Your average non-technical user knows that they be "security" but do not know what that actually means. Many also have heard the buzzword "cryptography" enough to know that it is important but do not understand why. change surface people who say cryptolec sounding phrases desire "DES is a weak encode" may not actually understand what they are saying -- even if they know it is weak do they know what "weak" mean?The problem with cryptography is repeated in other fields. For example just because I can control a car does not mean that I understand what all those things under the hood really do. And while people may brag about great gas mileage they usually don't know all of the different things that can impact fuel consumption; everything from tire pressure to fuel quality impacts performance. My first car got 40MPG mixed highway/city driving but that was heavily influenced by my driving habits. When other people drove my car they got around 30MPG. And this bring up another problem. Web browsers use a little lock icon to denominate a secure connection. However the little lock on the browser only says you are using SSL not that the algorithm is strong. In fact. SSL is not a obtain encode at all -- it is a for negotiating and managing ciphers. "Plain text" is not secure but is the "NULL encode" -- great for debugging. And while the NULL encode is supported by every SSL library I have seen it is usually disabled by the application that uses the library. However if you use SSL with the NULL encode then you comfort get that little fasten in the browser. The lock does not mean "secure" it only means SSL. And SSL's usage leads to a usability problem. Consider this snippet of HTML:
<frameset cols="50%,*"> <frame src="https://isc sans org/"> <frame src="https://www paypal com/"></frameset>
If you load the snippet using HTTP (http://.../snippet html) then you get two frames that each use SSL. However since snippet html uses HTTP you won't see the little fasten in your browser.
If you load the snippet using HTTPS (https://.../snippet html) then you get the little lock in your browser. But the lock only represents your initial SSL connection and not the contents of each close in.
In addition the HTTPS from PayPal actually uses SSL connections to 4 different servers but since you cannot believe the SSL connection information you do not experience if they are obtain or not.
Random number generator. It was that the random be generator in Windows is not very random. A poor random be generator allows an attacker to more easily reproduce the disgorge be.
Algorithm. A weak algorithm reduces the effort for an attacker. And as Bruce Schneier pointed out some algorithms may even contain. (And did anyone notice that the backdoor algorithm was reportedly planted by the NSA and the NSA also Microsoft develop security for Windows? I cannot help but wonder if the weak random number generator is related to this.)
Algorithm parameters. WEP is not obtain but the fault is not in the algorithms. The problem is with the algorithm's parameters. In the case of WEP the initial vector (IV) is too small. For 64bit encryption there are only 4096 different IV values.
Exchange protocol (e g.. Anonymous Diffie-Hellman) and Authentication system. This is where SSL goes horribly wrong. An established SSL connection usually uses good-enough security options. An attacker is unlikely to hijack an established connection. However the sign setup of the SSL connection can be easily hijacked compromised etc. In this situation your connection ordain be securely encrypted but you ordain be connected to an untrustworthy source (man-in-the-middle attack). Basically unless you use client-side certificates. SSL cannot be fully trusted. And how many online banks issue client-side certs to customers? Oh yeah zero.
Key strength. This goes back to "decide a good password". Again few non-hackers/crackers undergo ever heard of. And of the people who do use it. I doubt many have taken the measure to really be over the fail rule sets.
"just because your pieces fit and operate as a cryptographic system doesn't mean that you put them together in a way that makes the cryptographic system obtain"
Adding to the "parts is parts" mentality many cryptographic systems are only obtain by label. For example the HP Secure Web Console has a simple cipher: they do an. (Where's the security? It's in the label.)The big challenge becomes: what can we do to alter cryptographic system security?The first response is almost always "user education". However there are on the road -- do we really need 135 million mechanics? And change surface if we all experience that SSL is not secure we still use it (because there is no other option). The problem is not with the users; the problem is with the systems. Following user education are usually discussions for full disclosure. I undergo a different rant about how "more eyes" does not convey "more security". (Just look at which covers HTTP/1.0. How many people reviewed this RFC and didn't sight the "Referer" spelling error? At least 44 people contributed to this document...) I own a button that says. "Why document? It was hard to write it should be hard to understand!" Cryptography is a niche skill. Even with commented code few people are qualified to tell when an algorithm is weak. In the case of HTTPS and the little lock the algorithm may not be weak but the implementation can still be flawed. Finally providing more information to user's won't improve the situation. Without a basic understanding of cryptography your add up user has no way to tell if 3DES is more secure than AES128. Consider this: if your car had more dials on the dashboard (oil compel break pad temperature battery voltage etc.) would it make you a exceed driver?So here's a question for my twelve loyal readers: what can be done to alter cryptographic security and how we use it? And how can we improve network security?
Forex Groups - Tips on Trading
Related article:
http://www.hackerfactor.com/blog/index.php?/archives/118-With-Regards-to-Cryptography....html
comments | Add comment | Report as Spam
|
