Skip to content

On protecting yourself against MITM in SSH

SSH is one of the best security protocols out there. It is used by anyone remotely logging into servers, as well as for secure connection to Git servers, and for secure file transfers via SFTP. One of the key promises of SSH is protection against active man-in-the-middle attacks. This makes SSH the best choice when connecting to a server over a hostile network, such as over a public hotspot. However, some SSH clients (particularly on mobile phones) void this protection by not caching server keys. Can you do anything about it? Yes, use private-keys instead of passwords for client authentication. Read more (also) for the technical details.

Continue reading "On protecting yourself against MITM in SSH"

Using Tor to protect against certificate injection by Hotspots

Tor is typically used to attain anonymity and preserve privacy online. This is by far the most common and appealing use for it. Most people without such concerns are not likely to ever install a Tor browser on their workstations, and it’s a pity; Tor has at least one additional use-case which is applicable to a much larger audience. This use-case is the prevention of certificate injection when using untrusted network connections.

Continue reading "Using Tor to protect against certificate injection by Hotspots"

Book review: "Data and Goliath"

After sitting in my reading list for years, I finally got to read “Data and Goliath” by Bruce Schneier. Overall, this book is as well written as all of Schneier’s books, and is just as scientifically accurate (to the best that I could tell). However, whoever the audience for his book is, they may find it missing essential parts that make it not just a pleasant read, but also a useful one.

Continue reading "Book review: "Data and Goliath""

For and against security checklists, frameworks, and guidelines

We have seen many of those by now. Starting with old ones like FIPS 140, and concluding with more recent additions as the NIST CSF (Cyber Security Framework). The question is: are whose worth my time? What are they good for? Do we need to adhere to them? In a nutshell, I think they have their value, and need to be consulted, but not worshiped.

Continue reading "For and against security checklists, frameworks, and guidelines"

Bruce Schneier on Israeli export control

I usually agree with the opinions expressed by Bruce Schneier. Seldom do I think that he is dead wrong, and yet less often do I think that an essay of his is bluntly unsubstantiated. About a month ago, he published such a post, titled: How Israel Regulates Encryption. He quoted a research that sounds sensible, but ended up interpreting it entirely wrongly, in my opinion.

Continue reading "Bruce Schneier on Israeli export control"

The status of Truecrypt (2nd edition)

It has been a while since Truecrypt was discontinued. While it still works on most platforms, including new Windows machines (except for the full-disk-encryption on some of them), and while there still is no evidence to indicate that it is insecure, users of Truecrypt find the situation bothersome; and for a good reason. By now it seems obvious than an alternative has to be found.

Continue reading "The status of Truecrypt (2nd edition)"

Unsafe IoT safes

I have been saying that one of the challenges with securing IoT is that IoT device makers don’t have the necessary security background, and the security industry does not do enough to make cyber-security more accessible to manufacturers. We should therefore not be surprised that 150 years of experience in making robust safes and transferring money securely, did not help Brinks once they introduced a USB slot into one of their new models.

Continue reading "Unsafe IoT safes"

Why secure e-voting is so hard to get

A few days ago I gave a lecture about innovation and one topic that came up was the security of e-voting. It is widely accepted by the security community that e-voting cannot be made secure enough, and yet existing literature on the topic seems to lack high level discussion on the basis for this assumption.

Following is my opinion on why reliable fully digital e-voting cannot be accomplished given its threat and security models.

Continue reading "Why secure e-voting is so hard to get"

Running an effective security research team

I have been running a security research group at Sansa Security since 2006, and while I think about it often, I never bothered to publish any post about how to run an effective security research team. So here is a first post on this topic, with an anticipation for writing additional installments in the future.

I will address a few random topics that come to my mind this moment, about staffing, external interaction, being in the know, and logging. Feel free to bring up other topics of interest as comments to this post.

Continue reading "Running an effective security research team"