Paul Moore

Some quick googling gave me this:https://paul.reviews/passwords-why-using-3-random-words-is-a-really-ba… (also good stuff here: https://security.stackexchange.com/questions/151165/is-randomly-genera… It seems the consensus is to use 5-6 words, and following the xkcd trick of 4 may not be enough.

Paul Moore covered their weak security a year ago [1]. Worth a read. I've always avoided TalkTalk because they keep sending me junk mail reminding me that they offer free broadband if I take out a phone package, etc. It just screams race to the bottom. 1. https://paul.reviews/value-security-avoid-talktalk/

Hopefully it's slightly less pathetic than the "Police CyberAlarm". https://paul.reviews/police-cyberalarm-abysmal-security-yet-again/ https://scottarc.blog/2022/07/04/police-cyberalarm-uses-alarming-crypt…

I admit that, reading the code, I found it challenging to find a severe crypto bug simply because everything is wrong. Even their way of packing the data into a base64 is nonsense. The parser is nonsense. Almost every line of code is wrong. Without more context, I’m not quite convinced that the key is reliably anything other than a constant due to the use of PHP and the failure to validate that the variables in question are initialized. It’s like the most severe bugs are buried in code that is 100% bug! edit: the key is a constant. I’m speechless. See https://paul.reviews/cyberalarm-an-independent-security-review-and-why…

Honestly, the cryptography part of it is the least concerning (if it was just that it would be an easy fix). Here's a summary with some screenshots of the code: https://paul.reviews/cyberalarm-an-independent-security-review-and-why… The entire project is an unsalvageable mess and so is their response - clearly they've outsourced the entire thing to idiots and are trying to cover their ass now that it's been publicized.

That would be useful, but won't solve the problem alone. It's highly likely there were any number of engineers in these companies fuming about poor practice, but lacking management support to prioritise it. Look at how TalkTalk ignored a security researcher's warnings a year before incurring a major attack. They were also storing in plain-text, available to support staff, and came up with comments like "We're squeaky-clean on security". This is a PR response, not one from the engineers who know what's going wrong. https://paul.reviews/value-security-avoid-talktalk/

Paul Moore's findings from one year ago: https://paul.reviews/value-security-avoid-talktalk/