist Quinn Norton writes[1] on the broken culture of computer security.
>> >From complex software flawed with 0-days to human error and general culture
>>> prone to feeling powerless, she explains how security is currently just a
>>> mirage.Is computer security really just a wishful dream?
>>>
>>> Links:
>>> [1]: https://medium.com/message/81e5f33a24e1 (link)
>>
>> Journalist Jon Evans agrees.  "Online security is a horrifying
>> nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
>> X.509. Whatever security cataclysm erupts next, probably in weeks or
>> even days. We seem to be trapped in a vicious cycle of cascading
>> security disasters that just keep getting worse."
>>
>> http://techcrunch.com/2014/05/24/the-internet-is-burning/
>
> It really is.  Password handling in particular is terrible.  Every
> time we hear about a company's site being breached, it turns out
> they were doing really stupid things with passwords.

A time-sharing (access was via 110 baud terminals) company I worked for, 
way back when, changed to a hash-style method of storing passwords in 
1973. I don't know that it had today's level of cryptographic integrity, 
but I know it was designed to be expensive to brute-force. It's forty 
years later. One might have hoped that the need was now well understood.

I expect there's a selection bias. Those companies who know how to do 
this stuff properly don't get hacked in the first place.

> I don't understand why no one can do this properly.  Salt and hash,
> it's really not that hard!

As you say, it's not hard, but storing plain text passwords is the 
obvious approach, and unless the developer has the time and motivation 
to research the matter, to discover the issues and possible solutions, 
plain text is what you get. Take someone fresh out of university, and 
give them the task under time pressure, and it's easy to see how these 
things happen.

So far as I'm aware, no one has yet been seriously sued over this kind 
of thing. Until they are, I doubt we'll see much change.


Sylvia.

[toc] | [prev] | [next] | [standalone]

#3129

On 2014-05-25, Sylvia Else <sylvia@not.at.this.address> wrote:
> On 25/05/2014 5:13 PM, Randy Westlund wrote:
>> On 2014-05-25, David Harmon wrote:
>>> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
>>> <rsw@therandymon.com> wrote,
>>> >From the «type loudly so the NSA can hear you» department:
>>>> Title: Everything is broken
> As you say, it's not hard, but storing plain text passwords is the
> obvious approach, and unless the developer has the time and motivation
> to research the matter, to discover the issues and possible solutions,
> plain text is what you get. Take someone fresh out of university, and
> give them the task under time pressure, and it's easy to see how these
> things happen.
>
> So far as I'm aware, no one has yet been seriously sued over this kind
> of thing. Until they are, I doubt we'll see much change.
>
>
> Sylvia.

Putting on my economist hat, I think it has something to do with screwed
incentives.  Take six starving young CS graduates, stuff them in a
creative space in San Francisco, give them each a Macbook Pro, and set
the timer.  They've got huge ambition, limited time and energy, and a
hugely competitive, shark-filled marketplace.  The goal is to put
together some kind of web service that is so unique, useful, and
appealing, that it becomes trendy and then essential to use.  Then Apple
or Google buys you out (ha ha, not Microsoft! Those days have passed!),
and you live happily ever after in your nouveau-riche geek lifestyle.

So clearly: you focus your time and energy on features and usefulness,
and security - the essential but boring and largely invisible part no
one cares about unless something has gone wrong, and nobody notices if
you do it correctly - goes totally forgotten, or at a minimum,
deprioritized.

It's like the open source phenomenon where everyone wants to work on the
new theming engine, but no one really wants to work on the low level
messaging subsystem or file system abstraction, because it's not sexy
enough.  And absolutely no one wants to fix annoying bugs, as that's not
sexy, fun, or interesting in the slightest.  Security goes on that list,
too.

[toc] | [prev] | [next] | [standalone]

#3131

On 25/05/2014 7:10 PM, RS Wood wrote:

> Putting on my economist hat, I think it has something to do with screwed
> incentives.  Take six starving young CS graduates, stuff them in a
> creative space in San Francisco, give them each a Macbook Pro, and set
> the timer.  They've got huge ambition, limited time and energy, and a
> hugely competitive, shark-filled marketplace.  The goal is to put
> together some kind of web service that is so unique, useful, and
> appealing, that it becomes trendy and then essential to use.  Then Apple
> or Google buys you out (ha ha, not Microsoft! Those days have passed!),
> and you live happily ever after in your nouveau-riche geek lifestyle.

