Short comments on #STRATFOR

Lots of articles popping up on the #stratfor leaks all over the web. Some good, some not that good. Just a few comments from me, until I eventually get the time to do a bigger blog post on the subject.

Review: [hiddn] USB Crypto Adapter

[Picture from www.hiddn.no]

A representative from High Density Devices (HDD) participated at Passwords^10, and after that I've been talking to them from time to time. Especially their marketing manager Tormod Fjellgård has been very forthcoming, and granted me the chance to do a review of 2 of their crypto adapters. This is my first review of their USB crypto adapter, and I've warned Tormod that I just might have some critical comments for them. So here we go:

Når "anonym" har en arbeidsgiver

(Screenshot tatt fra www.vg.no)

VG Nett har nylig endret sine regler for å kunne legge inn kommentarer til saker de publiserer. De tillater ikke lengre anononyme innlegg, og forsvarer dette valget gjennom plakaten som vist over. En god kollega av meg, som ønsker å forbli anonym, stilte meg et spørsmål i dag som ga meg grunnlag for å kommentere denne endringen hos VG. Det gjelder nok også en rekke andre medier, så bloggposten er ment å være generell i så måte.

I'm not dead...

As you can probably see from my Twitter feed. I'm just drowning in work as a security consultant at the moment. My head is full with blog posts that I have to get out soon... For the password stuff, which still is my primary focus here, I'm pretty close to start releasing some never seen before statistics. In close cooperation with my friend and colleague Jan Fredrik (@KluZz). Keep watching this space!

Hotel TV Infochannel Security

[A rather static show at the hotel tv infochannel...]

Life as a security advisor, or just consultant if you prefer, can be very interesting. Working with a large variety of clients, tasks and situations is challenging, exactly the way I like it! To me it also includes going to other cities here in Norway, at the moment I'm at yet another hotel in Stavanger, Norway. 

During the past couple of weeks I've got a renewed interested in hotel television systems. No, not that kind of activity that you may have heard of, or seen demonstrated by Major Malfunction in Las Vegas many years ago. I'm just curious about the risk analysis - if any - performed by the hotels, finding it acceptable to put their infochannel systems directly onto the Internet?

Kjære kunde / Dear Customer

This one is for @Questback, as a reply after the last couple of tweets between myself (@thorsheim), and @HopeMears, partially also @Ronnie_Ostgaard. Both have been most helpful in replying to my blog posts and tweets, and I hope this will be my last blog post regarding our "controversies". :-)

Adgangskort og PIN koder

[PINs på Post-it. Er det noe problem?]

Denne bloggposten skrives etter veldig mange års frustrasjon med fysisk adgangskontroll. Bildet over bør være god nok forklaring på min frustrasjon, det er Post-it lapper jeg har fått utlevert sammen med ulike typer adgangskort, både magnetstripe og RFID baserte kort. Med et ønske om å bidra med "enkle sikkerhetstips i hverdagen", så har jeg noen spørsmål og tips rundt slike løsninger for adgangskontroll.

More STARTTLS support!

RFC 3207:

SMTP Service Extension for

Secure SMTP over Transport Layer Security

In a previous blog post entitled "STARTTLS support in Hotmail/Gmail", I requested these services to implement support for RFC 3207, in order to use automatic and transparent security at the "back side" of their services, when available. I doubt I'm the reason here, but Google now has support in place! (Hooray!)

Facebook password history...

"Unfortunately you have provided an old password. Your password was last changed yesterday at 07:52. If you don't remember making this change, please click here".

First thought: WTF does Facebook tell me this????

Second thought: Good, they seem to have some password history going on. Got to test that later on, by trying to change back to my old password. I guess they don't block that quite yet.

Third thought: This is good from a usability perspective. They've got quite a few users (...), this will make it easier for them to actually change their passwords whenever they feel the need to do so, and handle it afterwards.

Fourth thought: A bruteforce attack against known logins will eventually succeed, but it may also reveal one or more previously used passwords, enabling several methods of pattern-based password analysis to improve the chances of an attacker figuring out the correct password faster and with less attempts then from a blind start.


Not good.


Any opinions?

En ROSA bloggpost!

[Bilde fra WahWah brosjyre]

Jeg er gammeldags. Jeg har passert 40. Jeg har en tåpelig tendens til å ta i mot utfordringer fra jenter. Kristin er en av dem. Utfordringen kom for noen måneder siden; hun utfordret meg til å skrive et blogginnlegg om mote & skjønnhet og sånn. Jeg svarte at det var liksom ikke helt min greie, men dersom jeg gjorde det så måtte hun kvittere med en bloggpost om sikkerhet & sånn. Jeg gleder meg allerede! ;-)