FRESH

Hacker News

Home

Study: 'Security Fatigue' May Weaken Digital Defenses

91 points by giuliomagnifico

by compiler-guy

5 subcomments

I have seen this phenomenon especially at a couple of FAANGs over the past couple of years. Things are getting locked down so much, and so many special permissions are required that now people ask for permissions to systems or procedures preemptively. Because by the time they know if they will need it or not, it's too late.
And no one in the security business seems to consider the overall burden of yet another step. Each of which is simple in by itself, but cumulatively they are a giant hassle, and so people look for workarounds.

by dijit

3 subcomments

thats part of why NIST updated their password rotation recommendations from 90 days to indefinite: people pay lip service to security if it is too inconvenient. you have to try to meet people where they are.
Preaching is not a strong motivator for long.

by donatj

3 subcomments

The level of lockdown in current years is wild. With our 2FA requirements and SSO, signing into GitHub every morning takes me something like eight clicks and a solid minute. Everything has gotten so locked down in recent years, people are working so hard to protect what are largely basic CRUD apps

by onetimeusename

1 subcomments

I think security became part of compliance so security recommendations got detached from actual security. It seems like a lot of security recommendations are just busy work that justifies having a huge compliance industry. So an example of this might be security scanners for code where the output is not even useful. But using the tool, which searches for irrelevant findings, is required for compliance even if it basically does nothing for security.

by temporallobe

0 subcomment

Every time I see the term “SSO” I want to vomit. That does not exist any more. On my projects, there are literally dozens of systems each with their own siloed authentication systems. Just to throw out some of what I deal with: OKTA, MFA, MS 365, AWS, PIV/CACI, YubiKey, proprietary user name/passwords, IAM, OAuth, federated identity services, RSA, just off the top of my head. My single biggest fear is losing some or all of my credentials in sone catastrophe, so I keep my credentials in multiple places, including on my own phone and everyone else I know does the same thing. I have tried using password managers but one time my password database got corrupted and I lost everything, so now I just use plain text files - all of which is behind locked systems anyway (including my own phone). It’s maddening.

by charlieboardman

0 subcomment

My Steam password is one short weird phrase that I can remember. I haven't changed it since high school, ~15 years ago. Never had any security issues.
The modern landscape is frustrating because that setup actually works. Passwords, from a technical perspective, are actually great and are are bulletproof as long as they don't leak. No 2FA required. The entire issue is data leaks and phishing.

by randusername

0 subcomment

This is a much bigger problem than just security.
Incidents are inevitable at scale, but risk management at scale is an append-only operation that eventually becomes so complex and suffocating the only recourse is noncompliance.
Even going to the doctor I find myself pleading with the staff to just let me see my PCP instead of going through the full process. It takes 30 minutes now to get through the opening interrogation about overseas travel, human trafficking, vaccine awareness, anxiety and depression panels, domestic violence questions, multi-part questions about recent falls, and everything else that they keep tacking on. Usually in triplicate, waiting room forms, questions from the nurse, questions from the doctor.
And I know behind each of these individual decisions there is a horror story or someone proactively trying to prevent one, but altogether they create their own.

0 subcomment

by kstenerud

0 subcomment

And now we're at the threshold of the next level of security fatigue: permission fatigue.
It's shocking how little people are paying attention to this upcoming security nightmare. It wouldn't take much for a bad actor to poison an AI session to wait for you to start selecting yes, yes, yes and then slip in something bad.

by gz5

0 subcomment

Absolutely. Easier said than done, but the best security is structural security - as near to invisible for end users as possible. This needs to be the goal, imo, even if not fully achievable.

by ctxc

1 subcomments

Fairly obvious? Or isn't it that way for everyone?

by languagehacker

0 subcomment

Nice to see SUNY Albany on here!

by kotaKat

0 subcomment

At some point I need to ask Corporate IT for my justification logs for every elevation request. I'm certainly sure I've submitted at least a couple hundred "because I said so"s and at least three Bee Movie scripts.

by scuff3d

1 subcomments

Was talking with someone about this yesterday. From cold start, for me to get to the VM I do my actual work on I have to
1. Enter a password to decrypt the computer
2. Enter a username and password to log into my account
3. Enter another set of credentials to access the corporate VPN
4. Enter another username and password to access the network the VM is on
5. Enter another username and password to get to the actual machine
6. And then navigate a nest of authorization for docker/git/etc to actually do anything useful

by nathan_compton

1 subcomments

The number of times I have to "single sign on" is truly maddening.

by lloydatkinson

1 subcomments

Who could have guess bombarding users with 2FA, 3FA, MFA requests to their phone 20 times a day would cause fatigue!
Some personal highlights spread across multiple jobs:
- IT decided they'd make some awful SharePoint page the browser homepage for Chrome via group policy. That page required you to login to your Microsoft account. If it was a Monday morning you'd have to authenticate via SMS just to see your homepage, or, what I did usually was ignore it. Every time I opened a new browser tab I'd get a new SMS. This went on for weeks at a time, maybe 50 SMS per day, out of spite. Eventually they disabled that crap. Anyone that deals with Microsoft logins knows that "Remember me" is almost totally a fake option that does nothing on purpose. [1]
- VPN that requires logging into your Microsoft account, which then sends you a notification to Microsoft Authenticator app, which requires a face scan, followed by typing in a code, followed by another face scan. At no point in the design process of that did someone think typing the code was redundant.
- Despite being a software engineer, able to produce executable binaries at will, which all seem to be trusted by our security software, I still need to talk to IT maybe 5 times a month to get <very popular well known widespread development tool> approved by the security software.
- Bonus points for the previous one, I often need to manually provide the exact DLL's used by the above. Every update means new file hashes, meaning repeating it all over again.
- Local admin rights to my work machine and yet for whatever reason IT make us type a password to open Windows Task Manager.
- Telling us all they have bought Copilot licenses we should use, only for IT to ring you almost immediately after using it because their corpo-garbage firewall starts throwing a fit about Copilot's requests to github.com, despite us already using GitHub.
[1]: https://www.bbc.com/future/article/20150415-the-buttons-that...

by general_reveal

0 subcomment

Just get off as many of these platform as you can. That’s about the only security that you’ll ever get. If you are still in the Matrix, listen the weirdos on here that take “don’t trust anything” seriously to the point of absurdity.
The Matrix was not fiction. Our modern internet is a system. You have to figure out how to live truly free from it, because it absolutely owns you.
__
Revelation 13:16–17
“And he causeth all, both small and great, rich and poor, free and bond, to receive a mark in their right hand, or in their foreheads: And that no man might buy or sell, save he that had the mark…”