undefined | Better HN

0 pointsOhMeadhbh6d ago0 comments

What will cryptography buy you in this instance? Do digital signatures imply virtuous behaviour? Does the lack of a signature imply vice?

0 comments

gabdpipi6d ago

It’s not just cryptography when a developers password manager gets compromised and all, the hacker is “in”.

If it’s secured by a hardware key, they need to have the key physically.

Two step could work as well with the proper Authenticator.

OhMeadhbhOP6d ago

IPCMSes make it somewhat easy to MitM SMS. If your system poops a cookie in the wrong place it doesn't matter if the secret is in someone's head or if it's in a hardware dongle, like you say... the hacker is "in".

My recommendation for bad guys is to not attack the part of the system where it is strong. Just sniff around a bit until you find the weak part and attack that.

Also remember most devs couldn't use a static analysis tool to save their lives (which is why mythos is relevant.) I suspect that a 15 year old copy of Fortify or CoVerity could find bugs mythos missed.

And if that doesn't work, just start scanning github repos for entropy. That's where the credentials that were accidentally published live.

gabdpipi6d ago

Yeah that’s fair. It’s only as secure as the weakest link.

That was one of the promises of wasm was sandboxing npm packages independently. Not sure what happened with that or not but I’d be curious to know now we’ve had a lot of recent supply-chain publicity.

For example, if every fetched module is sandboxed and even if they got compromised there would be more protection. It would be more “when” not “if” the package is compromised, nip it in the bud.

But then attackers will target the most exposed packages… :)

Security is hard.

j / k navigate · click thread line to collapse

0 comments

gabdpipi6d ago

It’s not just cryptography when a developers password manager gets compromised and all, the hacker is “in”.

If it’s secured by a hardware key, they need to have the key physically.

Two step could work as well with the proper Authenticator.

OhMeadhbhOP6d ago

My recommendation for bad guys is to not attack the part of the system where it is strong. Just sniff around a bit until you find the weak part and attack that.

And if that doesn't work, just start scanning github repos for entropy. That's where the credentials that were accidentally published live.

gabdpipi6d ago

Yeah that’s fair. It’s only as secure as the weakest link.

But then attackers will target the most exposed packages… :)

Security is hard.

j / k navigate · click thread line to collapse