Hacker News Reader

Comment by modeless | Hacker News Reader

MITM of any SSL connection in Safari and other system apps, and they couldn't even bother to have an OS X patch ready at the same time as the disclosure for iOS? I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.

View on HN

Seriously, what were they thinking? They've announced you can attack ≈40% of OS X machines and then didn't provide a fix. Great.

  > I think anyone relying on the security of OS X is going to have to seriously rethink their OS choice after this.

10.7.3 logging FileFault (that was a typo, but I think I'll keep it) passwords in plain text might have been a subtle hint in that direction.

They've honestly done a pretty great job on iOS security (at least since iPad 2/iPhone 3GS). OSX, not as much.

Disagree. They can't even keep the lock screen secure. Any major or point release there's been a bypass exploit.

Android has a flawless record, though.

http://www.androidcentral.com/samsung-lock-screen-bypassed-e...

Who said anything about Android?

You might find this article a good read: http://www.theverge.com/2014/1/21/5307992/inside-the-mind-of...

How can you know?

Is there a radar number for that?

This. Canned my MacBook Pro over this. It's been a bumpy relationship anyway. Just on Thursday Apple Mail stopped sending mail to my SMTP server. Final straw for me.

It's mainly an SSH and RDP terminal anyway.

OSX quality and QA is extremely bad.

Indeed the only secure OS nowadays is Linux. Everything else should be considered compromised by default a priori.

Linux is only secure if you secure it.

Sure, but at least you have a say there.

If you need to say something to make it secure then wouldn't it also be compromised by default?

Security is not a Boolean. A better question is, which OS is more secure OOTB for a given user.

For some users, none of them. Some users, no matter what, demand password as their password.

Do you know of any good guides?

This seems to be a reasonable starting point:

https://www.gov.uk/government/publications/end-user-devices-...

> Indeed the only secure OS nowadays is Linux

Tell that to the people who generated keys on Debian.

Programmers are simply not good enough at writing secure code. Full stop. If you say anything else, you're just flaunting your own unreliability as a source of security advice.

At least that was public and fixed. I think the point is that keys could be completely deterministic on closed source systems and there is no way to know. It's very easy to have deterministic "random" sources that pass statistical tests for randomness.

Not true. IIRC, the way the Debian bug was found was by some parties noticing a bunch of collisions of SSH public keys.

(For example, Github lets you push/pull via SSH as git@github.com, and they determine your identity by the SSH key used.)

How is what I said not true? If the same thing as the Deb prng bug happened in a closed source system, it could sit for a couple of years exposing thousands/millions of systems and then be patched quietly to avoid embarrassment, leaving everyone vulnerable.

FYI -- the source code here is public. Didn't help :D

It helped us realize how easy it would be to test for this, and that Apple isn't.

I question your code comprehension. This is not easy to test for at all, and Chrome doesn't do it either. Do you understand how to exploit this issue?

Static analysis would have caught this immediately. It caused unreachable code that the compiler even recognized and optimized away.

You're saying Google Chrome doesn't test that an ephemeral key is actually signed by the cert's private key? If that's the case, that's completely unacceptable because it's the whole point of the protocol.

Don't get too comfortable with linux --- Debian had its own openssl patch fiasco with consequences that were similarly nasty.

http://research.swtch.com/openssl

Every OS is compromised a priori. It's just a matter of when the compromises will be discovered. Linux has certainly had its share of flaws.

I think the various BSD folks, especially those from the OpenBSD team, would like to have a word with you. There are many other unixes out there that put a strong, probably even stronger than linux, emphasis on security.

ChromeOS is by far the safest thing out of the box, IMO.

Um, sure, after it updates. Assuming a similar bug isn't found there and exploited when it connects to the Internet. Since, you know, it can't do anything without a network connection. Just playing devils advocate here, I like ChromeOS too.

"Indeed the only secure OS nowadays is Linux."

You're kidding, right?

http://www.debian.org/security/

Edit:

There were multiple security issues in OpenSSL as recently as January.

http://www.debian.org/security/2014/dsa-2833

We need to stop using OpenSSL. A new crypto stack coded in a provably secure language is sorely needed.

Reply on news.ycombinator.com