• 0 Posts
  • 60 Comments
Joined 4 months ago
cake
Cake day: June 23rd, 2024

help-circle








  • Laser@feddit.orgtoLefty Memes@lemmy.dbzer0.comIt's all in the name
    link
    fedilink
    English
    arrow-up
    66
    arrow-down
    7
    ·
    6 days ago

    A secret police is something different from officers without uniforms. A secret police is an instrument of the ruling party to oppress opposition and are part of a “justice” system outside of the official one, e.g. secret police can arrest you on whatever charges (don’t have to be revealed) and you’ll be put into a secret prison where your relatives can’t find you. The fact that they don’t wear uniforms goes beyond why regular police goes it: it’s to create an atmosphere of fear that everyone around you could be secret police, and that they can just arrest you, and there’s nothing you can do.








  • I worked in software certification under Common Criteria, and while I do know that it creates a lot of work, there were cases where security has been improved measurably - in the hardware department, it even happened that a developer / manufacturer had a breach that affected almost the whole company really badly (design files etc stolen by a probably state sponsored attacker), but not the CC certified part because the attackers used a vector of attack that was caught there and rectified.

    It seemingly was not fixed everywhere for whatever reason… but it’s not that CC certification is just some academic exercise that gives you nothing but a lot of work.

    Is it the right approach for every product? Probably not because of the huge overhead power certified version. But for important pillars of a security model, it makes sense in my opinion.

    Though it needs to be said that the scheme under which I certified is very thorough and strict, so YMMV.




  • Salt the hash with something unique to that specific user so identical passwords have different hashes

    Isn’t that… the very definition of a Salt? A user-specific known string? Though my understanding is that the salt gets appended to the user-provided password, hashed and then checked against the record, so I wouldn’t say that the hash is salted, but rather the password.

    Also using a pepper is good practice in addition to a salt, though the latter is more important.