Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Engineering Security (2014) [pdf] (auckland.ac.nz)
63 points by Tomte on Jan 6, 2019 | hide | past | favorite | 10 comments


Note that Guttman was also one of the people who gave formal, methods people a reality check:

https://web.archive.org/web/20170214231046/http://www.cypher...

His work taught me to watch out for such problems. Plus, keep a mix of formal and empirical methods on any given project so they cross-check each other.


Extremely interesting to read how data availability is very often (in the military, no less) more useful than both confidentiality (because any eavesdroppers are unlikely to be able to act on the information quickly enough) and authenticity. I wonder if the latter is because of some combination of the difficulty of crafting a believable message which will have the intended effect and the hardware requirements, because the sky isn't full of nuclear missiles.


The part on the placebo SSL certificate is interesting (https://www.cs.auckland.ac.nz/~pgut001/pubs/book.pdf#page37). Do users really ignore the big red warnings that web browsers give for invalid certificates? I imagine that it has to do with the fact that someone would rather be able to do what they want to do instead of heeding a warning they don’t understand.


This phenomenon even has a name. Dancing pigs: https://en.wikipedia.org/wiki/Dancing_pigs


I've done phishing testing with self-signed certificates, and I don't feel it had any impact on the rate at which users handed over credentials.


Note the Author is Dr Peter Gutmann, maintainer of Cryptlib. Highly recommend you go to one of his talks if you ever get the chance,


Wow this guy is snarky (probably with good reason though).


On further reading it seems like just the intro section is (imo) unnecessarily hostile. This is a pretty engrossing read - although I'm skimming through and just reading all of the amusing anecdotes.

Specific example: Phrases like "Fashion Statement Technology" seemed kind of unhelpful, better keeping the explanation of why they are bad without the snarky labels.


For a variety of reasons, snark is omnipresent in security culture. This writing style is immediately familiar to me as a result.


Just dropping my two cents in as the author was asking for feedback. No idea if they're reading this thread though.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: