Pwnd. Again. And again.

[My colleague Jørgen, putting up his best smile after a successful PWN of me]

This short notice is to acknowledge the fact that I got Pwnd. Again. I'm experiencing that at a rate of <=2 per year. Not good, but then again; I don't think that's too bad, considering the fact I'm actually inviting people to test me. You can see my previous blog posts "Can you see my password?" and "Pwnd. Again." for more information about previous (successful) attempts, as well as competition rules. :-)

Activesync and FIPS 140-2 part 1

Perhaps the best Dilbert/Mordac ever...?

I am not Mordac. I can admit being a bit similar to Mordac once upon time, but that is a looong time ago. I'll bet I can get somebody to confirm it, at least if I get to "talk" to them a little bit before you do. ;-)

Seriously, I've been doing some testing with Microsoft Activesync in order to find some common ground across iOS & Android for setting a "good practice" password policy level. After spending some time on this, I think Mordacs work at Apple & Google. I also think that Mordac was involved in the creation of FIPS 140-2, at least when somebody thought it would be a good idea for mobile devices.

I'll explain that later on, but first 2 simple things to remember here:
1. A default policy, no matter which product, should never be considered "secure" or "good enough".
2. I say Good Practice. "Best practice" cannot be proven legally, period. There is a legal difference here.

STARTTLS & the Police

[Kids say the darndest things...]

The FBI got "hacked" by Anonymous (NYTimes), eavesdropping an international telephone conference regarding criminal activities by Anonymous. The hack wasn't all that sophisticated (...), since they probably got access to the meeting invitation sent by e-mail (pastebin), which contained all the necessary info. Just a few tips here for those interested:

Simple Security Usability part 1

[Grabbed from Microsoft. Too lazy to make my own. Sorry.]

Try searching Google for pictures related to "security usability". You will find quite a few pictures similar to the above.

Is that really the simple - and stupid - truth? Does it always have to be like that? I'd like to fight against some misconceptions in the area of security vs usability. Here's a very simple example; improving security by simplifying usability.

Minimum Password Length POO

(Picture from fileformat.info, showing U+1F4A9]

Looking at the wonderful new character named "Pile of Poo" in Unicode 6.0 (not 6.1, as re-tweeted by many...), I think my spontaneous competition on Twitter Jan 31 became even more fun to write about now. While I still owe you to write loads of opinions for/against periodic password changes, I'll drop this one as an input to the "minimum length" discussions as well.

Hvordan bli et pengemuldyr

Her er et rykende ferskt eksempel på hvordan skurker forsøker å verve nordmenn til å fungere som "money mules", eller pengemuldyr som vi skriver her hjemme på berget. Et pengemuldyr er en person som bevisst eller ubevisst hjelper utenlandske svindlere med ulovlige pengeoverføringer. Dette gjøres ofte ved at "muldyret" mottar penger inn på sin bankkonto, og deretter tar pengene ut i kontanter snarest mulig. Så går muldyret til en annen bank, spesialiserte selskaper eller privatpersoner for den saks skyld, og der overfører pengene (minus en provisjon til seg selv) til en utenlandsk mottaker.

Kommentar: sikring av iPad

Hans Petter Nygård-Hansen har skrevet en veldig bra bloggpost med tittelen "11 tips for å jobbe sikkert på din iPad". Jeg vil så absolutt anbefale alle med iPad (eller iPhone for den saks skyld) å lese denne bloggposten. Det er vel verdt det, og den er ikke bare aktuell for de som bruker iPaden sin i jobbsammenheng.

Jeg vil bare gi noen små kommentarer og tips til de som ønsker å gjøre disse anbefalte tiltakene:

Password Change Frequency

(Picture of Cliff Stoll, linked from Berkeley website)

Professors are nice people. Seriously. They can be a challenge too, as I got to experience firsthand during my 3,5 hour lecture on password security at the NISNET winter school, 22-27 May 2011. Paranoid as I am, I even suspect two of them agreeing into a secret pact to have some fun on my behalf. ;-)

Note: I started writing this blog post in May 2011. Dropped some of my ideas, and have spent another 8 months to think, read and discuss the issues of password change frequencies. Now, at the time of publishing, I still haven't made up my mind. The "simple" question of How often should I change my passwords? isn't all that easy to answer.

Passwords^12

(Picture is (C) KluZz - aka my friend/colleague Jan Fredrik Leversund)

I have received many questions about the two first Passwords^XX conferences that I arranged in cooperation with professor Tor Helleseth at the university here in Bergen, Norway. The most frequent question after Passwords^11 in June 2011 is of course "when and where will the next conference be?". So here is some preliminary information from me, as well as a quest for sponsors for doing the conference somewhere in the US as well! :-)

Errata for Errata security

Sorry about the title, best I could come up with late at night.

The blog post Passwords: uniqueness, not complexity from Robert David Graham (@ErrataRob) at Errata Security isn't bad, but it is not all that good either. Based on the recent - should I say ongoing - breach of #stratfor, Robert recommends unique passwords instead of having complex passwords. I would ask "why not both?". Let me explain...