HackerCode

Encrypting the whole network

In a prime example of better living through math, the group behind the Pirate Bay wants to encrypt everything, or at least everything that moves across a network.

From newteevee.com:

The team behind the popular torrent site The Pirate Bay has started to work on a new encryption technology that could potentially protect all Internet traffic from prying eyes. The project, which is still in its initial stages, goes by the name "Transparent end-to-end encryption for the Internets," or IPETEE for short. It tackles encryption not on the application level, but on the network level, the aim being that all data exchanged on your PC would be encrypted, regardless of its nature -- be it a web browser streaming video files or an instant messaging client. As Pirate Bay co-founder Fredrik Neij (a.k.a. Tiamo) told me, "Even applications that don't supporting encryption will be encrypted where possible." [From The Pirate Bay Wants to Encrypt the Entire Internet « NewTeeVee]

This is sure to annoy Comcast. Here's the project page.

freedom, net neutrality, comcast

United States ranks 48th in freedom of the press

The United States was ranked 48th in press freedom by Reporters Without Borders 2007 index. Countries with greater freedoms include Estonia, Boznia, Ghana, and Taiwan.

From the announcement:

There were slightly fewer press freedom violations in the United States (48th) and blogger Josh Wolf was freed after 224 days in prison. But the detention of Al-Jazeera's Sudanese cameraman, Sami Al-Haj, since 13 June 2002 at the military base of Guantanamo and the murder of Chauncey Bailey in Oakland in August mean the United States is still unable to join the lead group. [From Reporters sans frontières - Annual Worldwide Press Freedom Index - 2007]

Here's a link to the index itself, and its methodology.

Community, Culture, propaganda, freedom, blog, politics

Catching up after a brief vacation

I've been on the road for almost a week and am finally able to catch up on everything, so here are some of the more interesting tidbits that I've been reading while I'm away.

A bit on log policy from Anton Chuvakin:

I did this VERY fun webcast with WhiteHatWorld this week and a lot of good questions about log management came up. I am answering them here for my readers. BTW, LogLogic product-specific questions can be found on LogLogic website; I am not answering them here. [From Anton Chuvakin Blog - "Security Warrior": More Log Management Questions - Answered!]

Some questions about the ethics of vulnerability research from Information Security Magazine via TaoSecurity:

One of my favorite sections in Information Security Magazine is the "face-off" between Bruce Schneier and Marcus Ranum. Often they agree, but offer different looks at the same issue. In the latest story, Face-Off: Is vulnerability research ethical?, they are clearly on different sides of the equation. [From TaoSecurity: Response to Is Vulnerability Research Ethical?]

Now some Bruce Schneier on selling security:

It's a truism in sales that it's easier to sell someone something he wants than something he wants to avoid. People are reluctant to buy insurance, or home security devices, or computer security anything. It's not they don't ever buy these things, but it's an uphill struggle. The reason is psychological. And it's the same dynamic when it's a security vendor trying to sell its products or services, a CIO trying to convince senior management to invest in security or a security officer trying to implement a security policy with her company's employees. [From Schneier on Security: How to Sell Security]

I'll post the latest vulnerabilities I've been following in the next post.

policy, research, Security, Bruce Schneier, vulnerability, ethics, logs

The Cost of Compromised Data

There are always going to be studies that show how much data breaches cost companies, mostly because it's a factoid that security researchers think will persuade the C-level types.

The flip side is that the frequency of these data breaches among peer organizations lessen the impact when it "happens here" and that the financial downside is just a cost of doing business.

It can also promote a culture of cover-ups. If it's a common thing, then there's no reason to make a big deal of it.

From Gene Schultz over at Hightower Software:

A recent study by the Ponemon Institute shows, for example, that 55 percent of participants in this study said they had been informed of more than one security compromise involving their personal data over the last two years, and eight percent said that they have been informed of four or more of such compromises.

The Ponemon Institute's study also shows that 63 percent of the survey participants reported that the letters they received after data security compromises had occurred contained no information concerning what to do to safeguard their data afterwards. Furthermore, the majority of the respondents indicated that more than a month had transpired before they were finally informed that their personal data were compromised. At the same time, however, 98 percent of those who had fallen victim to a data security compromise actually became victims of identity theft afterwards. Most significantly, almost one out of every three individuals who were informed of a data security compromise involving their personal data have ceased doing business with the company that experienced the incident. [From High Tower Blogs > Security Insights » Blog Archive » The Business Costs of Security Compromises]

Over one third of Chileans' information compromised

from Adam Shostack at Emergent Chaos, 6/16th of Chileans personal information leaked by hacker:

A hacker in Chile calling himself the 'Anonymous Coward' published confidential data belonging to six million people on the internet.

Authorities are investigating the theft of the leaked data, which includes identity card numbers, addresses, telephone numbers, emails and academic records.

Chile has a population of about 16 million, so that's 3/8ths of the country.

See "ALERTA: Se filtran datos personales de 6 millones de chilenos vía Internet" (Google translated). The blogger, Leo Prieto, gets a rude awakening when he reads the law, "¿Es privada la información personal en Chile?" (see translated version)

More than a third of a nation has been compromised by this "Anonymous Coward" (Slashdot reference anyone?), making this one of the most significant data releases to date. I bet the American media ignores it completely ...

Google Friends Connect

from O'Reilly Radar, Google Friend Connect Previews Tonight:

Later today Google is going to preview Friend Connect (it's not live yet at http://www.google.com/friendconnect), a product that lets any website host OpenSocial applications. These applications will enable a site's user to interact with their social network from other sites (assuming they are logged in). Initially users will be able to see their networks from Facebook (using their APIs), Google Talk, and Orkut. Future participants will include hi5 and plaxo.

Initially Google will be letting websites in slowly. Upon acceptance webmasters will be able to submit their website (URL and name) and select colors. They can then select applications for their site from a new application gallery.

The user experience is simple. When a user comes to a site in the Friend Connect program they can sign into any social network that is sharing their data. Their data is not actually shared with the site. Impressively Google is supporting OpenID and OAuth in addition to their own standard OpenSocial.

This sounds like it's expanding identity management from the authentication piece that projects such as OpenID and Shibboleth tackle to explore a richer version of identity.