Announcing: Slashdot Deals - Explore geek apps, games, gadgets and more. (what is this?)

Thank you!

We are sorry to see you leave - Beta is different and we value the time you took to try it out. Before you decide to go, please take a look at some value-adds for Beta and learn more about it. Thank you for reading Slashdot, and for making the site better!



Book Review: Bulletproof SSL and TLS

ChadL Re:Certificate warnings (92 comments)

If a site sends a strict transport security header (e.g. "Strict-Transport-Security: max-age=31536000; includeSubDomains"), it will cause a browser to store that and refuse to allow an override if the certificate verification fails (and also changes plain http attempts to https). So for sites that do have certificates and wish to have enforcement of that there is a good option for that (though doesn't help for the first request, that is unlikely to have anything interesting in it).

about a month ago

Carmakers Promise Not To Abuse Drivers' Privacy

ChadL Re:Pinky swear? (98 comments)

They don't need to take an oath given what I read from the document. It doesn't really say anything, uses lots of weasel words such as "legitimate business purposes". Additionally they allow sharing of covered information to protect the "safety, property, and rights" of Participating Members (themselves), which I see as allowing them to come up with some reason to share whatever they want.

about a month ago

Linux Kernel Git Repositories Add 2-Factor Authentication

ChadL Re:How does it work without a clock? (49 comments)

I have a Yubikey that I use for encrypting my password stores (using the private id as one of several components passed to a pbkdf). It detects replays by verifying that every token has a larger counter then all prior used tokens (and the timer depending on the application).
A Yubikey token looks like 'ficrtvulktgnerhddigbhcudufurijghfcckvchhjfli' and is a modhex (16 chars picked for being the same across charsets) and contains the following:
1) A public ID to identify the key
2) AES128 encrypted 128 bits containing the following:
a. Secret ID
b. Insertion counter (how many times its been plugged into a computer)
c. Token counter (within one insertion)
d. Timestamp (A counter counting the time since the token was inserted into the computer)
e. Random number
f. Checksum of the above
Their website has full specifications and documentation.

about 4 months ago

Study: Firmware Plagued By Poor Encryption and Backdoors

ChadL Re:Self signed-certificate?? (141 comments)

That depends on the use case. Take for example a printer which is using TLS to encrypt documents sent to it and scans from it to the computer. In the case of a single self-signed CA its just snake oil as far as security as anyone could take the self-signed certificate from the FW image and MiTM the connection.
If, instead, the printer created a random self-signed certificate on first boot and the printer driver asks the user on a certificate change 'printer xyz appears to have changed its fingerprint, did you perform a factory reset?' (and on new printer add just save the certificate from the new printer on first use).
The above change would change the snake oil to some meaningful level of security (not 100%, but most likely the first setup isn't going to be MiTM'ed). Additionally if TLS isn't using forward-secrecy then a certificate shared across all devices allows anyone to decrypt logged traffic to/from any of these devices by extracting the key from the manufacturer provided fw image rather then having to hack it out of the physical device itself.

about 4 months ago

How One School District Handled Rolling Out 20,000 iPads

ChadL Re:Expensive? (285 comments)

The digital versions of textbooks that I've thus far seen are anything but free, unless the district got a special deal on the digital text book versions for the iPad's that make them less expensive. Without having said numbers (that I'm sure are under multiple NDA's) speculation on the overall price is difficult.
Looking at the Google Play textbook store (because its easy to look at and ebook prices seem the same across sources in my experience) they are between $40-$50 each, and then couldn't be transferred between devices (e.g. students) if they are given rather then loaned the iPad (article uses the term 'given'); again could be changed with a special contract.

about 5 months ago

Selectively Reusing Bad Passwords Is Not a Bad Idea, Researchers Say

ChadL Re:Passwords are bad (280 comments)

Not the OP, but I'd like to see passwords replaced with SSL client certificates. The GUI for them in most modern browsers is horrific and the error messages shown when something goes wrong even worse; but both issues could be fixed.
If additional verification of identity is required then a password would be much safer behind a certificate (as an attacker trying passwords would need the users certificate and could easily be rate limited by account).

