• 0 Posts
  • 137 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle
  • This is fundamentally true. However it is possible to limit the bandwidth of data the employee can exfiltrate.

    Assuming a privileged employee suddenly becomes a bad actor. Private-keys/certs are compromised, any kind of shared password/login is compromised.

    In my case I have a legit access to my company’s web-certs as well as service account ssh-key’s, etc. If I were determined to undermine my company, I could absolutely get access to our HSM-stored software signing keys too. Or more accurately I’d be able to use that key to compile and sign an arbitrary binary at least once.

    But I couldn’t for example download our entire customer database, I could get a specific record, I could maybe social engineer access to all the records of a specific customer, but there is no way I’d be able to extract all of our customers via an analog loophole or any standard way. The data set is too big.

    I also wouldn’t be able to download our companies software source code in it’s entirety. Obviously I could intelligently pick a few key modules etc, but the whole thing would be impossible.

    And this is what you are trying to limit. If you trust your employees (some you have to), you can’t stop them from copying the keys to the kingdom, but you can limit the damage that they can do, and also ensure they can’t copy ALL the crown jewels.











  • Indeed, and currently there exist several cities that execute that ideal more-or-less. NYC is the obvious one, but Washington DC, Chicago, hell even the worst city in America, San Francisco does it adequately. The only reason we can’t have that kind of public transit everywhere is because no one is forcing city officials to plan for the long-term, and reduce sprawl.

    Zero Growth Lines are a great way to mandate density, without any other policies needed.







  • I wouldn’t ban cameras, but I would require the visibility be obtained without them. Cameras can give vision that is useful and implausible without them.

    Yea this is probably the better play. But too often with modern cars they use the existence of the camera’s to make the sight lines impossibly dangerous (the infamous front facing camera on the f150 for example).



  • Turn off broadcast of the SSID

    Don’t do this. It provides zero security, and just reduces usability. Now you should call your SSID something non-identifiable. So instead of “$YourName Wifi” call it “pleasure chest” or something. Additionally do not set a ridiculous 64 character + special characters password, because again you are providing next to zero additional security, while hugely reducing usability.

    Use a simple password scheme of 3-5 unrelated common words like from here: https://www.correcthorsebatterystaple.net/index.html for your wifi password.