# Our "security" is so good, nothing fucking works anymore **URL:** \ **Category:** The BBQ Pit\ **Created:** [November 13, 2019, 4:17pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368 "2019-11-13T16:17:27Z")\ **Posts on this page:** 14\ **Page:** 4
**Author:** ![squidfood](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@squidfood](https://boards.straightdope.com/u/squidfood)\ **Post date:** [November 21, 2019, 9:26pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/61 "2019-11-21T21:26:13Z")
> [@Slash1972](#): > > When was this? 8-10 years ago - a couple years back the agency actually listed to scientists greenlighted/contracted some cloud services (shocker I know) ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [November 21, 2019, 9:39pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/62 "2019-11-21T21:39:24Z")
> [@squidfood](#): > > 8-10 years ago - a couple years back the agency actually listed to scientists greenlighted/contracted some cloud services (shocker I know) That’s good. Because now, I can think of several Federally mandated policies and security controls that make running a rogue cable between buildings a very bad idea 🙂 As an aside, the good security folks should work with the people involved to determine a safe and secure method to do what they want to do. The bad ones just say “Nope!” I hate the bad ones too. US Army, I’m looking at you! ---
**Author:** ![Llama\_Llogophile](https://avatars.discourse-cdn.com/v4/letter/l/49beb7/32.png) [@Llama\_Llogophile](https://boards.straightdope.com/u/Llama_Llogophile)\ **Post date:** [November 21, 2019, 9:46pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/63 "2019-11-21T21:46:17Z")
> [@Slash1972](#): > > Seems to me to only inconvenience those who forget their username, and don’t know the policy on who to call to get it. Clear instructions on what to do to get your username should be on the web site. If they are not, that’s not security’s fault. > > Those two people wasted your time because they didn’t know the policy. Again, not security’s fault. So it’s everyone’s fault except the people who do security. Got it. My best friend (now deceased) was a computer security expert, a specialist in cryptography. He used to complain about “users” too. He and I had an ongoing argument about users vs. systems, and my point was that if the system continually induces the same kinds of problems for multiple people, then there’s something wrong with the system. ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [November 21, 2019, 9:50pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/64 "2019-11-21T21:50:46Z")
> [@Llama\_Llogophile](#): > > So it’s everyone’s fault except the people who do security. Got it Yeah. There’s a policy that everyone is supposed to follow but nobody knew it. How’s that security’s fault? > [@](#): > > My best friend (now deceased) was a computer security expert, a specialist in cryptography. He used to complain about “users” too. He and I had an ongoing argument about users vs. systems, and my point was that if the system continually induces the same kinds of problems for multiple people, then there’s something wrong with the system. Of course I agree that if a system is hampering a significant amount of people, then yes, it needs to be looked at. But every user thinks they are “significant” 🙂 ---
**Author:** ![squidfood](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@squidfood](https://boards.straightdope.com/u/squidfood)\ **Post date:** [November 21, 2019, 9:53pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/65 "2019-11-21T21:53:23Z")
> [@Slash1972](#): > > That’s good. Because now, I can think of several Federally mandated policies and security controls that make running a rogue cable between buildings a very bad idea 🙂 > > As an aside, the good security folks should work with the people involved to determine a safe and secure method to do what they want to do. I sure as hell wouldn’t have done it without that CYA email from headquarters, that’s for damn sure! I thought at the time “are you suuure it doesn’t violate something” but it was their call. (also, there were existing telephony conduits so it wasn’t like we were stringing cables in trees). They (DC IT) actually worked on earnestly to try to get the “through HQ” routing working and we were never sure where in the chain it was timing out. I got the impression that someone above them was preventing them from setting up a direct pipe and there were HQ politics involved - the cable solution may have been a bit of malicious compliance towards their own bosses. ---
**Author:** ![Dr.Strangelove](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dr.strangelove/32/6613_2.png) [@Dr.Strangelove](https://boards.straightdope.com/u/Dr.Strangelove)\ **Post date:** [November 21, 2019, 10:29pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/66 "2019-11-21T22:29:15Z")
> [@Llama\_Llogophile](#): > > I seriously doubt that, again because this a very esoteric undertaking with not very much at stake. You might be surprised. Automated hacking systems are _always_ running; scanning the internet for exposed services and exploiting bad passwords, known backdoors, etc. I have a web server that’s run a few no-stakes services over the years: a webforum that was never used, a WordPress blog site, a simple photo album. _All_ of them were hacked. They were filled with spam, probably the password DBs harvested, and the scripts were changed to themselves send out spam. Fortunately, these sites were never very important, so it was no loss just to delete them and move on. The automated systems that hack them don’t care about that, though. If your work services have any public-facing aspect at all, then there will be hack attempts. That’s not to say that IT is doing the right thing here, but assuming that you’ll never be hacked because you’re unimportant is false. ---
