Pages: 1 3 4 5 ...6 ...7 8 9 10 11 12 ... 14

  2019-12-31

Time to reclaim the Internet

  22:55, by Hagai Bar-El   , 2015 words
Categories: Security Engineering, Security Policies

We grow increasingly reliant on quite a few Internet-based services: social networks, messaging, photo sharing, and the rest. The challenges we face with privacy, data ownership enforcement, surveillance, and other aspects of digital abuse could all be substantially reduced if those data sharing needs were addressed by the Internet as it was originally architected: decentralized and open. We have waited very long, and so remediation would take more than just new standards, but it is doable.

Full story »

  2019-09-07

On protecting yourself against MITM in SSH

  21:40, by Hagai Bar-El   , 1081 words
Categories: IT Security, Day-to-Day Security Advice

SSH is one of the best security protocols out there. It is used by anyone remotely logging into servers, as well as for secure connection to Git servers, and for secure file transfers via SFTP. One of the key promises of SSH is protection against active man-in-the-middle attacks. This makes SSH the best choice when connecting to a server over a hostile network, such as over a public hotspot. However, some SSH clients (particularly on mobile phones) void this protection by not caching server keys. Can you do anything about it? Yes, use private-keys instead of passwords for client authentication. Read more (also) for the technical details.

Full story »

  2019-08-31

Using Tor to protect against certificate injection by Hotspots

  15:21, by Hagai Bar-El   , 667 words
Categories: IT Security, Day-to-Day Security Advice

Tor is typically used to attain anonymity and preserve privacy online. This is by far the most common and appealing use for it. Most people without such concerns are not likely to ever install a Tor browser on their workstations, and it’s a pity; Tor has at least one additional use-case which is applicable to a much larger audience. This use-case is the prevention of certificate injection when using untrusted network connections.

Full story »

  2019-07-28

Book review: "Data and Goliath"

  21:40, by Hagai Bar-El   , 413 words
Categories: Sources

After sitting in my reading list for years, I finally got to read “Data and Goliath” by Bruce Schneier. Overall, this book is as well written as all of Schneier’s books, and is just as scientifically accurate (to the best that I could tell). However, whoever the audience for his book is, they may find it missing essential parts that make it not just a pleasant read, but also a useful one.

Full story »

  2017-10-13

For and against security checklists, frameworks, and guidelines

  18:03, by Hagai Bar-El   , 636 words
Categories: Security Engineering, Security, Cyber Security, Counter-media

We have seen many of those by now. Starting with old ones like FIPS 140, and concluding with more recent additions as the NIST CSF (Cyber Security Framework). The question is: are whose worth my time? What are they good for? Do we need to adhere to them? In a nutshell, I think they have their value, and need to be consulted, but not worshiped.

Full story »

  2016-01-12

Bruce Schneier on Israeli export control

  22:09, by Hagai Bar-El   , 650 words
Categories: Security Policies, Counter-media

I usually agree with the opinions expressed by Bruce Schneier. Seldom do I think that he is dead wrong, and yet less often do I think that an essay of his is bluntly unsubstantiated. About a month ago, he published such a post, titled: How Israel Regulates Encryption. He quoted a research that sounds sensible, but ended up interpreting it entirely wrongly, in my opinion.

Full story »

  2015-11-30

The status of Truecrypt (2nd edition)

  18:22, by Hagai Bar-El   , 419 words
Categories: IT Security

It has been a while since Truecrypt was discontinued. While it still works on most platforms, including new Windows machines (except for the full-disk-encryption on some of them), and while there still is no evidence to indicate that it is insecure, users of Truecrypt find the situation bothersome; and for a good reason. By now it seems obvious than an alternative has to be found.

Full story »

1 3 4 5 ...6 ...7 8 9 10 11 12 ... 14