It's incentivized top-to-bottom. Every audit is structured around checking boxes, absolutely zero interest in actual security. Just state you have processes, that they meet the loosely written (or in some cases bizarrely specific) spec, and be able to provide some writing that explain them at least at a surface level.

This is the case for just about every framework, and even though these systems are just for window dressing, the auditors are mostly incompetent. A review a few years ago showed that 20-50% (depending on which of the Big 4 you've decided to hire) of audits were done incorrectly.

I recently quit my job in Information Security. We used the NIST 800-53 framework. 99% of people following security frameworks just blindly check in boxes during audits or control assessments. A security control/requirement can’t be met? No problem! Just create another piece of paperwork accepting the risk and get it signed off by the system owner (who has the most incentive to not inconvenience their project or department due to an outstanding security requirement).

The things I saw that were labeled as “acceptable risk” would drive me crazy. Maybe the government hires incompetent security practitioners? Do all organizations have this type of behavior behind the scenes?

The entire system is about abstracting away liability, not keeping things secure. Every framework is like this. The fact that companies are paying auditors to review their own work creates a completely upside down incentive model, and turns it into effectively a rubber stamp. You have to do things horrifically wrong for an auditor to care, and it's not like they're actually going to fail you, they'll just tell you to fix it and give you a generous deadline (or, for frameworks that allow it, do what you described and have it signed off as a known risk).

The flipside: I've recently been working with a company that was audited and called out for allowing too many security policy exceptions.

As a result, unless you can satisfy every one of their requirements, regardless of mitigating controls, you cannot get installed. Even if you're a security product whose ultimate use case is discovering in-progress exploits.

I'm not sure if that's an example of the system working or being broken. But overall, Information Security is a complicated problem.

I was working for one of the Big 4 in risk assessment and this is 100% how it works.

They want us to be compliant, not secure:

https://www.go350.com/posts/they-want-us-to-be-compliant-not...

It's absolutely bonkers what stupid crap some companies would call "security", and what lengths they'd go to enforce it.

- Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one.

- A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser. This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more.

- Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password.

- Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance.

> - Security questions. Yeah, right, please give us what amounts to a password, but that other people likely know, and that we'll probably store in plaintext. You'll use this much weaker backup password if you forget your real one.

A good password manager, such as KeePass, will generate a passphrase. That is, words. Use that instead. Even if they ask "what is your mother's maiden name" just make up a passphrase.

> - A time component. Any kind of it. Sessions should not have an expiration time, period. Not unless I specifically checked a box that I want a session that expires. I never, ever want to be greeted with a login form when I follow some link when I've already logged into this thing a hundred times in this browser.

Yes, but;

> This may have made sense 15 years ago when people shared computers, but people aren't sharing computers any more.

This is false. I know many people who share computers. I treat all my computers as shared even though they are not; it's safer that way.

> - Related: required password changes once a certain time period. Bonus points if I can't reuse any password I had in the past. You want me to forget my password? Because this is how you make me forget my password.

I agree that password changes after a certain time period is stupid. However, a password manager solves the problem of forgetting your password.

> - Doing anything with IP addresses besides packet routing. Yes, my ISP uses a single IP address for at least several tens of subscribers. No, it's not my fault and I should not be punished for this. And no, if I went to other country, this doesn't mean I'm dangerous to the security my own accounts, ffs. You shouldn't care. You were provided with correct credentials, and you thus must log me in with no hindrance.

100% this

> A good password manager

> a password manager solves the problem

Sorry but as a software developer myself, I can't trust a piece of software to store all my passwords and thus be a single point of failure for my entire digital life.

> This is false. I know many people who share computers.

With a single OS user account? Even android tablets these days come with multi-user support.

> I treat all my computers as shared even though they are not; it's safer that way.

Do you not have a password, and preferably full-disk encryption, on them?

Ideally Bitwarden, Keepass or what have you should be printed on a piece of paper and put in a safe.

If anyone gets access to my weapon safe I got bigger problems to think about (no, not the weapon(s) but whatever has caused the situation.)

As a software engineer you should know that you could use multiple redundant open source password managers with your password database backed up multiple times and remove your current single point of failure (your memory).

> You want me to forget my password? Because this is how you make me forget my password.

   MySuperSecrit001
   MySuperSecrit002
   MySuperSecrit003

...

Amazon's security is completely bonkers.

I lost access to my old account and they just decided that I will never change my password there.

