I'm not sure how you figure. Defense of device is effectively static right now, there is a pretty hard cap on a persons device rating + firewall and willpower. It may be difficult to brick a device in one go for starting characters but people arn't going to stay that way for long, nor should that be the sum total of it. Plus there's edge expenditure.

Indeed...
There is a vast difference between Internal Cyberware and the Computer environment a business uses. One should never have online requirements at all (it is firmware), and the other functions more efficiently (possibly) if it is online.

I have absolutley no issues with a Network of computers having issues with a Hacker. I have great issues with a Hacker screwing with internal 'ware.

Data Spike damage is Attack + net hits, resisted normally. That's not usually enough for the 9+ boxes of damage required to brick a device in one shot, even with a very high Cyebrcombat stat. Each mark on the target adds 2 to the damage, so it's helpful to have a mark or three to push the total up above what the target can reasonably resist.

Or just data spike it twice and be done, No Marks required.

Though, if a Street Sam can equip his cyberware with Black IC, then perhaps then having Wireless gear becomes fun and amusing.

Why would he do that... a Data Spike would completly ignore the IC from what I have seen. Though Maybe I have read that wrong.

8 Intelligence + 5 cybercombat + is base dicepool. I could also get the hotsim bonus Currently i will typically running a attack rating of 7 or 8 (6 or 7 plus decrypt). Against anything but a comlink with an absurdly high DR I will probably crush it, and do 7 or 8 damage plus net successes plus 2 for hammer. So yea anything not protected very very well indeed is probably going bye-bye. And this is a character with just a few modules under their belt, on less then optimal conditions.

My complaint remains, matrix combat needs some form of dodge or parry. Some way to bring skill back into the equation. Right now it absurdly penalizes defenders.

You should probably do some more research before making silly claims like that.

Guess those jerks didn't read SR5 before they did that. Their Photoshop test is only going to be a +1, not a +3.

Given that people give up their administrative password to technical support people every day and that failure to properly secure your comlink means that the lives of fellow teammates are on the line, I think many teams would be hesitant to head out with a team mate whose comlink hasn't been cleared as clean and secure. Just my $0.02, not supporting the slaving option, just the notion of not allowing the team hacker the access.

This debate is starting from a flawed premise. Your comlink is not your computer.... It is your phone + computer + interface to AR. The latter alone makes you handicapped in many places without. Unable to pay. Unable to read menus. In some places in gross violation of the law (ergo. Required Active Mode).

Nice. I hadn't looked around for pirated CC, not really relevant. We're still running on a mix of CS5 and CS5.5 (we still can't get every computer in the office on the same page and there's only seven machines!)

Okay... So a Smartphone? Fair Enough? So.... Still not seeing any reason that I would be vulnerable to the vagaries of the Internet and hacking IRL, because I do not even own a Cell Phone, let alone a Smart Phone.

In Shadowrun, all that is required is that you have "something" that broadcasts your Identity in those places that require it (and amazingly enough I can still browse AR with it, but not connect it to anything else, because it would be a security breach). There is nothing requiring that you use the Matrix, or even be active online. There never has been, either. But Wait... Since Shadowrunners have been so keen on Matrix security that the hacker is useless, lets Force them to open up their devices (including those that make no sense to be online, like Internal Ware) so that they can be hacked... that sounds like it would be fair, becasue Hackers don't have anything else to do in combat...

Lunacy Indeed...

There's a big difference between allowing access and turning over full control though. Giving the decker access pre-run to make sure you're not already infected, or have any glaring vulnerabilities? Sure. But his access is going to be removed almost immediately afterwards unless I trust that guy with my life.

Seriously how many people in the world would you trust to have constant total control over machinery inside your body?

My counter is: How well do you know the street doc working on your ware? Or a modern day equivalent: How well do you know the next surgeon, anesthesiologist, nurse, etc when you have an operation? Despite our best paranoia, there are times you must extend unearned trust.

Unless your character has a software R2 or higher, this doesn't fly. He has NO idea what the hacker is doing once inside...

Welcome to the 2070's my friend. You either opt in or opt all the way out.

You can stop here. You misunderstand the technology.

Then you've already been hacked. You just don't know it yet, because you don't understand Security Engineering. Let me help you:

You exist in a world that has a permanent denial of service attack perpetuated against it.

Except, in this case, instead of your computer being hacked they went straight to the brain hack.

-Wired_SR_AEGIS

I'm sure you can install the new Tinfoil Hat cyberware if you like...

I'd like to throw out these descriptive texts for digestion.





