swillden - Slashdot User

Submission + - Details of iOS and Android Device Encryption

Submitted by swillden on Monday October 06, 2014 @03:36PM

swillden writes: There's been a lot of discussion of what, exactly, is meant by the Apple announcement about iOS8 device encryption, and the subsequent announcement by Google that Android L will enable encryption by default. Two security researchers tackled these questions in blog posts:

Matthew Green tackled iOS encryption, concluding that at bottom the change really boils down to applying the existing iOS encryption methods to more data. He also reviews the iOS approach, which uses Apple's "Secure Enclave" chip as the basis for the encryption and guesses at how it is that Apple can say it's unable to decrypt the devices. He concludes, with some clarification from a commenter, that Apple really can't (unless you use a weak password which can be brute-forced, and even then it's hard).

Nikolay Elenkov looks into the preview release of Android "L". He finds that not only has Google turned encryption on by default, but appears to have incorporated hardware-based security as well, to make it impossible (or at least much more difficult) to perform brute force password searches off-device.

Submission + - What examples of Security Theater have you seen? 1

Submitted by

swillden

on Wednesday May 28, 2008 @11:57AM

swillden writes: "Everyone who pays any attention at all to security, both computer security and "meatspace" security, has heard the phrase Security Theater. For years I've paid close attention to security setups that I come in contact with, and tried to evaluate their real effectiveness vs their theatrical aspects. In the process I've found many examples of pure theater, but even more cases where the security was really a cover for another motive.

Recently, a neighbor uncovered a good example. He and his wife attended a local semi-pro baseball game where security guards were checking all bags for weapons. Since his wife carries a small pistol in her purse, they were concerned that there would be a problem. They decided to try anyway, and see if her concealed weapon permit satisfied the policy. The guard looked at her gun, said nothing and passed them in, then stopped the man behind them because he had beer and snacks in his bag. Park rules prohibit outside food. It's clear what the "security" check was really about: improving park food vending revenues.

So, what examples of pure security theater have slashdotters noticed? Even more interesting, what examples of security-as-excuse have you seen?."

Submission + - Should the GPL be used as a click-wrap?

Submitted by

swillden

on Thursday September 21, 2006 @09:57AM

swillden writes: "I've come across an increasing number of GPL programs lately that display an EULA-style click-wrap agreement during installation. While not exactly wrong, this seems like a bad idea to me, since it perpetuates the idea that you must agree to some arbitrary set of conditions in order to install and use a piece of software. In this case the conditions are very liberal (there are none, really), but still it reinforces the notion that you can't install a package unless you agree.

The FSF says that such click-wrapping is neither required nor forbidden but it seems like a bad idea to promote the click-wrap meme, even if the license is user-friendly. What do slashdotters think?"

Slashdot Top Deals