Wednesday, May 21, 2008

Botched Security Lifetime Achievement Award


I wasn't going to add my 2c to the debate rumbling behind the OpenSSL defect, (summarised nicely here) Plenty of knowledgeable folks have raked over those coals already.

But then I came across this story, I don't know how old it is, Hardworking Locksmith In Prisons and it struck me that the OpenSSL problem was essentially the opposite of the locksmiths one.

On the one hand we have a security technology which was compromised because its secrets weren't known and understood well enough, and on the other we have a security technology who's flaw is that it relies to a large extent on practitioners keeping secrets.

So the award goes jointly to the guys who compromised OpenSSL without knowing what they were doing, and the guys who compromise our homes and offices just because they do.

I'm still not sure whether I'm happier to rely on knowledge or ignorance for my security though.


Comments:

Anonymous said...

Interesting comparison, but the summary you link to is pretty flawed, for all its succinctness.

blog comments powered by Disqus

I know nothing, I'm not a fortune teller, and you'd be insane to think that I am. This disclaimer was cribbed from an email footer I once received. It is so ridiculous I had to have it for myself.

Statements in this blog that are not purely historical are forward-looking statements including, without limitation, statements regarding my expectations, objectives, anticipations, plans, hopes, beliefs, intentions or strategies regarding the future. Factors that could cause actual results to differ materially from the forward looking statements include risks and uncertainties such as any unforeseen event or any unforeseen system failures, and other risks. It is important to note that actual outcomes could differ materially from those in such forward-looking statements.

Danny Angus Copyright © 2006-2013 (OMG that's seven years of this nonsense)