Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3125

Re: Is computer security culture simply broken?

Show all headers | View raw

On 25/05/2014 5:13 PM, Randy Westlund wrote:
> On 2014-05-25, David Harmon wrote:
>> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
>> <rsw@therandymon.com> wrote,
>> >From the «type loudly so the NSA can hear you» department:
>>> Title: Everything is broken
>>> Author: gerty@pipedot.org
>>> Date: Sat, 24 May 2014 13:40:54 -0400
>>> Link: http://pipedot.org/story/2014-05-24/everything-is-broken
>>>
>>> Journalist Quinn Norton writes[1] on the broken culture of computer security.
>> >From complex software flawed with 0-days to human error and general culture
>>> prone to feeling powerless, she explains how security is currently just a
>>> mirage.Is computer security really just a wishful dream?
>>>
>>> Links:
>>> [1]: https://medium.com/message/81e5f33a24e1 (link)
>>
>> Journalist Jon Evans agrees.  "Online security is a horrifying
>> nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
>> X.509. Whatever security cataclysm erupts next, probably in weeks or
>> even days. We seem to be trapped in a vicious cycle of cascading
>> security disasters that just keep getting worse."
>>
>> http://techcrunch.com/2014/05/24/the-internet-is-burning/
>
> It really is.  Password handling in particular is terrible.  Every
> time we hear about a company's site being breached, it turns out
> they were doing really stupid things with passwords.

A time-sharing (access was via 110 baud terminals) company I worked for, 
way back when, changed to a hash-style method of storing passwords in 
1973. I don't know that it had today's level of cryptographic integrity, 
but I know it was designed to be expensive to brute-force. It's forty 
years later. One might have hoped that the need was now well understood.

I expect there's a selection bias. Those companies who know how to do 
this stuff properly don't get hacked in the first place.

> I don't understand why no one can do this properly.  Salt and hash,
> it's really not that hard!

As you say, it's not hard, but storing plain text passwords is the 
obvious approach, and unless the developer has the time and motivation 
to research the matter, to discover the issues and possible solutions, 
plain text is what you get. Take someone fresh out of university, and 
give them the task under time pressure, and it's easy to see how these 
things happen.

So far as I'm aware, no one has yet been seriously sued over this kind 
of thing. Until they are, I doubt we'll see much change.


Sylvia.

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web