Discussion
I was telling the CS club about the situation with PHP and they were fascinated.
"does that mean our server could be hacked?"
"Yes, however since it's on the school intranet it'd need to be someone using the school wifi doing it. We aren't at risk from the greater wide internet."
So we are having a kind of informal hacking contest now. Change the website without using the password.
To celebrate we'll update the software.
(The student run webserver isn't just hackable due to PHP.)
I'm a little worried they are learning security by obscurity works.
Or security by not really being connected to everything works, but that second lesson isn't as bad.
Anyway. I need to find my white hat.
@futurebird - To back you up and add encouragement, I always teach folks that:
- *Relying on* security by obscurity is bad, but...
- Obscuring things can increase the "attacker's budget" and therefore help to lower risk.
(It's a similar discussion to the difference between "cover" and "concealment" in the military now that I think of it. Anyhow.)
And your second point of not being connected to everything absolutely lowers the attack surface thus lowering risk as well.
You've lead them to wonderful opportunities to discuss nuance in security and it's further wonderful that you are having these discussions with the students in the CS group!
That's awesome and so needed right now! Thank you!
@futurebird I always find myself thinking about banana plants when people get sulky about security by obscurity.
@futurebird lol that is how all of it works. the math which holds all of they keys has no proofs.
Install Fedizen
Get the full app experience
@futurebird A long time ago, I was a TA on a university CS class where one task had the students write a client for a simple chat server that we'd written rather quickly. Rather than fix the security issues, we awarded bonus points for finding and exploiting them.