• malloc@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    Google, Apple, and rest of big tech are pregnable despite their access to vast amounts of capital, and labor resources.

    I used to be a big supporter of using their “social sign on” (or more generally speaking, single sign on) as a federated authentication mechanism. They have access to brilliant engineers thus naively thought - "well these companies are well funded, and security focused. What could go wrong having them handle a critical entry point for services?”

    Well as this position continues to age poorly, many fucking aspects can go wrong!

    1. These authentication services owned by big tech are much more attractive to attack. Finding that one vulnerability in their massive attack vector is difficult but not impossible.
    2. If you use big tech to authenticate to services, you are now subject to the vague terms of service of big tech. Oh you forgot to pay Google store bill because card on file expired? Now your Google account is locked out and now lose access to hundreds of services that have no direct relation to Google/Apple
    3. Using third party auth mechanisms like Google often complicate the relationship between service provider and consumer. Support costs increase because when a 80 yr old forgot password or 2FA method to Google account. They will go to the service provider instead of Google to fix it. Then you spend inordinate amounts of time/resources trying to fix issue. These costs eventually passed on to customer in some form or another

    Which is why my new position is for federated authentication protocols. Similar to how Lemmy and the fediverse work but for authentication and authorization.

    Having your own IdP won’t fix the 3rd issue, but at least it will alleviate 1st and 2nd concerns

    • saltesc@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      2 months ago

      Our names, numbers, and home addresses used to be in a book delivered to everyone’s door or found stacked in a phone booth on the street. That was normal for generations.

      It’s funny how much fuckwits can change the course of society and how we can’t have nice things.

      • dmtalon@infosec.pub
        link
        fedilink
        English
        arrow-up
        1
        ·
        2 months ago

        Right, but when everyone got phone books, those were only shared locally in the town. It would be pretty hard to figure out someones phone number from across the state/country without the internet unless you knew someone in the town.

        You could also pay to be unlisted, which is a luxury long since gone. How cool would it be to make your data ‘unlisted’ by paying a small monthly fee.

  • Zacryon@feddit.org
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    Casually rotating 18,446,744,073,709,551,616 IP addresses to bypass rate limits.

    I am not in IT security, but find it fascinating what clever tricks people use to break (into) stuff.

    In a better world, we might use this energy for advancing humanity instead of looking how we can hurt each other. (Not saying the author is doing that, just lamenting that ITS is necessary due to hostile actors in this world. )

  • x00z@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    $5,000

    This is like 1/10th of what a good blackhat hacker would have gotten out of it.

  • dan@upvote.au
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    Most service providers like Vultr provide /64 ip ranges, which provide us with 18,446,744,073,709,551,616 addresses. In theory, we could use IPv6 and rotate the IP address we use for every request, bypassing this ratelimit.

    This usually doesn’t work, as IPv6 rate limiting is usually done per /64 range (which is the smallest subnet allowed per the IPv6 spec), not per individual IP.

  • jballs@sh.itjust.works
    link
    fedilink
    English
    arrow-up
    1
    arrow-down
    1
    ·
    edit-2
    2 months ago

    Damn that’s interesting. I like how they walked through step by step how they got the exploit to work. This is what actual real hacking is like, but much less glamorous than what you see in the movies.

  • rollmagma@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    arrow-down
    1
    ·
    2 months ago

    God, I hate security “researchers”. If I posted an article about how to poison everyone in my neighborhood, I’d be getting a knock on the door. This kind of shit doesn’t help anyone. “Oh but the state-funded attackers, remember stuxnet”. Fuck off.