**Author:** ![squidfood](https://avatars.discourse-cdn.com/v4/letter/s/a87d85/32.png) [@squidfood](https://boards.straightdope.com/u/squidfood)\ **Post date:** [November 21, 2019, 10:30pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/67 "2019-11-21T22:30:27Z")
> [@gotpasswords](#): > > Sounds like there may have been an old mainframe in there somewhere. Until just a couple of years ago, our mainframes running CA Top Secret would cheerfully ignore the ninth and any further characters typed into the password field at login. You couldn’t create a password longer than eight characters, but if your password was **password** you could enter **passwordsarethetoolofthedevilandadda#anda7forthehellofit** and you’d get in. That’s been fixed and users can use anything from 6 to 128 characters. There was one app I used where it sent username and password as a combined (hopefully encrypted but I dunno) string to the server like this: username@domain/password. When you set the password, you were allowed to use the @ in the password (and of course you were encouraged to include at least one special character). Unfortunately when the system then parsed the combined string, the @ would read as the domain separator and you could never log on. ---
**Author:** ![Nava](https://avatars.discourse-cdn.com/v4/letter/n/da6949/32.png) [@Nava](https://boards.straightdope.com/u/Nava)\ **Post date:** [November 22, 2019, 3:58am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/68 "2019-11-22T03:58:35Z")
> [@Slash1972](#): > > Seems to me to only inconvenience those who forget their username, and don’t know the policy on who to call to get it. Clear instructions on what to do to get your username should be on the web site. If they are not, that’s not security’s fault. That would depend on whether security has actually made the instructions available. From what he’s saying, security hasn’t even made them available for security personnel. ---
**Author:** ![ENugent](https://avatars.discourse-cdn.com/v4/letter/e/4af34b/32.png) [@ENugent](https://boards.straightdope.com/u/ENugent)\ **Post date:** [November 22, 2019, 5:41am UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/69 "2019-11-22T05:41:52Z")
> [@Colibri](#): > > However, I had registered under my name without my middle initial, while I had obtained my NATO number using my middle initial. Although I tried repeatedly to reconcile the registrations, and called the help center, it proved utterly impossible to renew my registration. Fortunately I haven’t had any new government contracts. In the event I do, I’m sure I’ll be better off starting all over rather than trying to renew my former one. I have been having the same problem when we changed our health insurance. My beloved husband didn’t put any middle initials (or his own Jr.) on the form, and now it is impossible for me to log in to the new insurance site unless I nuke all of the old information first. Since a bunch of medical providers are still billing the wrong insurance, I’m not willing to do that until we have it all straightened out. It is driving me batshit. ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [November 22, 2019, 1:07pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/70 "2019-11-22T13:07:31Z")
> [@Nava](#): > > That would depend on whether security has actually made the instructions available. From what he’s saying, security hasn’t even made them available for security personnel. Sorry, but the help desk is not “security personnel”. And they DID have them, or else they wouldn’t have been able to relate the instructions on who to call. People blaming “security” for lack of operational policies, training, or inconsistent help desk direction is a pet peeve of mine. ---
**Author:** ![Miller](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/miller/32/481_2.png) [@Miller](https://boards.straightdope.com/u/Miller)\ **Post date:** [November 22, 2019, 3:51pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/71 "2019-11-22T15:51:08Z")
> [@Slash1972](#): > > Yeah. There’s a policy that everyone is supposed to follow but nobody knew it. How’s that security’s fault? Isn’t it security’s job to disseminate security practices? ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [November 22, 2019, 4:01pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/72 "2019-11-22T16:01:19Z")
> [@Miller](#): > > Isn’t it security’s job to disseminate security practices? Who to call to get your username is not a “security practice”. Similarly, who to call to get your password reset is not a “security practice”. How to verify a caller is the user they say they are IS a “security practice” ---
**Author:** ![Atamasama](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/atamasama/32/12961_2.png) [@Atamasama](https://boards.straightdope.com/u/Atamasama)\ **Post date:** [November 22, 2019, 4:36pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/73 "2019-11-22T16:36:03Z")
> [@Slash1972](#): > > Who to call to get your username is not a “security practice”. > > Similarly, who to call to get your password reset is not a “security practice”. > > How to verify a caller is the user they say they are IS a “security practice” So it’s not the job of security to determine who has permission to access sensitive information like a person’s username or who can reset a password? Your definition of “security” is a bit fucked up. ---
**Author:** ![Slash1972](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/slash1972/32/6461_2.png) [@Slash1972](https://boards.straightdope.com/u/Slash1972)\ **Post date:** [November 22, 2019, 4:46pm UTC](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368/74 "2019-11-22T16:46:57Z")
> [@Atamasama](#): > > So it’s not the job of security to determine who has permission to access sensitive information like a person’s username or who can reset a password? > > Your definition of “security” is a bit fucked up. Depends on what you mean by “determine who has permission” Let’s say I am the CIO of a business. I determine that the help desk, and ONLY the help desk can reset passwords. I send out a memo to this effect including the number of the help desk. Neither of those is a “security practice” “Security” does a review of permissions and determines the exact permissions people at the help desk need in order to reset passwords. This is a “security practice”. Operations changes the permissions of anyone working at the help desk so they can do their job. Now, if you call the wrong number? Not a security issue. The help desk person doesn’t know how to change the password? Not a security issue. The help desk person doesn’t have the right permissions? Not a security issue. If the help desk person doesn’t know he/she is supposed to be resetting passwords? Not a security issue. Does that help? [Previous page](https://boards.straightdope.com/t/our-security-is-so-good-nothing-fucking-works-anymore/843368.md?page=3)