Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3150

Re: Is computer security culture simply broken?

Show all headers | View raw

Randy Westlund <Vorzakir@invalid.invalid> wrote:
> On 2014-05-25, David Harmon wrote:
> > On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
> > <rsw@therandymon.com> wrote,
> >>From the «type loudly so the NSA can hear you» department:
> >>Title: Everything is broken
> >>Author: gerty@pipedot.org
> >>Date: Sat, 24 May 2014 13:40:54 -0400
> >>Link: http://pipedot.org/story/2014-05-24/everything-is-broken
> >>
> >>Journalist Quinn Norton writes[1] on the broken culture of computer security.
> >>From complex software flawed with 0-days to human error and general culture
> >>prone to feeling powerless, she explains how security is currently just a
> >>mirage.Is computer security really just a wishful dream?
> >>
> >>Links:
> >>[1]: https://medium.com/message/81e5f33a24e1 (link)
> >
> > Journalist Jon Evans agrees.  "Online security is a horrifying
> > nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
> > X.509. Whatever security cataclysm erupts next, probably in weeks or
> > even days. We seem to be trapped in a vicious cycle of cascading
> > security disasters that just keep getting worse."
> >
> > http://techcrunch.com/2014/05/24/the-internet-is-burning/

> It really is.  Password handling in particular is terrible.  Every
> time we hear about a company's site being breached, it turns out
> they were doing really stupid things with passwords.

> I recently inherited a project involving a web application with a
> database back end.  The guy working on it before me was actually
> storing plain text passwords in the users table directly.  There was
> also an admin account called 'test' with the password -- you guessed
> it -- 'test'.

> I don't understand why no one can do this properly.  Salt and hash,
> it's really not that hard!

Hmm...  Some guesses:

1) school has changed from teaching "how to think" into teaching "how
   to memorize standardized answers";

2) most individuals do not in any way, shape, or form, possess the
   "security mindset"
   (https://www.schneier.com/blog/archives/2008/03/the_security_mi_1.html);

3) because of #1, no school even addresses the "security mindset"
   angle, because to do so would be to attempt to teach how to think
   and how to solve unknown problems;

4) ignorance (much as a result of 1-3 above) on the part of most dev's;

5) just not caring, or worse, thinking "I'll work on that later, but
   right now I've got to get _something_ working;

6) ... ???

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web