Slashdot Mirror
Father of SSH Says Security Is 'Getting Worse'
alphadogg writes with an excerpt from an interview with the designer of SSH-1: "Tatu Ylönen has garnered fame in technology circles as the inventor of Secure Shell (SSH), the widely used protocol to protect data communications. The CEO of SSH Communications Security — whose crypto-based technology invented in 1995 continues to be used in hundreds of millions of computers, routers and servers — recently spoke with Network World on a variety of security topics, including the disappearance of consumer privacy and the plight of SSL. (At the Black Hat Conference this week, his company is also announcing CryptoAuditor.)"
- But what if anything could replace the SSL certificate infrastructure?
- For consumers in the short term, no. But SSH is an option, especially for automation. It would require an extension to SSH. I actively proposed it to replace SSL 15 years ago but I was basically railroaded at the IETF by Microsoft and Sun!
"...Imagine all the people
browsing through SSH, uh uh u-uh uh"
If you think about it, the issues with key infrastructure are nothing new, they've been there since day 1, and in fact the same can be said about the micro-controllers which are now being regularly exploited by big brother.
User/Device security is no more or less "secure" than it was back in 1995, actually I'd argue that it's getting better as it's more widely adopted (when was the last time you used rsh?). In general it's always an evolving process.
We still don't have a practical way of breaking high bit crypto, and in general I feel plenty safe with my 1024 bit ssh connections to my LAN machines =)
I try to get my college buddies to send me encrypted email, and it's the same story, "Dude, just use Facebook like everybody else". I have a Facebook but stopped using it because I don't want FB snooping all my communications!
Privacy disappears because people don't value it. If they did, they wouldn't be using Facebook for all their communications. If they cared, they'd be using encrypted point-to-point VOIP for voice, not Skype. If they cared, they would be using OTR and Pidgin for chat.
Slashdot peoples care, but outside that crowd, people value convenience, not security or privacy. That's the only way so many privacy-violating services have become so huge when there are alternatives that preserve your privacy.
98% of people in the 22-29 year old age bracket now use Facebook. Most of those use it as their primary means of communicating with friends, and you're now considered "abnormal" if you don't have a Facebook. Even if you explain it to them the pitfalls of FB they don't care.
Until people start to care about their security and privacy, they won't have any. You have to vote with your actions.
CEO of Security Company warns of ever-increasing security dangers ... suggests own company's auditing tool to combat it!
I have a home. On this home there is a lock.
Now, an ignorant fool might think the lock is there to keep other people out. Nope, they are wrong. You see, in addition to my lock, I have windows, doors, a roof and floors, and walls. None of them are made of unobatanium.
An intelligent 5 year old child, with no training whatsoever can break my window and climb into my house.
My lock is there fore two distinct purposes:
1. It tells the world that this place is private - that the owner does not want anyone to enter it and will try to punish those that violate it's privacy. It's a sign.
2. It lets me get into my house easily, while making it much more difficult for anyone else to get in without leaving clear and obvious signs that they have trespassed (i.e. a broken window.)
That's what the locks on my home do - notify the world of my privacy and create traceable evidence of a violation of that privacy.
We need to start using IT security for the same purpose. Among other things, that means that when you log on to any website, it should list the last time you logged, and from where (using either an IP address and/or a cookie to identify the device used).
I don't want, nor do I need, an unbreakable password. I want to know when I've had a trespasser.
excitingthingstodo.blogspot.com
And here's an example: I remember when, a few years ago, a new version of a supposedly secure communications tool would let a person connect to a valid account by using any two letters as the password...
#DeleteChrome
I would largely agree. Unfortunately, I believe it is because real security - cryptography and end-to-end security and privacy - are very difficult, and hence, very expensive to develop, implement, and test. My experience with such coding is that it's every bit, if not more, rigorous as code written for medical devices or flight control software. It simply has to be bulletproof. Any one hole in the theory, algorithm, or implementation - and the whole thing comes apart. Learning about all those possible holes and plugging them is a herculean task. One can point to the near constant stream of security patches for every browser, app, and OS on the market. And these are the best-funded commercial enterprises around.
Another huge problem is the 'meh' attitude people have towards their personal information. We throw our data around so willy-nilly on smart phones and social networks. We check in places that tell everyone where we are (or are not http://pleaserobme.com/ ), publicly publish our most intimate family and friend relationships, report where we live and work, we even identify people to image recognition software. One expert I heard said that he could not imagine a more dastardly personal information monitoring system than Facebook. And we WILLINGLY give that information away. Google reads your emails and all the documents you upload to their 'free' services. Websites use everything they can to target ads at you, etc.
The unfortunate part, as my CS security professor pointed out, is that by the time it crosses an ethical line - it's nearly impossible to stop. Even worse, what if the company you gave all that info too gets sold to a very un-scrupulous person in a country with no protections? What if your government is taken over and they raid these databases for information about dissenters? All of these things are real, happen today, and yet we consider it more important to be able to brag to our friends and family what we had for dinner last night than protect ourselves.
Tatu Ylönen has garnered fame in technology circles as ... the dick who tried to trademark the term SSH in a move to try to shut down OpenSSH as a free alternative to their commercial product.
If IPsec had been made routine and manageable by mere mortals then *everything* running across the Internet could be secure by now. At first everyone would have supported it as an option, then at some point during one of Microsoft's mad security drives, it would have set "IPsec connections only" as default in one of its new operating systems. Businesses would have rushed to make sure that their systems were compliant.
But geeks promote ssh, which involves a mindset of explicitly setting up a tunnel - something the majority of people won't do. And if, as a service provider, you don't care about your client's security, you'll prefer HTTP rather than HTTPS on CPU usage grounds alone.
It's such a fucking shame that the transition to IPv6 hasn't involved a transition to IPv6sec.
No one cares about security. They cover everything with contract language but only to the extent that they could be hit with fines. Beyond that, customers literally do not give a fuck about security anymore. Not if it costs a nickel. And when it does, 4.9999 cents of that nickel goes into excruciatingly dense reporting which no one, NO ONE, ever reads.
Once the IT industry was taken over my lawyers and accountants, it's been downhill into a pool of shit since.
im not paying to get some cert
end of story and my users will still enjoy SSL https....
There have been several incidents where someone has stolen from the certificate authorities.
Let's see, who would want that that much to do the breakins? NSA, FSB, RIAA, MPAA, Chinese state sec...
What does Tatu YlÃnen know about this? It only took 20 years for his security tool to be softened by hackers. It takes almost, um, minutes for a new Apple ios to be jail-broken. Never mind.
...and left out the word "says" in my mind. I thought, "Oh no! I hope he'll be okay!"
You're typically irrational about privacy, but focusing on Facebook.
In fact, it makes little difference whether Facebook snoops on your E-mail in order to show you ads; there's little they can do to you, and if they harm you, you can recover damages.
What should concern you is that governments and law enforcement get ever increasing access to your data, and the false positive rate for their data mining techniques is doubtlessly high. And when they drag you away in some pre-crime effort, you have little recourse. Yet, politicians successfully stoke the fear of companies like Facebook while at the same time creating laws that let government and police intrude ever more into our private lives.
Until people like you actually start getting a clue, acting rationally, and demanding change from politicians, privacy will continue to spiral down the drain.
Nah, he's probably just from Finland. Oh wait, he actually is.