Today is the day before thanksgiving in the U.S., otherwise known as the busiest travel day of the year. It is also the date of national opt-out day, an effort to raise awareness of the TSA’s use of “strip search scanners” and “enhanced pat-downs”. While I’m sure most folks would prefer not to be irradiated, seen naked, and/or groped, they will willingly do it because (a) they want to get to their destination with a minimum of hassle, and (b) everyone else is doing it. Robert Graham decided to address this topic and to do so he wanted to take some photos of his TSA checkpoint for his blog. Photography is, by the way, completely allowable under TSA regulations. Unfortunately,[…]
Category: rants
A colleague lent me his most recent copy of IEEE’s Computer magazine. Inside was an article entitled A Web 2.0 Model for Patient-Centered Health Informatics Applications (IEEE membership required to read). Some possible benefits of their proposed approach were listed, including: Run deeper analytics across physicians groups and facilities, which can include relevant patient data… Provide a wide community of health professionals with feedback on the use and effectiveness of protocols… Share similar and alternative protocols and their analyses across many medical facilities and individual providers… Anyone want to guess what’s completely missing from their approach? You guessed it, any mention of security. The commonly misunderstood (and frequently misspelled) HIPAA makes it pretty clear that the privacy and confidentiality of personal[…]
If you haven’t already heard about LIGATT security, you need to. I won’t do them a favor of linking to them from this blog post, but I would like to provide some information about why I’m afraid of them. No, it’s not because they have the world’s #1 hacker. There is a lot of terrific information about the company, its misgivings and wrongdoings on attrition.org’s Charlatan page for Gregory Evans, the LIGATT founder and CEO. Convicted of wire fraud in the beginning of last decade, Mr. Evans made good upon his release from prison by… marketing a caller ID spoofing service starting two days after the US House of Representatives made caller ID spoofing illegal. Another fantastic resource is the[…]
For starters, let me just say that I personally have three Mac systems and three Windows systems I interact with on a regular basis. I’m writing this blog post from a Macbook Pro. However, there is a wide and growing misconception about the security of Mac systems vs. the security of Windows systems. I just came across the following post in PC Magazine’s Security Watch blog, and there is a lot of good information in there; specifically the following quote which I want to share: In the abstract, Macs are every bit as vulnerable as Windows systems, perhaps more so. But in the real world Mac malware is so rare that it actually makes news. Hundreds of Windows trojans like OpinionSpy[…]
Today Slashdot had a story about how a news story about an Australian transportation plan was broken early by a newspaper. The transport minister said the access of this information was akin to the newspaper trying to “pick the lock off a secure office and take highly confidential documents”. What was the brilliant security plan that was supposed to be protecting this information? The information was all stored on an unpublished URL with no security or authentication in place. We in the security industry call this “security by obscurity“. And it is not security at all.
An uproar was recently started in reference to some privacy concerns about the new release from Google, Google Buzz. One of the first to sound the alarm was a blogger who was quite explicit about disliking some of its default options (and by explicit I mean “NSFW language” explicit, the post is here) which prompted some quick changes from Google. In order to start using Buzz, you have to create/modify your Google public profile which will appear next to all of your activity in the Buzz feed. By default, the public profile would display all those you follow. Chances are you’ve followed everyone in your contact list, so you just made your whole contact list public. Now in the new[…]