安全与隐私troyhunt.com
那些愚蠢的安全设计
Stupid security things
2017 — 2022，它一次次回到首页
黑点是上首页（≥ 50 分）的那次投稿，空心点是没冲上去的投稿，点越大分数越高。
导读
Troy Hunt（Have I Been Pwned 创始人）在文中吐槽各种荒诞的安全实践，并邀请读者分享自己见过的“愚蠢安全设计”。评论区则变成大型吐槽现场：明文存密码、强制定期改密码、静默截断密码、把安全流程当免责手段等真实案例层出不穷。
为什么经久不衰：安全领域的反面教材历久弥新——这些荒诞做法至今仍随处可见，读它既是警示也是解压。
HN 评论精选
很多安全措施的真实目的是免责和合规，而非保护用户
“我们遵循了行业最佳实践”是完全站得住脚的辩护——出了事也没人指望他们做得更多。安全措施往往是为了让管理者在出事时不被问责、顺便省钱：只要做到“搞砸了也不会被开除”的程度就是胜利。真正的需求方——用户——反而没人关心。他还举了实体安全的例子：90年代离开英特尔晶圆厂时要检查公文包里有没有文件，却不管软盘，因为这是防股东诉讼的，保安也只会做这些。
gumby查看英文原文
> and I know for a fact 90% of the sites I personally sign up to online also follow that same process. This is a totally legit response. After all if something goes wrong they must have followed "best practices". No reasonable person would expect them to do more. And it's true (if you only consider the needs of the business). This is a solid strategy for getting lawsuits dismissed. I've seen it in physical security too [+]. It only took one investment bank to put badge-checking turnstiles in place and then they all had to do it. That stuck with banks only for a while until one more conventional business did it...and now I was at Twitch the other day and they have it. Of course who's missing here is the customer. But the customer's needs aren't paramount: the business's are -- and more specifically the manager who has to spend the money on security. If they have put in just enough that they won't get fired when it fucks up, and if they saved money and effort in the process: WIN! [+] my favorite physical security story is old, so at the end: when leaving Intel's Santa Clara fab in the 1990s you would have to hand over your briefcase for inspection to make sure you weren't leaving with any Intel documents. They didn't care if you had floppy disks. Why? Because this was a defense against shareholder lawsuits and "what else could the guards do?" This is where I learned the explanation above: once anyone in the industry increased plant security they all would have to, which nobody wanted. So LCD was the name of the game.
过度安全流程把简单事情变得极其繁琐，同样是糟糕的设计
这太可怕了。但同样糟糕的是对鸡毛蒜皮的小事强加繁琐安全措施的网站。比如英国税务海关总署（HMRC）：发邮件通知“你有新消息”，却出于“安全原因”不放链接，要登录账户才能看——而内容不过是“记得一月前提交自评申报”这种我早就知道的事。加上强制双因素认证，读一条垃圾通知得翻出记不住的 Government Gateway 号码、再找手机做验证。别再相信有人说英国政府数字服务（GDS）是可用性的标杆。
throwaway6845查看英文原文
This is pretty horrifying. But almost as bad: websites that insist on over-elaborate security measures for trivial stuff. Take a bow, HM Revenue & Customs: > You’ve got a new message from HMRC > Dear Fred > You have a new message from HMRC about Self Assessment. > To view it, sign in to your HMRC online account. For security reasons, we have not included a link with this email. > Why you got this email > You chose to get paperless notifications instead of letters by post. This means we send you an email to let you know you have a new message in your account. > From HMRC Self Assessment And HMRC have mandatory 2FA. So to read the spam they've sent me - and it is pretty much spam, it says "you need to do your self-assessment before next January", I know that already - I need to go through the rigmarole of entering my Government Gateway number, which I don't remember but starts with a 4 or something and hopefully that will be enough for Chrome to autofill it, then authing with my mobile phone. Which I think I left upstairs or something. Wait while I ring it with the landline to find where it is. Seriously, I might just go back to getting letters by post. Edit: No. My Government Gateway number which starts with a 4 is my company one. My Self-Assessment login appears to be a different number. People elsewhere in the world, whenever anyone tells you that the UK Government Digital Service is a beacon of usability and good practice, please don't believe them.
