Most security is based on the honor system
mhd-aboelez.medium.com
mhd-aboelez.medium.com
By way of example, Rod was able to facilitate hardware level duplication (and could have easily performed neutralization though he did not) of the Permissive Action Link nuclear keys in the active german theatre which were also in locked safes on one of the largest US bases in the world behind many, many layers of armed soldiers.
Correction: we didn't do that in the unclassified literature. PERSEREC did a deep dive and that deep dive remains behind the Green Door (same with Hanssen's, Boyce's, and Ames's, among others).
Imagine if they were given up by a human source. That kind of thing doesn't leak until everyone is dead and buried, and even then it doesn't always get out because it gives foreign counterintelligence services some ability to assess the damage done by the source.
Imagine if they were given up by a technical collection program. Same thing.
In a previous age, human activity was siloed out of necessity. The affects of a security breakdown were thus localized to a small population.
Technology allows business and government to save a few pennies by aggregating all the little silos into a few gigantic pools. One break in, and millions pay the price.
Phrased this way the solution seems pretty clear -- we need to decentralize personal information out of these 3rd party databases. No amount of security is ever going to prevent a leak at some point so it's insane to keep creating these massive databases; and every time we ratchet up the security we're actually handing power over to the State and multi-national corporations.
The best example of this is trying to build a system that allows law enforcement to read private data. There's no way to ensure that only law enforcement (and none other) does that.
Keys Under Doormats - https://www.schneier.com/wp-content/uploads/2016/09/paper-ke...
Specifications and details here: https://openaps.readthedocs.io/en/latest/
The code is hosted on GitHub, and is against Microsoft's Terms and Conditions, for obvious reasons. Still, nothing is done about it.
It's not uncommon for these engineers to have a 'if I am incapacitated, do not hook me up to these devices' card in their wallet like you'd normally see for alllergies for products they've worked on.
Also, these projects were designed on purpose to circumvent or in some cases break the law, which is the wrong approach to medical device design. It's dangerous and designs kill, as you know.
See this stipulation (and control/command + f = "commercial" in paper):
27) ‘making available on the market’ means any supply of a device, other than an investigational device, for distribution, consumption or use on the Union market in the course of a commercial activity, whether in return for payment or free of charge;
Also:
46) ‘investigational device’ means a device that is assessed in a clinical investigation
Also:
1) ‘medical device’ means any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings for one or more of the following specific medical purposes:
— diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of disease,
Also:
(19) It is necessary to clarify that software in its own right, when specifically intended by the manufacturer to be used for one or more of the medical purposes set out in the definition of a medical device, qualifies as a medical device, while software for general purposes, even when used in a healthcare setting, or software intended for life-style and well-being purposes is not a medical device. The qualification of software, either as a device or an accessory, is independent of the software's location or the type of interconnection between the software and a device.
IMO, yeah, community approaches might not be the ideal solution, but when it comes to my health it's the better of the two options I have (community that I can actually look at the implementation of vs. proprietary that I know has systemic regulatory issues and is a crap shoot on if it is actively killing people and the engineers who worked on it don't ever want it used on them). If it comes down to it I'm going to choose my health over legality every time.
This could be done to keep the professionals on their toes without resorting to relying on random unvetted software.
They could even take pull requests, as long as the company takes responsibility for them.
Thanks, I am aware of this. It's called a block diagram, and is standard safety design. See page 3: https://pdfserv.maximintegrated.com/en/an/AN4675.pdf
I don't mean to single out you specifically, I keep noticing it now.
I was going to say (did type) that I can't think of another word that's used in the same sort of declaratory way - but actually, as I wrote, it occurred to me that 'funny' is too.
'Funny, I just never noticed it with 'sad' until a few years ago.'
Of course, those insulin pumps are running insecure firmware allowing for adjustments to be made remotely by an sbc (Raspberry Pi) where the OpenAPS software lives and takes measurements from a GCM. Without the insecure remote interface on those insulin pumps, OpenAPS might not exist.
I'm not sure it's moral to attack such a project built and maintained by diabetics who simply want to provide for themselves a better quality of life.