about 5 months ago

Philips Ethernet-Powered Lighting Transmits Data To Mobile Devices Via Light

ChadL Re:IPv6 (104 comments)

These are embedded devices so they would need to be on a firewalled off network (presumably allowing access from the byod wifi to allow control from selected smartphones) anyway to keep them from being internet-hackable, as they aren't likely going to get patches for security and protection from disgruntled employees who have the lights ips/keys already.
That being the case, there is little reason to use public IP's for them at all (since the entire range would have to be completely firewalled off, so using fe* or 10.* IP's doesn't really matter all that much and allows for somewhat easier auditing of the security situation.

about 6 months ago

Philips Ethernet-Powered Lighting Transmits Data To Mobile Devices Via Light

ChadL Re:Well, this sounds brilliant... (104 comments)

The use I can think of is the ability of office workers to change the color (presuming these are similar to their Hue bulbs) and brightness of the lights over their cubes (as they could use their smartphones to identify said lights and connect to them without going through some central system) or in their offices rather then being stuck under florescent lights or with the same color/brightness for everyone that the office management decided on using.
Not a really great use, but its better then no use. I'd expect most offices would nix the idea of having assorted light colors throughout the cube farm as being unclean and disable the feature, leaving no use for all but some of the offices.

about 6 months ago

Boston Trying Out Solar-Powered "Smart Benches" In Parks

ChadL Re: Someone put gum in the outlets. (119 comments)

Liquids aren't hard to defend against, all it has are two wires with +5 volts and ground and a resistor across another two lines to tell the device its a dumb charging terminal (that doesn't need to be asked to draw more power). Some simple epoxy around the wires and a current limiter (common in just about every usb setup anyway) will take care of conductive liquids (by preventing them from doing damage to the electronics with the limit until the liquid drains out of the port).
Chewing gum stuffed into the USB port is likely the most common and hardest to solve problem there. I presume they would have designed the contacts to be resistant to chemicals that dissolve gum to allow cleaning, but still not going to be pretty.
Other then that, its a big metal box, assuming the solar panel is covered in suitably tough plexiglass I don't see too much in the way of likely damage (but I'm not a vandal, who likely have more experience in how to cause problems that aren't easy to fix).

about 6 months ago

Boston Trying Out Solar-Powered "Smart Benches" In Parks

ChadL Re:But ugly as hell (119 comments)

It looks suspiciously like the smaller armrests placed in the middle of benches in order to prevent the homeless from being able to sleep on the benches, rather then just a poor design decision; but I don't really know what the thought process behind the decision was. I agree with you, a poor design that is also ugly.

about 6 months ago

Russia Bans US Use of Its Rocket Engines For Military Launches

ChadL Re:suspend GPS? (522 comments)

They are talking about the GPS ground stations that monitors the GPS signals (and is programed with its exact position and altitude) and determine what corrections, if any, need to be made to the GPS signals (so that what it knows to be its correct position is the same as what its GPS receiver is telling it)
Russia wants similar ground stations set up in the US for their GLONASS system, which I think is fair (and good for users of navigation systems, if not for the US military which would like to be able to turn off Russia's navigation systems).

about 7 months ago

Researchers Find, Analyze Forged SSL Certs In the Wild

ChadL Re:More secure browsing... (86 comments)

Where there is an IT team to provide support using SSL client certificates will prevent (and detect via server SSL logs and client errors) fake certificates.
When enabled the client will sign (using their client cert, generally with a site-specific internally managed CA) all the communications after the key negotiation finishes, so if there is a middle-man that modified the certificate/keys the server will see the clients signature of the communications as incorrect (as the client and server wouldn't agree on what the communications were) even if the user overrides the SSL certificate warning or an attacker (or employer, or user, or vender) adds a fake/compromised CA to the trust store.
Doesn't work for sites without a support team to work with users and investigate failures or in cases where the internal CA is compromised, but for the highest of security needs its more effective then using Flash.

about 7 months ago

Scientists Warn of Rising Oceans As Antarctic Ice Melts

ChadL Re:Should solve water shortage issues... (784 comments)

Reading the wiki on both desalinization via boiling and reverse osmosis indicates the vast majority of the energy in both methods (ether boiling the water under a vacuum or pumping at a high pressure) seem to be independent of how much salt it has to remove; so reducing the salt content by a few percent won't reduce the energy consumption (but will flood most existing plants and require more energy to have them rebuilt).

about 7 months ago

Did the Ignition Key Just Die?

