What · Technology · Security
ssh which is RSA, uh I forget how many bits in my key. So these humble letters have been through a whole lotta bit-bangin’ along their route from my fingertips to your retina. Getting all this set up takes more work than it really ought to, but it’s getting easier, and once the arrangements are there, it totally doesn’t get in the way. Which is a good thing, because the Internet is a rough neighborhood, and in a rough neighborhood you don’t send your kids walking off to school alone. No more should you send your vulnerable little words out on its mean streets without some cryptographic Block Parents lending a hand.http://legal.example.com/blog; puzzled, I checked it out and was challenged for my email before it would let me in. They were fine with my ordinary address, and I found myself in their legal department’s internal blog, full of discussions of people suing them, reports to management, real juicy stuff. Nice Moveable Type group-blog setup; and they’d pointed to my recent bulleted-list rant, leaving a trail of crumbs back to their unprotected unmentionables. I saw that a few of the posts were by a jbloggs and Google, via a search for jbloggs@example.com, revealed that this particular Joe was their Senior Vice President and General Counsel. So I sent him an email saying “Er, your legal department blog is open to the public.” and a couple of hours later got friendly email from someone @example.com saying “I think we closed it, could you check?” and they had. A couple of details in the narrative have been changed to protect the guilty, but if I told you what went between legal. and .com you’d gasp. Anyhow, we already knew these things, but on the evidence it can’t hurt to say them again: First, security by obscurity just doesn’t work, and second, never assume something on a Web server isn’t Internet-visible until you’ve had somebody try from outside and prove it.
