Forgot your password?

typodupeerror

+ - The state of information security today->

Submitted by tanawts
tanawts writes "Capturing a recent topic posed during a panel at CERIAS Symposium, Gene Spafford breaks down the problems of the industries current response to computer security today.

The article touches on recent government involvement, pwn2own style competitions, and the vicious cycle of IT professionals being pulled into incident after incident without being allotted the time and priority to correct the systemic problems that cause these security fiascos.

"There's another barn on fire! Quick, get a bucket brigade going — we need to put the fire out before everything burns. Again. It is getting so tiring watching all our stuff burn while we're trying to run a farm here. Too bad we can only afford the barns constructed of fatwood. But no time to think of that — a barn's burning again! 3rd time this week!""

Link to Original Source

+ - Crisis averted in BIOS source code leak->

Submitted by mask.of.sanity
mask.of.sanity writes "The world's largest BIOS vendor has attempted to calm rising panic over the leak of the cryptographic signing keys and source code for its UEFI BIOS
A Taiwanese vendor had left a file transfer protocol server open for anyone to browse and download internal emails and the source code for the vendor's UEFI BIOS and cryptographic signing keys.
The company, American MegaTrends, said the security keys on the ftp server were not used for production systems."

Link to Original Source

Comment: Re: Improve infrastructure, don't inact laws to p (Score 1) 80

by tanawts (#43380223) Attached to: Why Laws Won't Save Banks From DDoS Attacks
To put it another way. The wolf does not adhere to the laws of the little pigs. If your tired of him blowing your house down, you need to stop thinking about patching holes in your straw house. Reenforcing reeds isn't a scalable solution. You need to start building the houses with bricks.

Comment: Re: Improve infrastructure, don't inact laws to pr (Score 1) 80

by tanawts (#43380175) Attached to: Why Laws Won't Save Banks From DDoS Attacks
I'm not sure that we have a choice. "Because its hard" is probably not going to be a sufficient excuse with respect to the critical mass we are heading toward. If everything that the world has invested in standing on top of the Internet is so important, than all that important stuff is going to need to experience the growing pain of adapting to new redesigned transit protocols. The alternative seems to be a sheer cliff.

Comment: Improve infrastructure, don't inact laws to prolif (Score 2) 80

by tanawts (#43376411) Attached to: Why Laws Won't Save Banks From DDoS Attacks
Given that a lot of these problems stem from inherent design flaws with our current Internet protocols, perhaps we ought to start improving upon the 20 and 30 year old protocols we've been relying on. Fundamental scale and design flaws will continue to empower bad people to do bad things so long as it continues to be nearly effortless. BGP, DNS, IPv4... You can only build on a foundation for so long before its age and brittleness beings to cause serious problems.

Comment: Re:Only Paypal or Amazon (Score 1) 58

by junk (#42383989) Attached to: Internet Archive Needs Donations, Has Matching Donor

I went to donate and saw that. I'm actually very unhappy about it but I won't be able to donate because they only accept payment via systems I don't trust. If there a direct payment option, I'd have opened my wallet immediately but I refuse to do business with PayPal and just don't trust Amazon. Call me paranoid but it is what it is.

Comment: Re:Defective Microsoft (Score 5, Insightful) 65

by junk (#41980219) Attached to: Skype Disables Password Resets After Huge Security Hole Discovered

I almost feel sorry for them discovering this just after they discontinued Microsoft Messenger and moved people on to Skype. To be fair I expect this hole existed when they brought Skype.

I’m not so sure about that, y’know. It would likely have been discovered by now.

I expect it’s a side effect of the migration of MSN users to Skype as it likely requires changes to both Skype and its backend.

It's not new. I have an email address that people assume doesn't exist and rt they sign up for things all the time. About two years ago, I received a password reset mail from Skype. When I went to reset it (as I do with every random account people sign up for with my email), they gave me the option to reset about a half dozen accounts. I now maintain a list of burner Skype accounts that had previously used my address.

Fun fact: you are limited to 4 successful resets, per email address, per day.

Q: What is the difference between a duck? A: One leg is both the same.

Working...