This is the issue here, with a cyber to physical attack, which is bound to happen at some point, with some medical device, and this project is a huge target for something like that. This project was specifically mentioned in the book "Click Here to Kill Everybody" by renowned cybersecurity expert Bruce Schriener, too.
OpenAPS was also designed to circumvent government laws, and is not-as-legal as the creators portray it to be. For example, one of the main "advocates" calls OpenAPS an "off-label qualification" for use (in the USA), when in order for that to apply, the specific device intended to be used must be FDA approved. As you know, OpenAPS cannot be FDA approved at this point of time. This individual also illegally markets unapproved medical devices across the United States, Europe, Australia, and New Zealand, plus online, with various gatherings for it. If you look at the specific laws of those lands, it is pretty clear cut what is going on is illegal. Plus, the new EU Medical Devices Regulation applies now.
Yes, it is illegal. I am astonished that this individual has not gotten in trouble with the FDA yet.
The key to safety is that hardware itself a) shows the real state of things and b) has safety mechanisms in place such that even the most malignant control software would be no worse than poorly timed manual dosing.
What are the obvious reasons?
> “So it’s an inside job?!”
> “No, the hacker got in by guessing one of the clerks’ passwords.”
> “That’s not possible, we have a password security policy in place. Brute forcing that kind of thing would take hundreds of thousands of attempts.”
> “Well, normally, yes, but the clerk was using the same password for her email, and that server got hacked, and a file with all the usernames and plaintext passwords got dumped.”
> “But everyone knows user passwords need to be stored as one-way hashes so that getting the plaintext back out of them is impossible.”
> “They were hashed, but only md5! The hackers just used a rainbow table to do the lookups.”
A password security policy could have prevented that. ;p
I'm not sure that's true anymore.
Without salts (which the third party didn't have) I'd assume many passwords the human mind can remember within workable policy rules have been compromised.
If the 3rd party had salted them, even with a common salt, the password policy probably would have worked though.
Whether you can remember a password depends mostly on how often you use it. If you have to type it in every day, 30 random letters aren't difficult to remember.
I can still tell you my first library card number just from the messages the library would leave when a book came in. 1000102772901.
Only somewhat true.
This XKCD is absolutely wrong - https://xkcd.com/936/
10 billion MD5s a second should be easy. So the XKCD pass phrase goes from 550 years -> to one hour, on a normal GPU, for one person. Rainbow tables mean after that one hour on their gaming PC no one else has to do it.
Start adding in other requirements to the pass phrase the hour goes up, and perhaps you have to rent some cloud time, but only one person once has to do it once.
But, if you assume it's likely other sites use seeds, then rainbow tables are out, and length can matter again. And that's reasonable. You need to wreck as many points in the attackers chain as possible. That's the game.
I'm not sure what you're saying here. If by seeds you mean "salts", they're not relevant -- the whole point of a rainbow table is that you precalculate the hash of every possible password. If it's salted, you'll see the salt in the plaintext and just remove it.
But a rainbow table for long passwords will develop pretty extreme storage requirements, and take a long time to compute.
Yep
> If it's salted, you'll see the salt in the plaintext and just remove it.
No. You can't use rainbow tables on salted data. Maybe when a framework has a default common salt that people forget to change.
> rainbow table for long passwords will develop pretty extreme storage requirements,
Not really, that's the point of rainbow tables. They can be reasonable, they are not lookup tables. If you are looking at large ones, they can be compacted at the expense of time.
For "CorrectHorseBatteryStaple" the rainbow table will not contain "sdfgnWlgiuwreFrglrkemnmZflgh". You map the chain to your search space. So after CorrectHorseBatteryStaple might be SimpleFineChairBook or S1mpleFineChairB00k or SimpleFine@ChairBook depending on your space.
There's something about this that you're failing to understand, but I'm not sure what it is.
A rainbow table is a collection of key-value pairs. The key is a hash, and the value is input that produces that hash.
