Comments for What The Hell? Security

Comment on about by hell if i know

hell if i know — Sat, 17 Jul 2010 06:40:01 +0000

You’re absolutely right. I have not addressed that. Chalk it up to “lost objectivity.” My next post will address it.

Comment on about by Eric Stott

Eric Stott — Fri, 16 Jul 2010 16:52:36 +0000

How would you solve the answer to the SSL bribes? I mean, would you put together a new authentication system altogether, or train internet users (that small subset of the world’s population) that the warning when either a company has refused to pay the SSL bribe, or created self signed certificates: should be ignored, or something altogether different?
Or am I missing the point altogether?

Comment on about by wth

wth — Fri, 16 Jul 2010 08:16:25 +0000

This is an outstanding question. One of my goals is to NEVER ridicule something unless:

(1) I have years of experience with it, AND …

(2) Those years have led me to conclude there has got to be a better way of accomplishing the goal, AND …

(3) I’ve invested a great deal of time identifying a better way, where “better” definitely includes “viable” but not necessarily “easy,” AND …

(4) I’ve persuaded a handful of security pros whom I deeply respect, that my “better” way is indeed better

Naturally I aim not to miss the mark here, so when I do or appears I do, I reckon it’s due to one or more of:

(a) Having so much to say, I have to say it in chunks e.g. The 9 Laws of Phishing, OR …

(b) I’ve lost objectivity from having thought about it so long, OR …

It would be helpful for me if you could point out one or two posts that need clarification.

Comment on about by Eric Stott

Eric Stott — Wed, 14 Jul 2010 07:43:17 +0000

I have read all of your blog entries: all VERY riveting.
I totally understand where you are coming from and totally agree that security is essentially a SHAM.
I am not a security guy, and so I ask: since you are a security guy -> what would you do different?
It appears to be be a lot of soap-box screaming, but with no suggestions on what to do better, what good is this blog?
Did I just waste an entire night reading every single blog entry searching for answers, only to walk away empty handed?

Excitedly waiting for some alternatives to SSL-Bribes.

Comment on Security and the Unforeseen Use Case by Tweets that mention Security and the Unforeseen Use Case « What The Hell? Security -- Topsy.com

Thu, 03 Jun 2010 12:49:31 +0000

[...] This post was mentioned on Twitter by Hart Rossman, Hart Rossman and Joshua Corman, Rugged. Rugged said: 'Thank you! Very few [security]/people get this. "Security and the Unforeseen Use Case" http://bit.ly/d3EcLz an interesting piece.' #Rugged [...]

Comment on Security and the Unforeseen Use Case by joe jackson

joe jackson — Thu, 03 Jun 2010 05:43:50 +0000

Nicely done. Very much in line with the rugged software manifesto.

Comment on Fishing for Red Herring Phishing Solutions by ljh

ljh — Wed, 14 Apr 2010 12:34:48 +0000

Fair enough. But since I agree that email is a vector it’s not clear to me where we diverge. And actually you’re one of a tiny group of people that know anything about phishing who have ever been willing to agree that phishing is not about email, without putting up at least a small fight.

I agree that Netflix credentials are boring in the grand scheme of things. But if I were a phisher that’s not what I’d be after if I sent a Netflix phish. I would just want you to click on the link and drop some malware your way before redirecting you to Netflix. Then I’d own you.

Anyway, I’ve spent half of ecommerce history working for an ecommerce powerhouse. We processed nowhere near the trillions that pass through a bank like yours each year, but it was plenty of billions. And PII is PII even if you can’t milk cash from it the minute you reel it in.

Comment on Fishing for Red Herring Phishing Solutions by Phishing dude

Phishing dude — Wed, 14 Apr 2010 02:49:37 +0000

So, phishing is not about e-mail? Um, DUH.

Phishing is about USING e-mail as a channel to dupe people into forking over their banking credentials. Sears.com credentials? Nope. Netflix credentials? LOL. Wells Fargo credentials? You betcha.

Tell you what — how about you go work for any company that stores other people’s money as a business, and then come talk to us about phishing, ok?

Comment on about by Cormac Herley

Cormac Herley — Sat, 10 Apr 2010 00:16:52 +0000

I’m privileged then to know the Scarlet Pimpernel of security? Best of luck as you try to save sanity from the clutches of Madame Guillotine. Will this Reign of Terror never end?

Comment on about by whatthehe11

whatthehe11 — Wed, 07 Apr 2010 02:23:56 +0000

Thank you for the high compliment Cormac. To add to the mystery: We actually know each other. :)