Re: [Full-disclosure] Re: choice-point screw-up and secure hashes

Valdis.Kletnieks_at_vt.edu
Date: 03/20/05

  • Next message: Feher Tamas: "[Full-disclosure] Re: Attack & Defence Against Visual CAPTCHA" 
    To: Atom Smasher <atom@smasher.org>
Date: Sat, 19 Mar 2005 19:05:51 -0500

    On Sat, 19 Mar 2005 18:18:46 EST, Atom Smasher said:

    > some companies have a legitimate need to ask that question. they should be
    > subject to more stringent checks than our recent bad guys. FTMP, however,
    > that question is of very little use... if you want to know the SSN of
    > "john smith", born 1976-07-04 you're likely to come up with several
    > matches.

    Exactly. That's why the SSN ends up being the key for the database rather
    than name/DOB.

    > the solution i've described is not meant to protect servers. it's meant to
    > protect data that people subscribe to. the fact that people subscribed to
    > the data indicates that the servers are well protected, or at least a
    > harder target than opening an account.

    Note that in general, the people who are subscribed to the data are not the
    people who's data is being subscribed to. It's *my* data on store at <insert
    data warehouse>, but it's the bank or utility or car dealership that's paying
    for access to the data, and it's yet some *other* place that was the *source*
    of the data.

    > the real issue, again, is that we are talking about a SYSTEM. each
    > component of that system has different threat models and needs to be
    > protected in different ways. what protects the data may not help the
    > servers... that protects the servers might not protect dead hard drives...
    > what protects dead hard drives might not protect the network... for a
    > group of security professionals i'm disappointed that so many people are
    > looking for a single "magic bullet" that will just "secure" every part of
    > a complicated system. it doesn't work like that in the real world.

    Notice that your "hash the SSN" defense would have done exactly *ZIP*
    to defend against the ChoicePoint debacle that started this thread, and
    doesn't really provide very heavy protection against a compromise of the
    database itself. We're not looking for a magic bullet that would secure
    it all - but it would be nice if proposals to secure a part of it did in
    fact add significant security to that part....

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Feher Tamas: "[Full-disclosure] Re: Attack & Defence Against Visual CAPTCHA"

    Relevant Pages

    • RE: [PATCH RESEND 1/1] crypto API: RSA algorithm patch (kernel version 2.6.20.1)
      ... the set of people I allow to put money in my account might include ... Would you trust someone to protect your account if he says ... kernel, something else has to. ... I already said in another email that symmetric key encryption is only as secure ...
      (Linux-Kernel)
    • Re: Linux security
      ... I don't want to diminish sudo, but it doesn't protect your data files. ... Linux doesn't have PR to worry about; ... In other words, Firefox is more secure than IE, Thunderbird is more secure than Outlook, and OpenOffice is more secure than MS Office. ... Daniel: Linux is more secure than Windows. ...
      (Ubuntu)
    • Re: how can i secure a choice on a switchboard in access?
      ... I think there are instructions in the security FAQ if you want code to ... simply protect one form. ... > Thanks for you quick response Rick. ... I don't secure individual objects with passwords. ...
      (microsoft.public.access.security)
    • Re: Question 2
      ... the updates from MS on both computers. ... >> doesn't it provide a good security system with its OS? ... > needing networks and they assumed they were also secure networks. ... > not protect the system, only gives a false sense of security. ...
      (microsoft.public.windowsxp.help_and_support)
    • Automated Backup for MT
      ... back-up system to protect my personal and business records in case of ... secure storage (Get more through the referral ...
      (sci.med.transcription)