Securology

I am a big fan of Dan Geer (image at left); he always has an interesting perspective on security issues, but that's not to say I agree...

The three categories of authentication : Something you know Something you have Something you are Physical hardware tokens, like RSA's Se...

F-Secure's blog is discussing how there are more bad TOR nodes out there. I discussed awhile back how TOR's goal of anonymity is ...

Of course, the media are spinning this as " don't encrypt your laptop and you could go to jail " when the goal of the legislat...

Recently, law enforcement acquired confidential email messages from the so-called secure email service , Hushmail . Law enforcement explo...

Extended Validation (EV) SSL Certificates are one of the information security industry's worst cover-ups. And to make matters worse, it...

There has been a lot of discussion around retailers pushing back on the PCI (Payment Card Industry) Data Security Standards group. The...

So many of computer security implementations today depend on what I call "opt-in" security. It could be called " trusted cli...

One of the biggest problems with security threats in the Web 2.0 world is the erosion of trust boundaries . Dynamic web applications pull ...

There is a pretty good article over at LWN.net about the state of Trustworthy Computing in Linux , detailing the current and planned support...

I hold out hope for this project: Cornell University's Nexus Operating System . There are only a few publications thus far, but the ide...

I never have quite figured out why people will put a download link with a SHA-1 or MD5 hash output side-by-side on the same web page. Someb...

Dartmouth College researchers Denise Anthony and Sean W. Smith recently released a technical report of some very interesting research aro...

For years, one of my biggest frustrations with vendors claiming to have "enterprise" software applications (I'm talking genera...

Rootkits , in general, are of extreme interest to me-- not because of what can be done with them (I can assume anything can be done with th...

There's a buzz around the Microsoft URI Handlers . Basically, applications that rely on that Windows service can be handed data that is...

From a recent Secunia advisory post : " Solution: Do not browse untrusted websites, follow untrusted links, or open untrusted .PD...

Recently, I noted that it's not important whether source code is open or not for security , it's important to have well-qualified an...

I just came across this on Jon Callas' CTO Corner just now (11 PM GMT, when I started this draft). I had a busy day Friday (obviously...

Again, inspired by the PGP WDE Bypass Issue ... I am not the only one in the world that uses the term " backdoor " in a generic...