I’m not sure the exact numbers, but browser providers these days are providing the very useful, ability to share your browser-stored IDs and passwords between browser instances. Do you have them on your phone, desktop, pad, and laptop computers? Fantastic..
Except for one thing
If I should gain access to the storage area they use to synchronize them I gain access to not only all of yours but all of everyone’s associated with the browser.
But encryption, multi-factor, and …
I’ve heard it all before. Just don’t believe it. It’s ridiculous to imagine that with the volume of capabilities and monies available by breaking into these mechanisms, there can conceivably be enough protection to make them safe. Just consider these little things:
I could come up with more, but I will leave that up to your LLM to give you lists.
So what’s the problem?
It’s all about risk aggregation, or in other words, trust architecture.
If you put that much trust on any technology, eventually your trust will not be justified.
What do we do about it?
Disaggregate the risk. Or in other words, architect the trust to that the amount of value gained by attacking is lower than the cost of attack. An example?
Conclusions
The point here is that we have lots of these kinds of things, and we have not applied what we know, as a field of endeavor. How do you architect and manage trust? More next month.
Click Here to Enroll for an Online Certification Course in Cybersecurity Overview