Hacker News new | ask | show | jobs
by gabdpipi 23 days ago
Yeah I was thinking the difference between open source and enterprise to mitigate this is a simple hardware security module right?

If the attackers spearfish folks who hold “keys to the castle” and everything is digital it’s game over no matter what ecosystem.

Those things should be locked down by “something you have” because that’s much more difficult.
1 comments
OhMeadhbh 23 days ago
What will cryptography buy you in this instance? Do digital signatures imply virtuous behaviour? Does the lack of a signature imply vice?
link
gabdpipi 23 days ago
It’s not just cryptography when a developers password manager gets compromised and all, the hacker is “in”.

If it’s secured by a hardware key, they need to have the key physically.

Two step could work as well with the proper Authenticator.

link
OhMeadhbh 23 days ago
IPCMSes make it somewhat easy to MitM SMS. If your system poops a cookie in the wrong place it doesn't matter if the secret is in someone's head or if it's in a hardware dongle, like you say... the hacker is "in".

My recommendation for bad guys is to not attack the part of the system where it is strong. Just sniff around a bit until you find the weak part and attack that.

Also remember most devs couldn't use a static analysis tool to save their lives (which is why mythos is relevant.) I suspect that a 15 year old copy of Fortify or CoVerity could find bugs mythos missed.

And if that doesn't work, just start scanning github repos for entropy. That's where the credentials that were accidentally published live.

link
gabdpipi 23 days ago
Yeah that’s fair. It’s only as secure as the weakest link.

That was one of the promises of wasm was sandboxing npm packages independently. Not sure what happened with that or not but I’d be curious to know now we’ve had a lot of recent supply-chain publicity.

For example, if every fetched module is sandboxed and even if they got compromised there would be more protection. It would be more “when” not “if” the package is compromised, nip it in the bud.

But then attackers will target the most exposed packages… :)

Security is hard.

link