12. September 2013
network , security
Top Security/Privacy Concerns Today – Not a complete list but some important items that not everyone is aware of.
Metadata – Metadata is the information found about data. Even if your data is encrypted there is still a lot of metadata that can be just as revealing as the data itself. Some examples include…
- Sending encrypted email – Hackers will still know whom it went to and when it went to them.
- Bitrates - Certain traffic bitrates can be linked to movies, music, etc.…
- Proxy Servers - Using an anonymous proxy? Without random packet delay the traffic going out is easily match to the traffic going in. With this it’s not too hard to figure out what data is going where.
Lack of Perfect Forward Secrecy (PFS) usage - Many TLS implementations have refused to offer PFS. Without this if a hacker ever obtains the private key even after the key expires all communications it ever encrypted could be decrypted. Where do most people store their expired SSL keys? Do they keep them just as secure as their active ones?
Lack of (PIE) Pre Internet Encryption – Unless the data you are putting on the Internet is encrypted securely using a secret key that is not stored on the internet your data is not truly secure.
Difference of opinion – If company 1 needs the last 4 digits of your credit card in order to reset your password and company 2 gives you the last 4 digits of your credit card so you can see what card you are using this makes social reverse engineering very easy. With enough pieces to the puzzle you can take over all accounts owned by a single entity.
How Apple and Amazon Security Flaws Led to My Epic Hacking http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/
Pre-Internet Encryption - Gibson Research Corporation
Perfect forward secrecy