Security Hype

 

 Security Hype 7.6-SiteKey (not) broken and Mozilla's radical Security UI idea [30:03m]: Play Now | Play in Popup | Download (1881)

Bill and Bob peel back the hype on “SiteKey is broken!” claims and find that it’s working as designed. SiteKey isn’t broken, but computer security user interface design IS broken. User’s don’t know how to evaluate when computer systems are behaving securely, and are struggling to stay safe on the Internet.

New MIT & Harvard research indicates that people don’t know that the ABSENCE of security information on a banking website means “danger”. More evidence that security usability - particularly with web browsers - is in a sad state.

Microsoft’s support for EV SSL certificates has several new UI changes in the IE browser in an attempt to help people make security determinations. The Mozilla Foundation is considering taking a radically different approach. Jonathan Nightingale believes that SSL web connections is not about encryption, it’s about identity of the website you’re connecting to. Is the Lock Icon going away!?! Will this actually work and protect users on the Internet? Does this make sense? Send us your thoughts to comments@SecurityHype.com. We’ll try to get Jonathan on the show.

DiscoverCard’s fraud detection process is being exploited by hackers through “phone phishing” attacks. We tried to explain this to the DiscoverCard operator and they just didn’t understand the attack vector. Credit card companies spend millions of dollars printing and issuing credit cards to people, why would they use a different phone number for their customers to call and report fraud? They should be encouraging customers to use a simple, verifiable, and secure process.

What other silly security processes have you run across?

If you like the show, please go to iTunes and add your reviews to our podcast. If you have suggestions for show topics or have comments on this episode please send your feedback to comments@SecurityHype.com

Thanks for listening!

 

 Security Hype 7.5-CreditCard Skimming, Setting up Secure Email: Play Now | Play in Popup | Download (2202)

Bill and Bob discuss credit card skimming, how is this risk different than exposing your CC number over the Internet? In this episode you’ll learn how to secure your email using FireFox and Thunderbird. You’re using 2048-bit RSA keys, right? And you’re backing up your digital certificates and private keys too, yes? Once you get your certificate, send us an encrypted email using our certificate!

Alternative instructions: Outlook and Apple Mail.

Did you know that if you aren’t digitally signing AND encrypting your email, the message isn’t truly secure? Bob discusses this subtle but important distinction. If this doesn’t make sense, let us know and we’ll cover this in more depth.

Free S/MIME certificates are available from Comodo (Windows only) and Thawte. Remember that with Thawte you have to “join” their system.

If you’re enjoying our podcast, we’d appreciate hearing more feedback from you and seeing your reviews at iTunes. If you have comments, suggestions or know where Bob, Alice, Eve and Mallory are please contact us at comments@SecurityHype.com.

Thank you for listening!

 

 Security Hype 7.4 - OCSP, CRL, and Vista's new SSL tricks: Play Now | Play in Popup | Download (1859)

Bill and Bob catch up on listener feedback, then delve into more details about digital certificates. Certificates and private keys may become compromised before they expire. CRL and OCSP are two methods that applications and systems can verify the status of digital certificates. Microsoft Vista, for the first time, now performs certificate revocation status checking by default. This is a good thing and we hope other systems and applications follow their lead.

Do you use CRLs, OCSP, or something else in your PKI? How did you decide which protocol to support, if any? We’d love to know. Have you encountered any OCSP-related errors in Vista? We have, and we’ll talk about them in upcoming episodes.

If you’d like to join the conversation, send your feedback to comments@SecurityHype.com. Thank you for listening!

 

 Enhanced Podcast [18:30m]: Play Now | Play in Popup | Download (1814)

Bob and Bill discuss their impressions of the RSA 2007 Security Conference. It seems to be getting less “technical” and more “business focused”, but Bill was underwhelmed. Bob notices that all the good security company names are taken. What were your thoughts of the conference, did you find it as helpful as previous years?In the new “Vendor Smackdown” section, Bill tries to figure out what problem PC Magazine’s “CoverUp” program was designed to solve. Do you use it and find it useful? Tell us if we’re missing something.

Send your smackdown nominees, suggestions, or feedback to Comments@SecurityHype.com

Links referenced in this episode:

• RSA Security Conference 2007
• PC Magazine’s CoverUp

And thanks for listening!

 

 Enhanced Podcast [39:42m]: Play Now | Play in Popup | Download (1973)

Many banks encourage phishing through their use of inconsistent user interfaces and the improper use of SSL, both putting their customers’ credentials at risk. Financial institutions invent their own email security schemes that are readily copied by hackers and provide no real security. Bill and Bob describe several examples of how bad web and email security practices confuse their customers and weaken the total online security experience. They also provide some suggestions based on solid security practices.

Think SSL is too expensive to deploy? That’s 20th century thinking! Bob’s team has lab test statistics to refute that old myth: http://boblord.livejournal.com/1538.html

Links referenced in this email:

1. ETrade “Secure” Email which dilutes the security lock icon’s value
2. NetCraft Phishing Link
3. NetCraft Surveys
4. Yahoo! endangers, confuses uses instead of using SSL to begin with
5. SSL security warnings don’t stop users from getting hacked
6. Google’s SSL warnings don’t stop users either
7. Fake Chase phishing email #1
8. Fake Chase phishing email #2

Thank you for listening! Please send your comments, suggestions, and feedback to comments@SecurityHype.com.

 

 Enhanced Podcast [15:39m]: Play Now | Play in Popup | Download (2007)

Bill and Bob discuss misinformation about SSL represented in the February issue of Popular Mechanics and from BEA technical documents. We also discuss why hackers aren’t concerned by PayPal’s announcement to issue One Time Password (OTP) tokens to protect their members: the hackers already know how to defeat them.

(Technical glitch: the 8-second gap in the beginning of the audio will be fixed by our next episode.)

Please send your comments, suggestions, and feedback to comments@SecurityHype.com. And thank you for listening!