Larry Seltzer

Everyone’s talking about Chrome, Google’s new Web browser that endeavors to be more than a web browser. It’s an exciting program in many ways, but none more so than in what they are attempting to do with browser security. I won’t go into everything security-related in the program. For instance, the Incognito mode and blacklists […]

The rumors were right: Internet Explorer 8 will have new privacy features akin to those in Apple Safari. What role should they play in the enterprise? InPrivate Browsing (“Private Browsing” was already taken by Apple) lets the user control whether or not IE saves potentially privacy-related data, including cookies (all cookies become session cookies), history […]

People make much of technical matters in security, but the most important force behind malware is social engineering, not some vulnerability or bad design. The current hot malware is a textbook case of social engineering and an aggressive marketing campaign. You must have seen them by now: ads for “Antivirus XP 2008” or some variant […]

In perhaps the most appalling breach of security at a major operating system vendor, Red Hat has revealed that a compromise of its internal systems included the digital signing keys for its distributions. An Aug. 22 advisory from Red Hat announces new OpenSSH packages to deal with the problem: “In connection with the incident, the […]

Browsers And Unsigned Certificates by Larry Seltzer Read Larry Seltzer’s article on The Untrustworthiness of Self-Signed Certificates. Browsers And Unsigned Certificates – Suspicious of SSL Making the Web “safe by default,” browsers are suspicious of SSL Web sites (those with a https:// prefix) that use certificates not signed by a trusted authority – VeriSign, GlobalSign, […]

User interface changes in some newer browsers have gotten some in the security community riled up. The issue is self-signed certificates. Some folks don’t like users being told that their roll-your-own certificates aren’t as good as the non-free ones. But the fact is that they aren’t as good, especially when the overall population of users […]

I don’t do a lot of reviews anymore, but I spent about 13 years in the reviews business, testing a wide variety of products. A badly-done, badly-thought out review hits me like fingernails on the blackboard. So it is with the recent Consumer Reports story on computer security and accompanying review of computer security software […]

In light of some recent vulnerability announcements, research has shown OpenID to be an untrustworthy system. This is disappointing; I really liked OpenID. But it also conforms to some suspicions I had about it from early on. OpenID is a protocol for authentication. One party, the OP (OpenID Provider)-it can be anyone, but some famous […]

There’s no doubt that Georgia is being militarily attacked by Russia. Russia is dropping actual bombs deep inside the country, and it’s not clear, at the moment, how far the attack will go. There are also reports that cyber-warfare attacks are under way, and here the picture is less clear. Jart Armin’s RBN Blog, which […]

The news is full of talk about Microsoft’s Midori, a research project to make Windows more distributable and reliable. But Microsoft has many other research projects and directions for Windows in the works. One thing that has been clear for a while about operating system design at Microsoft is that it will be changing the […]

Users spend little time thinking about Internet registries like ICANN or VeriSign because they don’t deal with them directly. Perhaps they should. VeriSign and the other companies that operate the top-level domains on the Internet are critical infrastructure. At least some of them are. What if one of them was to fail somehow? This is […]

I spend a lot of my time writing about security bugs found in products and what is done about them. In fact, there are hundreds of blogs and news outlets that spend a considerable amount of time on such bugs. The news “markets” seem to think they’re worthy of the attention. An industry has built […]