Hacker News Reader

Comment by embik | Hacker News Reader

It would be helpful if the post not only told you what to _not_ do (especially when it is a frequently done thing) but offered any sort of alternative.

View on HN

Probably a generalization but in my experience many IT security people don't seem very pragmatic. "No you can't do that" but no alternative. "No don't use that cipher" but can't tell you the correct one. "Don't use equipment that doesn't receive firmware updates anymore and doesn't support newer encryption standards". "Don't allow mDNS" so no more printing from smartphones or presenting stuff from your laptop using Miracast? It gets tiresome really fast.

Edit: yeah sure downvote me into oblivion. I'm not throwing away perfectly functional equipment because it doesn't support the latest and greatest ciphersuite. I'm also not planning on a being a roadblock on everything, it's balancing act.

> so no more printing from smartphones or presenting stuff from your laptop using Miracast? It gets tiresome really fast.

You can still print from a phone or present from a laptop, just not with solutions relying on insecure services.

It requires some effort is all.

Cookie based session logins like everyone used to use?

Not everyone can look back at a 10 year long career in the industry to draw inspiration from. Especially for junior engineers, pointing out alternatives (that feel obvious to you) would be important.

Can’t be used when embedding on third party sites though.

I work for ab EU government, and cookies are a no-go because of cookies directive, so we use JWT and auth the javscript engine, not the browser.

This leads to a multitude if problems, but who cares?

This makes no sense. The law didn't specify cookies specifically, it is agnostic about the technical implemention, surely?

Is this a clueless manager thing?

Not a manager thing, it is a consensus in at least one major EU government sweatshop.

Go figure.

>and cookies are a no-go because of cookies directive

haha, what?!

this is not true.

That's bullshit. Even ec.europa.eu (the European Commission's website - I have to login there from time to time) sets session cookies on my browsers. Either you've misunderstood what's asked of you, or your manager has, or someone higher up in your organization. But the "cookie directive" has never prevented anyone from using cookies altogether. You don't even need to ask for consent for a session cookie.

*.europa.eu websites have been known to infringe on EU rules forever. Shoemaker without shoes, you know.

That's a bold claim, any source?

PASETO?

Reply on news.ycombinator.com