If society can't trust banks and other institutions to safely control their data, what follows ?
Do we we collectivelly switch off the internet?
Yet they’re still the predominate search engine, sadly the concerns of the few don’t interest monopolistic profit seekers without forced regulations, think how airlines are legally required to give refunds for delayed flights, there’s a reason it required legislation
You don’t tie it to “your device”.
You tie it to your security key.
Which is treated like a credit card.
and your extended family, friends, or volunteers can act as social proof to allow you back into your accounts,
if your key burns up, it breaks and you were too cool to provision a backup, etc.
> it breaks and you were too cool to provision a backup
If we're relying on the average person to back things up properly, this idea is doomed from the start.
Just new banks.
Same as people being unafraid of their car key being cloned - because they don’t hand it around the general public.
The average person is relying on the average person, for everything, and I agree, they are doomed from the start.
Tech-related items inclusive.
I was working at the fruit company when they just hard stopped people from recovering their fruitcloud accounts via phone support due to social engineering.
Social Engineering risk just increases the burden on the consumer/internal support services. The risk is that not everyone has pulled up stumps to protect these services. After a few high profile fuck ups they will. The herd loses 2 beasts and the rest wander away from that water hole.
Its much like how after bitlocker we dont have user access to backup server disks anymore. The lesson was learned and we moved on. Lots of high profile fuckups but we dont get those anymore. CTO's were forced, basically at gunpoint, to adapt or die.
But the idea that we'll squash all of the critical vulns is simply nonsense, despite the weird Firefox blog posts that indicate otherwise.
In other words: do you think that the impossibility lines in exhausting the number finds or does the impossibility lie in fixing them?
In either case, do you think that this was also true pre-AI? That is to say: it was not possible to, given some set of practical resource constraints, find and fix all the vulnerabilities that a similarly-resourced group would find?
If so, then would you say that you just fundamentally don't believe in secure software and the only defense is lack of attention?
> In either case, do you think that this was also true pre-AI? That is to say: it was not possible to, given some set of practical resource constraints, find and fix all the vulnerabilities that a similarly-resourced group would find?
Yes.
> If so, then would you say that you just fundamentally don't believe in secure software and the only defense is lack of attention?
I believe in security software, few people are building it though and the majority of relevant attack surface is dogshit for security.
Squashing vulns via discovery is irrelevant to security. If we want safer software it has to be built to be safer.