Suppose my password on a website is "password". The MD5 hash associated with that password is 5f4dcc3b5aa765d61d8327deb882cf99 . If you dump the user database and see this:
+--------------+----------------------------------+
| user | password |
+--------------+----------------------------------+
| thaumasiotes | 5f4dcc3b5aa765d61d8327deb882cf99 |
+--------------+----------------------------------+
If you salt the password, nothing changes. When you dump the database, you'll see this instead:
+--------------+----------------------------------+-------+
| user | password | salt |
+--------------+----------------------------------+-------+
| thaumasiotes | 9caa7f6693553ed9129bb0c7a0c8aa50 | bEanx |
+--------------+----------------------------------+-------+
A rainbow table can tell you that 9caa7f6693553ed9129bb0c7a0c8aa50 came from "passwordbEanx" just as easily as it can tell you that 5f4dcc3b5aa765d61d8327deb882cf99 came from "password". That's what rainbow tables do.
> they are not lookup tables
This is flat wrong; that's exactly what a rainbow table is.
> For "CorrectHorseBatteryStaple" the rainbow table will not contain "sdfgnWlgiuwreFrglrkemnmZflgh". You map the chain to your search space.
This is a possibility, but it's also an admission that making a rainbow table at the desired length is infeasible. You trim the space of passwords you can look up down to something that you hope contains your target's password. Now you don't have a rainbow table up to 30 characters, you have a rainbow table for a list of common passwords.
But once you've done that, you are vulnerable to password security policies. You can no longer crack uncommon passwords, and uncommon passwords are the problem rainbow tables are meant to solve. Common passwords you can often just guess.
Examples - https://api.wordpress.org/secret-key/1.1/salt/ No rainbow table will contain those.
bEanx actually works pretty as a fine salt, it wrecks Rainbow tables. But just like comments people understand salts more if they look complicated.
Check out this https://rsheasby.medium.com/rainbow-tables-probably-arent-wh... It explains Rainbow Tables != Lookup Tables
It explains that rainbow tables are lookup tables which use a clever method to reduce their enormous storage requirements by increasing the lookup time. That doesn't make them any less lookup tables.
> Salts might be 100 characters in length.
Absolutely. But in that case, the rainbow table would be having trouble with the length of the (salted) password, not with the fact that a salt exists. I will stipulate that a salt will automatically add extra resistance to rainbow tables (compared to no salt) while not adding any inconvenience to the user who has to enter their password. But in the context of a password security policy, what you're getting there is added convenience, not added security.
> It could be a book.
Probably not; the salt has to be stored on a per-user basis.
> bEanx actually works pretty as a fine salt, it wrecks Rainbow tables.
Only to the extent that it makes the password longer. There is no theoretical difficulty that salts cause for rainbow tables.
It's on the line probabilisticly, so I can't make a harder statement, but 20 characters (which takes the programmer 2 more seconds to smash in) takes us to computers the size of the earth conversation which ok you win, it is possible :)
> the salt has to be stored on a per-user basis.
That's of no use to stop Rainbow tables. One salt across the site is fine to destroy or not destroy Rainbow tables. Either 'bEanx' or “For Sale: Baby shoes, never worn.” will work fine commonly used on all passwords. A common salt is not great for brute force though, but that's a different topic.
Yes, as your link (well, part 2) notes, publicly available rainbow tables are available up to 8 mixed-case characters or 10 lowercase characters. Salting with "2" is sufficient to avoid them. That is because rainbow tables cannot practically attack long passwords.
>> the salt has to be stored on a per-user basis.
> That's of no use to stop Rainbow tables.
I didn't say it was. It's a requirement of salting. Salting is unrelated to rainbow tables. Instead, it defends against comparing one user's hashed password to a second user's hashed password, which I assume is what you're referring to when you say "not great for brute force". All I said here was that the salt is unlikely to be a book, because that imposes a very large per-user storage burden.
It's trivial to create a rainbow table that attacks passphrases. This statement is wrong. You example 1000102772901 is easily within rainbow tables. Trivially so, it's worse than a passphrase.
