Financial CryptographyWhere the crypto rubber meets the Road of Finance...H4.2 -- Usability Determines the Number of Users- June 22, 2008 Last week's discussion (here and here) over how there is only one mode, and it is secure, brought forth the delicious contrast with browsing and security: yes, you can do that but it doesn't work well. No, I'm not talking about the logos being cross-sited, but all of the 100 little flaws that you find when you try and do a website for secure purposes. So why bother Financial cryptography eats its own medicine, but it doesn't do it for breakfast, lunch and desert. Which reminds me to introduce...https://financialcryptography.com/mt/archives/001068.html Why is is this blog secure Because there is only one mode, and it is secure!- June 21, 2008 Anon asks: > ian: I never understood why you insist on using HTTPS for the blog... maybe you can shed light Fair question, and often I ask myself whether it is worth the extra effort. As succinctly as I can put it, it is because of the fundamental principle: There is only one mode, and it is secure. This principle is not so well understood in today's Internet security business, so I'll explain. Whenever a system has two modes, there is always weakness as it switches from one mode to...https://financialcryptography.com/mt/archives/001067.html updating Top Tips for your security -- keep the Mac, Firefox 3, add NoScript- June 19, 2008 I keep a list of "Top Tips" for the non-techie people over on the right side of the blog. They have to be simple, easy, and user-friendly, workable for grandma. Time for a review. McAfee AverLabs reported last year that the news was good for Mac OSX: Today we know of over 236,000 malicious malware items. These are mostly meant for the MS-Windows environment. Only about 700 are meant for the various UnixLinux distributions. Current known Mac OSX malware count is even less with 7, so...https://financialcryptography.com/mt/archives/001066.html Digital Evidence -- 26-27 June, London- June 17, 2008 Cryptographers, software and hardware architects and others in the tech world have developed a strong belief that everything can be solved with more bits and bites. Often to our benefit, but sometimes to our cost. Just so with matters of law and disputes, where inventions like digital signatures have laid a trail of havoc and confusion through security practices and tools. As we know in financial cryptography, public-key reverse encryptions -- confusingly labelled as digital signatures -- are...https://financialcryptography.com/mt/archives/001065.html Historical copy of PGP 5.0i for sale -- reminder of the war we lost- June 17, 2008 Back in the 1990s, a group called the cypherpunks waged the crypto wars with the US government. They wanted easy access to crypto, the US government didn't want them to have it. RAH points to Sameer's blog: The solution for my company, C2Net Software, Inc., was to develop an offshore development team and have them develop the software there. Other companies developed different strategies. Most opted to sell broken products to their overseas customers. One other company cared about the security..https://financialcryptography.com/mt/archives/001064.html Digital Signing: new category for FC- June 16, 2008 A comment by Stephen Mason this morning caused me to realise that there is no digital signing category in FC. I have now added it, and you can see the link in the 'menu' section to the right of the main page, under Governance. Or click here. Here's an older reference to an apparent application of digital signing of serious documents, spotted in the wild: Great Lakes Educational Loan Services used an external e-signature service from DocuSign to help it deal with the flood of loan requests it...https://financialcryptography.com/mt/archives/001039.html Selling Security using Prospect Theory. Or not.- June 15, 2008 Bruce Schneier writes a good essay on Prospect Theory and how this effects selling of security. The basic story is that people accept a risk-free smaller gain, but gamble with a risky larger loss; our decisions are not symmetric, and do not follow "utility" or "expected value" lines. Given that we gamble big with losses, he closes the essay with: How does Prospect Theory explain the difficulty of selling the prevention of a security breach It's a choice between a small sure..https://financialcryptography.com/mt/archives/001061.html Hypothesis 4 -- The First Requirement of Security is Usability- June 14, 2008 Duane points to a recent debate, something about DNSSEC and its added value, which resulted in this comment by one Thierry Moreau: DNNSEC is almost worthless! The reasons appear to be based on an analysis of three usage models, and each usage model heads for the rocks for one reason or other. Thierry points out that user 1 is not interested, user 2 is small, and user 3 will be not be allowed. The analysis is worth a read, as it is nicely laid out (regardless of whether you agree or not). What...https://financialcryptography.com/mt/archives/001046.html Negroponte's judo flip on the PC industry- June 7, 2008 Sometimes we get to watch a structural change unfold before our eyes. The Intel 64bit mistake that let AMD in was one such; the Napster story another, and now, we are seeing the endings of another. Again against Intel, the OLPC, the so-called $100 laptop, has succeeded in creating a new segment. The Economist writes: But in one respect the XO Laptop has undoubtedly made an impact: by helping to spawn a new market for low-cost laptops. Hardly any models costing $500 or less were available when...https://financialcryptography.com/mt/archives/001060.html The Dutch show us how to make money: Peace and Cash Foundation- June 6, 2008 Sometime around 3 years back, banks started to respond to phishing efforts by putting in checks and controls to stop people sending money. This led to the emergence of a new business model that promised great returns on investment by arbitraging the controls, and has led to the enrichment of many! Now, my friends in NL have alerted me to the NVB's efforts to sell the Dutch on the possibilities. Welcome to the Peace and Cash Foundation! A fun few minutes, and even though it is in Dutch, the...https://financialcryptography.com/mt/archives/001059.html |