Thread

1. jacobgold · 1790110395 · focus · HN ↗

   At this point, no one seems capable of keeping a large database safe. I assume all medical and biographical information that exists is in the hands of the major state actors.

   China hacked 22.1 million records of US government employees:

   <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;2015_Office_of_Personnel_Management_data_breach" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;2015_Office_of_Personnel_Manag...

   1. coldpie · 1790111715 · focus · HN ↗

      It is unthinkable to me that anyone believes there is such a thing as computer security after so many years of nonstop hacks and leaks. If you have a computer and it is connected to a network with access to the Internet, assume that computer is semi-public. Meaning, if someone was interested enough in accessing your computer, they could do it. Do not hook any computer with access to anything that would be devastating if it was made public to the Internet. Do not put anything that would be devastating if it was made public onto someone else&#x27;s Internet-connected computers.

      For example, do not hook your goddamn water or traffic or electricity infrastructure up to the goddamn Internet, and then, do fire the guy who suggested it.

      The correct analogy for computer security is not locks and keys and doors and gates. It is a house in a floodplain. Your house will not survive the flood of it hits you. Do not store anything critical or irreplaceable in that house.

      1. shepherdjerred · 1790112734 · focus · HN ↗

         It used to be that nothing was secure but that was OK because at least adversaries would have to expend effort. If you are one of a million companies why would anyone hack you. Maybe if you are a target you need a lot of investment, but most orgs only prevent the most egregious of vulnerabilities.

         The calculus has certainly changed. Hacking is becoming even more frequent and… I’m not really sure what the equilibrium looks like.

         It’s not really an option to stop using computers or networks. But it’s going to be way too expensive (or maybe even impossible) to secure even just critical systems.

         Maybe banks and governments can secure themselves (and that’s a big IF) but it really feels like something fundamentally has to change.

         1. pixl97 · 1790113490 · focus · HN ↗

            &gt;The calculus has certainly changed.

            Adding AI into this really is just changing it to how much money your adversary is willing to spend to break in. The moment one crack in the armor shows up countless agents with unending patience can start embedding themselves everywhere in timeframes way faster than human actions. You could quickly find out all the special sauce for your company has been copied who knows where.

            Working with banks when the Glasswing&#x2F;Mythos first came out and they were given access to it has given me direct access to their infosec departments that are panicked. They&#x27;ve been sitting on piles of bugs for years that were low risk enough, and they have seen in their own tests how fast they can be probed.

            Worse those infosec systems that have identified the risks in their software that aren&#x27;t yet fixed are nuclear waste vats just waiting to get spilled to the wide world.

Unofficial Hacker News client; not affiliated with Y Combinator.