Re:LastPass release fix for DOM manipulation vulnerability
by godelski on Sunday April 02, 2017 @07:47PM
(#14019721)
So I think we have a different fundamental problem. I do not think a system can be fully secure. I think the vast majority of security researchers would agree with me too. A common saying is "given enough time and enough will power, someone will break your system."
What we're talking about here is the discovery of a vulnerability. Not that the company knowingly shipped the product with this issue.
Security is a constant cat and mouse game. Security through obscurity is an effective method in the short run. A company cannot and will not be responsible for shipping a car that could be hacked unless security researchers could show that there was gross negligence.
>Under no circumstances would I want to get into a car that an sdr could control
I suggest never entering a car with a computer in it. This likely means the car you own. Basically if your car has power steering and power braking then it can be hacked.
Of course they have options. It's up to them to choose whether to get into a dangerous car. They can arrange to ride-share, or book a taxi, or ask a favor from a friend. And even if they have no options, the vulnerability researcher didn't make them less safe by disclosing immediately. The car company made them unsafe by shipping a car that could kill them.
Tangentially related, but you may find that the term "responsible disclosure" has covertly influenced your thinking, as it did mine: https://news.ycombinator.com/item?id=12308246 It's easy not to notice.
> We are presented with a problem if the responsible party brushes off the researcher. It is the responsibility of the researcher partially disclosing to the public. So now we're in the second case presented above. But now there is more power to the public. From a legal standpoint you can prove recklessness or malice by the responsible party and a lawsuit will be much easier. The company can be required to replace the vehicle, provide a temporary replacement, or buy it back. Whatever happens it will go much smoother in court than if one of the first two events happened.
The company will undoubtedly be required to fix the vehicle anyway, if only to save their brand. Just because someone revealed the existence of a problem doesn't absolve them of any responsibility.
You make some good points, and the conclusions are logical and well-reasoned. Unfortunately I think we disagree on the central point: "This method IS protecting your life better than you could do on your own." Under no circumstances would I want to get into a car that an sdr could control -- this is the ultimate protection -- and the only way to ensure that is to be informed immediately.