nmadden

Yes, the WebAuthn spec is pretty unreadable. Every time I open it I feel like I’m lost in a maze of twisty hyperlinks, all alike.

Have you ever attended an all hands that couldn’t have been an email?

Indeed, modern ML has been a validation of (some of) GOFAI: https://neilmadden.blog/2024/06/30/machine-learning-and-the-...

Exactly that. (Hijack session rather than account: any competently designed system should require re-auth before any action that would allow permanent account takeover).

> each assignment is creating a new scope

No, it’s rebinding the variable within the same scope. Even if you view it as implicitly creating a new scope, the implicit part means it can happen on any line so you have to scan them all and mentally keep track of what changes where, (almost) exactly as you would for imperative code.

The ellipses in your straightforward transformation are doing some heavy lifting there. Typically the let…in construct has some way to indicate where the scope of the “in” part ends: indentation (Haskell), explicit “end” marker (SML) etc. Even with that, shadowing does make equational reasoning harder (you have to look at more surrounding context) and should generally be avoided.

The example given in the article is:

    counter = 0
    counter = counter + 1

This is very different to shadowing where there is a clear scope to the rebinding. In this case, I cannot employ equational reasoning within a scope but must instead trace back through every intervening statement in the scope to check whether the variable is rebound.

OK, sure. As far as I’m aware, nobody’s actually made that into an actual AKEM proposal though. (I wish they would, as I think many applications would be fine with pre-quantum authentication and post-quantum confidentiality).

Rebinding is nicer than mutation, but neither are referentially transparent.

This cuts both ways. The last major revision of SAML predates the iPhone by several years. Things like PKCE, which are essential for security on mobile devices and in other cases don’t exist at all in SAML, yet the same attack vectors apply (plus a boatload more).

It used to be the other way around. It’s been a while since I did much UI work, but the web always felt incredibly frustrating for layout compared to Tk. (I think CSS finally has something approaching Tk’s grid layout manager?) There are fewer frameworks for Tk, but I think it has most things you’d need. Maybe some of the finer control over fonts etc is lacking.

The committee report only looked at the regulator. To be sure, the regulator and the pensions industry should have done more. But the idea that Truss and Kwarteng are blameless innocents in the whole fiasco is ridiculous.

Are there? I’ve advocated for such constructions in the past, but I’ve never seen an actual proposal. Do you have a link?

Pull the other one. Only some of the tax cuts had been telegraphed in advance. Abolishing the top rate of income tax and cutting the basic rate early hadn’t been. They ignored all the warnings they were given and sidelined the OBR. The Truss/Kwarteng budget directly crashed the economy and trying to pretend otherwise is some serious revisionism.

https://www.bbc.co.uk/news/63229204

Ok, makes sense.

As rjsw says, they refuse to disclose who funds them. See https://www.monbiot.com/2022/10/07/thinktanking-the-country/ for some background.

One of the authors is from the Centre for Policy Studies. Another is from the Adam Smith Institute. These are the gang of shady right-wing think tanks that brought us Truss and Kwarteng. That tells you everything you need to know about their economic competence.

The way DH is used typically for encryption (ECIES) or in TLS doesn’t give you authentication. But you can get authentication from DH alone, without PSK or PKI. See https://neilmadden.blog/2021/04/08/from-kems-to-protocols/ for some details on the security properties of various types of DH.

Just want to point out that the article specifically says to use an authenticated KEM (AKEM). A normal, unauthenticated KEM would not work as it provides no authentication. There are no post-quantum authenticated KEMs as yet.

Originally it was about scalability - signed/encrypted cookies are stateless, and hence (in theory) allow easy horizontal elastic scaling: just share the key with the new nodes. But I suspect that in a lot of cases now it is because it is easier initially to throw a key into an environment variable than standup a database, sort out caching, etc. It’s only later that you start thinking about revocation and idle timeouts and key rotation and all the other stuff that it becomes clear that it's not that simple to do well.

Yes and no. HMAC is very inefficient for short messages, but that inefficiency quickly vanishes into noise for anything over a kB or two. (HKDF and HMAC-DRBG are probably the worst offenders as they are always running HMAC on small inputs).

But, on the other hand, HMAC has repeatedly proven itself to be resilient to all kinds of attacks. I definitely didn’t mean any MAC when I recommended HMAC: eg I don’t think Poly1305 is a good general purpose MAC. PRF maybe, but sometimes you need the MAC to be committing too. Yes, some hash functions can be used with a simple prefix MAC, but then you need to list which specific hash functions to use (and most of those are not yet widely available).

The article goes into a lot of detail about why the author thinks its unusual.

> Here are my priorities, in order of importance. I think these should be your priorities too.

I might perhaps consider adding “it’s secure" to that list...

(And if I might do some shameless self-promotion: https://www.manning.com/books/api-security-in-action)

The best way to do cryptographic agility is to associate the algorithm with the key and negotiate keys (from a given set) only. Google’s Tink library does this very well. See https://neilmadden.blog/2018/09/30/key-driven-cryptographic-... for some more background. Version numbers are just algorithm identifiers in another form.

Yes, Kyber (ML-KEM) ciphertexts can be compressed somewhat when you are sending the same message to multiple recipients. See https://csrc.nist.gov/csrc/media/Events/2024/fifth-pqc-stand... for details:

> "Asymptotically, the size of an mKyber multi-recipient ciphertext is 16 times smaller than the sum of the sizes of N Kyber ciphertexts.”

There’s a whole zoo of useful variants on the “KEM” idea, but sadly NIST decided to standardise the least flexible variant. See my blog from a few years ago for some background on the literature: https://neilmadden.blog/2021/02/16/when-a-kem-is-not-enough/

The Zscaler exchange also listens to incoming connections, as does the OpenZiti edge router. How is this different? I’ve just swapped one vendor’s edge appliance (eg AWS ELB) for another. A CVE in either has the same impact, no?

Application specific connections are great and everything. But if a web app has a log4shell-like vulnerability then that app-specific connection means nothing if the app isn’t also isolated at the network level to prevent lateral movement.

PS - denying incoming connections doesn’t eliminate all network attacks by any means.

But a simple gateway/ELB can protect your apps from the public internet. (But unless you’re pushing a root CA cert to all client devices then those apps aren’t “dark” in any sense due to CT logs). Zscalar’s ZPA docs say:

> [ZPA] mitigates lateral threat movement through advanced segmentation

https://www.zscaler.com/products/zscaler-private-access

So it must be doing some segmentation at the network level, otherwise what does that statement mean?

Sure, zero trust implies those things, but I was asking specifically about these kinds of all-in-one “zero trust appliances”. For me, as an AppSec specialist, I’d say ZT is primarily about making sure all your apps enforce authN/Z regardless of whether the users are on an internal network or not.

One way to do that is to stick a simple reverse proxy in front of every app that does OIDC to your central IdP, and then arrange your network so that you cannot bypass that (eg using (micro)segmentation or something like IAP’s signed headers). My impression from reading Zscaler’s docs was that it was really just an over-complicated version of this without even doing the segmentation for you, but it sounds like it does do that bit too.

I took tptacek’s comment as implying that ZTNA solutions do do microsegmentation. Otherwise, if I get a shell in one app and have access to the entire network then what was the point of any of it? Are you saying they don’t do microsegmentation?

Oh ok. I’ve been reading a lot of zscaler zpa docs at work and didn’t come away with that impression at all. (The Zscalar docs are awful though).