Sunday, October 9, 2016

Ignorance as a key to malware

The very disturbing study, described in detail here, indicates that any security warning are not effective, cause in the worst case people simply not "trust" the warnings. I.e. they trust a fishing website more, than the respected developer of the web browser. Ok ...

I think that's the same reason people go for Trump in these elections.

Wednesday, October 5, 2016

The flipside of cross-signing

The Chinese certificate authority WoSign used shady practices when issuing the certificates. To make things worse, it acquired the Israeli company named StartSSL and supposedly made it use WoSign's infrastructure. And that infrastructure was either misconfigured, or intentionally abused - we can only guess now.

Now, Apple has removed the root certificate of WoSign from its Trusted Roots. However, the WoSign's CA certificate is counter-signed by two other CAs, and that gives trust to the WoSign's CA. Without explicitly blocking this CA certificate neither Apple nor any other software vendor can't effectively prevent the abuse of the PKI infrastructure, when co-signing is used.

I was a proponent of the approach that certificates must be signed by more than one CA. This makes the system harder to compromise. But counter-signature must be validated using logical AND, not logical OR. One must require all three trusts to remain valid, rather than rely on any of the signatures, like in the above case.

I am wondering, how many security breaches should happen until the industry starts moving in the direction of requiring more than one valid signature on each certificate (or at least on CA certificates).

And I am afraid, that unless such movement is implemented in standards, we'll see vendors going in all directions implementing incompatible, if not mutually exclusive, approaches to strengthening PKI.

Full story here.

Wednesday, September 14, 2016

The inhuman factor

It would be an anecdote if it didn't reflect the poor situation with humans dragging severely behind  the development of technology.

The website of Social Security Service of the US attempted to introduce two-factor authentication. The idea was cancelled after it appeared, that only about 35% of the target audience know, how to read SMS on their phones.

Well, the target audience is those after 65 y.o, so no wonder. But these same people, who can't manage reading a couple of digits from the screen, and typing them back, are still allowed to vote and define the future of the younger generations.

Actually, we'd call all those people technically illiterate. They've learned to read and write, but didn't learn to understand technology.

For those people only biometric authentication such as FIDO UAF could probably work. And that's another investment, which most retired people can't afford. A Catch 22 of a kind ...

Friday, August 19, 2016

A password as a lever

A nice story about how passwords changed the life of the author.

And you know what? It's a great idea. Just try it. 

Tuesday, August 9, 2016

How open-source kills innovation

The terrifying stories about notebooks with thousands of confidential data records being lost come every other week. The best solution for this problem (apart of not carrying the notebook or the data) was to encrypt the data at rest. And this is to be done using either whole-disk encryption (not always feasible or even supported), or by creating virtual encrypted disks.

The niche of virtual encrypted disk software was initially occupied by PGPDisk (first by PGP Corporation, now by Symantec, that purchased PGP Corporation). Later the open-source alternative, TrueCrypt has appeared. There were several commercial attempts made to compete with TrueCrypt, but those alternatives didn't get popular because why pay when you can get it for free.

Ok ... And now the X day has come and TrueCrypt was declared to be insecure, and it was abandoned by the developers as well. Not a problem for open-source, you might say, as one can make a fork, plug the security holes and release an update. Yes, to some extent. Besides the lack of one important factor - motivation. Maintaining somebody else's software is not a big fun, especially when it's a badly designed kernel-mode driver (which is the core of TrueCrypt). And when it's done for free, there's always something more important in the to-do list, as you can imagine.

There were several groups that attempted to fork TrueCrypt (CipherShed and VeraCrypt are just two names). But they have kind of failed.  Neither CipherShed nor VeraCrypt have a good track of frequent releases and bug fix updates. Bugs remain numerous, support is not provided (see "motivation"). We call that DoA.

Now, we (the company I've been working in for all my life) have the products (kernel-mode drivers, encryption modules) that would let us create such software relatively easily. But we never did this, exactly for the reason of necessity to compete with open-source. TrueCrypt has effectively blocked the market for us. And we are not alone. I know at least several other attempts to build solutions for data encryption on disk level (say "virtual encrypted disks"), and none of them are successful for the same reason.

Ok, but do we have a chance once TrueCrypt is gone? Well, no. Truecrypt is dead but not gone, neither are VeraCrypt. While that buggy open-source is still available, people will prefer living with bugs to licensing the maintained product for a fee. And this is true for both personal and business users (the latter ones are also driven by people, who are used to asking the initial question of why pay for what seems to be free).

Well, I would happily say "good luck" to the world of socialism and open-source, if we could have at least some solution of the problem (how to create the encrypted disk).

Suggestions, anyone?