<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>My life, well-lived &#187; security</title>
	<atom:link href="http://blog.kgrothoff.org/tag/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://blog.kgrothoff.org</link>
	<description>It is indeed the best revenge... ;)</description>
	<lastBuildDate>Sun, 29 Jan 2012 09:59:58 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.3.1</generator>
		<item>
		<title>Ack&#8230; An anonymity nightmare</title>
		<link>http://blog.kgrothoff.org/2007/09/15/ack-an-anonymity-nightmare/</link>
		<comments>http://blog.kgrothoff.org/2007/09/15/ack-an-anonymity-nightmare/#comments</comments>
		<pubDate>Sun, 16 Sep 2007 02:24:52 +0000</pubDate>
		<dc:creator>Krista</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[anonymity]]></category>
		<category><![CDATA[idiots]]></category>
		<category><![CDATA[Internet]]></category>
		<category><![CDATA[privacy]]></category>
		<category><![CDATA[scary stuff]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[Tor]]></category>

		<guid isPermaLink="false">http://blog.kgrothoff.net/2007/09/15/ack-an-anonymity-nightmare/</guid>
		<description><![CDATA[I haven&#8217;t posted much on the privacy and anonymity front since getting pregnant, but I wanted to pass on a link in any event. Alex Janssen, a guy who runs a Tor server in Germany and who had promised never &#8230; <a href="http://blog.kgrothoff.org/2007/09/15/ack-an-anonymity-nightmare/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>I haven&#8217;t posted much on the privacy and anonymity front since getting pregnant, but I wanted to pass on a link in any event. Alex Janssen, a guy who runs a Tor server in Germany and who had promised never to shut down his server in spite of some groundless harassment from the German police, has <a href="http://itnomad.wordpress.com/2007/09/16/tor-madness-reloaded/">shut down his Tor node</a>; apparently, after last year&#8217;s baseless accusations of possessing kiddie porn, the police have come back this year to toss his apartment and accuse him of bomb and death threats, and when that didn&#8217;t pan out, he&#8217;s now being harassed about computer fraud.</p>
<p>What the Hell? The police obviously don&#8217;t understand <a href="http://tor.eff.org/overview.html.en">how Tor works</a> or what it is for, in spite of now having some experience with Tor operators, and yet even after being proven wrong again and again they still harass the same guy for various content that supposedly &#8220;came from&#8221; him.</p>
<p>I don&#8217;t blame the guy for shutting down the node &#8211; it&#8217;s one thing to hang on to an important ideal, but there are only so many lawyers fees and investigations &#8211; and so many groundless arrests &#8211; one can take before deciding that personal interest is more important than &#8220;the greater good&#8221;. Of course, I suspect this is what the police intend &#8211; if you can&#8217;t beat anonymous p2p networks by actual analysis or even shutting them down across the board, you can just scare the crap out of the operators until they cry uncle out of concern for their lives and family.</p>
<p>I might expect this kind of ignorance from our guys over here, but I expected rather more from the Germans&#8230;</p>

]]></content:encoded>
			<wfw:commentRss>http://blog.kgrothoff.org/2007/09/15/ack-an-anonymity-nightmare/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Ancient security secret, huh?</title>
		<link>http://blog.kgrothoff.org/2007/07/17/333/</link>
		<comments>http://blog.kgrothoff.org/2007/07/17/333/#comments</comments>
		<pubDate>Wed, 18 Jul 2007 05:40:21 +0000</pubDate>
		<dc:creator>Krista</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[humor]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blog.kgrothoff.net/2007/07/17/333/</guid>
		<description><![CDATA[It&#8217;s amazing how silly people are &#8211; everyone&#8217;s obsessed with &#8220;security&#8221; (in quotes on purpose here), yet the most obvious things slip by them. All this security theater, and yet you can drive an actual Trojan Horse through the gates &#8230; <a href="http://blog.kgrothoff.org/2007/07/17/333/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>It&#8217;s amazing how silly people are &#8211; everyone&#8217;s obsessed with &#8220;security&#8221; (in quotes on purpose here), yet the most obvious things slip by them. All this security theater, and yet you can drive an <em>actual</em> Trojan Horse through the gates of an Australian army headquarters, amongst other places.</p>
<p>No <em>really&#8230;</em> I snagged this clip from <a href="http://www.schneier.com/blog/archives/2007/07/realworld_troja.html">Bruce Schneier&#8217;s blog</a> &#8211; it&#8217;s really funny, so enjoy:</p>
<p><a href="http://blog.kgrothoff.org/2007/07/17/333/"><em>Click here to view the embedded video.</em></a></p>