Why would the first implant even have wireless connectivity? Or the second for that matter? SR4 just had them having RFID for diagnostic purposes. There is no reason for these to requires a matrix connection.

and nobody is complaining that you can hack things that are online and require online to function.

we're complaining that some things make absolutely no sense to have an online requirement, or would be mind-blowingly stupid to have an online requirement.

it's fine to have an ebay app that requires online connectivity. nobody will complain that hackers can hack your device that has the function of running your ebay app, nor will anyone complain that you lose the usefulness of your ebay app should you take it offline. frankly, for the most part, hackers won't care about this app, and there's millions or even billions of copies of this app or equivalents that the hacker could target instead, with most likely nothing particular to make yours stand out as a target. there is minimal risk, and it's basic function requires that it be accessible. there is no problem with this being hacked.

it makes no sense whatsoever for military-grade hardware to be designed to have completely unnecessary vulnerabilities. by nature, any time you need to use it, you are probably going to be going up against someone else with significant resources, significant motivation for targeting you over the many other people in the world with that device (on account of they're not dealing with those other people that have the device), and the resources they can call on are easily accessible from pretty much anywhere in the world, at a moment's notice. equipment designed for military use *should* be designed with the assumption that there will be a gigantic bullseye painted on it, because for all intents and purposes that is the case.

so when you have the sort of thing that pretty much only gets used by special forces/black ops teams, and for which the basic functionality does not inherently require that it be accessible to everyone, it makes no sense to have extra vulnerabilities added in. thus, we're upset that there is a bonus for wired reflexes and reaction enhancers, because their function is to make you move faster. they don't need an internet connection to make you move faster. if more processing power is required, because of the nature of the device, the only reasonable solution is to build in more processing power, or tone down the device so that it has fewer requirements, not to open the whole system up to another avenue of attack by using cloud computing and paint a gigantic "i'm an idiot, please nuke me" sign on the person dumb enough to buy and use such a moronic device.

so, in short: we're not angry that some devices have online bonuses. we're angry that devices which have absolutely no valid reason to have online bonuses, have online bonuses, and we're angry that those so-called bonuses are things that should be basic functionality. we want the mechanics to work, but it has to work within the setting provided. high-grade milspec gear that is most likely to see use in covert ops being designed so that it is less secure than it could be does not work within the setting provided. the intended market for that gear would pitch a fit over having an added weakness that is easily exploited.

the only way it could make sense if there was a consumer model, and a security/military model, and at that point, we're right back into not working with the setting. what company would be selling the kind of equipment that costs a small fortune (seriously, you could buy a small fleet of vehicles with that kind of money) and which has the primary function of making you better at killing things to private customers?

we're ok with the idea that you can hack things that are online. we're ok with the idea that some things get a bonus for being online.

but we want the bonus to make sense, and we want the risk to make sense, because that is a requirement for the setting to be at all plausible.

i've yet to see anyone complain that leaving your gear online makes you hackable.

i've seen many people complain that certain specific examples of things getting an online bonus are completely absurd, because their function does not require them to be online.

and i've seen many people complain that certain specific devices are only ever going to be used in situations where there is a high risk factor of them getting hacked, and as such should not be designed to have basic functionality that requires making them available to be hacked.

it's not the whole system of online bonuses that needs to be fixed. it's specific examples within that system that need changes, for the setting to be made plausible.

They shouldn't even need/have RFID. They could just as easily have some kind of I/O port. I mean, just because wireless exists, doesn't mean that there is no longer any use for wires, lol. Environmental plug to keep dust/moisture out, then hook it up to whatever equipment is running the diagnostics. I mean, it's not the easiest solution, but it's far from complicated, and definitely the way you're going to want it to work, when again, you live in a world where people can hack computers with their brains across thin air, lol.

And we're not just talking for Shadowrunners. The world is full of bored dickbags who hack things for fun. Any normal person isn't going to want to have somebody playing with their implants just because some writers of Shadowrun saw an episode of GitS:SAC once.

The problem is that paradigm exists today and yet everyone goes wireless everywhere, AP's not even using WEP (yes, broken but keeps out most), blue tooth everywhere, despite the fact it can be hacked from a lot farther than the advertised 25' range. I submit that people are lazy by default and take the easy way. Security is not a primary consideration for most. Shadowrunners are stuck working in a world that is designed for convenience, not security.

I would agree here.

Which is all well and good, but where is the convenience in having certain 'ware being wireless? The average Joe isn't getting wires or reaction enhancers.

Corps and military being able to shut down anyone who goes off the reservation?

Yeah, but it's a question of scale. Having your phone hacked would be annoying. Having your eyes hacked?

And regardless, the second people can do high-speed impromptu hacking in a wireless environment, the way we use wireless devices will change completely, and it won't be average users who drive it, it will be industries who sell and use the products.

