Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3151

Re: Is computer security culture simply broken?

Show all headers | View raw

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 25/05/2014 5:13 PM, Randy Westlund wrote:
> > On 2014-05-25, David Harmon wrote:
> >> On Sat, 24 May 2014 20:11:40 +0000 (UTC) in comp.misc, RS Wood
> >> <rsw@therandymon.com> wrote,
> >> >From the «type loudly so the NSA can hear you» department:
> >>> Title: Everything is broken
> >>> Author: gerty@pipedot.org
> >>> Date: Sat, 24 May 2014 13:40:54 -0400
> >>> Link: http://pipedot.org/story/2014-05-24/everything-is-broken
> >>>
> >>> Journalist Quinn Norton writes[1] on the broken culture of computer security.
> >> >From complex software flawed with 0-days to human error and general culture
> >>> prone to feeling powerless, she explains how security is currently just a
> >>> mirage.Is computer security really just a wishful dream?
> >>>
> >>> Links:
> >>> [1]: https://medium.com/message/81e5f33a24e1 (link)
> >>
> >> Journalist Jon Evans agrees.  "Online security is a horrifying
> >> nightmare. Heartbleed. Target. Apple. Linux. Microsoft. Yahoo. eBay.
> >> X.509. Whatever security cataclysm erupts next, probably in weeks or
> >> even days. We seem to be trapped in a vicious cycle of cascading
> >> security disasters that just keep getting worse."
> >>
> >> http://techcrunch.com/2014/05/24/the-internet-is-burning/
> >
> > It really is.  Password handling in particular is terrible.  Every
> > time we hear about a company's site being breached, it turns out
> > they were doing really stupid things with passwords.

> A time-sharing (access was via 110 baud terminals) company I worked for, 
> way back when, changed to a hash-style method of storing passwords in 
> 1973. I don't know that it had today's level of cryptographic integrity, 
> but I know it was designed to be expensive to brute-force. It's forty 
> years later. One might have hoped that the need was now well understood.

And Unix has had salted passwords since very early in it's development. 
Granted, the original DES based method is no longer viable given the
computational power of modern CPU's and GPU's, but it was done properly
for Unix as well.  So, yes, one might hope this was a solved problem.

> I expect there's a selection bias. Those companies who know how to do
> this stuff properly don't get hacked in the first place.

True.

> > I don't understand why no one can do this properly.  Salt and hash,
> > it's really not that hard!

> As you say, it's not hard, but storing plain text passwords is the
> obvious approach, and unless the developer has the time and
> motivation to research the matter, to discover the issues and
> possible solutions, plain text is what you get. Take someone fresh
> out of university, and give them the task under time pressure, and
> it's easy to see how these things happen.

Time pressure may be a big influence.  It is also easy to do a plain
text password:

  select 1 from users where id = 'joe' and password = 'frank';

Granted, one should use parameters rather than sql injection ready
code, but the above is easy to code, esp. while the system is still
running on the developers workstation only.  And it works, or at least
appears to work, from the point of view of the testing folks.  So no
one notices.

> So far as I'm aware, no one has yet been seriously sued over this kind 
> of thing. Until they are, I doubt we'll see much change.

This may be the biggest issue.  Until the ones pushing "get it done
yesterday" find the results of such a push causing significant
liability, they have no reason to change.

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web