]]></content:encoded>
			<wfw:commentRss>http://blog.kgrothoff.org/2007/07/17/333/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Fun with liquids and gels&#8230;</title>
		<link>http://blog.kgrothoff.org/2007/05/18/fun-with-liquids-and-gels/</link>
		<comments>http://blog.kgrothoff.org/2007/05/18/fun-with-liquids-and-gels/#comments</comments>
		<pubDate>Fri, 18 May 2007 19:56:40 +0000</pubDate>
		<dc:creator>Krista</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[humor]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blog.kgrothoff.net/2007/05/18/fun-with-liquids-and-gels/</guid>
		<description><![CDATA[Snagged from Bruce Schneier&#8217;s blog &#8211; great SNL skit about the TSA:]]></description>
			<content:encoded><![CDATA[<p><a href="http://www.schneier.com/blog/archives/2007/05/saturday_night.html">Snagged</a> from Bruce Schneier&#8217;s blog &#8211; great SNL skit about the TSA:</p>
<p><a href="http://blog.kgrothoff.org/2007/05/18/fun-with-liquids-and-gels/"><em>Click here to view the embedded video.</em></a></p>

]]></content:encoded>
			<wfw:commentRss>http://blog.kgrothoff.org/2007/05/18/fun-with-liquids-and-gels/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Take your right to vote seriously. Take your vote seriously.</title>
		<link>http://blog.kgrothoff.org/2006/10/02/take-your-right-to-vote-seriously-take-your-vote-seriously/</link>
		<comments>http://blog.kgrothoff.org/2006/10/02/take-your-right-to-vote-seriously-take-your-vote-seriously/#comments</comments>
		<pubDate>Mon, 02 Oct 2006 07:17:43 +0000</pubDate>
		<dc:creator>Krista</dc:creator>
				<category><![CDATA[Uncategorized]]></category>
		<category><![CDATA[Administration]]></category>
		<category><![CDATA[Bush]]></category>
		<category><![CDATA[Denver]]></category>
		<category><![CDATA[hardware]]></category>
		<category><![CDATA[Politics]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[software]]></category>

