Hacker News Reader

Comment by saulrh | Hacker News Reader

Might want to change the title to something like "LulzSec actually had a point after all." They do, too, an even better one than I expected. Not only are they making a point about how terrible security is ("Do you think every hacker announces everything they've hacked?"), but they've also called out the internet on its generally abysmal attention span. I wouldn't be surprised if they'd had this written on day zero.

View on HN

That's not the most important thing I took away from the submitted link.

To me, the important thing is that LulzSec says that it derives pleasure from causing harm to people -- like the people who used to add poison to bottles of Tylenol, package the Tylenol back up again and place it back on the supermarket shelf. Although they could be saying that to cover up their real agenda, most writers (and especially most writers who have the tech skills needed to do what LulzSec has done) could not fake an admission of this sort as well as this text would have to have been faked.

Since it is natural human behavior to rationalize an antisocial motivation with a more socially-acceptable cover story, you would expect LulzSec to say things like, "We are doing this to bring public attention to how terrible security is." But if it is a rationalization, and it sure seems that way to me, surely it would be a mistake to focus on it and not the true motivations.

>they've also called out the internet on its generally abysmal attention span.

What an surprizing interpretation! I interpreted the parts about boredom as a continuation of the author's honestly disclosing his own motivations, not anything about internet users in general.

Lets not overblow things. They don't kill random people, they carry out pranks which can cause emotional and maybe financial distress, that's all.

Part of me feels that the publicity side of their argument is a little overblown. Many people do publicly disclose exploits, it's just that LulzSec has made a huge deal in the media about each one. Another part of me is happy to see them call people out on their abysmal security practices. Sony would not have upgraded/redone their security practices had there not been attacks. The only thing worse than poor security is having a false assurance that it's good.

Not only are they making a point about how terrible security is ("Do you think every hacker announces everything they've hacked?"), but they've also called out the internet on its generally abysmal attention span. I wouldn't be surprised if they'd had this written on day zero.

Neither of these are novel concepts: we've heard about abysmal internet security (FireSheep) and low attention spans (Nicholas Carr[0, 1] and Jonah Lehrer[2]) repeatedly over the last couple of years.

This release may seem profound to you, but LulzSec proposes no solutions to the problems they're creating. They're too nihilistic to put on white hats, and they deserve none of your praise as a result.

[0] http://www.theatlantic.com/magazine/archive/2008/07/is-googl...

[1] http://www.amazon.com/Shallows-What-Internet-Doing-Brains/dp...

[2] http://scienceblogs.com/cortex/2010/04/attention_and_intelli...

The difference is that LulzSec managed to get their word on every tech blog in the world. They also managed to get their basic message - nothing is safe, and here's proof - onto nearly every single major news site in existence, and they made their message immediately and personally important to millions of people. That's why I'm praising them. They don't need to propose a solution; that's already been done. They don't need to have a new message; extant messages are good enough. What they bring to the party is visibility.

What they bring to the party is visibility.

Do published books and articles in The Atlantic, Wired, and NYT not work for you? Those are a few of the news sites that have covered declining attention spans.

As for internet security--anyone who can do something about it already knew there was a problem. On the consumer end, what are users supposed to do? Add symbols to their passwords? That would delay GPU- or SSD-based brute force techniques by, what, 10 seconds?

An article on Wired gets read and forgotten. An article about passwords in the NYT gets dismissed as "newfangled kids". Ten million credit cards stolen - one of which is yours - gets remembered. Having your FB account manually and maliciously defaced changes your life. That's visibility that no article or book can sell.

Consumers are supposed to start using tools like KeePass or LastPass. Adding symbols to a simple 6-character password doesn't help. Adding symbols to a high-entropy 20-character password and never using a password twice makes you basically immune to this kind of thing.

On the consumer end - what needs to be done is a massive education campaign, kept reasonably simple. It was done in 2000-2003 for anti-virus and it (roughly) worked for the 80% or so of the Windows world that did what they were told (by the mainstream press).

The mainstream press has (so far) done a terrible job on password education. You see long lists of rules that nobody but a security professional or hacker would follow. It needs to be boiled down to something simple, like:

Use a password manager to assign unique, random 15 character passwords for all accounts, protecting them with a strong master password.

I put together a guide based on this concept here:

http://www.filterjoe.com/2011/04/14/passwords-guide-without-...

Unfortunately, this (and probably other) good password guide(s) get far less attention than the latest Sony exploit.

Reply on news.ycombinator.com