Years ago, we did not trust cloud service providers, or we trusted them only when we had no choice. Then, consumers started using web-mail and other such services, and finally companies also moved into replacing their own IT with cloud applications. By now, we trust our service providers sufficiently, for the most part. We model our risks, we consider the benefits, and we usually decide that it’s worth it. But often enough, our trust in service providers still does not cause us the necessary warm and fuzzy feeling that is required for us to hand off all our data to the cloud and live a truly digital life. As it seems, thinking you are secure is one thing, and feeling you are sufficiently secure, even with your most critical data, is something else.
What do we do for now? – Use the cloud, but not for everything…
Continue reading "The effect of cloud services on our intimacy with IT"
How can you tell apart real company values from more superficial mantras or slogans?
There is one objective mark for values: they fight and they win, when contesting on scarce resources of any type.
A real company value wins fights against other interests when competing on budget, resource allocation, and other cost-bearing priorities.
If it does not fight – it’s not a value but a preference.
If it does not win – it’s not a value but a show.
One reason we struggle with finding a solution to the fake news problem is that we have never defined the problem properly. The term “fake news” started as referring to publications that look like news but are entirely fabricated. It then migrated to consist also of news articles that are just grossly inaccurate, to later expand further into consisting also of news one doesn’t like and tries to dispute.
It is amusing to see how we seek technical mitigation towards a problem which is entirely semantic. Just like a lie detector does not detect untruths but only the artifacts of a lying person, all technologies that are considered for fighting fake news do not detect untruths but mostly willful propaganda. However, just like plain deceiving, publishing propaganda also consists of many shades of grey, implying that whatever solutions we find, we will never be happy with them.
We should recalculate our route.
Continue reading "The Fake News problem will not be solved by technology"
The book “Permanent Record” is best known for its author, Edward Snowden, the whistleblower who released enormous amounts of secret NSA documents to the press, alleging that the intelligence community in the US violates the rights of citizens for privacy by implementing wide-reaching programs of wholesale surveillance. This is the second book I review that discusses Ed Snowden and his revelations; the previous book I reviewed was “No Place to Hide” by journalist Glenn Greenwald.
Continue reading "Book review: "Permanent Record""
Do you know what all security documents have in common? — they all were at some time called “threat model”… A joke indeed, and not the funniest one, but here to make a point. There is no one approach to threat modelling, and not even a single definition of what a threat model really is. So what is it? It is most often considered to be a document that introduces the security needs of a system, using any one of dozens of possible approaches. Whatever the modelling approach is, the threat model really has just one strong requirement: it needs to be useful for whatever purpose it is made to serve. Let us try to describe what we often try to get from a threat model, and how to achieve it.
Continue reading "Useful threat modelling"
Computers today already know how to draw great paintings using artificial-intelligence (AI) algorithms, after analyzing many real-human paintings. A sales house just sold one machine-generated portrait painting for $540,000, and by now there are startups that produce AI-generated portraits for $40 a piece. On the musical front, there already are algorithms that, after analyzing compositions made by Bach, compose “Bach” symphonies that even avid listeners cannot tell apart from the real thing. This brings up the question of what’s in the future for artists, now that machines create art that is indistinguishable from that produced by humans.
The same question (at a lower scale) has also been asked about security professionals. Now that machine learning algorithms can tell good from bad when looking at any type of event data, what would human security analysts be left to do? Traditionally, machines used to only sort through records using rules that humans wrote for them, but as it seems, machines are constantly getting better at writing those rules for themselves as well.
So should both worry for their jobs? It is my stance that not at all, and for surprisingly similar reasons.
Continue reading "What will artists do when AI makes art? ...Same as security architects"
We grow increasingly reliant on quite a few Internet-based services: social networks, messaging, photo sharing, and the rest. The challenges we face with privacy, data ownership enforcement, surveillance, and other aspects of digital abuse could all be substantially reduced if those data sharing needs were addressed by the Internet as it was originally architected: decentralized and open. We have waited very long, and so remediation would take more than just new standards, but it is doable.
Continue reading "Time to reclaim the Internet"
SSH is one of the best security protocols out there. It is used by anyone remotely logging into servers, as well as for secure connection to Git servers, and for secure file transfers via SFTP. One of the key promises of SSH is protection against active man-in-the-middle attacks. This makes SSH the best choice when connecting to a server over a hostile network, such as over a public hotspot. However, some SSH clients (particularly on mobile phones) void this protection by not caching server keys. Can you do anything about it? Yes, use private-keys instead of passwords for client authentication. Read more (also) for the technical details.
Continue reading "On protecting yourself against MITM in SSH"
Tor is typically used to attain anonymity and preserve privacy online. This is by far the most common and appealing use for it. Most people without such concerns are not likely to ever install a Tor browser on their workstations, and it’s a pity; Tor has at least one additional use-case which is applicable to a much larger audience. This use-case is the prevention of certificate injection when using untrusted network connections.
Continue reading "Using Tor to protect against certificate injection by Hotspots"
After sitting in my reading list for years, I finally got to read “Data and Goliath” by Bruce Schneier. Overall, this book is as well written as all of Schneier’s books, and is just as scientifically accurate (to the best that I could tell). However, whoever the audience for his book is, they may find it missing essential parts that make it not just a pleasant read, but also a useful one.
Continue reading "Book review: "Data and Goliath""