Confero Litterae

Privacy: when using a Web Browser

Vijay Pasupathinathan — Sun, 11 Jan 2009 04:32:18 +0000

Browser Privacy has gained a lot of attention and all major developers are jumping on the bandwagon (refer here here). gHacks has a nice blog entry and refers to a paper by Katherine McKinley.

The author says ”Unfortunately, the privacy modes offered by browsers are still evolving (several are only available as betas), and none remove all the tracking data users might expect them to block. A tool was created to set and report on different data stores. This paper presents the findings from running this tool using several major browsers with two plug-ins across three common operating systems. We find current browsers are unable to extend tracking protection to third party plug-ins such as Google Gears and Adobe Flash. Some of these require no user prompting under common configurations and even expose tracking data saved with one browser sites visited by a different browser.”

The Internet was never designed to protect privacy. Every IP is traceable. Tor is a good but painfully slow, and an organisation with resources can track back and find a person IP. Personally, I think private browsing in browsers is only for those who are trying to hide their behaviour from a family member rather than from any external entity.

An implication of this “private browsing” mode is that it makes parental supervision of a child’s browsing behaviour difficult. An option would be for browsers to implement parental controls so they can be switched off if required.

Attack on SSL

Vijay Pasupathinathan — Wed, 31 Dec 2008 04:29:27 +0000

Over the past couple of days there has been a lot of news about a group of researchers breaking SSL (to point a few visit here here here ). I mostly agree with Bruce and Ben, MD5 has been broken for many years (WEP comes to mind). The attack itself is interesting, but I think the solution involves decisions to be made at a management level.

Bruteforce attack on RFID in E-Passport

Vijay Pasupathinathan — Tue, 03 Jul 2007 08:32:33 +0000

CSO has an interesting piece on a attack on RFID chips in UK e-passport. More details at here.(technical)

A security expert has cracked one of the U.K.’s new biometric passports, which the British government hopes will cut down on cross-border crime and illegal immigration.

The attack, which uses a common RFID (radio frequency identification) reader and customized code, siphoned data off an RFID chip from a passport in a sealed envelope, said Adam Laurie, a security consultant who has worked with RFID and Bluetooth technology. The attack would be invisible to victims, he said.

Computerworld – How to become an exceptional security manager

Vijay Pasupathinathan — Mon, 30 Apr 2007 08:33:34 +0000

A good article for all security managers. Link

How many of us work in computer security environments where basic security recommendations are not applied consistently? I think it is nearly impossible to find a company that consistently and universally applies basic security tenets. So, we have inconsistencies, cracks in the system, and bad things are allowed to occur. The very human nature of purposefully allowing inconsistency as a norm leads to below-average outcomes. Taking a personal and institutionalised interest in applying basic security principles consistently will mitigate more risk and lead to a more secure environment.

What do you do as CISO ?

Vijay Pasupathinathan — Fri, 02 Feb 2007 08:30:48 +0000

A good article looking at CISO/CSO’s

Becoming the chief information security officer (CISO) of a corporation makes you a strategic IT advisor to business management, the chief information officer, and the rest of the information technology staff. Just as no company is the same as another, the job of CISO — or alternately, “chief security officer,” which might include physical security as well — isn’t either. The four security professionals who share their priorities with us make it clear there’s nothing cookie-cutter about the top IT security job.

New Voting Protocol by Rivest

Vijay Pasupathinathan — Sun, 01 Oct 2006 08:29:11 +0000

Rivest presents “The ThreeBallot Voting System”

We present a new paper-based voting method with interesting security properties. The attempt here is to see if one can achieve the same security properties of recently proposed cryptographic voting protocols, but without using any cryptography, using only paper ballots. We partially succeed.

The paper can be obtained from his website at pdf