Hacker News Reader

Comment by AnIdiotOnTheNet | Hacker News Reader

Frankly, that's an entirely appropriate way to deal with security. You can make the most secure product in the universe, but no one will use it if it takes forever to develop or is unnecessarily difficult to work with. Of course, how much security is enough is a multi-variable problem, but in general I find that "security people", who for obvious reasons want to sell you on security, way over-estimate its value.

View on HN

  no one will use it if it [...] is unnecessarily
  difficult to work with

In some aspects of security, you can trade off inconvenience for cost, instead of trading off against security.

For example, imagine an office with a security gate, but it takes a few days for new employees to be issued with a working gate pass.

One way to reduce that inconvenience would be to trade off security, by having staff members buzz strangers in if they know the magic words "I just started, my pass hasn't arrived yet".

An alternative way would be to trade off cost, by having while-you-wait gate pass printing, and every gate having a guard who can check an online employee directory before buzzing someone in without a pass.

I feel a lot of people say "Security is a trade-off with convenience" when they actually mean "Security is a trade-off with convenience and spending, but we've already taken spending off the table"

Well, to be frank, duh.

There's a trade-off between small battery size and battery capacity.

You don't really need to qualify that with "if you've taken spending off the table".

You’re getting downvoted because of being flippant but you are right, by definition there exists a trade off between cost and any feature. It’s the least interesting trade off: if want more X it will cost more. There also is a trade off between any two features mediated by cost, if I spend more on X, then I can’t spend as much on Y. What are more interesting are inherent trade offs. Like the famous trade off between security and liberty seems to not just be mediated by cost.

There is another option here. Have security passes issued promptly. It's possible, I've worked at a bank where it took all of 5 minutes. (Not that I disagree with the general point, just the example)

That's what I meant by "having while-you-wait gate pass printing" :)

A guard can still be useful to let in people who've forgotten their pass or left it at their desk, or whose pass has broken, or who have come from a different office, or who've got their hands full carrying things; and to deal with people without passes like contractors, interviewees, and other visitors; and to tell off people who tailgate now there aren't any good reasons to do so.

I had a meeting at a major UK broadcaster in London the other day. Arriving at reception I had my photo taken, a visitor pass printed, and put in a pass with a guest RFID enabled card, and to top it all a voucher for a free cup of coffee from the canteen.

No reason that such a system can't be done for the first week or so, even if you don't want to have the facility to print permanent cards in every office.

Oh it absolutely is, and the most humbling thing was realising that I would probably do exactly the same thing in their situation ;-)

However as a developer and business owner myself (as opposed to a security person), I genuinely thought more people would be more concerned about the security of their website. I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin....

You see not knowing is one thing, but knowing and being complacent is quite another. But we see that in more areas in life I guess :)

Really refreshing to see someone say they might do the same thing if the tables were turned. It's easy to judge others shortcomings in what we know, but there's probably plenty of other things that we have our own shortcomings with.

Thanks! There’s a reason large enterprises spend a ton of resources on security while SMBs are vulnerable on just about every public attack surface: priorities.

Well that and expectations. Most small business owners see security as part of the developer’s job. However don’t realise it’s something that needs non-stop attention as websites and technologies in general are affected by erosion. What’s safe today might not be tomorrow. The developer isn’t at fault for that, and yet the website owner refuses to foot the patch bill, or pay for continuous monitoring.

I could write all day about this and we’ve only been in the trenches for a few weeks now :p

> I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin

Changing the "password" field on http site to "textarea" with hidden css rule is another great one- to get rid off the browser warning. As it was explained to me, because TLS is too much hustle.

Oh that’s golden, I’m going to remember that one and pop it out as an example some time. Thanks for that!

> Frankly, that's an entirely appropriate way to deal with security.

No, it’s not. You don’t have to be perfect, but “critical vulnerabilities and half the owners don’t care” sounds a long way from approaching perfect. This is why we have botnets made of webcams and blogs, and constant leaks of people’s private information and passwords.

Let's qualify that - it's an entirely appropriate way to deal with security with the current climate of not actually having any repercussions (or none beyond some tepid market response) for security breaches that damage third parties.

Honestly, I feel this position is morally bankrupt.

When someone pays for your product, gives you sensitive information, or interacts with you in any way, they have a set of expectations. When purchasing medicine at a pharmacy, they expect to receive something that has a chance of making them better. When they deposit money into a bank, they expect that the bank will try to have the money there when they want it later. When they drop their car off at a mechanic, they expect the mechanic will try not lose the car. Anything less is called a scam.

So when someone purchases a product, they expect that appropriate measures have been taken to ensure that they will not be hurt by that product. The average consumer doesn't know about proper electrical grounding, the interactions of their prescription medications, or XSS. They shouldn't have to, they're paying to not have to.

"security people" overvalue security in relation to _your_ bottom line. In truth, they aren't just there for you, they're also there to advocate for the people who will actually be hurt when your garbage security gets circumvented.

He said it's overvalued, not that it's irrelevant.

In your example you expect the mechanic to lock your car and keep the keys safe, but you don't expect it to be put in a walled in area with armed guards and full-time surveillance.

The latter is what IT security can quickly lead to.

That's absolutely true, but the position he was endorsing was

>Meanwhile 4 put of 5 webshops we check have critical vulnerabilities and half the owners don’t care because “it just costs money to fix it and things have been fine so we’d rather spend more on Adwords”

Waiting until you get owned to actually patch up critical vulnerabilities in order to save money is negligence.

I'd agree with that if these people would also suffer financial consequences if it goes wrong, and not offload that on their customers whose data got compromised.

Let's say their customers were aware of and understood all the risks. Do you think they'd really go elsewhere or give up the service? If so, then you're right, but my guess is most of them wouldn't because the risk is acceptable.

That's fine as long as your customers have the same expectations of the level of security you're providing as you do, and you're complying with appropriate legislation around handling of customer personal and business data :)

Could I get a list of every product you've worked on or influenced? I want to know what I need to avoid at all costs.

The company running a tight ship front-loads risk costs. The firm that doesn't is arbitraging present vs. potential future costs. The apparent lower costs are illusory.

A lot of the time the costs aren't actually payed by the breached party though. Most customers don't meaningfully change behaviour due to security breaches and meaningful fines are the exception, so your biggest risk is a breach benefitting your competition. If most of the costs can be externalized there is little incentive to care about them.

The customers also play this game.

It's an availability heuristic.

Reply on news.ycombinator.com