Some of these things are painfully predictable. Want a system with an 
SQL insertion vulnerability? Easy, just high some junior (or even not so 
junior) programmers, and set them the task of capturing a web form data 
into an SQL database.

That's all you need do. I've seen it repeatedly.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#3142

Sylvia Else <sylvia@not.at.this.address> writes:

> On 25/05/2014 7:10 PM, RS Wood wrote:
>
>> Putting on my economist hat, I think it has something to do with screwed
>> incentives.  Take six starving young CS graduates, stuff them in a
>> creative space in San Francisco, give them each a Macbook Pro, and set
>> the timer.  They've got huge ambition, limited time and energy, and a
>> hugely competitive, shark-filled marketplace.  The goal is to put
>> together some kind of web service that is so unique, useful, and
>> appealing, that it becomes trendy and then essential to use.  Then Apple
>> or Google buys you out (ha ha, not Microsoft! Those days have passed!),
>> and you live happily ever after in your nouveau-riche geek lifestyle.
>
> Some of these things are painfully predictable. Want a system with an
> SQL insertion vulnerability? Easy, just high some junior (or even not
> so junior) programmers, and set them the task of capturing a web form
> data into an SQL database.
>
> That's all you need do. I've seen it repeatedly.

Yes, but I think that shows a deeper problem.  Software has the ability
to accumulate expertise, but does not seem to be happening as it
should.  Web services and systems should be built at a higher level than
they seem to be.  No one should be capturing a form at that level, but I
suspect they do because the system they are using has no flexible
plug-in module for transforming and/or checking the data as required.

Obviously this is not true in all cases -- there are, I imagine,
frameworks that do have these things, but unless you use the whole thing
you can't use the parts.  It should be possible to do better than that.

-- 
Ben.

[toc] | [prev] | [next] | [standalone]

#3151

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 25/05/2014 5:13 PM, Randy Westlund wrote:
> > On 2014-05-25, David Harmon wrote:
> >> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
> >> <rsw@therandymon.com> wrote,
> >> >From the «type loudly so the NSA can hear you» department:
> >>> Title: Everything is broken
> >>> Author: gerty@pipedot.org
> >>> Date: Sat, 24 May 2014 13:40:54 -0400
> >>> Link: http://pipedot.org/story/2014-05-24/everything-is-broken
> >>>
> >>> Journalist Quinn Norton writes[1] on the broken culture of computer security.
> >> >From complex software flawed with 0-days to human error and general culture
> >>> prone to feeling powerless, she explains how security is currently just a
> >>> mirage.Is computer security really just a wishful dream?
> >>>
> >>> Links:
> >>> [1]: https://medium.com/message/81e5f33a24e1 (link)
> >>
> >> Journalist Jon Evans agrees.  "Online security is a horrifying
> >> nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
> >> X.509. Whatever security cataclysm erupts next, probably in weeks or
> >> even days. We seem to be trapped in a vicious cycle of cascading
> >> security disasters that just keep getting worse."
> >>
> >> http://techcrunch.com/2014/05/24/the-internet-is-burning/
> >
> > It really is.  Password handling in particular is terrible.  Every
> > time we hear about a company's site being breached, it turns out
> > they were doing really stupid things with passwords.

> A time-sharing (access was via 110 baud terminals) company I worked for, 
> way back when, changed to a hash-style method of storing passwords in 
> 1973. I don't know that it had today's level of cryptographic integrity, 
> but I know it was designed to be expensive to brute-force. It's forty 
> years later. One might have hoped that the need was now well understood.

And Unix has had salted passwords since very early in it's development. 
Granted, the original DES based method is no longer viable given the
computational power of modern CPU's and GPU's, but it was done properly
for Unix as well.  So, yes, one might hope this was a solved problem.

> I expect there's a selection bias. Those companies who know how to do
> this stuff properly don't get hacked in the first place.

True.

> > I don't understand why no one can do this properly.  Salt and hash,
> > it's really not that hard!

> As you say, it's not hard, but storing plain text passwords is the
> obvious approach, and unless the developer has the time and
> motivation to research the matter, to discover the issues and
> possible solutions, plain text is what you get. Take someone fresh
> out of university, and give them the task under time pressure, and
> it's easy to see how these things happen.

