May 16 2008

Data isn’t ‘private’ if you put it on a social networking site

Published by Martin under Privacy

Private: confined to particular persons or groups or providing privacy; “a private place”; “private discussions”; “private lessons”; “a private club” … i.e. something a social network isn’t.

I get annoyed with people who use the word ‘privacy’ when talking about their information on a social networking site; by definition, anything put on a Facebook or MySpace is there for sharing and is no longer private. If you want to keep your information private, don’t put it somewhere that’s specifically designed around the concept of blasting your info to as many people as possible in the first place!

We’ve got mashables and all the other technologies that are designed to share our information, or data portability as it’s called. People want to be able take their information from one application to another as easily and transparently as possible. That’s great, it’s wonderful for sharing information. It’s also about as far away from ‘privacy’ as you can get.

There’s a big hubbub in the blogosphere because Facebook is blocking or limiting the amount of information other sites, like Google’s Friend Connect, can collect from the Facebook API. Facebook claims it’s about privacy; they believe users should have the right to control where their information goes and how it’s being used. I agree with that statement, but if someone is putting their personal information on Facebook, then they’ve made the choice of giving up that control, since any screen scraper or search engine can be used to pull down the information with very little effort. While I hate agreeing with Michael Arrington, he’s right; Facebook’s decision to limit what other social networks can pull from the FB API is about protecting Facebook’s business model and has nothing at all to do with their user’s privacy. Facebook wants to squeeze every possible cent from the value of your information before they let anyone else have it. I don’t blame them, I just don’t have to give them anything to work with.

Robert Scoble is wrong, privacy isn’t dead; people are just willing to give up privacy for the convenience of being part of a social network. If someone wants their data to be private, they shouldn’t be putting it online. Privacy isn’t dead, but you’ve made a decision to give up your privacy when you put it online. You have to weigh the value of having that social interaction versus what your information is worth to you. Most people make that decision without any conscious thought, which isn’t Facebook’s fault. Not everyone is a professional paranoid who spend a large amount of their time thinking about these issues, but everyone should at least be aware of what they’re putting online.

The Internet, and especially a social network, is designed around the concept of information sharing. Privacy is about controlling your information and controlling who has access to your information. If you put that information on Facebook, you’ve ceded that control to them, and even they don’t have that much control over who can access it. You can control where and when you put your information online, but once it’s there, privacy isn’t applicable. You’ve chosen to put it in a public forum, therefore your information obviously wasn’t something you wanted to keep private in the first place.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 15 2008

xkcd: Security Holes

Published by Martin under Uncategorized

Not to be outdone by Dilbert, xkcd has it’s own Debian related humor today. Who ever thought that the words “encryption” and “humor” would apply to the same blog post.


[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

May 15 2008

The Debian random number generator

Published by Martin under Humor

http://img502.imageshack.us/img502/2996/pmeo9hcjp7aw9.jpg

Ouch! That hurts, and I don’t even run Debian. Thanks, Stepto.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

2 responses so far

May 15 2008

Time to get a new set of keys

Published by Martin under Encryption, Security Advisories

If you’re using Debian or Ubuntu, it looks like you need to generate a new set of keys immediately, if not sooner! The SSH keys on those systems used the PID of the process as a seed for generating the old keys, which severely limits the randomness of the keys and has made it possible for a rainbow table of all possible keys to be generated.

There’s some debate about whether this vulnerability is related to an increase in SSH scanning on the Internet, but that’s really immaterial; it will cause a rise in SSH scans soon. Better to secure your system now and stay ahead of the curve than be one of the people unlucky enough to get compromised. As always, the real danger is not what’s happening today, but what happens in a few months when the awareness dies down and people who didn’t get the alerts leave their vulnerable machines on the Internet.

The Internet Storm Center thinks this is really important, so you probably should too.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

3 responses so far

May 14 2008

May SRT: RSA Conference - Beyond the Hype

Published by Martin under General, Podcast

Shortly after the end of RSA 2008, Michael Santarcangelo organized the latest Security Roundtable podcast. We were joined by a varied crowd of characters in the form of Dr. Anton Chauvakin, James Costello, and Jennifer Leggio. We had a lot of fun recording this conversation, even if poor Anton fell off fairly early due to phone problems. Luckily we let him get some of his shots in early.

Rich and I talked about this on an episode of the NSP, but there were no real ‘themes’ to this years RSA. There were a lot of interesting things going on, but it wasn’t on the showroom floor or in the key note presentations. I’m hoping that this means the industry is maturing, but it may just mean we’re in a lull between waves of marketing hype. Guess you’ll have to tune into next year’s SRT RSA podcast to find out.

