Re: Secure automation?
From: Juha Laiho (Juha.Laiho@iki.fi)Date: 06/18/02
- Next message: : "Re: subjective Q. - what's the most secure OS?"
- Previous message: Juha Laiho: "Re: Hashed PW's more secure than encrypted PW's?"
- In reply to: David Stanek: "Secure automation?"
- Next in thread: : "Re: Secure automation?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
From: Juha Laiho <Juha.Laiho@iki.fi> Date: Tue, 18 Jun 2002 19:17:01 GMT
David Stanek <no_spam..python@dstanek.com-NOSPAM> said:
>The problem I can't seem to get around is the fact that to decrypt you
>need a key. So it has to exist somewhere right?
Correct. And if you store the key on a system, the key can be copied
from the system - i.e. your data is only as safe as the overall system
is. Unfortunately there's no way out of this.
Examples:
To provide secured web services (https), a server SSL certificate is
needed. To reduce risk of fraud should a cracker be able to copy the
key off the system, it is suggested that the key is protected with
a password. The downside with this is that the web server will ask
for the password upon startup - so no more unattended startups. Unless
you come up with a program that would enter the password to the
web server that is starting up - but then you'd have to store that
password on the machine itself, so you'd lose the extra security you
tried to gain.
To be able to verify a server certificate, a web browser needs to
have a certificate corresponding to the one used to sign the server
certificate. To save the user form the hassle of obtaining and verifying
the CA public kays, the keys are distributed with browsers. Otherwise
the users would first need to obtain known good copies of the signing
CA's public key -- so even though the world seems so much simpler here,
it is so only because the browser manufacturer already bundles the known
good keys. Btw, mind where you get your browsers. Make sure the download
is not spoofed.
--
Wolf a.k.a. Juha Laiho Espoo, Finland
(GC 3.0) GIT d- s+: a C++ ULSH++++$ P++@ L+++ E- W+$@ N++ !K w !O !M V
PS(+) PE Y+ PGP(+) t- 5 !X R !tv b+ !DI D G e+ h---- r+++ y++++
"...cancel my subscription to the resurrection!" (Jim Morrison)
- Next message: : "Re: subjective Q. - what's the most secure OS?"
- Previous message: Juha Laiho: "Re: Hashed PW's more secure than encrypted PW's?"
- In reply to: David Stanek: "Secure automation?"
- Next in thread: : "Re: Secure automation?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
