Høyre og #DLD

I anledning Nasjonal Sikkerhetsdag 2010 lanserte min arbeidsgiver en rapport om hvordan taushetsbelagt informasjon sendes ukryptert via e-post i Norge. Rapporten var utarbeidet av meg sammen med min kollega Jan Fredrik Leversund, og fikk tydelig oppmerksomhet i media. Nå er snart ett år gått, og spørsmålet kommer naturlig: Har det skjedd noe siden sist?

Now Recruiting: Password Mules!

The above announcement originates from a web forum where users submit password hashes for cracking. Other users reply with recovered passwords. Recovering your own? well, why not. Recovering 100 million? A reasonable question would be: Where did you get those? It's about time to talk about ethics.

No good security @StepStone Solutions!

ERRATA:

I've received a reply to this blog post by private e-mail (Thx Pål!), and I will update it to reflect the difference between the two separate companies StepStone and StepStone Solutions. Erroneous text/links has been changed to strikethrough italics, while new text is written in blue.

I got an e-mail just before the new year from noreply@easycruit.com, a service from StepStone StepStone Solutions. It reminded me that I hadn't changed or updated my CV in their database for 6 months. They recommended that I updated it, otherwise they would delete it in two weeks. The e-mail also gave me my current username and password - in cleartext:

(Forgive me for my censorship here :-) Click for full size. Text in Norwegian.)

Facebook places - ny runde med sikkerhet

I går, det vil si onsdag 5. januar, ble endelig Facebook "Places" tjenesten også tilgjengelig for bruk i Norge. Personverninnstillingene relatert til denne funksjonen har vært tilgjengelig lenge, men dagens lille test (skjermbildet over) viser at ihvertfall mange av mine kontakter enda ikke har endret på dette. Det må vi få gjort noe med.

Hvem stoler du på?

Hvem stoler du på egentlig?
Din bedre halvdel? Dine barn? Naboen? Politiet? Banken? Kommunen? NSM?

For kort tid siden ble jeg gjort oppmerksom på en liten detalj rundt bankenes avtalevilkår for betalingskort, derav denne bloggposten. (Tusen takk til "R"!)

Videos and presentations now online!

Presentations as well as videos from the conference are now online. You can download the presentations as well as the video files (iPad friendly h.264 HD format) from http://ftp.ii.uib.no/pub/passwords10/ , or download them through bittorrent from http://home.online.no/~putilutt/torrents/. Just remember to seed them as well after downloading. :-)

I would really like to thank the University of Bergen, especially @haakonnilsen, for providing FTP server space to these files for us. Also a big thank you to all the presenters for allowing us to record and publish the videos online after the conference. Thank you to all participants for being there, great discussions and exchanging of ideas!

Last but not least; a personal big THANK YOU to Professor Tor Helleseth for providing me with the opportunity as well as budget, advice and everything else to help Passwords^10 come true. I really hope we'll do it again. :-D

Passwords^10 : Passware scared us all

Originally my plan was to do several blog posts based on what I heard, saw and learned at Passwords^10. That still is my plan of course, but the president of Passware, Dmitry Sumin, scared me. *A LOT*. So first things first; this blog post is highly necessary - and maybe time critical to some of us as well.

Passwords^10 : 2 dager om passord & PIN koder

Den 8 og 9 desember arrangeres det en 2-dagers konferanse om passord og PIN koder - og bare det! Arrangør er Per Thorsheim i samarbeid med Professor Tor Helleseth ved Selmersenteret, Universitetet i Bergen, og med Nisnet som sponsor. Per Thorsheim kan kontaktes på tlf 90 999 259 eller mail:
perkrøllalfathorsheim.net.

Konferansen er gratis, og åpen for alle, også media :-) Komplett program finnes her (PDF, 104KB, ingen javascript eller flash). Flere av presentasjonene vil inneholde mye matematikk/krypto, så er den advarselen gitt.

Formålet med konferansen er å presentere og diskutere noe som de aller fleste av oss må forholde seg til i hverdagen: passord & pin koder. Facebook, nettbank, dørene på jobben, mobiltelefonen eller den PIN koden som forsvant ut av hodet akkurat i det du kom frem til kassen etter 20 minutter i julepresang køen.

Why Passwords^10?

I've been asked this many times: "Why would you do a 2-day conference on passwords & PIN codes?". I'm being told that passwords are lame and old-fashioned. Biometrics and 2-factor authentication are much better at providing better security. Some even refer to xkcd 538 to describe to me why password-only authentication is stupid. Allow me to explain a little...

Revisiting password meters

(Screenshot from Swedish PTS on Sunday 28, Nov 2010)

In February this year I wrote a blog post named "Never Trust Password Meters", after a tweet from @mikkohypponen at F-Secure. One of the password meter services I commented on was "testalosenord" (test your password) from the Swedish Post and Telecom Agency. I e-mailed them the same day, just to inform them about my blog post. On November 18 I received a reply.