Dan Geer On Trusting PCs In Botnets

walk*bound writes "In an essay published by ZDNet, security scientist Dan Geer has an interesting proposal for e-commerce sites to evaluate the trustworthiness of clients that try to connect. Assume that end users either always say 'Yes' or always say 'No' to security dialog boxes. Then make the decision one of two ways: 'When the user connects, ask whether they would like to use your extra special secure connection. If they say "Yes," then you presume that they always say "Yes" and thus they are so likely to be infected that you must not shake hands with them without some latex between you and them. In other words, you should immediately 0wn their machine for the duration of the transaction — by, say, stealing their keyboard away from their OS and attaching it to a special encrypting network stack all of which you make possible by sending a small, use-once rootkit down the wire at login time, just after they say "Yes."'"

Comments

Go Fuck Yourself.

[Erris]

I sure as hell didn't write that.

You might not be responsible for that thread, but your are responsible for representing yourself as someone else and part of a harassment campaign against people who say things you or your employer don't like to hear. If you are doing it for yourself, you're an asshole. If you are doing for money, you are a whore. Either way, you're scum and should not be be trusted.

By the way, it's not working. Slashdot is still an entertaining and informative place, even for people like me.

You should do something better for a living like dishwashing. It pays better and would put you in touch with nicer people than your current employers and associates.

bend over mon

[dedazo]

I think willyhill is on to something, but you're just too damn stupid to see it yet.

I'll get the popcorn ready.