> it defends against comparing one user's hashed password to a second user's hashed password,
This has zero value.
I can only suggest you do a course on hash functions on Coursera, the mathematics is somewhat easy and interesting to know. It's fun to follow up with a Blockchain course also has very interesting mathematics around hash functions, I really enjoyed this.
I can't suggest which, the one I did isn't available, but check Google reviews there's a few out there.
> This has zero value.
I find it disturbing that you would say this. The purpose of salting passwords is to block this attack. Please familiarize yourself with the field before opining on what its goals are.
Making a password longer by salting it makes a short password harder to crack, because you are less likely to have the salted password in your table that is full of dictionary words and previously hacked passwords with different salts.
This is true if you're using a table, which password-cracking attacks don't do. It's not true if you use the actual password-cracking approach of guessing what the password is and then checking whether you were right. The salt doesn't impede that in any way.
I've held superuser root keys I shouldn't actually have so many times because the little who technically decide if I can use them refuse to learn how to grant and remove that permission.
> Not so, as the average programmer is trained not as an operator of simple input-output machines but as a Computer Scientist. And Computer Scientists are very clever. They’ve spent a lot of time and effort in figuring out how to successfully design complex applications.
> They also have to justify the forty hours a week they sit at their desks. It simply wouldn’t be feasible for a team of four programmers to finish a six-month project in two weeks. The entire management schedule would be thrown off.
> So, we have people specializing in complex systems with a vested interest in taking a large amount of time to create something. They’re faced with a simple problem. Clearly, the goal is to fit the problem into the system and time available, which necessitates taking the simple problem and making it more complex
I almost don't even know what to say in response to this. It is such an incorrect, uncharitable, foolish view of the situation that I can't take anything else in this essay seriously.
Not to say that these tendencies don't exist, but to take that as your assumption for the whole industry? If it's so simple, start a company, do it right, and put the rest of us out of business.
https://www.theverge.com/2021/4/22/22398156/university-minne...
> “Why didn’t anyone remove that device?!”
The correct answer is - "why didn't anyone fix this issue for the employee?"
It's also not, a wireless toaster is not required, because complex as computers are, humans are worse, it's you that's wrong if you want to second guess every employee. Cost it up and give the $ figure to the manager if it's too hard to help them within current policy.
This part of the breach was the IT departments fault if you want to assign blame. But just like people reuse emails and passwords because life is already too hard, IT departments also have hard jobs to do.
I wouldn't call it a 'Honor System' as such.
Now, you have legal recourse against local actors. That keeps a lot of folks acting well. But "trusting trust" is a chain that ultimately perpetuates itself.
I'd argue that the real "honor system" is that executables will do what you expect, and nothing more, on behalf of a user.
We look away to “live our life” and tacitly believe others are behaving honorably.
And they all do.
Economists teach us inflation is good because if we increase worker buying power they might own more than the current landlords.
Hedge funds short stocks 200% to crater companies and make a profit.
Social media manipulates our biochemistry (arguably wasteful consumerism is built around this altogether.)
We’re undermining the security of our habitat for future people through all of this.
Everyone is acting honorably given our detailed history of being honorable people.
Not everyone who disagrees with you is a paid shill. No, I will go further and say very few people are actually paid shills, and I don't like this boogeyman (though sadly shills of course also exist).
It’s terrible what China is doing to ethnic groups. They should chase extinction of the species itself! As if that doesn’t have old school biblical vibes. People were promised hell on Earth!
Play video games. Collect social points. Write code. Superior. Intellect echoes to fade out
As a mathematician, I’m often dismayed by the fantasy and fallacy the tech crowd buys into.
Tech hype isn’t high quality content, since most software is math that was already figured out years ago.
And finding yet another math object that abides the well known order of operations is a bit quaint at this point.
None of this is bending laws of physics.
Being accurately meta about reality is redundant and repetitive.
Edit: pretty great when a FB employee complains about the state of online discourse, btw. When a paycheck depends on ones obliviousness and all that.
In the end they’d turn to the same old nation state for a bailout.