Time pressure may be a big influence.  It is also easy to do a plain
text password:

  select 1 from users where id = 'joe' and password = 'frank';

Granted, one should use parameters rather than sql injection ready
code, but the above is easy to code, esp. while the system is still
running on the developers workstation only.  And it works, or at least
appears to work, from the point of view of the testing folks.  So no
one notices.

> So far as I'm aware, no one has yet been seriously sued over this kind 
> of thing. Until they are, I doubt we'll see much change.

This may be the biggest issue.  Until the ones pushing "get it done
yesterday" find the results of such a push causing significant
liability, they have no reason to change.

[toc] | [prev] | [next] | [standalone]

#3308

Rich <rich@example.invalid> writes:

> This may be the biggest issue.  Until the ones pushing "get it done
> yesterday" find the results of such a push causing significant
> liability, they have no reason to change.

And that person pushing, when hiring the pushees, quite possibly opted
for people with the minimum skills and/or experience to do the job *as
(s)he understood it*.  

Uh huh.  And now hurry up and get it done. Yup.

-- 
Mike Spencer                  Nova Scotia, Canada

[toc] | [prev] | [next] | [standalone]

#3311

On 2014-05-28, Mike Spencer <mds@bogus.nodomain.nowhere> wrote:
>
> Rich <rich@example.invalid> writes:
>
>> This may be the biggest issue.  Until the ones pushing "get it done
>> yesterday" find the results of such a push causing significant
>> liability, they have no reason to change.
>
> And that person pushing, when hiring the pushees, quite possibly opted
> for people with the minimum skills and/or experience to do the job *as
> (s)he understood it*.  
>
> Uh huh.  And now hurry up and get it done. Yup.

*applause*  Spot on.


-- 
Today is Pungenday, the 2nd day of Confusion in the YOLD 3180
"I do not believe in revealed religion — I will have nothing to do with your
immortality; we are miserable enough in this life, without speculating on
another." Lord Byron, 1778-1824, letter to Rev. Francis Hodgson, 1811

[toc] | [prev] | [next] | [standalone]

#3309

On 26/05/2014 12:18 AM, Rich wrote:

> Time pressure may be a big influence.  It is also easy to do a plain
> text password:
>
>    select 1 from users where id = 'joe' and password = 'frank';
>
> Granted, one should use parameters rather than sql injection ready
> code, but the above is easy to code, esp. while the system is still
> running on the developers workstation only.  And it works, or at least
> appears to work, from the point of view of the testing folks.  So no
> one notices.

Perhaps we should just remove literals from SQL altogether. Yes, there 
are many places where a literal makes sense, but since programmers 
cannot be trusted to use them safely, let's rip them out. Programmers 
will have to learn how to use parameters. Some would probably be 
surprised to learn that parameters even exist.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#3314

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 26/05/2014 12:18 AM, Rich wrote:

> > Time pressure may be a big influence.  It is also easy to do a plain
> > text password:
> >
> >    select 1 from users where id = 'joe' and password = 'frank';
> >
> > Granted, one should use parameters rather than sql injection ready
> > code, but the above is easy to code, esp. while the system is still
> > running on the developers workstation only.  And it works, or at least
> > appears to work, from the point of view of the testing folks.  So no
> > one notices.

> Perhaps we should just remove literals from SQL altogether. Yes, there 
> are many places where a literal makes sense, but since programmers 
> cannot be trusted to use them safely, let's rip them out. Programmers 
> will have to learn how to use parameters. Some would probably be 
> surprised to learn that parameters even exist.

We'd save ourselves the sql-injection possibilities that way.  We'd
lose the ability to hand type an SQL query at a prompt.

But that change would do nothing to prevent bad password storage
implementations.

[toc] | [prev] | [next] | [standalone]

#3315

On 28/05/2014 8:02 PM, Rich wrote:
> Sylvia Else <sylvia@not.at.this.address> wrote:
>> On 26/05/2014 12:18 AM, Rich wrote:
>
>>> Time pressure may be a big influence.  It is also easy to do a plain
>>> text password:
>>>
>>>     select 1 from users where id = 'joe' and password = 'frank';
>>>
>>> Granted, one should use parameters rather than sql injection ready
>>> code, but the above is easy to code, esp. while the system is still
>>> running on the developers workstation only.  And it works, or at least
>>> appears to work, from the point of view of the testing folks.  So no
>>> one notices.
>
>> Perhaps we should just remove literals from SQL altogether. Yes, there
>> are many places where a literal makes sense, but since programmers
>> cannot be trusted to use them safely, let's rip them out. Programmers
>> will have to learn how to use parameters. Some would probably be
>> surprised to learn that parameters even exist.
>
> We'd save ourselves the sql-injection possibilities that way.  We'd
> lose the ability to hand type an SQL query at a prompt.

