Guymon

Off The Grid Password Generator

Off the Grid von Steve Gibson ist ein spannender Ansatz für das “technologiefreie” Generieren von Passwörtern.

We designed this “Off The Grid” system to provide Internet users a uniquely and provably secure alternative to simply hoping that malicious software hasn’t, or won’t, infiltrate their personal password keeper, online password storage system, on-the-fly password generator, computer-hosted password storage vault, or whatever convenience technology is being employed to generate and/or store the passwords used to authenticate the user’s identity to remote Internet websites.

“Off The Grid” converts any website’s name into a secure password that you never need to write down, store, or remember because you can easily re-create the same secure password from the same website name the next time, and every time, you need it.

Ich denke darüber nach meine Passwörter mit diesem System zu erstellen und in 1Password zu speichern. Sollte 1Password eines Tages mal nicht mehr verfügbar sein könnte ich noch immer alle Passwörter wiederherstellen oder wenn ich nicht an einer eigenen Maschine sitze…

Browser Exploit Against SSL/TLS

In letzter Zeit gibt es viele schlechte Nachrichten rund um SSL/TLS, hier ist noch eine:

Die Forscher Juliano Rizzo und Thai Duong wollen kommenden Freitag auf der Sicherheitskonferenz ekoparty in Buenos Aires ein Tool namens BEAST (Browser Exploit Against SSL/TLS) vorstellen, mit dem ein Angreifer im gleichen Netz via SSL übertragene Browsercookies abgreifen und entschlüsseln können soll. (…) Gegenüber The Register gab Rizzo an, dass er dadurch ein verschlüsselt übertragenes PayPal-Cookie in unter zehn Minuten knacken könne.

NSA: Security Configuration Guides

Ich hatte mir vor einigen Jahren schon mal die NSA Vorschläge für sichere Computer Konfiguration angesehen und gerade entdeckt, dass die Vorschläge weiterhin aktualisiert werden.

Es gibt unter anderem: Hardening Tips for MAC OS X 10.6 Snow Leopard und Security Highlights of Windows 7

Basic Internet Security

Basic Internet Security via Floss Manuals:

When verbally passing a message you usually need to know your contact persons to know if you can trust them, but you also have to know your technology a little to know if you can trust it. Technologies can leak or distort your message just as humans can. Technologies are invested in types of trust relations: some devices are safer than others, some can be modified, and some are better avoided.

This book tries to address these different layers by giving hands-on explanations on how to make your digital communication and data more secure and by providing the reader with a basic understanding of the concepts of digital communication and data security. It derives from the following principles:

1. No method is entirely secure;
2. You need to have a basic understanding on how and why technology works to make it work for you;
3. You need technology for safer communication: either some basic tools, or more sophisticated equipment, depending on where you’re at and where you go.

Website Security

Ein “Schnupperkurs” in Sachen Website Security gibt es im Webmaster Central Blog:

Today we’ll show you some examples of how a web application can be exploited so you can learn from them; for this we’ll use Gruyere, an intentionally vulnerable application we use for security training internally, too. Do not probe others’ websites for vulnerabilities without permission as it may be perceived as hacking; but you’re welcome—nay, encouraged—to run tests on Gruyere.