Hacker News new | ask | show | jobs
by sam_lowry_ 17 days ago
There is a whole class of security issues where fixes are worse that the issues themselves. Case in point, the OpenSSH itself that sends 100 packets on each keystroke to avoid timing attacks.
2 comments

Why is that worse than the issue itself? If someone could figure out, say, my root password via an ssh timing attack, that seems bad. Sending 100 packets for each keystroke to protect against this seems cheap in the face of that.
Because it breaks our mental model of how things work.
Or it means it is time to update the model. Models need to change as the world they model changes, right?
The OpenBSD developers could have opted for a warning, like the one you see about post-quantum encryption when connecting to old servers.

Instead, they just sneaked the change upon the world.

The example doesn't seem worse, but more importantly - are these issues part of the class (and why)?