The continuity of SR5 exists in a world where people are unbelievably stupid. We're not talking about your 60 year old parents in 2013 not knowing how information security works. This is like imagining your future adult great-grandkids not understanding how information security works. People whose entire lives have existed in a world where these kinds of vulnerabilities were well known, and a world where information security vulnerabilities had nearly killed the world twice with the Crashes.

Well half the population is uneducated huddled masses, most of them aren't even legal citizens of where they were born, the population density suffered from some pretty hideous pandemics, so by and large most of everybody doesn't care so long as they can watch the trid and eat soyburgers.

The dragons mostly just laugh, and the corps have their really important stuff under so many safeguards it takes orbital thorium rod strikes to make them pay attention.

This is not comparable to the ease of hacking in Shadowrun and the level of damage you can cause with trivial attention from the hacker (or no attention at all if you just have an Agent start zapping everything). The rules would have you believe people are totally copacetic with having their commlinks getting bricked just by walking down the street because a hacker glanced at them for a second. A single activist hacker in a business district could cause a lot of damage, and even executives are not going to have spiders running overwatch when they go to Starbucks (but they should, in the SR5 network model).

Has anyone been watching Continuum?

How about the more recent episodes where they use a 1/8th slice of a time machine as a super computer to do massive data-mining in under 30 seconds ("connect me to all the security cameras and key in on Alec's face").

Think that kind of power being used in a brute-force attack on WPA2 passwords. And everyone has that kind of computing power in their pocket.

I've said this before -- people knock over convenience stores with firearms every day, yet you still go to convenience stores.

We can already do high-speed impromptu hacking in a wireless environment. There are some videos online proposing WEP done in under 3 minutes based on a 'Zero Knowledge' model.

Bluetooth isn't especially inspiring from a security perspective either, yet its the defacto standard for wireless phone accessories.

Regardless -- This discussion has DRAMATICALLY shifted from 'How to Secure your Wireless Devices in SR 5' into 'Wah wah, my last thread complaining about Wireless Access doesn't have much activity so I want to $#&@ in this one.'

We get it. You're a little sore. That's not what this thread is about.

-Wired_SR_AEGIS

... uh. Is that the best analogy you could come up with?

If a criminal could "knock over the convenience store" (I assume that is your indirect allusion to bricking your gear) in a second or two, with only the most trivial attention (he could do it in his sleep, or there was a special entrance just for convenience store robbers with an untraceable taxi waiting outside), and by firearm you mean he has a minigun he can use indiscriminately, ok.

"People lose at Candyland each day. So that justifies always-on cyberware." -- Shadowrun 5 Development Journal

I would submit, welcome to the modern age. I like to reflect now on a little demo the FBI did a few years back in (I think) downtown SF. They hacked into every wireless network in range (in minutes) to prove wireless encryption was not real security.

The real difference between Shadowrun and the current world in this regard? The incompetence of law enforcement tracking down Shadowrunners.

No, that's the comparison to "hackers could hack the entire public! no one is safe in Starbucks!" problem. A dude with a gun could walk into Starbucks and shoot up the place. A hacker could take down people in Starbucks with his hacker gun. The point is that both of these actions are

A) Very Illegal

B) Somewhat Rare, and

C) Dangerous to the Assailant.

The majority of hackers aren't going to hop down to the local Starbucks to grief the customers. Some activists may go out and slap offensive AR protest signs in people's faces while they try to drink their coffee, which would be the equivalent of throwing paint on people wearing fur.

But bricking 'ware and potentially harming random people in public? Lone Star would go out in force to find and stop them.

Remember that in Shadowrun there's a certain amount of Matrix forensics that can be done -- instead of inside a Run where bricking the Rigger's VCR will get an alert sent out for security, doing something like that in public would draw the 21st Precinct Lone Star Decker Division to the local Matrix grid almost instantly (remember, Matrix, fast), they'd bombard the area with traces, tag the hacker so they can locate him wherever he is, and send in the foot troops.

The only people who would be able to get away with that sort of activity for very long would be expert criminals who could cover their tracks, and why would they spend time, energy, money, and risk on random violence? Especially Deckers, who don't pay 450 bucks for a used pistol, but tens of thousands of nuyen on the decks and programs you need to even try.

It's like saying that high class movie-style art thieves exist, so you have to worry about them stealing all the Home Goods quality art from the nearby Applebee's.

Glorious. You have a link to the story?

(Semi-related: beware of imitation calamari)

You don't want to know what I "get" about you.

Why don't you leave the insults at home, because you'll lose that battle kid.

I'm still considering the idea of just taking every piece of matrix enabled cyberware and turning it into its own rating 6 device. Stuffing it with as much IC as I can, and hoping that as the hackers keep disabling my ware, that eventually GOD will blow them out of cyberspace when they leave one of my pieces of now bricked ware, and go to the next one.

