Internet censorship and loss of privacy

Surveillance
Surveillance

An excellent essay by Bruce Schneider on government organized initiatives worldwide to reduce internet privacy and for censorship. There is also evidence that criminals can (mis)use such infrastructure for their own purpose. Please click here to read.
 
 
 
 
 
 
 
 
 
 
 

Every year brings more Internet censorship and control — not just in
countries like China and Iran, but in the United States, the United
Kingdom, Canada and other free countries.

The control movement is egged on by both law enforcement, trying to
catch terrorists, child pornographers and other criminals, and by media
companies, trying to stop file sharers.

It’s bad civic hygiene to build technologies that could someday be used to facilitate a police state. No matter what the eavesdroppers and censors say, these systems put us all at greater risk. Communications systems that have no inherent eavesdropping capabilities are more secure than systems with those capabilities built in.

Share

False sense of security

Photo by public15

 

http://www.e-signature.com/ provides logo and signature embedded fonts. Per se, there is nothing wrong with the service, and is useful for people who need it.

However, a look at the website throws up the claims below. Each one has a quote from me below it on the truth behind the statement.

Imagine being able to distribute a signed word processing document to your staff or clients without fear of the logo or signature being copied…

DW: Even if the font is embedded, the logo/signature can still be copied and used on other documents. While this is not possible as a font letter, it can be done as a bitmap.

No embedding is the option most often selected for signatures as it ensures the highest security – the signature will only appear on computers that have the font installed. If you use signature fonts for signing checks, no embedding is also recommended.

DW: Please don’t use this for cheques. Its easier for someone to access your computer and steal the font than you think. The font will be installed on your PC and will remain there, its not something that you can carry on a pen drive and keep in lock and key.

The recipient does not have access to the font to reproduce it in another document nor can they cut-and-paste the on-screen signature or logo.

DW: Again wrong. It cannot be cut-and-pasted as a font letter, but can be done as a bitmap.

Keep your font proprietary. No one can copy your font because it will reside in an inaccessible cache on the browser. You can display your text the way you want without fear of anyone copying it.

DW: What’s an inaccessible cache? No cache is inaccessible – a smart user can always take your font away. Remember: if the browser can download it (and use it to show your content), a user can download it too.

It appears to me that these folks are very much aware that they are making statements that are not 100% truth. A false sense of security is worse than no security.

Share

Scripted thumbnail generation: security perspective

Money gone!
While searching for something on the net, I came across some scripts that generate image thumbnail on the fly.

For example: http://tech.mikelopez.info/2006/03/02/php-image-resize-script/.

While using such scripts we should be aware of the security point of view: your site can easily become a proxy for other people or websites. Continue reading “Scripted thumbnail generation: security perspective”

Share

Remembering your passwords

Remembering passwords
Remembering passwords

In today’s online world we have to remember a lot of passwords. Security advice is that they must all be different (so that if one account is compromised, we don’t loose the security of all accounts), and be changed every now and then.

It is sometimes difficult to cope with such requirements, without writing down the passwords – and if you do write them down, what happens if you loose your notebook?

The answer to such problems is a piece of software called ‘Password Safe’ – it has been developed under the watchful eyes of a well known security expert. It keeps all your passwords encrypted by one single password. So you only need to remember one password from now on. You can keep the software on a USB pen-drive (its even platform independent so you can run it both on Windows and Linux) and take it along with you – no harm if you loose the pen-drive – no one can retrieve your passwords.

Note that there are a lot of different software applications with the same name, and not all of them may be equally secure. Please download only from http://passwordsafe.sourceforge.net/.

Note: this is not professional advise, use at your own risk.

Share

Licensing and information about the blog available here.