银行能“删除”密码中的特殊字符，说明根本没按规范加密存储密码
几年前英国桑坦德银行改版网站后我的密码突然失效，打电话过去对方说：如果密码里有特殊字符，已被新系统移除，因为新系统不支持特殊字符，请用原密码去掉特殊字符再试。第一，这么大的银行居然不接受特殊字符？第二，如果密码真像应该的那样是加密存储的，怎么可能删掉其中的字符？我正式投诉后他们回复说安全无虞，一周后我销了户。
gambiting查看英文原文
Huh, couple years ago Santander in the UK changed their web layout. No big deal, except that my password wouldn't work anymore - I rang them up, and they said "did you have any special characters in your password? If yes, then they have been removed because the new system does not support special characters. Please use the same password as before, but without special characters". 1) This is one of the largest banks in the UK and they don't accept special characters? 2) If you store my password encrypted(as you should be!), how could you remove any characters from it? I sent them an official complaint, they replied saying their security is fantastic and there is nothing to worry about, I closed my account a week later.
连经历过重大泄露的征信机构仍在推行已被权威指南否定的过时安全要求
我们公司和三大征信机构之一签了协议，对方发来安全尽调问卷，其中要求我们强制员工定期更换密码。他们坚称这对安全很重要，直到我们甩出微软、NIST 和英国国家网络安全中心的参考资料——都指出强制改密码反而降低安全性——才作罢。我怀疑他们只是从我们这份合同里删掉了这条，整个流程并未改变。经历过那次著名数据泄露之后，他们的安全审查里还有不少其他糟糕项。
mijoharas查看英文原文
At my work we signed a deal with one of the big three credit reporting agencies that had a well publicized security breach a little while back. As part of this, they sent us some security due diligence questions, which is fairly routine. One of the things that they wanted us to agree was that we forced all of our employees to change their passwords every $timeperiod. They insisted that this was important for security, and only backed off after we sent them references from all of microsoft[0], nist[1] and the uk national cyber security centre[2] saying that doing so would reduce security. My suspicion though is that they only removed it from our specific contract, and they hadn't changed the entire process. I would have hoped that after their security breach (this happened afterwards) they would have reviewed their security and improved it but unfortunately that didn't seem to be the case. There were a fair few other things in the review that were generally poor security wise, but that one is the one that stood out to me. [0] can't find the reference I probably used, but this talks about it https://arstechnica.com/information-technology/2019/06/microsoft-says-mandatory-password-changing-is-ancient-and-obsolete/ (I think microsoft was one of the links we sent them?) [1] https://pages.nist.gov/800-63-3/sp800-63b.html#memsecretver [2] https://www.ncsc.gov.uk/blog-post/problems-forcing-regular-password-expiry
历次讨论
同类还值得读
非法素数
Illegal prime
维基百科条目，介绍“非法素数”：某些素数之所以被称为“非法”，是因为它们经特定编码后，恰好对应一段被法律禁止传播的数据——最著名的是 DVD 解密程序 DeCSS 的代码，有人把…
安全与隐私上首页 5 次 · 2010–2021en.wikipedia.org编辑精选关于 /dev/urandom 的常见误区
Myths about /dev/urandom
（Thomas Hühn 撰写，2014 年首发并持续更新）逐条反驳关于 /dev/urandom 的常见误解：它与 /dev/random 使用的是同一个 CSPRNG，一旦完…
安全与隐私上首页 5 次 · 2014–20202uo.de编辑精选AES 高级加密标准火柴人图解
A Stick Figure Guide to the Advanced Encryption Standard (AES)
一篇用火柴人漫画形式讲解 AES（高级加密标准）算法的经典科普文章。
安全与隐私上首页 5 次 · 2009–2022moserware.com编辑精选指纹是用户名，不是密码
Fingerprints are Usernames, not Passwords
作者（eCryptfs 维护者、Ubuntu 安全工程师）认为指纹等生物特征是公开、不可更改的标识，应视作用户名而非密码，不能当作秘密凭据用于认证。
安全与隐私上首页 4 次 · 2013–2017blog.dustinkirkland.comHTTPS 连接的最初几毫秒（2009）
The First Few Milliseconds of an HTTPS Connection (2009)
逐毫秒拆解一次 HTTPS 连接建立时发生了什么，重点讲 TLS 握手、证书验证、RSA 签名与密钥协商等机制，面向不熟悉该领域的读者。
安全与隐私上首页 4 次 · 2009–2020moserware.com编辑精选