Y’all want to work on your art projects, fine. I see no reason to industrialize confirming mathematics operators still work.
Sure, that’s how it works.
I’ve noticed a trend of people good at abstraction believing they know the state of all particles that ever were and ever will be, use emotional language to make routine cognitive moments giant feeling.
Like that’s just how it is for all time, man.
When I got my item I told the employee, "you know, there's only like 5 people working here today, everybody in this store could just up and walk out with whatever they wanted. The 73 year old guy marking ppls receipts ain't gonna tackle anybody, and I wouldn't be surprised if the company tells you not to try to stop shoplifters anyway."
She was not impressed by my powers of observation and ideas of economic self-interest.
Years ago, I used to work a late shift, and go to a supermarket in the middle of the night that was open 24-hours. There wouldn't be a lot of customers, but there would predictably be a few, of which a couple would be buying a month's worth of groceries. And there would always be exactly one register open, and all the self-checkouts inactive.
I'm sure management didn't care if people had to wait half an hour, because they figure if you're going to go to the store in the middle of the night, you'll put up with the wait, and they don't want to pay people extra for the night shift.
It would also mean higher prices, because the store would have to pay for the extra payroll.
You can already choose to use a higher priced store that is better staffed if you want. If such stores don't exist, that's because people are voting with their wallets, and you are in the minority in preferring a higher price for that benefit.
More likely, those people are actually just ordering online and paying for delivery.
This is the free market economy in action. Your proposal would turn that on its head, while denying the poor the opportunity to get more for their money in return for their time.
Prices are not set based on costs. Nobody buying stuff at retail has signed a contract to pay cost plus X%. Nobody with a store has to make the same margin on every product whether essential, luxury, or junk, either.
>If such stores don't exist, that's because people are voting with their wallets
There is no voting against what doesn't exist.
>denying the poor the opportunity to get more for their money
Spending more on people with lower wages doesn't cause general price increases in the long run, precisely because a great deal of the inputs aren't coming from those people. This is HN, think of all the high paid software and other engineers who indirectly enable a modern store.
It's impossible to improve things only in the case where everyone is already equal.
In a competitive market, prices follow costs. Businesses that raise price above cost lose business to businesses that do not. And obviously businesses that price below cost fail. Margins might vary per-item because of market dynamics. But ultimately this is what is going on. This is Economics 101. If you want to claim otherwise, I think you need some extraordinary evidence here.
Whether you want to say that means prices are "set" on costs or not is semantics.
> There is no voting against what doesn't exist.
In a competitive market, what doesn't exist doesn't exist because it's not economically viable. It's not economically viable because the market doesn't want it. If you think otherwise, then maybe you should start up a business that does this - since according to you, you'll make a killing.
So, you think the gas stations are charging you the cost of gas? Fast food joints charge you according to the cost of a hamburger or a soda?
>In a competitive market, what doesn't exist doesn't exist because it's not economically viable. It's not economically viable because the market doesn't want it. If you think otherwise, then maybe you should start up a business that does this - since according to you, you'll make a killing.
This is sophistry. "The market" isn't one particular thing that exists or can exist without constraints. I suggested one more, different, better, out of thousands. That could change what is economically viable. That's the point.
Nothing is privileged about the exact situation that exists today, that will change tomorrow anyway. Except if you insist on an absurd Panglossianism.
It costs more than the cost of the goods to run a business. There's also the cost of payroll (if you remember, that's the cost I said would go up leading to higher prices). And rent, or the capex for the land and building. Maintenance. Utility bills. Taxes. Regulatory compliance. The list goes on. There's also the cost of risk, such as staff illness and any adverse business conditions (a temporary downturn caused by a pandemic included, but also seasonal variations, changes in fashion, and so on).
All of that gets factored into "costs". Once it's all factored in, then yes - if the gas station is in a competitive market, then it's pricing will be approximately the same as its costs.
Again, this is Economics 101. If you really thought that these weren't included in "cost", then perhaps you need to study the subject before making absurd claims.
You don't have to stop and show them your receipt.
‘Yeah, go ahead and take it all’