Slashdot Mirror
Zimmermann Enters Debate on Microsoft Encryption
Golygydd Max writes "I didn't see much coverage of the RC4 flaw in Microsoft Office that was uncovered recently by a researcher, Hongjun Wu. Now, PGP creator Phil Zimmermann, dissatisfied with Microsoft's response, has joined in the debate. In an interview with Techworld he castigates Microsoft for their inadequate response: 'The lay user ought to be entitled to assume that the encryption produced by Microsoft is adequate. ... If Microsoft wants to earn the respect of the cryptographic community and the public it must rise to the occasion by producing competent security.' The cynic might ask, 'what respect', but should Microsoft have taken a flaw in some of its most popular programs more seriously?"
Perhaps Microsoft should employ Mr. Zimmerman of PGP to fix M$'s broken code.
The fact that so many documents written (especially now) are using Microsoft formats, makes this problem very dangerous.
Its worth mentioning that any docuemtns that are actually worth protecting should by default not rely on Micrsofts (lack of) security, as it is a known trend that Microsoft fails time and time again to provide adaquate security.
People think "wow! encryption, and NOT a lame password". By as per normal, scratch a little deeper and you can see how flawed microsoft code actually is...
Zimmermann makes some Pretty Good Points in the interview.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
Why fix it in a free patch, when they can charge money for a new version that you have a reason to buy?
I wonder when someone writes a script to google for Word documents, get the protected ones out and decrypt them. Ought to be a fun project.
8 of 13 people found this answer helpful. Did you?
MS considers it a low priority because there is no tool that currently is known to be available that can leverage the theoretical issues brought up in the paper. I agree with them. An issue is "high priority" when there is a tool that can be used by an end user now as an exploit. That is how you prioritize things in real life.
Consider NSA's track record:
An agreement with Microsoft to ensure insecure encryption would be very out of character for them.
That is, unless they're just a bunch of Linux freaks.
These comments do express the opinions of my employers, and, personally, I think they're complete rubbish.
While I agree that the 'spiteful employee' arguement is largely bunk, the 'employee who quit, got fired, or otherwise left unexpectedly' arguement is not.
e.g. I am a sysadmin, and I store all the incident reports on a Win2k3 EFS box, encrypted to my key. These incident reports are important to whomever is doing my job -- no one needs to see them unless I leave unexpectedly. If I get trampled by a herd of malicious gnus on the way to work, the top-level admins will need access to my data, as will whoever replaces me.
There are two solutions to that -- share my key or use the EFS recoverable key system. Guess which I'd rather do?
We may not imagine how our lives could be more frustrating and complex—but Congress can. – Cullen Hightower