The “big” news of the week (thus far), if you can call it that, is Google’s announcement of the availability of soft tokens for Google Apps as of today (read about in their post “Moving security beyond passwords“). From a security perspective I’m greatly underwhelmed. Maybe I’ve just become jaded in my old age, but this really strikes me as a big “so what?” announcement. AOL did this several years ago (unsuccessfully, I might add) using RSA hard tokens. The reason for their failure is myriad, ranging from a lack of promotion to requiring customers to pay for it, but ultimately it came down to one specific concern: usability. I don’t for a minute accept TechCrunch’s take on this announcement[…]
HP announced this morning that it would buy ArcSight. This follows Intel’s acquisition of McAfee last month. This isn’t the first time a large computer maker/systems offering has purchased a security company, but what does it mean for our industry? Will it mean that McAfee will only run on Intel computers (not that there are many others..)? Or that ArcSight will only be available on HP systems? Or will the companies operate fairly independently and we won’t see much in the way of changes for consumers (and businesses)? I’m really hoping that the industry stays fairly open, allowing cross-platform interoperability between systems and products. It allows customers to select the best non-security system for their needs, and then allow them[…]
OAuth is a protocol that lets applications request data or privileges you have on a remote service without you having to provide your credentials for that service. A classic use case for this “valet key” system is contact import – you can let a site load your address book from Gmail without giving that site your actual Gmail password. Twitter recently required that any third-party applications using their API must authenticate using OAuth. Twitter’s implementation is based on OAuth 1.0, which was finalized in April but has been in development for several years and is already widely supported. But work on a new version is now under way, and Facebook has already implemented one variety of the draft specification for[…]
Teensy is an interesting device. Not much larger than a quarter, the technology behind it is comprised of a micro controller and other associated electronics (memory, I/O, etc). The result is a very functional, yet flexible, USB thingamabob that can let people program their own logic to run their own routines, commands, and instructions. Teensy was recently used in a unique demonstration of some interesting security implications that arise from exploiting the USB-to-OS trust relationship. By programming Teensy to identify itself as a keyboard, someone could trigger it to send automated keystrokes at will (or set via timer). But this has been possible for years. In fact, for this example in-particular, it’s probably desirable for users to not have to[…]
There has been much criticism of risk assessment and analysis over the past few years that amount to much ado about nothing. Why is it much ado about nothing? Well, because, quite simply, people oftentimes don’t understand what it is they’re criticizing, especially in the case of quantified risk analysis methods. Before we get into risk measurement, let’s first make one thing clear: risk analysis is nothing more than a decision-analysis (or decision-support) tool. It helps provide reasonably accurate data points that decision-makers can use when make decisions. It is not a panacea for all things risk or infosec, nor is it some sort of special magic-sauce voodoo with no grounding in reality (at least not in terms of well-considered[…]
Recently, Vinay Deolalikar self-published a proof that P is not equal to NP. So what does that mean exactly? P is short for Polynomial, and NP is short for Non-deterministic Polynomial. To understand the exact difference requires you to understand Turing machines (usually a senior level CS class). P is the class of problems that can be solved in polynomial time on a deterministic Turing machine in polynomial time, and NP is the class that can be solved on a non-deterministic Turing machine in polynomial time. Here’s the catch: so far, no non-deterministic Turing machines exist. There’s speculation that quantum computers are non-deterministic Turing machines, but not a proof that I know of. Another way of thinking about P and[…]