infosec

SSL is still garbage.

Apropos of the Shop outage yesterday: It is trivially easy (albeit usually expensive) to strip SSL connections, and do it in a way most end-users won’t be able to detect.

Alis2018-09-18T10:36:53+00:0018th September, 2018|Tags: infosec, ssl, tech|Comments Off

Bad life choices.

James Mickens on machine learning, AI, and security.

From the keynote’s summary:

Using case studies involving machine learning and other hastily-executed figments of Silicon Valley’s imagination, I will explain why computer security (and larger notions of ethical computing) are difficult to achieve if developers insist on literally not questioning anything that they do since even brief introspection would reduce the frequency of git commits.

Alis2018-09-10T08:24:52+00:005th September, 2018|Tags: infosec, tech|1 Comment

Space worms.

So you know that scene in Independence Day where Will Smith uses a Mac to beam the virus onto the alien ship? The one that everyone lols about now?

Yeah well… what happens if aliens did it to us, instead?

Alis2018-03-14T11:22:01+00:0025th August, 2018|Tags: infosec, tech|Comments Off

The world expert on password analysis (no, really) looks at the “secret codes” posted by QAnon conspiracy trolls… and determined they’re very obviously just keyboard mashing. The methodology used to determine this is pretty interesting, too, and makes total sense when explained. You can even follow along yourself at home!

Also of interest: the “codes” were almost certainly generated by someone using a QWERTY keyboard, which probably means someone in the US (UK keyboards have slightly different symbol arrangements above the number keys, as do Russian keyboards that have joint Cyrillic/English layouts).

Alis2018-08-15T08:45:17+00:0015th August, 2018|Tags: culture, infosec|Comments Off

Common goods.

Data privacy is not like a consumer good, where you click “I accept” and all is well. Data privacy is more like air quality or safe drinking water, a public good that cannot be effectively regulated by trusting in the wisdom of millions of individual choices. A more collective response is needed.

Part of the problem with the ideal of individualized informed consent is that it assumes companies have the ability to inform us about the risks we are consenting to. They don’t. Strava surely did not intend to reveal the GPS coordinates of a possible Central Intelligence Agency annex in Mogadishu, Somalia — but it may have done just that. Even if all technology companies meant well and acted in good faith, they would not be in a position to let you know what exactly you were signing up for.

Zeynep Tufekci on risk.

Alis2018-02-06T09:46:40+00:0024th July, 2018|Tags: infosec, privacy|12 Comments

Hinted text.

Encoding a text-within-a-text by using almost-imperceptible changes in the shape of letters in a font.

Alis2018-06-15T07:21:39+00:0013th June, 2018|Tags: infosec, privacy|3 Comments

SSL is terrible, pt. 495.

Tl;dr, like everything else with SSL, EV is fucking broken.

Because I will forever be, at heart, a huge brat, one of my favorite questions to ask people who pretend to know about INFOSEC is, “So what, exactly, is the point of SSL?” (Or TLS, or HTTPS, or however you want to word it.)1

Pretty much no one, in the field or out of it, gets the answer to this question correct. I’ve written about it before 2 but, tl;dr version, the original intent of SSL was to link an online presence with a real-world entity. The problem is that the validation requirements were, well. Expensive. Like, thousands of dollars worth of expensive, which is how much a “real” SSL certificate is supposed to cost. Because the CA that issues it is “supposed” to investigate you—to actually meet you, face-to-face, in fact—and make sure you’re really who you say you are, before issuing the cert in the first place.

“But Alis!” you say. “I can get an SSL cert free from, like, Let’s Encrypt! Hell, you get free certs from Let’s Encrypt!”

Yeah, I do. And the thing about Let’s Encrypt? It’s a perversion of the entire point of the system. And it provides exactly squat in the way of security, because in a world where anyone can get a cert issued to basically anything, for any purpose, under any name, how do you know that the entity you’re communicating with is, in fact, the entity you want to be communicating with?

Spoiler alert: you can’t, see original linked article.

“Wait,” you say, confused. “If SSL is so broken, why do tech companies like, say, Google push it so hard?”

Well, Dorothy, because, firstly, the one thing SSL does do is give carriers a level of plausible deniability when it comes to government requests to wiretap internet traffic. “Well. Here are the traffic logs from the server! Oh, well. No, you can’t read them because it’s all HTTPS. Sorry, not our fault! We did what you wanted!”3

But, mostly? Google in particular pushes SSL so damn hard because one of the thing SSL does in change the way HTTP referrers are sent. Why does Google care about this? Well, because it means webmasters suddenly don’t or can’t know where some or most of their website traffic is coming from, including search requests. So isn’t it great that Google can sell them this information as part of its ad platform! Phew, thanks Google! What a win for “privacy”!

… yeah.

Tl;dr, SSL is still terrible. And the “good” news? There’s still really no better option.

The difference? Very briefly, SSL and TLS are two implementations of a secure communications protocol, with SSL being the older-and-now-deprecated version. HTTPS is basically “the web but with SSL/TLS.” In most cases the three terms are used as synecdoches, though HTTP isn’t the only thing that can be used with SSL/TLS. ^
At length. It’s a bugbear, what can I say? ^
It’s worth noting that this is mostly security theater; nation-state level actors, specifically intel organisations, can and do actively tap backbone networks. The thing they mostly don’t do is share the information gathered from these sources with law enforcement agencies, who desperately want it. In other words, yes. Most Current Issues In Government Surveillance are a dick measuring contest between spys and the cops. ^

Alis2018-05-22T09:01:53+00:008th June, 2018|Tags: infosec, privacy, ssl, xp|1 Comment

When it’s girls, it’s not hacking.

A look at the strange, lost community of Petz hackers.

For the record, cheating in The Sims was my introduction to hacking hex files. I couldn’t find a trainer or cheat that would alter social relationships,1 so I wrote down, in order, the values for the current like/love values of the sim I wanted to edit, converted those to hex, opened the save file in a text editor, and found where that sequence appeared. Then I edited it. I corrupted a few files, but mostly it worked like a charm.