No, it would just mean that the query had to be parsed and the literals 
extracted and passed in as parameters.

>
> But that change would do nothing to prevent bad password storage
> implementations.

True enough, but one step at a time.

Actually, I wonder why we're even still using passwords.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#3323

In message <bulrlrF5u4uU1@mid.individual.net> 
  Sylvia Else <sylvia@not.at.this.address> wrote:
> On 28/05/2014 8:02 PM, Rich wrote:
>> Sylvia Else <sylvia@not.at.this.address> wrote:
>>> On 26/05/2014 12:18 AM, Rich wrote:
>>
>>>> Time pressure may be a big influence.  It is also easy to do a plain
>>>> text password:
>>>>
>>>>     select 1 from users where id = 'joe' and password = 'frank';
>>>>
>>>> Granted, one should use parameters rather than sql injection ready
>>>> code, but the above is easy to code, esp. while the system is still
>>>> running on the developers workstation only.  And it works, or at least
>>>> appears to work, from the point of view of the testing folks.  So no
>>>> one notices.
>>
>>> Perhaps we should just remove literals from SQL altogether. Yes, there
>>> are many places where a literal makes sense, but since programmers
>>> cannot be trusted to use them safely, let's rip them out. Programmers
>>> will have to learn how to use parameters. Some would probably be
>>> surprised to learn that parameters even exist.
>>
>> We'd save ourselves the sql-injection possibilities that way.  We'd
>> lose the ability to hand type an SQL query at a prompt.

> No, it would just mean that the query had to be parsed and the literals 
> extracted and passed in as parameters.

>>
>> But that change would do nothing to prevent bad password storage
>> implementations.

> True enough, but one step at a time.

> Actually, I wonder why we're even still using passwords.

<https://www.grc.com/sqrl/sqrl.htm>

-- 
"He has never been known to use a word that might send a reader to the
dictionary." - William Faulkner (about Ernest Hemingway).

[toc] | [prev] | [next] | [standalone]

#3341

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 28/05/2014 8:02 PM, Rich wrote:
> > Sylvia Else <sylvia@not.at.this.address> wrote:
> >> On 26/05/2014 12:18 AM, Rich wrote:
> >
> >>> Time pressure may be a big influence.  It is also easy to do a plain
> >>> text password:
> >>>
> >>>     select 1 from users where id = 'joe' and password = 'frank';
> >>>
> >>> Granted, one should use parameters rather than sql injection ready
> >>> code, but the above is easy to code, esp. while the system is still
> >>> running on the developers workstation only.  And it works, or at least
> >>> appears to work, from the point of view of the testing folks.  So no
> >>> one notices.
> >
> >> Perhaps we should just remove literals from SQL altogether. Yes, there
> >> are many places where a literal makes sense, but since programmers
> >> cannot be trusted to use them safely, let's rip them out. Programmers
> >> will have to learn how to use parameters. Some would probably be
> >> surprised to learn that parameters even exist.
> >
> > We'd save ourselves the sql-injection possibilities that way.  We'd
> > lose the ability to hand type an SQL query at a prompt.

> No, it would just mean that the query had to be parsed and the literals 
> extracted and passed in as parameters.

True, that would work.  A more complicated CLI, but feasable.

> > But that change would do nothing to prevent bad password storage
> > implementations.

> True enough, but one step at a time.

> Actually, I wonder why we're even still using passwords.

Some guesses:

  1) trivial to implement (the implementation is really only on server
     side) [even if done right, they are still trivial to implement];

  2) very easy for the average joe to use/understand (this may, of
     course, be more a function of their ubiquity such that almost all
     average joe's already "understand");

  3) "instant" registration of new "average joes", i.e., no need to
     ship a physical hardware token (RSA secure-id token or the like);

[toc] | [prev] | [next] | [standalone]

