Hackers take over prominent Twitter accounts in simultaneous attack

Re:Hackers take over prominent Twitter accounts in simultane... by _-___________-_ on Wednesday July 15, 2020 @11:15PM (#23855350)

> Not that either. It feel like the conversation around these things is stuck in the far past. Large-scale organizations can and have driven the number of people with root passwords to zero. "Filesystem access" shouldn't be as easy as you're implying and it also shouldn't be of any use, since everything in the files ought to be separately encrypted with keys that can only be unwrapped by authorized systems.

OK, what about the people who have physical access?

> even a minor application of imagination can lead you to think of an init daemon that can enforce the pedigree of every process on the machine.

Who watches the init daemon?

[ Parent | on HN ]

Re:Hackers take over prominent Twitter accounts in simultane... by jeffbee on Wednesday July 15, 2020 @11:24PM (#23855400)

> OK, what about the people who have physical access?

What about them? Nothing about physical presence should lead to userdata access, nor the ability to act as users, if the application-layer security is squared away. In any case, physical security is by far the easiest of these topics to handle. Keeping people out of buildings is a human undertaking with 1000s of years of solid doctrine.

> Who watches the init daemon?

Another important question! If you don't know what's running on your box, you really don't have a security story at all.

https://cloud.google.com/blog/products/gcp/titan-in-depth-se...

[ Parent | on HN ]