Hacker News Reader

Comment by pieter | Hacker News Reader

Excuse notes are a great example of why you need verification. Anyone can write one for themselves, and give it to you without proof it really came from a parent. That's a classic man in the middle attack.

What you really need is some kind of certificate for each parent, allowing you to verify the note really came from the parent. That's why self-signed certificates really aren't worth much -- anyone could have created them.

View on HN

I thought it interesting that even without such a certificate, the teacher still had a pretty good idea of which notes were fake and which were legitimate. Kind of like websites - you just kinda know when they fake..

You don't know the teacher knew; all you know is that he sorted the notes into two piles. You don't know if the piles were correct. Not sayin' he was wrong. Just sayin'.

If no one wants to miss class, you don't have to worry about this.

I think that concisely encapsulated the two go-to solutions for so many hackers: a) create a complex system that will postpone or perhaps solve the problem; and b) make the problem irrelevant with a miracle stroke of genius solution to be fleshed out at a later date.

Hackers, hackers, hackers, why does every thread have a post about how hackers are so great? Can we stop the big circle jerk?

Circle jerk? I was pointing out unproductive behavior - the tendency to simplify a problem such that it fits into a stock solution or counting on a miracle. Neither of these actually confront the original problem - just duct tape and wishes.

It's called "Hacker News" for a reason.

Totally agreed; this is exactly the generalized message I took away.

How many "lessons" (goals) could we tailor to the desires of the "student" (user) as a substitute for enforcement mechanisms? Surely not all, but many more than we're presently doing.

No, excuse notes are not that important.

Or maybe security should be simple enough that people don't mind doing it for the most trivial things.

There is a great Erma Bombeck (author who wrote books satirizing suburban life "The Grass is Greener Over the Septic Tank") line about how the only real excuse notes are those written on a napkin, in lipstick and crumpled.

Really? Because the actual story seemed to demonstrate exactly the opposite

Now, if you are teaching kids Network Security and you start getting these kinds of forged excuse notes, you are exactly on the right track. Just start having the kids alternate between thinking of ways to make sure the notes are really from the parents, then thinking about how to crack the system they just came up with.

If anyone reading this is teaching such a class to undergrads or lower, please use this as a lecture technique and let us know how it goes. :)

Instead of sending notes, an easier way to weed-out most fakes would be to require a phone call. Sure, it can be faked but it's a lot more difficult do (especially if they have met the teacher).

how about exchanging certificates in person?

Reply on news.ycombinator.com