QRZ Security Update: 2FA and Verified Users

Sheesh. What happens when any company gets hacked? Are there any hackproof companies? Your fear mongering about something that happened more than 5 years ago is completely irrelevant. Don't be part of the problem. You're spreading FUD (Fear, Uncertainty, and Doubt) that only confuses our non-technical users. You're spreading confusion about a complex topic that undermines our program. I'm willing to hear constructive criticism on this project, but I will not tolerate scare tactics as a counterpoint.

 

I don't have any opinion about you on a personal level. Stating that we don't like each other is nothing less than a supposition on your part. Okay, you probably know how you feel but you have no idea about what's on my mind.

Your comments suggest that "oh what the hell, it's a losing battle so why try?". That attitude would never have won the battle at D-Day and I just don't subscribe to it. Problems are never solved, or even mitigated by doing nothing. This is not the kind of problem that will "work itself out on its own".

QRZ isn't covering our asses, we're covering your asses. We're not getting ripped off by scammers, you are. If we do nothing, nothing at all, we'll still be here 10 years from now. By then, however, hundreds of thousands of dollars worth of bad deals will have gone down. If we can change that to tens of thousands of dollars then we'll consider it a win.

Your argument also suggests that our solution isn't perfect, that 2FA will soon be obsoleted by 3FA, and that even big companies will get hacked. Perfect is the avowed enemy of good and I'm perfectly happy with good. That's why we're moving forward with this despite the fact that we can't predict the future or that someday, 2FA will become obsolete. One thing for damn sure is that plain passwords, no matter how complex they are, are obsolete already, and the situation won't improve under your "security plan", which as far as I can determine is "none".

Then, your last question, i.e. "Do you think all this scammery escalated after the migration to Amazon cloud service or whatever it's called?". Is this supposed to apply to QRZ, who migrated to AWS 8 years ago, or to the thousands of other companies that have as well? We used to have our own hardware that we purchased and maintained ourselves. Our move to AWS resulted in greater security, better performance, lower cost, and better reliability. In the past 8 years, cybercrime has escalated throughout the world and to suggest that AWS is particularly vulnerable over all others is so unsubstantiated that it reeks of conspiracy theorist conjecture.

Just as the internet and computing, in general, has grown over the past decade, so has cybercrime. Cybercrime isn't fought by acceptance or resignation. It's fought by engaging them directly on the battlefield. You apparently aren't interested in fighting them, and so we can't really take you seriously as a security proponent.

 

Not to pick on you in particular but I would like to ask this rhetorical question: Would you let me see your license if we met face to face? I suspect that you would probably say "yes". So then, the difference, as you stated, is in its transmission over the Internet.

The primary thing that folks worry about transmitting data over the internet is that the actual wires that carry the data can be eavesdropped. This is true, and there are probably dozens if not more points along the route between your computer and ours where someone could insert a tap and watch the data go by.

The data that flows over the wire, however, is completely encrypted such that even though it may be seen or even collected by others, it cannot be decoded. It's just numeric gibberish when its obtained through eavesdropping. This protection is provided by Secure HTTP, known as HTTPS. You will notice that QRZ made the entire site HTTPS a couple of years ago and this is something that we will never turn back. This means that whatever leaves your computer cannot be viewed or decoded by anyone except QRZ. Even individual keystrokes are afforded this protection. When you type in your password, for example, it is also completely encased in strong encryption for travel back to QRZ. Therefore, the risk of a compromise between your computer and ours is mitigated by strong encryption.

I don't expect my explanation above will change your mind, and that's fine but I wanted to point this out in case others were concerned by the notion that something transmitted over the internet cannot be trusted. The trust must lie with the endpoint, not the transmission medium. So, if in our face-to-face meeting, you used a 10-foot pole grabber to hand me your license, you wouldn't be worried about the security of the pole.

Also, I will add that you may redact whatever you like from the document and our staff will evaluate what's left to see if it provides enough confidence to approve. If not, we'll tell you.

73, -fred