Page 498

New SSL Vulnerability

It’s hard for me to get too worked up about this vulnerability:

Many popular applications, HTTP(S) and WebSocket transport libraries, and SOAP and REST Web-services middleware use SSL/TLS libraries incorrectly, breaking or disabling certificate validation. Their SSL and TLS connections are not authenticated, thus they—and any software using them—are completely insecure against a man-in-the-middle attacker.

Great research, and—yes—the vulnerability should be fixed, but it doesn’t feel like a crisis issue.

Another article.

Posted on November 7, 2012 at 1:39 PMView Comments

Regulation as a Prisoner's Dilemma

This is the sort of thing I wrote about in my latest book.

The Prisoners Dilemma as outlined above can be seen in action in two variants within regulatory activities, and offers a clear insight into why those involved in regulation act as they do. The first relationship is that between the various people and organisations being regulated ­ banks, nuclear power stations, council departments, police agencies, journalists, etc, and the clear lessons from history are that even for those organisations that are theoretically in competition with each other, it is beneficial to both/all sides in the long run to use mutual cooperation in order to maximise their personal benefit. Whether it was Virgin and British Airways forming an illegal cartel to fix the price of fuel surcharges (a benefit to themselves which was paid for in increased prices for passengers); football shirt retailers (and Manchester United) being fined £16m for fixing the price of replica football shirts, or Barclays (and undoubtedly other banks) working together to fix the LIBOR rate, the reason why they do it is simple and unanswerable—it is in their benefit to do so.

[…]

However, when it comes down to the relationship between the regulators and those being regulated, then a completely different strategic dynamic comes into play. The ability of the regulated organisation to maximise personal benefit is then based on the ability to predict what the other side will do in response to the two options ­ cooperate (play nicely) or betray (screw the customer). Given that in almost all cases the regulatory body has less funds, personnel, resources and expertise than the organisation it is regulating, then it becomes clear that there is little to be gained in the long run by cooperating / playing nicely, and much to be gained by ignoring the regulator and developing a strategy that focuses purely on maximising its own personal benefit. This is not an issue of ‘right’ or ‘wrong,’ but purely, in its own terms at least (maximisation of profit, increased market share, annual bonuses, career prospects), of whether it is ‘effective’ or ‘ineffective.’

Posted on November 7, 2012 at 6:16 AMView Comments

Wanted: RSA Exhibitor for Book Signing

Is anyone out there interested in buying a pile of copies of my Liars and Outliers for a giveaway and book signing at the RSA Conference? I can guarantee enormous crowds at your booth for as long as there are books to give away. This could also work for an after-hours event.

Please let me know. I can get you a great bulk order price with my publisher.

Posted on November 6, 2012 at 10:13 AMView Comments

New WWII Cryptanalysis

I’d sure like to know more about this:

Government code-breakers are working on deciphering a message that has remained a secret for 70 years.

It was found on the remains of a carrier pigeon that was discovered in a chimney, in Surrey, having been there for decades.

It is thought the contents of the note, once decoded, could provide fresh information from World War II.

It was a British pigeon, presumed to have died while heading back to Bletchley Park.

Some more articles. Additional video.

ETA (11/5): Another article, and Bletchley Park news release.

ETA (11/6): And another.

I look forward to seeing the decryption.

EDITED TO ADD (11/25): GCHQ can’t decrypt it. They think that it’s either a one-time pad or a unique codebook.

Posted on November 5, 2012 at 1:26 PMView Comments

On the Ineffectiveness of Airport Security Pat-Downs

I’ve written about it before, but not half as well as this story:

“That search was absolutely useless.” I said. “And just shows how much of all of this is security theatre. You guys are just feeling up passengers for no good effect, which means that you get all the downsides of a search—such as annoyed travellers who feel like they have had their privacy violated—without any of the benefits. I could have hidden half a dozen items on my person that you wouldn’t have had a snowball’s chance in a supernova of finding. That’s what I meant.”

“Sir, are you hiding something?” he said, and as he did, I saw three other security guys coming our way. Oh dear.

“Of course not.” I said. “But if I had wanted to, I could have.”

“Why do you have such a problem with being searched?” another security guy said, presumably the first guy’s supervisor.

“Look, I have absolutely no problem with being searched. But if you’re going to do it, do it properly—the plane is no safer at all after this gentleman half-heartedly stroked me for a couple of seconds” I said.

“How do you mean?” the supervisor asked.

“He was stroking me as if he was trying to get me to sleep with him, not as if he was trying to find anything on me.” I said. “I’ve been searched many, many times, and in this case, I could have hidden things in my socks, taped to my thigh, taped to the small of my back, the insides of my upper arms, under my testicles or anywhere on my buttocks.”

“Why have you been searched so many times?” the supervisor asked sharply.

“I’m a police officer. I help train other police officers. When we search someone, we assume that the person who searches us may have a knife or something else they can use to harm us, so we search properly. And yes, this means that you have to take a firm grip of somebody’s groin, yes, this means that you search even the parts that are less comfortable to have searched, and yes, this means that you’re probably going to incur a couple of sexual harassment accusations along the way.” I nodded at the security guard who had searched me. “This fellow here did by far the most useless search I have ever been subjected to, and if I wanted to, I could have smuggled half a dozen knives onto the flight. I don’t have a problem with being searched at all—in fact, if you guys think it’s necessary, I’d be the first to admit that I look a little bit suspicious before I’ve had my first cup of coffee in the morning—but if you’re going to stroke me gently in front of hundreds of people, you’d better buy me a fucking drink first, is all I am saying.”

The security supervisor was standing there, frozen at my rant.

Posted on November 5, 2012 at 6:19 AMView Comments

Sidebar photo of Bruce Schneier by Joe MacInnis.