A system for approaching security questions
Wednesday, October 17, 2018
Security questions are user hostile and advantage the attacker Why security questions suck They’re based on publicly available information. They’re based on capricious and changing feelings They’re based on murky and easily misremembered factoids They’re based on certain assumptions of the world that are not universally true What to do? Social Engineering A system for security questions System Requirements System #1 - Design Considerations The MUST-NOT Items The MAY Items Some Example System 1 System #2 - Design Considerations Conclusion Security questions are user hostile and advantage the attacker Security questions are a terrible concept and should be abolished. Unfortunately, they won’t be, and even if they will be at some future point, they’re here now and we’re forced to participate. …
Arguments Against HTTPS
Monday, September 3, 2018
Disclaimer: I think HTTPS everywhere is a generally good thing, but it isn’t unmitigated. See this earlier post about why HTTPS is good and why you should do it. That being said, there are arguments against it that ought to be taken seriously. Some of these arguments apply systemically, i.e., because of choices made by the browser vendors, such as the decision to mark all non-HTTPS sites as insecure by default. …