		<guid isPermaLink="false">http://blog.kgrothoff.net/2006/10/02/take-your-right-to-vote-seriously-take-your-vote-seriously/</guid>
		<description><![CDATA[We watched Unprecedented: The 2000 Presidential Election this evening, a documentary about election irregularities and how the 2000 election progressed. I hate watching these things, in that they depress me about the state of this country so severely, but they &#8230; <a href="http://blog.kgrothoff.org/2006/10/02/take-your-right-to-vote-seriously-take-your-vote-seriously/">Continue reading <span class="meta-nav">&#8594;</span></a>]]></description>
			<content:encoded><![CDATA[<p>We watched <a href="http://www.imdb.com/title/tt0346091/" target="_blank">Unprecedented: The 2000 Presidential Election</a> this evening, a documentary about election irregularities and how the 2000 election progressed. I hate watching these things, in that they depress me about the state of this country so severely, but they are some defense against complacency if nothing else.</p>
<p>It is amazing to me that even for someone who is, I think, fairly cognizant of the crap that&#8217;s gone on for the past 5 years, it is still easy to forget what really went on. What can still go on. What probably will continue to go on. And I seriously cannot fathom why more people &#8211; Democrats, Republicans, <em>whoever </em>(this is a citizens&#8217; issue, not a partisan one) &#8211; are not screaming bloody murder about the conversion to unverifiable, <a href="http://www.freedom-to-tinker.com/?p=1064" target="_blank">basically unsecured</a>, <a href="http://www.msnbc.msn.com/id/14825465/">easily-hacked</a> voting machines. Sure, having no paper trail (and no reason to look at one) keeps things less messy &#8211; nothing to recount if irregularities occur, so we just have to accept the result &#8211; but it&#8217;s a disaster for our democracy. My point about there being no reason to look at a paper trail is, I guess, a reflection of my feeling that if the politics are played just right, more often than not, people won&#8217;t even look at the paper trail if there is one. But it&#8217;s better than nothing, and a physical record that the voter can verify &#8211; and deposit himself somewhere &#8211; is vital.</p>
<p>Getting it right with electronic voting systems isn&#8217;t easy; designing such a system &#8211; and only a thumbnail sketch of one at that &#8211; was the PhD qual question for my information security final back in my CS days, and I remember that every time I was ready to add another component to the system, the nagging questions of accountability, verifiability, authentication, and integrity would pop up in some ugly way or another and I&#8217;d have to consider another path. I&#8217;m not a systems expert by any means, but it&#8217;s not easy, and as far as I can tell, all Diebold and company have gotten right is &#8220;easy to tamper with&#8221; and &#8220;easy to screw up.&#8221; Go Diebold! Hell, I can do <em>that</em> much, and I&#8217;m <em>much</em> cheaper.</p>
<p>By the way, if you think &#8220;all the kinks have been worked out&#8221; by now, and that folks like me are just getting all worked up over nothing, I urge you to have a look at <a href="http://avi-rubin.blogspot.com/2006/09/my-day-at-polls-maryland-primary-06.html" target="_blank">Avi Rubin&#8217;s post about his day as an election judge in Maryland last month.</a> For those who don&#8217;t know, Avi Rubin is not just some guy off the street &#8211; he&#8217;s a professor at JHU who does work in (among other things) electronic voting security, and he&#8217;s a smart guy. Particularly confidence-inspiring is the account of the well-trained and competent Diebold technician &lt;insert sarcasm here&gt; and how the machines malfunctioned pretty spectacularly.</p>
<p><strong><em>Last month</em></strong>, folks. You can bet that not a whole lot will change by November.</p>
<p>You know the push for folks to vote absentee if their precinct allows them to cast a no-excuse absentee paper ballot? I&#8217;m thinking hard about it. In fact, the <a href="http://denvergov.org/EC_Voter_Services/template116714.asp" target="_blank">Denver Election Commission webpage</a> actually encourages it:  <span id="more-220"></span></p>
<blockquote><p><strong><span style="font-size:10pt;">Absentee Ballot Application</span></strong><span style="font-size:10pt;"></span></p>
<p>Please  consider applying for an Absentee Ballot to vote by mail. <em> This is the most convenient way for you to vote.</em> The ballot comes to your  home, you take your time reviewing the issues (but observe deadlines, see <a href="http://denvergov.org/EC_Voter_Services/template116710.asp">Elections Calendar</a>), you send in the ballot, and your  vote is cast. Simple and easy. <a href="http://denvergov.org/EC_Voter_Services/template116715.asp">Vote Centers</a> indeed take  voting in person to a new level of convenience, but the Absentee Ballot  surpasses even that.</p></blockquote>
<p>It won&#8217;t change the election if I do it, but if enough people do, who knows? On the other hand, absentee ballots by mail are certainly no panacea &#8211; it&#8217;s easy to just &#8220;lose&#8221; paper ballots that come in by mail; what you need, in some sense, is a chain of custody for the physical votes, and I&#8217;m not sure dropping something off at the post office does that. But it may be as close as most people can get for the moment. Denver does use <a href="http://www.sequoiavote.com/demo.php?lang=vv" target="_blank">machines that apparently produce a paper trail</a> &#8211; I still don&#8217;t like the fact that even though you get to see the paper record, you do not get to physically deposit it somewhere yourself, however; I think it would be too easy for someone to go in and, in the guise of repairing the machine or switching the tape, replace it with another one, or for the machine to produce a second, different record. I don&#8217;t know anything about this machine in particular, but I honestly don&#8217;t understand why people were so hot to go to machine voting in the first place, except that the crooks in office saw an opportunity for more dirty tricks and knew the American public reveres technology without understanding it.</p>
<p>Guys, just because something is done using a computer, there&#8217;s no reason to believe it&#8217;s going to be better or correct. Trust me. Programmers are a tricky lot (we have two living in this two-person household, and we&#8217;re not to be trusted <img src='http://blog.kgrothoff.org/wp-includes/images/smilies/icon_wink.gif' alt=';)' class='wp-smiley' /> ), and in this case, it wouldn&#8217;t take much to falsify data.</p>
<p>In the meantime, if there are any more interesting &#8220;<a href="http://www.rollingstone.com/politics/story/11717105/robert_f_kennedy_jr__will_the_next_election_be_hacked/1" target="_blank">election surprises</a>&#8221; this year in rampantly Democratic districts, I&#8217;ll be in the bathroom. Retching.</p>
<p>Do what you can to make your vote count this year, whoever you&#8217;re voting for. Do what you can do ensure everyone else&#8217;s does too, whether you agree with them or not. And whatever you do, <em>vote</em>.</p>
<p><u><em><strong>Edit</strong></em></u><em><strong>:</strong></em> I&#8217;m slow (and busy)&#8230; The Rocky Mountain News <a href="http://www.rockymountainnews.com/drmn/elections/article/0,2808,DRMN_24736_4994042,00.html" target="_blank">reported in mid-September</a> that a lawsuit had been filed to ban the use of electronic voting machines in Colorado after Ed Felten&#8217;s group&#8217;s demonstation showing the easy compromise of such machines; according to a <a href="http://www.rockymountainnews.com/drmn/elections/article/0,2808,DRMN_24736_5026901,00.html" target="_blank">follow-up article</a>, Denver District Judge Lawrence Manzanares said it was too late to ban them, but agreed with the plaintiffs that the Secretary of State&#8217;s office had not tested the machines adequately (including having a total non-expert &#8211; in fact as well as according to Colorado law &#8211; as the person charged by the Secretary of State with testing them, <a href="http://www.denverpost.com/localpolitics/ci_4340407" target="_blank">according to the Denver Post</a>) and ordered chain-of-custody rules for the machines and other measures designed to prevent hacking or tampering.</p>
<p><strong>The Colorado Democratic Party is calling on voters to cast absentee ballots by mail for the fall 2006 election. </strong>The last day to apply by mail for an absentee ballot is October 31, 2006; the last day to apply in person for an absentee ballot is November 3, 2006. Ballots must be received by 7 pm on November 7th (Election Day). More information (and a form to apply for an absentee ballot) can be found <a href="http://denvergov.org/EC_Voter_Services/template116714.asp" target="_blank">here</a> &#8211; note that the address is for Denver voters, and that if you live elsewhere in CO, you&#8217;ll need to find the correct address for your area to submit the form to.</p>

]]></content:encoded>
			<wfw:commentRss>http://blog.kgrothoff.org/2006/10/02/take-your-right-to-vote-seriously-take-your-vote-seriously/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>