ChadL Re:If not... (865 comments)

For my Prius there is a metal ring around the start button (and a mechanical key built into the key fob to open the doors) and if I press the fob on the ring even without a battery in the key the car can power it enough to authenticate the key and will then allow me to start the car.
The price of the keys, however, is indeed unacceptable.

about 8 months ago

Time Dilation Drug Could Let Heinous Criminals Serve 1,000 Year Sentences

ChadL Re:Ridiculous. (914 comments)

My (limited) understanding of how drugs like the ones talked about here work is that they increase the number of "ticks" that the brain records so it thinks more time has passed, rather then actually speeding the brain up.
So, if the intent of work is to torture people with work then it might be effective, though afaik said people wouldn't likely get any more accomplished per earth-year then anyone else. Perhaps they would waste less time thinking that more wasted time has passed being wasted or something of that nature depending on what it covers.

about 9 months ago

'Google Buses' Are Bad For Cities, Says New York MTA Official

ChadL Re:True innovation (606 comments)

I don't work from home all that productively, and do much better from a workplace that is split from my living space (and don't want to pay for the space to have an office in my apartment).
So for my uses it would take more innovation then virtual conferencing tools.

about 10 months ago

Why Your Phone Gets OTA Updates But Your Car Doesn't

ChadL People would demand updates be made (305 comments)

Currently they just don't fix problems in cars software unless there is a recall.
There haven't been any patches for the security holes associated with the electrical impulses causing doors to unlock (a patch requiring the door controller to get a cryptographic hello should do the trick), nor the issue allowing one remotely take control of a car, never mind the assorted annoyances that a software patch could fix.
If they were actually able to remotely patch a car there would be more questions about why they aren't making the patches, and they would rather not the focus be on them being cheap.

about 10 months ago

ICANN's Cozy Relationship With the US Must End, Says EU

ChadL Re:Huh? (193 comments)

One problem with ICANN now is that they hold the root DNSSEC keys, so anyone who controls the strings of ICANN can spoof otherwise secured DNS records (and the associated SSH/PGP/HTTPS key pinning done with said records). The NSA, for example, I'm sure would be interested in the ability to man in the middle domains that are seen as important (ones that someone bothered to sign with DNSSEC).
I'm also sure that the GCHQ is equally interested in getting their hands on said keys.

about 10 months ago

Adobe Flash Remote Code Execution Flaw Exploited In the Wild

ChadL Re:This is ridiculous (187 comments)

I agree, however the current uses of flash are:
1) Videos
2) Copying text to the clipboard
3) Cow-clicking Games
The first could be moved to HTML5 but DRM (or in YouTube's case advertisement functionality) are slowing that down. DRM by definition can't be open source, so we ether have Flash or HTML5 DRM extensions (that are likely to be almost as bad, in addition to not being maintained and having security researchers yelled at as pirates instead of fixing the vulnerabilities).
In the second case some browser extension could be developed to allow copying only on button click like the popular flash applet does for that, better then having a full programing language for it.
The third case could make use of a foss solution, but with the first two having better options and devs already set in the ways of Flash its unlikely that there would be enough of a market for that to become substantial.

about a year ago

New, Privacy-Oriented, FOSS Web-mail: Mailpile

ChadL Re:More powe to them, but... (116 comments)

Rather then attaching the public key, a system such as GPG's pka that publishes keys for e-mail addresses in DNS via DNSSEC signed records is likely a safer alternative against modified keys. It also allows the first e-mail between two people to be encrypted (as the key can be found via a DNS request).
PKA works now, but the clients have to be told to use pka manually, so its of limited value in its current state until adoption gets a little wider. Sadly leaves GMail and friends out in the cold (unless they offer a key publishing service to their DNS), but works well for privately controlled domains (since commercial webmail can't really be secure anyway, its as good as I think we are likely to get).

about a year ago


ChadL hasn't submitted any stories.


ChadL has no journal entries.

Slashdot Login

Need an Account?

Forgot your password?