Pages: 1 2 ...3 ... 5 ...7 ...8 9 10 11 12 ... 14

  2014-04-03

Bitcoin does not provide anonymity

  22:22, by Hagai Bar-El   , 762 words
Categories: Security Engineering, Security Policies, Security, Counter-media

When people discuss Bitcoin, one of its properties that is often considered is its presumable anonymity. In this respect, it is often compared to cash. However, it shall be recognized and understood that Bitcoin is not as anonymous as cash; far from it, actually. Its anonymity relies on the concept of pseudonyms, which delivers some (unjustified) sense of anonymity, but very weak anonymity in practice.

Full story »

My new patent on secure key provisioning

  12:02, by Hagai Bar-El   , 151 words
Categories: Personal News, Security Engineering

I recently got a US patent application granted by the Patent and Trademark Office. The patent bears the title "Methods Circuits Devices and Systems for Provisioning of Cryptographic Data to One or More Electronic Devices".

Full story »

  2014-02-01

CyberTech 2014

  21:10, by Hagai Bar-El   , 438 words
Categories: IT Security, Cyber Security, Events, Counter-media

I attended CyberTech 2014 on January 27th-28th. CyberTech is a respectable conference for technologies related to cyber-security. The conference consisted of lectures and an exhibition. The lectures were most given by top notch speakers from the security space, both from the public sector and from the private sector; most being highly ranked executives. The exhibition sported companies ranging from the largest conglomerates as IBM and Microsoft, to garage start-ups.

I am easy to disappoint by cyber-security conferences. Simply put, there are more cyber-security conferences than what the security industry really has to say. This implies that for the security architect or practitioner, most cyber-security conferences lack sufficient substance. I take CyberTech 2014 with mixed emotions too. The exhibition showed interesting ideas, especially by start-ups, while the lectures left more to wish for.

Full story »

  2014-01-29

SnapChat and client authentication

  21:37, by Hagai Bar-El   , 25 words
Categories: Security Engineering

Visit: http://www.discretix.com/blog/hacked-in-a-snap/

A post I have written about the SnapChat hack, and what it can teach us on the need for secure execution and secure client authentication.

  2013-12-28

Book review: Little Brother

  11:25, by Hagai Bar-El   , 336 words
Categories: Security Policies, Sources, Security

I have just finished reading Little Brother by Cory Doctorow. This book presents the story of a typical but tech savvy teenager who falls victim to harassment by the Department of Homeland Security and the police state, where every citizen is constantly tracked and monitored as a potential terrorist. The story is fictitious, of course, but those who follow the reaction of some nations to the terrorism threat and the ever increasing amplitude and sophistication of wholesale surveillance, cannot miss that while the story is factually fictitious, it is not at all implausible.

Full story »

  2013-09-15

How risky to privacy is Apple's fingerprint reader?

  22:11, by Hagai Bar-El   , 964 words
Categories: IT Security, Security Engineering

Congratulations to Apple for featuring a fingerprint reader as part of its new iPhone. It was reported by The Wall Street Journal here, in the blog of Bruce Schneier here, by Time Tech here, and in dozens of other places. Very much expectedly, this revelation spurred anxiety among the conspiracy theorists out there. The two common concerns that were raised are:

  • Apple will have a database of all our fingerprints.
  • What if someone breaks into the device and gets at our fingerprint?

(There is another line of concern, related to the fifth amendment and how its protection may be foiled by authenticating using biometrics alone, but this is a legal concern which is off topic.)

While a bit of paranoid thinking is always helpful, security engineering requires more than crying out each time a mega-corporate launches a new technology that involves private data. Assets and threats need to be determined, and then we can decide whether or not the risk is worth the benefits.

Full story »

  2013-09-13

Protecting private data: with law or with technology?

  13:54, by Hagai Bar-El   , 954 words
Categories: Security Policies, Security, Counter-media

There is an ongoing debate on the need for new regulations that protect individuals' personal data. Regulation is said to be required to protect the personal data of citizens, consumers, patients, etc., both against corporate service providers as well as against governments.

There is a growing concern about the implications of the data collection habits of social network operators, such as Facebook, as well as other service providers. Even those individuals who claim to not see any tangible risk behind the massive collection of data on themselves by service providers, still feel unease with the amount of data available on them, and on which they have no control.

On the state side, knowing that your government may monitor every single email and phone call reminds of George Orwell's book "nineteen eighty-four". It is largely agreed that this practice, if not outright eliminated, shall at least be better controlled.

This essay discusses the two possible domains for such better control: technology and regulation, arguing that the former is tremendously more effective than the latter.

Full story »

1 2 ...3 ... 5 ...7 ...8 9 10 11 12 ... 14