Gates: Forget your passwords
29051
Biometric and smart-card technology will replace passwords to verify ID, Microsoft head Bill Gates says. Again.
392137
(InfoWorld) - Whitfield Diffie has been credited with making privacy possible in the digital age. As a co-inventor of public key cryptography, he is one of the most respected contributors to the field of computer security and is in constant demand as a speaker. In his day job as Sun Microsystemsâ chief security officer, he works out of a corner office in the Sun Labs, just down the hall from where scientists are working on Sunâs next-generation Proximity Communication processors, which seek to do away with wire connections. Although he describes his job as a âmarketingâ position, Diffie didnât sound anything like a corporate pitch man when he spoke with IDG News Service reporter Robert McMillan at his Menlo Park, California office recently. The following is an edited transcript of that conversation. InfoWorld: When the PC went on the network, there were security implications that nobody thought about. Microsoft has spent the last five years fixing all of the security problems that maybe could have been foreseen.                                                     Whit Diffie: Wait a minute. I think there are two issues. I think youâll find that lots of them were foreseen. I think the critical thing [is] that Microsoft showed that its judgment was correct. If it had paid less attention to security, maybe it would have had less market share. It had no real motivation, I think, until the last few years to try to fix these things. The interesting thing to me is why itâs been so hard for them to do so, because they must have half the smart people I know about in the industry, and in security, working for them. And I think it has to do with the problems of legacy code, and the legacy interface expectations of their customers. IW: Nowadays we donât hear about widespread security outbreaks, but thereâs a sense that many of the things we do on the Internet are not trustworthy. People going to Web pages do not have confidence that they are where they think they are. WD: I think thatâs a well-placed misconfidence. IW: So, are things getting better? WD: I certainly donât worry about the security arrangements of going to Americanexpress.com, where I probably make the single largest most routine money transfer that I initiate. Iâm not the least bit worried about that, partly because of the law, and partly because the essential point of SSL [Secure Sockets Layer â a standard used in secure Web connections] is not about the quality of the cryptography but about the fact that the certificate costs enough money that the thieves arenât putting up a front. IW: I think that ties into an interesting point you made earlier: This lack of security is a fair price to pay for growth. WD: Look at Microsoft. It has 99 percent penetration in the Chinese market and 1 percent payment in the Chinese market. The business asset to them of being able to claim that they were ripped off at the same time that they gained this market of one billion people is fantastic. IW: What are your current thoughts on privacy? WD: I believe in privacy, but privacy is just one of a number of considerations. Privacy of political conversation is essential for a democratic society. Is the privacy of information about yourself necessary for it? Thatâs not very clear. Itâs a very squishy concept. In small communities, you have very little privacy, but you have accountability because you know who the members of the community are. What bothers me is that information about people is so readily available in a way not auditable to them, to organizations like ChoicePoint, who broker it around and enable other people, who are not legally constrained in what they do with it, to make decisions based on it. I am, on balance, more pleased with the fact that I can learn lots of information about people in minutes by using the Web than I am concerned about the fact that people can learn lots of information about me that way. And I would not like to see laws that restrict peopleâs ability to go investigate things. Hereâs my scenario: For all its current faults, it wonât be 10 years before facial recognition gets incredibly good. So everybodyâs camera will be saying "hi" to the people who go by. Would I like to see that outlawed? I think what outlawing it would be saying [are] that certain classes of big boys â the Fortune 1,000, the secret police â would be allowed to have access to such information, but you little irresponsible children wonât be. So I have a cowboy viewpoint on this.
