Hacker News Reader

Comment by peter303 | Hacker News Reader

EVERYTHING done online could be public someday. Act like it.

I feel this is a defeatist stance to take; LFI's are a solved problem and we should be looking to how and why this happened and prevent it in the future.

Another angle: we're supposed to not do anything that requires any form of confidentiality online? can't book a doctors appointment, transfer money, send emails to family?

It's not defeatist, it's personal hygiene. Sure there are some convenience trade offs and edge cases, but things like Facebook, Dropbox, etc can almost assuredly be treated as "eventually public" no matter how many buttons and knobs they add. The sooner people realize it, the better.

> Sure there are some convenience trade offs and edge cases

Some convenience trade offs? You're suggesting that people don't use any modern bank, don't use any hospital, don't interact with any state body at all. Should we go live in a cabin in the woods?

It seems to me that what they're actually saying is to tread carefully when it comes to social media and cloud services.

What about people who want to communicate and socialize but want some privacy?

Go for a hike in the woods with them

Signal.

It's a realistic stance. What's possible or achievable is not what's commonly done. Even companies that know better or have staff often don't care enough to apply it. Malware with keyloggers and search functions hit computers regularly. The expectation should be, "If it's connected to Internet, treat it like it's public."

It's why quite a few organizations still used air gapped systems, link/IP encryption between locations, and private, leased lines. A smaller number use more secure or just obscure endpoints that can't execute the programs malware authors write. You don't read about such people in the news getting hit by malware or hackers. They can be hit, esp by high-strength attackers, but it's just rare because they don't trust the Internet, Windows, etc in how they do IT.

This is such a statement of failure of the IT industry as a whole.

And I think it's right. None of the large OS are fit for purpose. And it's about time that regulators start protecting unsuspecting consumers from unscrupulous incompetent fly-by-night developpers like the ones behind this website.

I wrote a quick rundown of it on Schneier's blog discussing liability:

https://www.schneier.com/blog/archives/2011/09/an_interestin...

Idea being we just combine the right features, often standardized in libraries, with the most cost-effective of assurance activities proven to work. I gave a list of the latter to pick and choose from in another discussion:

https://news.ycombinator.com/item?id=10734477

Cleanroom methodology with safer languages with test-case generation, battle-tested libraries for common risk areas (esp web attacks or crypto), automation of parsing/protocol handling, static analysis to eliminate common issues, and basic code review would knock out vast majority of code-injections.

I think I mostly agree with what you're saying. I'm under no illusion that things can actually be secured; I don't own a single device that I'm not even slightly suspicious is running malicious code or otherwise leaking information I'm not aware of. Whether by negligence or purely the asynchronous nature of attack.

But is it productive for us to declare everything unsafe and somewhat give up believing we can build and use safe platforms?

I think there's a balance somewhere. I (to give a rather crude example, apologies) would never take a nude photograph of my partner on a digital camera because it's an unacceptable risk. But I'll share fairly personal thoughts knowing that they may come back to embarass me one day.

I want to put the pressure on companies who make such bold claims about their "military grade encryption" to face bankruptcy and shame when it's proven they're full of lies and negligence; if we just assume everything can be attacked with an LFI, it seems we've stopped caring about trying.

Caveat: I still haven't had breakfast, I don't have my best thinking cap on right now, but that's my gut instinct.

"But is it productive for us to declare everything unsafe and somewhat give up believing we can build and use safe platforms?"

There's the problem: we. We might be able to do it with time and money. Most startups, publicly-traded companies, regular companies, government groups (esp w/ legacy systems), and IOT makers aiming for max cost-cutting won't do it. Most don't know how but won't make the sacrifices even if they learn. Their incentives plus demand-side tell them not to. So, no reason to think they'll do it any time soon past marginal improvements for public relations.

What can happen is people forming organizations idealogically and/or by charter committed to puting quality/security over highest-margins in their products or services. Look up Praxis Correct-by-Construction for an example who charges 50% premium for software they warranty for quality. Secure64 sells DNS with ultra-hardened OS. GENU builds on OpenBSD. Green Hills has INTEGRITY-178B. OK Labs (now GD) put microvisor in a billion phones. There's some others but really niche and still successful where well-marketed.

We could see more of that. Only problem is they fight an uphill battle since they're expected to include a pile of insecure features and protocols in lots of products. And, despite maximum quality, at same price or cheaper than competition! What could go wrong in such an IT market?!

The reason you can transfer money online is because banks and payment providers are insured, so when things go wrong you can (usually) get your money back.

Online banking doesn't implement security features to make things safe; it's to make the insurance cheaper.

Yes, and the insurance is cheaper because the probability of things going wrong is lower. Transitively, they are doing it to make things safe.

This is a dark thought, but your country may one day slip into becoming a totalitarian state, where the data of private companies is appropriated by the powers that be.

> we're supposed to not do anything that requires any form of confidentiality online? can't book a doctors appointment, transfer money, send emails to family?

You probably won't want to do any of this stuff outdoors in 10 more years, or indoors around a smartphone, television set, refrigerator, or any object with flashing LEDs on it. As a combined network, smart audio coverage can be made to be so complete that incomplete areas will arouse suspicion.

Registering on (or even visiting) an internet site is just slightly different than signing a contract (and in some opinions, legally equivalent.) If you had to sign a form with your address to visit a prostitute, and you couldn't even open the door without it recording your license plate number - what kind of expectation of privacy could you reasonably have?

Read Quinn Norton's "Hello Future Pastebin Readers!"

https://medium.com/message/hello-future-pastebin-readers-39d...

Norton's law: Over time, all data approaches deleted, or public.

No. This is a stance of totalitarian regimes. I doubt the people that joined this site should be shamed for their choices.

That is a weird opposition. It's very true that everything could be public. I don't see OP as shaming any of these people, just pointing out that you have to be safe about what you release to the Internet.

No, get people to make safe and proper websites.

The internet is becoming too important to our lives, we can't just say "presume everything is public"

Your advice means that someone should refuse to visit a doctor or hospital which uses computers, since "I have to act like everything online could be public!". That's just unworkable.

> No, get people to make safe and proper websites.

Not gonna happen. That's like saying companies should make un-breakable security for buildings. No such thing will every exist.

Reply on news.ycombinator.com