OpenGear Networks
Saturday, 14 August 2010
NYTimes on SSL Certificate Issues
The NYT has an article[1] in the Technology section about SSL Certificates and how the profusion of Certificate Authorities (CAs) is a security issue that needs to be addressed. The key issue is that due to the chains of trust (as accepted by browsers like IE and Firefox due to the root certificates that they ship with) entire countries could act as "countries-in-the-middle" and harvest (for lack of a better term) information that the browsers are completely unaware of. The UAE seems to be a case in point (especially with the recent RIM security issues featuring in security headlines across the glove). The article seems to be a continuation on the recent research by the EFF[2] as posted here[3] and here[4].
URL[1]: http://www.nytimes.com/2010/08/14/technology/14encrypt.html
URL[2]: https://www.eff.org/
URL[3]: https://www.eff.org/observatory
URL[4]: https://www.opengear.net/blog/2010/08/08#EFFSSLObservatory-20100808
Wall Street Journal Covers Internet Privacy and Anonymity
Over the past few days, WSJ has been covering the various facets (and fallacies) of privacy as it relates to the Internet. The articles have been quite interesting and reveal a lot of the behind the scenes goings on by various companies and how they are able to track users and their online excursions. There's one article [5] that also covers privacy as it relates to cell phone usage and location tracking. They also do offer some advise on how to avoid being tracked as well as a reasonable glossary of some terms. All in all a very nice set of reads that are quite revealing.
The series is called "What They Know" [6,7] (very appropriate!).
Nicholas Carr's article "Tracking Is an Assault on Liberty, With Real Dangers" [2], Jessica Vascellaro's "Google Agonizes on Privacy as Ad World Vaults Ahead " [3] and "On the Web's Cutting Edge, Anonymity in Name Only" [4] by Emily Steel and Julia Angwin are particularly nice reads.
On a related note, Bruce Schneier[8] has an interesting blog entry [9] on social networking data (sort of tangential to the WSJ privacy articles that are more browsing/online related vs. the social networking aspects of conscious or intentional exposure). Of course there's also a Slashdot post[9] related to it. All in all there's suddently a spurt of opinions, ideas, thoughts (with their fair share of facts) and it's been a series of interesting reads.
URL[1]: http://online.wsj.com/public/search?article-doc-type={What+They+Know}&HEADER_TEXT=what+they+know
URL[2]: http://online.wsj.com/article/SB10001424052748703748904575411682714389888.html
URL[3]: http://online.wsj.com/article/SB10001424052748703309704575413553851854026.html
URL[4]: http://online.wsj.com/article/SB10001424052748703294904575385532109190198.html
URL[5]: http://online.wsj.com/article/SB10001424052748703467304575383522318244234.html
URL[6]: http://online.wsj.com/public/page/what-they-know-digital-privacy.html
URL[7]: http://blogs.wsj.com/wtk/
URL[8]: http://www.schneier.com/
URL[9]: http://www.schneier.com/blog/archives/2010/08/a_taxonomy_of_s_1.html
URL[10]: http://yro.slashdot.org/story/10/08/10/1352244/Schneiers-Revised-Taxonomy-of-Social-Data
A Proof that P != NP from Vinay Deolalikar of HP Labs
Slashdot[1] brought this up first (at least to the Internet at large) and then came postings on Schneiers' blog [2] which also references [3]. There was also a small post in comp.compression that referenced [4].
It appears to be a serious effort but of course it is still very early to know for sure what is going on. There's a group of folks [5] (including Terence Tao) who are looking into the paper (or whatever has been published). And of course Slashdot has an update[6].
As for the basic stuff it is here[7] and here[8].
Interesting times lie ahead...
URL[1]: http://science.slashdot.org/story/10/08/08/226227/Claimed-Proof-That-P--NP
URL[2]: http://www.schneier.com/blog/archives/2010/08/p_np_1.html
URL[3]: http://rjlipton.wordpress.com/2010/08/08/a-proof-that-p-is-not-equal-to-np/
URL[4]: http://rjlipton.wordpress.com/2010/08/09/issues-in-the-proof-that-p%e2%89%a0np/
URL[5]: http://rjlipton.wordpress.com/2010/08/10/update-on-deolalikars-proof-that-p%e2%89%a0np/
URL[6]: http://science.slashdot.org/story/10/08/11/0239209/Possible-Issues-With-the-P--NP-Proof
URL[7]: http://en.wikipedia.org/wiki/P_versus_NP_problem
URL[8]: http://www.claymath.org/millennium/P_vs_NP/
Quote of the Day for 2010-08-09
We who lived in concentration camps can remember the men who walked through
the huts comforting others, giving away their last piece of bread. They may
have been few in number, but they offer sufficient proof that everything
can be taken from a man but one thing: the last of the human freedoms -- to
choose one's attitude in any given set of circumstances, to choose one's
own way.
-- Viktor Frankl, author, neurologist and psychiatrist, Holocaust
survivor (1905-1997)
Sunday, 08 August 2010
The EFF[1] has an interesting project going on - an SSL Observatory [2]. They've collected a fairly large set of SSL certificates from various (public) IPs that are running an SSL enabled HTTPS server on port 443 and then done some analysis on the various aspects of the certificates. It is a very nice study and points out how many "poorly" implemented SSL servers there are out there. They also mention some bits (pun intended) about the Debian SSL [3,4] issue as well. The accompanying presentations (PDFs, [5] and [6] are very nice reads as well. Thanks to LWN [7] for pointing this out.
URL[1]: https://www.eff.org/
URL[2]: https://www.eff.org/observatory
URL[3]: http://digitaloffense.net/tools/debian-openssl/
URL[4]: http://wiki.debian.org/SSLkeys
URL[5]: https://www.eff.org/files/DefconSSLiverse.pdf
URL[6]: https://www.eff.org/files/map-of-CAs.pdf
URL[7]: http://lwn.net/Articles/398857/