To unblock I must provide them with proof of identity.... that includes: - notary certified copy of my passport, in English... (I'm not from an English speaking country) - proof of residence in Ireland, where I wasn't even resident, but I did receive a few packages

or.... I could just call my old phone number and ask the person to just forward me a text that they send to that phone number.

I mean... How over the top are the requirements, while someone with a damn leaked password database and access to my old phone number will be able to just "sail through"...

My AWS/Amazon accounts don't even have any activity or data in them...

The amount of trust that providers put in phone numbers is absolutely insane.

That aspect is significantly worsened if your country has had proper electronic IDs for nearly two decades. I laugh my ass off but also shed a tear each and every time some foreign provider asks for "identification". Security questions, electrical bills and selfies, medieval garbage. But I guess I should be happy fax usage has dwindled somewhat.

Fax usage has not dwindled at all for hospital medical records; it's still the primary way of transferring records from one hospital to another if they don't have the same computer software running the hospital. It's ridiculous.

Is this a niche waiting to be exploited?

Yes. The public good derived from sane EHR interoperability would be enormous. Lower costs, better treatments, more informed policies...

But there are lots of political barriers. NHS is trying, and pretty open to private tenders. I'm actually working on a very related field.

Smaller or more atomized healthcare systems than NHS would be probably even difficult to deal with initially.

I'm pretty sure in the US the barriers are also commercial, ie, Epic (a huge hospital software company) is not going to make it easy to do digital transfers of their patient data to non-Epic computer systems. Only the small-fry software companies will want this.

What needs to happens is for the US federal government to issue a mandate: if a hospital wants to get federal dollars (Medicare, etc), its computer system has to comply with the FXHR rules (Federal eXchange for Health Records, or whatever they want to call it). To establish FXHR, they get the top 5 vendors in a room and tell them that they WILL come up with a data exchange protocol and format within x months. They did this with HIPPA, they can do it with data exchange too.

And it is sorely needed. I went to Mayo Clinic for a week, which generated 80 pages of medical reports. To get these transferred to my regular doctors, I had to call Mayo, request the transfer, and they had to schedule the transfer, which sometimes took up to a week. This isn't because they are inefficient (far from it). It's because when they do a fax, sometimes the fax machine isn't on, so it can't go through. They have to retry until they get through. The receiving machine ran out of paper. Etc. It's ridiculous.

Beyond that, I watched my eye doctor try to flip through 80 pages of crap that mostly didn't relate to him to find the pages that were eye related. None of this has any structure; it's just a bunch of pages of text. Horribly inefficient use of his time, and very likely he would miss something important. You want to see blood test results? Well, I had about 10 of them testing various things, and the lab results are spread all through the report. Good luck finding what you want. Truly a mess, and the large software companies have zero incentive to fix this problem. Their goal is to be "the one to rule them all", or at least one of the few. And when there are only a few, there still won't be any data exchange, because they will be duking it out with each other.

Government screws stuff up all the time, but so do private companies, and government is the only player in a position to force the private companies to do the right thing.

The trouble with this issue for the NHS is that UK governments have tried to give away access to the most sensitive of records on a national scale so many times now and then rowed back in the face of predictable criticisms that the public would have to be collectively insane to allow broad access to medical records through any centralised system any time soon.

It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways. But we have no constitutional way to establish adequate legally binding safeguards that some later government can't just overturn for its own convenience in the future.

> ...insane to allow broad access to medical records through any centralised system any time soon.

> It is unfortunate because obviously in principle a single centrally-administered records facility with robust security and audit trails for all access and a Hippocratic Oath level of privacy protections would be far better than the status quo in many ways.

Funny, one would have thought that pretty much is the status quo already: Looks to me like the UK already has (or should have) a single centrally-administered records facility with robust security and audit trails -- isn't that the NHS?

If it doesn't at the moment quite fulfill your requirements, it certainly ought to anyway, oughtn't it? So the problem is one of fixing its possible current deficiencies, not one of lacking it entirely. Or?

The NHS isn't really a single body at all. It's a vast, unimaginably complicated network of healthcare professionals, medical facilities, managerial organisations, supply chains, and so on, under the shared banner of being public-run and with strategic leadership appointed by the central government (modulo some devolution to different parts of the UK at various scales).

In normal circumstances an individual's primary point of contact with the NHS is supposed to be their GP, and the GP's surgery will normally hold the main medical records for each person under their care. But then other parts of the NHS, such as hospitals or therapists, may hold their own records in connection with the specialised treatments they provide. There are all kinds of protocols for sharing health records between clinical professionals who are directly responsible for a patient's care and potentially others and successive governments keep meddling with them in ways that make you nervous about those others and what they get to know and what they can do with it.

