Heathrow airport may now not get facial recognition technology at all five of its terminals in time for the Olympics as planned, according to the Financial Times.…
View full post on The Register – Security
Android users who were looking forward to playing the popular Temple Run game – currently available only for iOS devices – have probably thought that the happy day has arrived when they discovered the…
View full post on Help Net Security – News
If employees use their same password at work and in their personal lives, another company’s breach may weaken your own security. Five steps to mitigate the risk.
View full post on Dark Reading – All Stories
From the start, Google’s Safe Browsing API was designed to spot malicious Web pages so users wouldn’t get trapped in them. Google identifies these sites through its own algorithms and user notification.
View full post on Security – Infoworld
There was a post on Ars Technica yesterday, that led back to another blog post from Sunday that suggests that Google Chrome will stop doing CRLchecks at some point in the not too distant future. This has led to some interesting debate because the CRLmechanism has largely been ineffective. For a public key infrastructure (PKI) such as HTTPS to work, there must be an effective way of verifying the validity of the certificates. Due to the number of Certificate Authority (CA) breaches in recent years we’d all like a fast and effective method of taking compromised certificates out of play. During the highest profile breaches, all the major browser vendors simply pushed new versions of the browser with the root certificates from the breached CAs removed, in part because the browsers by design fail open (allow the connection)if they are unable to verify the certificate. So, is this a big deal? Is it the right way to go? Is it time to rethink/redesign/replace SSLor HTTPS? What do you think?
References
http://arstechnica.com/business/guides/2012/02/google-strips-chrome-of-ssl-revocation-checking.ars
http://www.imperialviolet.org/2012/02/05/crlsets.html
—————
Jim Clausing, GIAC GSE #26
jclausing –at– isc [dot] sans (dot) edu
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
View full post on SANS Internet Storm Center, InfoCON: green