If not... at least they have to 'ware by 'ware, brick stuff, and my IC may tear them a new one at some point. After all, each piece of 'ware will have it's own damage boxes, no?

I actually don't. All that is required is a Comlink. You can go dark for EVERYTHING ELSE, even in SR5.

I do understand it, I even work in the damned field. *shrug*

NOT EVERYONE, and that is the POINT.
In game, Security is a Primary Concern for the Megas and their operatives, and it is also a concern for the Shadowrunners. Not everyone is Lazy, and they will take the necessary steps to secure their stuff. In fact, that is WHY the new paradigm of unsecured stuff now exists in Shadowrun, because Shadowrunners and their targets took those steps in the previous editions.

Did I miss the part where I insulted you? I didn't miss the part where you hijacked the thread.

I did, however, miss the direction this thread could have gone which is why I drew attention to it: How to protect your devices in 5th Edition.

-Wired_SR_AEGIS

Please remember this is a game. It is not based on real world computing. This is also an internet forum for people who want to discuss that game, not posture and threaten others about a potential argument which they may or may not lose. Take a deep breath, get a cup of coffee, and close your browser for ten minutes.

On a much lighter note, and not in my mod voice. I remind people of xkcd.

And people react to this by arming themselves. In the real world, there are reactions to problems like this. In SR, there should be, too. Instead, it seems, people in SR just don't mind.

Or they do mind for some things, but wired reflexes are still mostly illegal milspectech so that one doesn't so much.

The underlying principle is that there exists a place where the risk generated by a threat to a vulnerability is accepted due to the benefits associated with maintaining that risk. It occurs in a number of ways. For instance, legacy computer systems are may be frequently left unpatched because their reliability, and availability are more important than the costs associated with the exploitation of a vulnerability. Or there are mitigating factors at work. This may even include web facing resources, if the revenue associated with those devices dramatically exceeds the cost of protecting them!

Alternately, each and every one of us use our internet browsers daily because of the perceived benefits we draw from internet browsing.

The risk of being robbed at Starbucks is miniscule. Even in California where owning a firearm will get you pelted by eco-friendly sustainable clam. So that risk is frequently accepted. Much like people drive places instead of cowering at home, despite the risk associated with operating a motor vehicle.

That risk vs. reward paradigm is maintained in SR 5.

On to the topic at hand: Has anyone run any simulations of various defensive device stats against common hacker dice pools, to develop a model for good cost vs. protection? It seems like a nice, high rating Commlink to slave your gear to is essential. What's the formula for calculating commlink cost?

-Wired_SR_AEGIS

without the actual book this would be a wasted effort using speculative data. I will likely do this when I get my copy on the 11th.

I keep hearing bluetooth and the like being brought up for smart phones, but what about people like me who disabled that on their phones because they don't use it. My phone still works perfectly well, I'm just denied some shitty little accessories and QoL items. My smartphone still works perfectly well, but my wifi and bluetooth are off. (Furthermore, I password protect all my stuff too, so even physical hacking it going to take longer, that of course fits into making it worthwhile).

As for convenience stores, we as consumers also have the option to go to stores that aren't getting held up constantly. So why wouldn't our characters, as consumers, have the option to get some of these items that don't require the wireless connection but still retain their bonuses.

Because securing your devices against hacking has been declared Bad-Wrong-Fun?

Again you are making the point for matrix bonuses. Yes your cell works perfectly well without the Bluetooth. That is the baseline. Those thing you consider accessories that are superfluous, are of n
much more importance to me. I drive a lot and a headset is indispensable to me. Thus the bonus is worth the risk in my opinion. In your opinion it is not. The same goes for the matrix bonuses. If you feel that the bonus is not worth it then don't turn it on. I may feel it is, and that flexibility of options is good for the game. Should Bluetooth be discontinued because you don't use it? I would thank you not to try to make my mind up for me.

Actually, he is making a point for Standard Functions to be Standard. There is no benefit to having your ware matrix enabled. The attempts, so far, to rationalize their inclusion do not really hold up under scrutiny. In the example above, yes, Blue tooth has a purpose, and is therefore useful, but it in no way impacts the standard functionality (to make phone calls) of the smart phone to begin with. Now, if you could ONLY talk through the Blue tooth, that would be ridiculous, don't you think?

Some things should have genuine bonuses, but others make no sense. It would be like your watch not telling you time because it doesn't have a bluetooth connection to your phone. I wasn't saying that features should be discontinued, simply that they shouldn't exist in certain devices. I don't need bluetooth for my shoes to work.