Designing Application-Managed Authorization
Schoon, Rees, Jezierski (Microsoft):
Designing Application-Managed Authorization
software development, security, opinion
Schoon, Rees, Jezierski (Microsoft):
Designing Application-Managed Authorization
Gary North, via Jude Wanniski:
The World We Are Losing
During World War II, the British cracked the Germans’ military code. The Brits knew the times and routes of the oil tankers that were to supply Rommel’s forces in Africa. To keep the Germans from figuring out that their code had been broken, the British would send a reconnaissance plane,
which would make itself visible to the men on the tankers, and then run for cover. The plane would send a message announcing the whereabouts of the tanker. The Germans on the tanker would conclude that they had been spotted from the air. What bad luck! If they radioed home, they would
tell the command that they had been spotted. Then a British submarine would sink the tanker. The Germans never did alter the code.The reconnaissance plane was part of the deception. So are the random searches of passengers and bags. They are to provide camouflage: (1) from voters who demand action; (2) from lawyers who might otherwise get their swarthy clients released on the basis of racial profiling. Anyone who really expects searches like these to protect airliners is so abysmally dense that he might as [well] be a Congressman. The other purposes of the new surveillance system relate more to controlling average people than catching terrorists.
Bob Toxen:
Linux Security: Reflections on 2002
“
The current interest of everyone and his brother in forensics and honeypots will die down. For other than those doing serious research in computer security, I find its only value is demonstrating to management that insecure systems will be breached.
”
History:
A Study of the ARPANET TCP/IP Digest
and of the Role of Online Communication
in the Transition from the ARPANET to the Internet (Ronda Hauben, Columbia University)
Jakob Nielsen:
Top Ten Web-Design Mistakes of 2002 ” Every year brings new mistakes. In 2002, several of the worst mistakes in Web design related to poor email integration. The number one mistake, however, was lack of pricing information, followed by overly literal search engines. “
Now Noble and graduate student Mark Corner have come up with a high-security system for the slothful. The system protects data by automatically scrambling it the moment users walk away, then quickly restoring it upon their return.
Called
Zero-Interaction Authentication, or ZIA, the system requires laptop owners to wear a small device or token – in this case a wristwatch equipped with a processor and short-range wireless link to communicate with the laptop. When the token moves out of range, ZIA re-encrypts information on the laptop within five seconds, before someone else can gain access to it. When the laptop detects that the token has come back within range, the system decrypts the information within six seconds.
From Bruce Schneier’s Crypto-Gram newsletter:
Kevin Mitnick’s book, "The Art of Deception," is a good read. The missing first chapter, deleted at the last minute by the publisher, is on the Internet. The chapter talks about Mitnick’s life as a hacker and a fugitive, and his arrest and trial. It’s very interesting reading.
<http://www.wired.com/news/culture/0,1284,56187,00.html>
<http://littlegreenguy.fateback.com/chapter1/Chapter%201%20-%20Banned%20Edition.doc>
The Economist:
The race to computerise biology
(A layman’s introduction to bioinformatics)