by
Jeffrey Goldberg
It has recently been noted over at ZDNET that if your Facebook password is PattyAndMolly, Facebook will also accept pATTYaNDmOLLY as a valid password. This may initially seems look something that weakens users’ security. However it actually is a good thing.
Continue reading
by
Jeffrey Goldberg
The big security news of the past few days is the story of the compromise of the DigiNotar Certificate Authority and the subsequent issuing of fraudulent SSL certificates, leading to actual Man in the Middle attacks against Gmail users in Iran. If that previous sentence was gobbledygook, this post should explain some of it. It will also give you …
Continue reading
by
Jeffrey Goldberg
Twelve passwords for banks and bills so high, Seventy for retailers with their online stores, Ninety for communities of Men to whom I say “hi”, One for me, ’cause I can’t know more. In the land of Crypto where the Secrets lie.
Continue reading
by
Jeffrey Goldberg
We often hear people say that there is a trade-off between security and convenience. Although there is some truth to that, I want to explain why, more often than not, security actually requires convenience. I should warn you, though, that this is going to be one of my most boastful articles to date.
Continue reading
by
Jeffrey Goldberg
An otherwise excellent article over at The Inquirer has a very unfortunate title: AES encryption is cracked. AES is the Advanced Encryption Standard and is at the heart of so much encryption used today by governments, militaries, banks, and all of us. It is used by 1Password and less directly by Knox for Mac. It is the work horse of modern …
Continue reading
by
Jeffrey Goldberg
I’ve always wanted to write a technical followup to an earlier post, Toward Better Master Passwords, but this time going into some of the math behind it. Today’s xkcd comic does that for me:
Continue reading