Security Roundtable for May 2008 | RSA Conference - Beyond the Hype

 
icon for podpress  SRT May 2008 - RSA [54:34m]: Play Now | Play in Popup | Download
[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 14 2008

Microcast: Ron Gula on Nessus license changes

Published by Martin under Podcast, Security Advisories

Rich and I got a chance to talk to Ron Gula, CEO of Tenable Network Security about the changes that were made today the the changes in the Nessus licensing model. This is a follow up to the post I wrote this morning and explains the reasoning behind the changes straight from the man in charge.

 
icon for podpress  Microcast: Ron Gula on the changes to the Nessus licensing model [15:43m]: Play Now | Play in Popup | Download
[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 14 2008

WP Security Scan

Published by Martin under Uncategorized

I don’t care if you’re a security blogger or just plain vanilla blogger, you owe it to yourself to check out WP Security Scan. This plugin will scan your WordPress installation and give you suggestions on how to make it more more secure. It found a number of permissions on my blog that had been set incorrectly (now fixed) and gave me other suggestions such as changing the names of the directories from the easily guessed defaults. I know that a lot of people have a hard enough time just keeping their blogs up to date, but given the rash of WordPress compromises I’ve heard of recently, this is something everyone running a WP installation needs to do.

Another plugin in the same vein worth checking out is WordPress Automatic Upgrade. No more waiting for your service provider to get around to the upgrade or mess with all the funky files yourself. The only problem I have with it is re-enabling the plugins after an upgrade, which is a relatively minor issue. I run the plugin occasionally just to get a backup of the blog. See, I do learn from my mistakes occasionally.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 14 2008

Changes to the Nessus license

Published by Martin under Security Advisories

Last time Nessus changed their licensing model, there was a big uproar. Many people, including me, thought it was a huge error on their part and that it’d drive folks away from using Nessus. Luckily we were wrong; Nessus and Tenable are still around and still the most popular scanning solution available.

Tenable has come to the decision that it’s time to change their licensing model again. The Registered Feed will be going away; instead you’ll have the option of having a HomeFeed or a Professional Feed. Home Feed will only be for use on personal networks, but it will have the same vulnerability updates that Professional Feed will. If you were using a Registered Feed to scan your own network, that is no longer going to be acceptable under the new licensing and you’ll have to upgrade to a Professional Feed, which is pretty reasonable at $1200 a year. For that price you also get compliance checks, which includes my favorite, PCI.

It’s a major change for Tenable to require anyone using Nessus in a corporate setting to pay for the feeds; you used to be able to use the Registered Feed for your own business but had to pay for the Direct Feed if you used it for consulting. This is a continuation of Tenable’s desire to get paid for the incredible amount of work they put into Nessus, something I have a hard time faulting them for. There is a loophole in the licensing that will allow you to get a free license if you’re a charitable or educational organization. The exact requirements for this exemption haven’t been made public yet, but should be soon.

Nessus 2.0 is still open source. Nessus 3.0 was never open source, nor have the plugins been, though a lot of people have treated them as such through the Registered Feeds. This change in the licensing may open a gap that will allow a new open source vulnerability scanner to come to the forefront. Given the breadth of Nessus implementations, I think this is unlikely in the near future, but may happen slowly over the next few years. Most businesses are probably going to ignore Tenable’s new license until their Registered Feed expires on July 31st. The big question is will they continue using Nessus without updates, pay for the Professional Feed, switch to another product or quit scanning all together? Short term, I’m betting on scanning without updates, but long term is another question all together; is $1200/year really all that much to pay compared to what any other scanning tool is going to cost you?

Tenable made a business decision that they need to collect revenue on their plugin feeds in order to continue providing the level of support they have always given. Some people are going to complain that Tenable is getting greedy; I’d counter that they just want to get paid for the work they’ve been supplying to the community for years. I guess that’s one of the things actually meeting the people doing the work will do to you.

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

2 responses so far

May 13 2008

Network Security Podcast, Episode 104

Published by Martin under Podcast

We’re back, me from being ill, Rich from some alone time with his wife. Nothing really interesting to talk about other than what’s in the show notes, so I’m not going to waste a lot of time writing about it.

Show Notes:

 
icon for podpress  Network Security Podcast, Episode 104: Play Now | Play in Popup | Download

Network Security Podcast, Episode 104, May 13, 2008

Time: 33:12

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

No responses yet

May 13 2008

Interview with Mike Smith, the Guerilla CISO

Published by Martin under Government, Podcast

A few weeks ago I had a chance to have lunch with Mike Smith,author of the Guerilla CISO, in Washington, DC. Mike’s area of expertise is FISMA and he’s an experienced educator in the area. Mike feels about FISMA much like I do about PCI: it’s not perfect, but it’s a heck of a lot better than what came before.

 
icon for podpress  NetworkSecurity Podcast: Mike Smith, Guerilla CISO [9:00m]: Play Now | Play in Popup | Download

NSP Microcast: Mike Smith, Guerilla CISO

Time: 9:00

[Slashdot] [Digg] [Reddit] [del.icio.us] [Facebook] [Technorati] [Google] [StumbleUpon]

One response so far

Next »