Nick La, witer for Web Designer Wall, is writing a complete guide on how to install WordPress and customize WordPress themes.

(Via -Complete WordPress Theme Guide.)

The Apple experience is a combination of form, function and intangible user emotional responses earned from its masterful blend of software and hardware

(Via -The Apple Experience | TheAppleBlog.)

Athneal Olliviere was my Great Uncle; my mother’s father’s brother. He is a legend on the island of Bequia and the rest of the Grenadines. He was the last of the of the traditional harpoon and small wooden boat whalers.

A sobering thought.

So, in a corner case example, what does a boundary condition like the out-of-cycle patch release of MS08-067 mean when your infrastructure and applications are no longer yours to manage and the ownership of the “stack” disintermediates you from being able to control how, when or even if vulnerability remediation anywhere in the stack (from the network on up to the app) is assessed, tested or deployed.

(Via Rational Survivability-Patching The Cloud?.)

Recently the topic of spam came up in one of the meeting of the PMUG. Someone suggested that digital signatures was one solution to the problem of spam but there was no clear understanding of digital signatures and how they help with the spam problem. I intend to write a concise but easily understood series of article on digital signatures, email encryption, and how to use it on Mac OS X ( with Mail.app ).

What is a digital signature?

According to Wikipedia:

A digital signature or digital signature scheme is a type of asymmetric cryptography used to simulate the security properties of a handwritten signature on paper.

Digital signatures are one component of what is called a public key infrastructure ( PKI ). PKI provides mechanisms and process for ensuring the confidentiality and integrity of digital information. It allows someone to prove his/her online identity and that documents and communications ( e.g. email and banking transaction ) haven’t been tampered with.

How does it work?

The science behind PKI involves some very complicated math. It involves finding the factors of very long prime numbers. These factors are used to create two keys, one private and one public. The private key is kept strictly confidential and is not shared with anyone, while the public key is distributed widely. Messages encoded with the private key can only be decoded with the corresponding public key and message encoded with the public key can only be decoded by private key.

How is this useful for digital signing?

The idea is to take piece of digital data and using a mathematical algorithm compute a large number called a hash – a small digital “fingerprint” made from any kind of data. The hashing function should create a unique hash for any particular piece of data. If the data changes then the hash will also change and we will know that the data has been tampered with.

To digitally sign a document, we compute the hash of the document and then encode the hash using the a private key. Since the data was encoded with the private key, it can only be decoded with the corresponding public key. To verify that the document ( e.g. email message ) came from that user, simply decode the hash using the widely known public key, compute a new hash from received document, and compare against the hash that was sent. If the hashes do not match we know that the document was tampered with. We know who sent the message because only that user has the private key used to encode the message.

How do I know the person sending the message is the person sending the message?

How do I know that the doctors is really a doctor? That the lawyer really knows the law? In the end, everything in security boils down to trust … but verify. In the real world we have authorities that certify that the doctors and lawyers ( teacher etc ) know what they are doing. The doctor or lawyers has been issued a license (certificate) to practice their craft. In a similar way PKI has the concept of a Certificate Authority (CA).

The user securely creates a private key and the CA signs the users public key with their private. This places their stamp of approval on the user digital certificates. The system is very heavily dependent on the trust placed in the CA. If the private key of the CA is compromised the entire PKI system is at risk since anyone could use that private key to create digital certificates. Similarly if the user loses his/her private key then anyone could digitally impersonate that user.

How does it all work together?

• A and B want to exchange confidential message. – A creates a message and encodes the message ( and the message hash ) using B’s public key. B receives the message and decodes the message using his/her confidential private key. B is the only one who can decode the message because B has the private key.
• A wants to send B an ( non-confidential ) message but B wants assurances the message did come from A. -A creates a message and encodes the hash of the message using her private key. B received the message and decodes the hash using As public key. B knows the message came from A because only A has the private key to encode the hash.

What’s Next?

In my next article I plan to show how to use digital certificate and digital signature to make your email more secure.

References:

• Public-key encryption for dummies, MIKE ROTHMAN, Network World, 05/17/99,http://www.networkworld.com/news/64452_05-17-1999.html
• Digital signature,Wikipedia, http://en.wikipedia.org/wiki/Digital_signature#Definition
• Cryptographic hash function, Wikipedia,http://en.wikipedia.org/wiki/Cryptographic_hash_function
• What is PKI?, SearchSecurity.com, 10 Oct 2006,Jim Brayton, Andrea Finneman, Nathan Turajski, and Scott Wiltsey,http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci214299,00.html

Cross posted from the Princeton Macintosh User’s Group

Looks like I made a good choice.

Methodology Annual pay for Bachelors graduates without higher degrees. Typical starting graduates have 3 years of experience; mid-career have 15.5 years. See full methodology for more.

 

Did I miss a Safari for OS X update?, originally uploaded by Khürt on 13th September, 2008.

I checked with “Software Update” just to be sure. Yep. I’m still running 3.0.4 but Gears wants 3.1.1

The SecurityFocus web sites has been running a series of articles on web browser security.  The articles target the two major browsers, IE (6 and 7) and (strangely) older versions of Firexfox (1.5 and 2.0).  The current article looks at attacks on Password Managers. The user is given a false sense of security because they “expect that the browser, possibly in conjunction with the operating system, will protect their information”. The major take away was that these browsers are not to be trusted to store personal information such as usernames, passwords and other stored form information.

Firefox’s password manager (version 2.0) as of Novermber 2006 has a software flaw that allows a user’s credentials (from the site being currently visited) to be posted to any URL if the user clicks a maliciously crafted link.

And IE( 6 or 7) has this issue:

Internet Explorer is usually a prime target for malware infection. …… these vulnerabilities converge at a dangerous point where malware programs are specifically targeting AutoComplete information. These programs gain confidential information, and then send it back to the attacker.

So what we do to reduce the risks?  Fortunately the article provides some defensive strategies.  They suggest avoiding password managers altogher, using a strong ( not easy guessed ) password to protect the password manager, using an alternative password manager that support encryption, strong and unique passwords for every site, and even some programming tips for web developers.

On my Mac I use 1Password.  IPassword uses a master password, encrypts stored passwords and form data, and can generate unique random passwords for any site.  You can Download 1Password here and give it a test drive.

Gnip’s jud valeski on Chrome.

My favorite kind of technology is the kind that quietly gets built, then one day you wake up and it’s changed everything. Google Gears has that potential and if Chrome winds up with meaningful distribution (or Firefox adopts Gears) web apps as we know them will finally have mark-up-level access to local resources (read “offline functionality”). This kind of evolution is long overdue. — Gnip Blog

I think this would make an excellent Ubuntu Linux workstation for a small office.

• Intel® Pentium™ Dual Core T2390 (1.86GHz/533Mhz FSB/1MB cache)
• Slot Load CD / DVD Burner (Dual Layer DVD+/-RW Drive)
• 1GB1 Shared DDR2 at 667MHz (1 DIMM)
• 160GB2 SATA Hard Drive (5400RPM)
• Intel® Integrated Graphics Media Accelerator X3100
• Integrated Stereo Audio with 5.1ch digital output (S/P DIF)