Abuse Prevention Is Tradecraft. Content Moderation Is Not Infosec

Re:Abuse Prevention Is Tradecraft. Content Moderation Is Not... by aidenn0 on Tuesday October 18, 2022 @12:02PM (#33249485)

Except the examples given of IA are so broad as to eliminate the distinction between IA and STO. Knowing a value that is in a space larger than 2^64 possibilities is qualitatively different than knowning something in a space of only millions of possibilities. The real difference with como is that it's a cat-and-mouse game (or Red Queens race as another commenter said).

It's more like being able to teleport all the keys in all the houses from under the doormat to under a rock in the garden once you notice thieves are checking the doormat. This would, in fact, appreciably increase house security on average, while still being STO.

[ Parent | on HN ]

Re:Abuse Prevention Is Tradecraft. Content Moderation Is Not... by aidenn0 on Tuesday October 18, 2022 @02:21PM (#33251714)

Upon further reflection, the question is "how hard is it to find the needle in the haystack"

If you use a 128 bit key, but use a non-time-constant compare somewhere, then it's pretty darn easy to find the needle.

This is why the JPEG fingerprinting example from TFA doesn't qualify to be in the same category as a properly secured cryptographic key. They can notice that non-picture posts are not blocked, but picture posts are, which already greatly narrows it down. They could post a picture generated from the actual client, and see it go through, and narrow it down even more. That's not even that hard of a one for an attacker to figure out. It's much closer to "key under doormat" than "random key"

[ Parent | on HN ]

Re:Abuse Prevention Is Tradecraft. Content Moderation Is Not... by alecmuffett on Wednesday October 19, 2022 @07:38AM (#33260658)

I kinda agree (and I wrote the cited article) but as soon as you pick a number (2^40? 2^64? 2^80? 2^128?) you are painting a huge target on your forehead, when it's better to teach people that the point is the asymmetries (plural) and how you use, combine and compose them.

[ Parent | on HN ]

Re:Abuse Prevention Is Tradecraft. Content Moderation Is Not... by brudgers on Wednesday October 19, 2022 @06:07PM (#33268470)

The degree of nuance in the parent comment is why I find informational asymmetry a useful way of understanding my frequent uneasy intuitions in discussions of security.

What I mean is informational asymmetry frames security within engineering practice, though perhaps at a price of winning the internet.

YMMV.

[ Parent | on HN ]