598143
(InfoWorld) - A security researcher who collected thousands of sensitive e-mails and passwords from the embassies of countries such as Russia and India blamed systems administrators on Monday for not using encryption to shield their traffic from snooping. Dan Egerstad, a 21-year-old security researcher, revealed on Monday he was able to capture the information by setting up his own node in a peer-to-peer network used by the embassies to make their Internet traffic anonymous. The embassies relied on a volunteer network of servers using software calledÂ Tor (The Onion Router)Â to hide their Internet traffic and make it anonymous. Traffic sent through a Tor node is transmitted through a randomly selected series of other Tor nodes before exiting the network for its intended destination, so as to disguise the source and destination of the traffic. But although traffic between nodes in a Tor network is encrypted by default, traffic entering and exiting the system is not, so anyone wanting to hide not only who are they are communicating with, but what they are saying, must apply an extra layer of encryption themselves. Embassies and companies neglected to do this, which left their information open for Egerstad to collect. Anyone can run a Tor server and add it to the network. Egerstad, who runs his own consulting company in Malmo, Sweden, did just that as part of his security research, and monitored the traffic exiting the Tor network through it. To his surprise, he found that more than 99 percent of the traffic -- including requests for Web sites, instant messaging traffic, and e-mails -- were transmitted unencrypted. "By accident, I saw one really sensitive e-mail," Egerstad said in a telephone interview. "I thought 'What is that doing there?"" Using specially designed software to search that traffic for keywords, Egerstad was soon collecting usernames, passwords, and e-mail sent by embassies around the world, as well as large companies. Late last month, Egerstad published the usernames and passwords for around 100 embassies. Egerstad said the process of snooping on the traffic is trivial. The problem is not with Tor, which still works as intended, but with users' expectations: the Tor system is designed to merely anonymize Internet traffic and does not perform end-to-end encryption. "If they are using encryption -- no problem, it doesn't matter," Egerstad said. Organizations running other Tor nodes could also be snooping on traffic exiting the network there, Egerstad warned. For example, several Tor nodes in the Washington, D.C., area can handle up to 10TB of data a month, a flow of data that would cost at least $5,000 a month to run, and is likely way out the range of volunteers who run a node on their own money, Egerstad said. "Who would pay for that?" Egerstad said. Egerstad said he read a lot of the e-mail he collected but has since wiped the hard drives and deleted the information. After he posted the usernames and passwords to his Web site, he said he received an e-mail from the U.S. company hosting the site informing him that it would be shut down. He has since created a new site. Egerstad said what he did is not illegal, as the e-mail and passwords he collected were contained on his own computer. He said he did not use the usernames and passwords to log into any accounts, although one journalist in India did. The point of his work is to raise awareness of security concerns, he said: "Go ahead and use Tor, but you better be sure you have good encryption." Â
90778
It only takes 20 minutes on the Internet for an unprotected computer running Microsoft Windows to be taken over by a hacker. Any personal or financial information stored
405148
Passwords are out and tokens are the authentication wave of the future, right? Not so fast, says Jon Espenschied. The next next thing is both stranger and more familiar.
321146
Fornisce password e indicazioni per esaminare i computer
416981
To see the e-mail I get every day from readers about security issues is to develop a deep discomfort with the state of computing today. Keeping a Windows PC safe can demand a high degree of vigilance. -Rob Pegoraro
338524
Keeping information secure in this age of laptop-lugging workers is the tech industry's most formidable challenge, Microsoft Corp. Chairman Bill Gates said Tuesday.
475065
A new product from Microsoft Corp.&#39;s hardware group aims to eliminate the need for that not-so-secret list of user names and passwords hidden in the typical desk drawer.
235413
Data Traveler Secure Privacy Edition U.S.B. port is not just password-protected but also scrambled using high-strength, 256-bit encryption.
224951
Those who have not changed the default passwords on their home routers may be putting themselves at risk of attack, researchers at Indiana University and Symantec are warning.
532182
In Tunisia, Iran's password is "Tunisia" Underscoring a major susceptibility threatening thousands of high-profile computer users across the world, a Swedish security consultant has published login credentials belonging to some 100 embassies.â¦
3066
Skype warns users password-stealing Trojan horse is making the rounds, disguised as a Skype security plug-in
450803
Sneaky program takes a different tack to capture people's passwords and potentially steal money.
101788
MIT researchers develop an authentication system that's not so easily revealed to prying eyes.
631605
Microsoft can't stop crowing about new Vista security features. But the system still has holes. Here's how to plug them.
87414
A few of my previous columns discussed my vision of creating a more secure Internet. It involved replacing the Internet's default anonymity with pervasive authentication, from the hardware initialization, through the OS and all applications, the user, and ending with a verifiable network stream. It is my strong belief that without a complete overhaul of default authentication, malicious hacking is going to continue indefinitely.