Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #3341

Re: Is computer security culture simply broken?

Show all headers | View raw

Sylvia Else <sylvia@not.at.this.address> wrote:
> On 28/05/2014 8:02 PM, Rich wrote:
> > Sylvia Else <sylvia@not.at.this.address> wrote:
> >> On 26/05/2014 12:18 AM, Rich wrote:
> >
> >>> Time pressure may be a big influence.  It is also easy to do a plain
> >>> text password:
> >>>
> >>>     select 1 from users where id = 'joe' and password = 'frank';
> >>>
> >>> Granted, one should use parameters rather than sql injection ready
> >>> code, but the above is easy to code, esp. while the system is still
> >>> running on the developers workstation only.  And it works, or at least
> >>> appears to work, from the point of view of the testing folks.  So no
> >>> one notices.
> >
> >> Perhaps we should just remove literals from SQL altogether. Yes, there
> >> are many places where a literal makes sense, but since programmers
> >> cannot be trusted to use them safely, let's rip them out. Programmers
> >> will have to learn how to use parameters. Some would probably be
> >> surprised to learn that parameters even exist.
> >
> > We'd save ourselves the sql-injection possibilities that way.  We'd
> > lose the ability to hand type an SQL query at a prompt.

> No, it would just mean that the query had to be parsed and the literals 
> extracted and passed in as parameters.

True, that would work.  A more complicated CLI, but feasable.

> > But that change would do nothing to prevent bad password storage
> > implementations.

> True enough, but one step at a time.

> Actually, I wonder why we're even still using passwords.

Some guesses:

  1) trivial to implement (the implementation is really only on server
     side) [even if done right, they are still trivial to implement];

  2) very easy for the average joe to use/understand (this may, of
     course, be more a function of their ubiquity such that almost all
     average joe's already "understand");

  3) "instant" registration of new "average joes", i.e., no need to
     ship a physical hardware token (RSA secure-id token or the like);

Back to comp.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Is computer security culture simply broken? RS Wood  <rsw@therandymon.com> - 2014-05-24 20:11 +0000
  Re: Is computer security culture simply broken? David Harmon <source@netcom.com> - 2014-05-24 18:17 -0700
    Re: Is computer security culture simply broken? Randy Westlund <Vorzakir@invalid.invalid> - 2014-05-25 07:13 +0000
      Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 17:47 +1000
        Re: Is computer security culture simply broken? RS Wood <rsw@therandymon.com> - 2014-05-25 09:10 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-25 19:23 +1000
            Re: Is computer security culture simply broken? Ben Bacarisse <ben.usenet@bsb.me.uk> - 2014-05-25 12:33 +0100
        Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:18 +0000
          Re: Is computer security culture simply broken? Mike Spencer <mds@bogus.nodomain.nowhere> - 2014-05-28 01:43 -0300
            Re: Is computer security culture simply broken? Huge <Huge@nowhere.much.invalid> - 2014-05-28 08:07 +0000
          Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 15:25 +1000
            Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-28 10:02 +0000
              Re: Is computer security culture simply broken? Sylvia Else <sylvia@not.at.this.address> - 2014-05-28 20:21 +1000
                Re: Is computer security culture simply broken? Lewis <g.kreme@gmail.com.dontsendmecopies> - 2014-05-28 18:11 +0000
                Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-29 10:39 +0000
      Re: Is computer security culture simply broken? Rich <rich@example.invalid> - 2014-05-25 14:12 +0000
        Re: Is computer security culture simply broken? Paul Sture <nospam@sture.ch> - 2014-05-31 10:05 +0200

csiph-web