Tag Archives: Security

The//Intercept on Choosing Passwords

Posted on 2015-04-08 by jcs

The//Intercept has an excellent article on how to choose secure passwords that are (relatively) easy to remember. The problem with passwords is that they are almost never secure. Most people choose stupid ones (password, 123456, \(\dots\)) and even those of … Continue reading →

Posted in General | Tagged | Leave a comment

HTTP/2 and TLS

Posted on 2015-03-25 by jcs

Speaking of nosy Parkers, the Open Web Alliance is annoyed that HTTP/2 will make it harder for them to spy on you and is lobbying against mandatory encryption in HTTP/2. Sadly, they’ve won the first round. The Open Web Alliance … Continue reading →

Posted in General | Tagged , | Leave a comment

The Difference Between Malware and Adware

Posted on 2015-03-16 by jcs

Infosec Taylor Swift has a clarification for Lenovo, other computer manufacturers, and the journalists who report on them: Journalists: "Adware" is malware with a legal team. — InfoSec Taylor Swift (@SwiftOnSecurity) February 19, 2015

Posted in General | Tagged | Leave a comment

Do As I Say…

Posted on 2015-03-07 by jcs

An almost too delicious piece of hypocrisy.

Posted in General | Tagged , | Leave a comment

What Happens When You Build In Backdoors?

Posted on 2015-03-07 by jcs

They end up biting you in the butt. Matt Green’s post is a nice explanation of the FREAK exploit. You can read his post for the technical details, which, really, aren’t that interesting except that they show how making it … Continue reading →

Posted in General | Tagged , | Leave a comment

Just When You Thought It Couldn’t Get Worse

Posted on 2015-02-28 by jcs

What could make the Lenovo/SuperFish scandal worse than it already is? This could: .@iblametom @Forbes @kristamonster May I rephrase? “$250,000 is all it takes for Lenovo to sell its customers out.” — Reginald Braithwaite (@raganwald) February 27, 2015 If true and … Continue reading →

Posted in General | Tagged , | Leave a comment

And So It Begins

Posted on 2015-02-23 by jcs

The lawyers will be happy.

Posted in General | Tagged , | Leave a comment

Everybody Wants Ta Get Inta Da Act

Posted on 2015-02-23 by jcs

Apologies to Jimmy Durante but everyone, it seems, is waging man-in-the-middle attacks. The latest perpetrator is the provider of in-flight WiFi, Gogo. Google security engineer Adrienne Porter Felt, while on a flight, discovered that Gogo was serving up fake SSL … Continue reading →

Posted in General | Tagged , | Leave a comment

Lenovo Denies Security Problems

Posted on 2015-02-22 by jcs

It’s infuriating that Lenovo continues to deny that SuperFish is a security threat. They keep saying that they’ve stopped installing it but that in any case SuperFish didn’t collect or store any private information. Doubtless that’s true but it’s a … Continue reading →

Posted in General | Tagged , | Leave a comment

MITM Coming to a Job Near You

Posted on 2015-02-21 by jcs

Just in case you think that man-in-the-middle attacks are just for the victims of Lenovo’s shenanigans, there’s this .@mountain_ghosts Such as this lovely device, which goes by the Orwellian name of an "SSL Visibility Appliance": https://t.co/TEmLfOTZnt — Nick Stenning (@nickstenning) … Continue reading →

Posted in General | Tagged , | Leave a comment