#3150

Randy Westlund <Vorzakir@invalid.invalid> wrote:
> On 2014-05-25, David Harmon wrote:
> > On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
> > <rsw@therandymon.com> wrote,
> >>From the «type loudly so the NSA can hear you» department:
> >>Title: Everything is broken
> >>Author: gerty@pipedot.org
> >>Date: Sat, 24 May 2014 13:40:54 -0400
> >>Link: http://pipedot.org/story/2014-05-24/everything-is-broken
> >>
> >>Journalist Quinn Norton writes[1] on the broken culture of computer security.
> >>From complex software flawed with 0-days to human error and general culture
> >>prone to feeling powerless, she explains how security is currently just a
> >>mirage.Is computer security really just a wishful dream?
> >>
> >>Links:
> >>[1]: https://medium.com/message/81e5f33a24e1 (link)
> >
> > Journalist Jon Evans agrees.  "Online security is a horrifying
> > nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
> > X.509. Whatever security cataclysm erupts next, probably in weeks or
> > even days. We seem to be trapped in a vicious cycle of cascading
> > security disasters that just keep getting worse."
> >
> > http://techcrunch.com/2014/05/24/the-internet-is-burning/

> It really is.  Password handling in particular is terrible.  Every
> time we hear about a company's site being breached, it turns out
> they were doing really stupid things with passwords.

> I recently inherited a project involving a web application with a
> database back end.  The guy working on it before me was actually
> storing plain text passwords in the users table directly.  There was
> also an admin account called 'test' with the password -- you guessed
> it -- 'test'.

> I don't understand why no one can do this properly.  Salt and hash,
> it's really not that hard!

Hmm...  Some guesses:

1) school has changed from teaching "how to think" into teaching "how
   to memorize standardized answers";

2) most individuals do not in any way, shape, or form, possess the
   "security mindset"
   (https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html);

3) because of #1, no school even addresses the "security mindset"
   angle, because to do so would be to attempt to teach how to think
   and how to solve unknown problems;

4) ignorance (much as a result of 1-3 above) on the part of most dev's;

5) just not caring, or worse, thinking "I'll work on that later, but
   right now I've got to get _something_ working;

6) ... ???

[toc] | [prev] | [next] | [standalone]

#3435

On 2014-05-25, Rich <rich@example.invalid> wrote:
> Randy Westlund <Vorzakir@invalid.invalid> wrote:
>
>> I don't understand why no one can do this properly.  Salt and hash,
>> it's really not that hard!
>
> Hmm...  Some guesses:
>
> 1) school has changed from teaching "how to think" into teaching "how
>    to memorize standardized answers";

That's true of the Microsoft Certification malarkey.  I was reluctantly
pushed onto a course for one of those exams and the course instructor
recommended that on top of an already expensive course we buy sets of
typical questions to practice on.  He then recommended one in particular
and proudly stated that out of the $150 or so it cost, he'd get $50.

The advice I received from others who had done this before was to stock up
on practice questions and learn them by rote, "because there's
insufficient time in the exam to think about each answer".

The whole experience left me with a very nasty taste in my mouth.

> 2) most individuals do not in any way, shape, or form, possess the
>    "security mindset"
>    (https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html);

Hehe.  I think I do possess that mindset (though maybe not as acutely as
Bruce), and I put it down to a fascination with "what if?" constructs.

For example when I first read a description of Curiosity's Mars landing
my first thoughts as each step of the procedure automatically focussed on
what could go wrong, for example "what if just one of those explosive bolts
failed to go off or jammed?".

> 3) because of #1, no school even addresses the "security mindset"
>    angle, because to do so would be to attempt to teach how to think
>    and how to solve unknown problems;

The emphasis at my school (a long time ago of course) was to question
stuff. I am pretty sure that such an environment fosters an enquiring mind.

> 4) ignorance (much as a result of 1-3 above) on the part of most dev's;
>
> 5) just not caring, or worse, thinking "I'll work on that later, but
>    right now I've got to get _something_ working;

I once did a stint at a company that boasted that they used "software
prototyping" to good effect.  Some unfinished stuff definitely did find
its way into production (I had to sort it out), but they were very
profitable. "Publish and be damned" seemed to work for them, and then
they had the money in the bank to pay folks like me to sort out the mess.

> 6) ... ???

Back to point 1) really.  The various certification systems out there
attract a lot of parasites who are more interested in the money that actual
teaching.  And there is a lot of money in it.  Since my experience of that
MS certification course every time I hear the word "incentive" I go through
the mental exercise of seeing whether "back hander" is a better description.


-- 
Paul Sture

The final step of #heartbleed recovery is to call your mother, and advise
her to change her maiden name                                  -- @gojomo

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web