Ah, thanks!

I kind of assumed there was some public administrative service run by the national government behind it all. That would have been the logical entity to run a central storage repository, and perhaps to administer and maybe even define the storage and transmission format(s). IMO.

LOL!

I just had an email from Mouser(online electronics store), that gave me the option to send in export for by fax...

I agree. I change my phone number often and this is annoying.

It's also very annoying that most EU banks rely on SMS codes to confirm transactions as it's quite easy to clone SIM cards. Yet they don't support real OATH OTP.

I hate Office 365, but I have to concede that their login is much more robust. I use passwords + OATH and it's truly reliable.

Gmail has locked me out very often for no clear reason. Besides they don't support TOTP unless you use a key or a phone app. So I can't use an airgapped device to store my keys.

Not my experience in the germanic portions of Europe. Every bank i’ve been involved with in the last 20 years has had otps of one kind or another.

That's interesting. What 2FA system do they use exactly?

AFAIK, N26 still uses on-time codes sent by SMS which I regard as very insecure.

It had completely depended on the bank. In the Netherlands, 20 years ago it was a hardware OTP device. Same with a big Swiss bank ten years ago. Up until a few years ago with a big german bank it was a physical sheet of OTPs. Now it’s a mobile app that either recognizes a challenge image, or receives a challenge by network.

N26 has always used their proprietary app confirmation. I never (in over 5 years) got an SMS instead from them. But that’s in Germany, maybe it differs between countries?

Or maybe do they really want your phone number? (Uninformed guess but isn't it valuable data?)

I was thinking that, when I tried to enable 2FA on Twitch. Allegedly, they support TOTP. But only after verifying your phone number. And they even check that it’s a mobile number (I tried using a VoIP number that can receive SMS).

My phone number is probably the least valuable thing Amazon knows about me, I figure.

Phone numbers are basically super cookie identifiers unless you make a new phone number for each account and use different aliases & maybe addresses for them too. They all sell into centralized information systems and create profiles about you that are very detailed, which includes banking, income and credit info. So yes, the phone number is incredibly valuable, especially a place like amazon that shows different prices to different users and who's recommendation engine drives a lot of sales.

Phone 2 factor is pretty much the only kind of 2 factor most people will accept, and for most people the phone number probably has better security than most people's emails, because most people reuse passwords, while with phones you had to do a special non-password effort for them.

I’ve always figured this was what they wanted. They probably tie it to your IMEI so they can track you everywhere online and in the real world.

E: Seriously? This is a multi billion dollar industry. Oh no, Google would never do that…

Yeah I have a pool of virtual numbers and use them for any of this bull, and rotate them in/out. No business needs to know my phone number.

Wechat does this to me just to use the app. They keep making me play stupid recaptcha games and do verification codes then ultimately block me anyway. I finally gave up on using it.

To be fair its not just Google and amazon etc. I had a similar issue with my bank, they blocked a transaction in online banking which had pre requisites of logging in (three secrets effectively) plus sms verification, and specific sms verification for this transaction. unblocking it required only control of my phone number and knowing my date of birth and other easy to get info. If it had been a fraudulent transaction then the bad actor already had my sim card and ability to log into my account.

Serious question: is there any examples of a robust way of doing customer security? Even just a proposal/document or blog post (doesn't need to have been implemented). I sort of feel no one has figured this out yet (if its even possible).

Companies just need to make sure their insurers will pay out, which if there is not proven solution seems about all they can do.. tho a little humility and honesty that that is their position would go a long way.

U2f key ? Works for me.

Are there best practice process diagrams to support the correct usage of these with b2c services?

how should the initial verifiacation happen? what happens when i loose/corrupt/break the device? should this represent me as a human or the keys to an account? - should a human hold the permissions ultimately (if so how to i override a key?)

I always wonder, are there banks using U2F/Fido(2)/Webauthn or whatever it’s called now? I’m reasonably certain not in Germany, but is there one in another country?

2FA is going to be exposed badly by some basic social engineering one day. When I worked in a hospital, 99% of the people dealing with HIPAA protected patient data were doing so on a desktop that sits in an unlocked office or in an open reception area with the duo two factor authentication set to call the landline right next to the desktop.

HIPAA is always going to be a joke. Walk around the hospital's parking lot and drop a bunch of malicious USB drives with the logo of the hospital on them. Someone is bound to pick one up and stick it in a machine on the network.