security

Unchecky is another tool to help with staying out of trouble with malware

Dave Farquhar security , , , , ,

I found a mention of a tool called Unchecky as a minor point in a story about something else entirely. Unchecky helps to solve the problem with downloaded programs including a bunch of extra junk you don’t want.

I won’t be running it myself. But the next time I fix a computer, I’ll probably install it on that one.

Read more

Password management advice from CSO Online

Dave Farquhar security ,

Over at CSO Online, there’s a nice war story about tracking down and resetting 300 passwords.

I could pick nits at a few of his details, but that’s annoying and counterproductive. His overall advice is very good–manage your passwords, set them to something random, keep in mind that some sites just won’t allow for a very strong password so do the best you can, and protect your main e-mail password and your password management system password with all the diligence you can muster.

Read more

What the NSA can crack, and how to protect against it

Dave Farquhar security , , , ,

Ever since the Snowden leaks, there’s been considerable speculation about what cryptography the NSA could break, and why. Finally, there’s a study that goes into deep detail about what it is the NSA probably can break, and why, plus how to protect against it.

Read more

What to do after you get breached and sign up for the free credit monitoring

Dave Farquhar security

After a large company that has your data gets breached, the standard next step is to give you credit monitoring.

It’s not enough to protect yourself, but you can make it enough. Read more

If you use Truecrypt, migrate to Veracrypt

Dave Farquhar security ,

I’m playing catch-up with this one, but if you’ve been relying on the quasi-open source Truecrypt encryption solution, you need to migrate to Veracrypt as quickly as possible.

For some reason, it doesn’t seem to be common knowledge that Veracrypt is derived from Truecrypt and is, for all intents and purposes, the successor to Truecrypt.

Read more

Change a headline, go to prison

Dave Farquhar security , , , ,

A former journalist whose track record includes being fired from the Tribune Co. and from Reuters is facing two decades in prison for giving the hacking group Anonymous credentials to log into a Tribune web site and change stuff.

Anonymous changed one headline, and it took about 40 minutes for someone at Tribune Co. to notice and change it back.

It reminds me of something that happened at the newspaper where I used to work.

Read more

A sports analogy for security

Dave Farquhar security

Explaining security is really hard, but sometimes a sports analogy helps. Here’s an appropriate sports analogy for security.

Imagine you’re playing a sport. The sport doesn’t matter. What matters is you’re playing, and so is the opponent, and you have to follow the rules while they don’t. But you still have to prevent them from scoring.

But it’s more complicated than that. Imagine there’s another game going on, either adjacent to the field or within the field. That’s the business. Whatever you do can’t interfere with that second game, and you also have to keep your cheating opponent from interfering with that second game. And your success at preventing interference with that second game is how you’re going to be judged.

Vigilante router security

Dave Farquhar security , , , ,

Last week, Symantec discovered a worm that infects routers and takes measures to make them more secure. For lack of anything else to call it, Symantec is calling it malware, and most of the security echo chamber is probably howling over this, but I think I understand why it was created.

Read more

Flash vs Shockwave

Dave Farquhar security

Bad things happen when security pros like me start asking our infrastructure brethren to patch Flash. We get better security, but the Flash upgrade fails enough of the time to cause extra workload, and it can be confusing. One of the problems is the question of Flash vs Shockwave.

Consequently, I see more Flash-related helpdesk tickets than I ever saw, even when I was doing desktop support long ago. Adobe doesn’t make it any easier by calling the plugin “Shockwave Flash.”

Read more

A collection of hacking e-zines, new and old

Dave Farquhar security

I found this collection of hacking e-zines a while back. Some are new, some are old. Some are series and some were one-offs. If you’re interested in the early days of hacking, or the undercurrents of today, it’s not a bad place to peruse.