News for hackers. Stuff that matters.
Re:Safari tries to fill username by Wowfunhappy on Friday May 28, 2021 @10:42AM (#27315890)
> This is the continued dilution of security with audit/compliance. It's a mindless, check the box mentality.

If I can play devil's advocate for a moment—isn't this just how insurance necessarily works? Your car insurance company isn't going to interview your teenage son; they don't care that he's a particularly mindful individual, who never speeds because he remembers the time a close friend died in a car crash. "The policy says 17-year-olds are high risk, pay us a zillion bucks a month."

Of course, guidelines that have literally zero value still have zero value. But they have to come up with something concrete...

Re:Safari tries to fill username by Vrondi on Friday May 28, 2021 @11:19AM (#27316430)
Bad example. They aren't going to interview your son, but _most_ will take his high GPA and certificate of completion of Driver's Education class, and give you a discount for it, which is the next best thing without spending the time to interview him.
Re:Safari tries to fill username by Wowfunhappy on Friday May 28, 2021 @11:22AM (#27316461)
But isn't that driver's education class certificate basically a “checkbox”? I don’t think it’s so different from those IT certifications.
Re:Safari tries to fill username by fuzzer37 on Friday May 28, 2021 @02:17PM (#27318721)
I think the difference is that taking a drivers education class, and (in my experience, at least) is that there is actual hands on driving experience. I think an IT certificate or security audit is a lot more abstract.

The only way to check the "Has taken a driving class and has at least 20 hours behind the wheel" is to do just that. How many different ways could you check the "Secure password requirements are enforced by users" box? How many ways could you check the "physical security to encrypted systems" box?

Re:Safari tries to fill username by Wowfunhappy on Friday May 28, 2021 @09:41PM (#27322431)
Totally—but I think that's actually what leads to the dumbest requirements people are complaining about. "Don't allow autofill." "Don't allow pasting passwords." "All passwords must contain at least five special characters and your first born son." Those are boxes that can only be checked one way.

I'm not quite sure where I'm going with this. Something about, maybe things are broken because they don't fit in the insurance company model, and someone needs to solve for that before anything gets better.