RSA Blogs

Video at http://blogs.rsa.com/idp-beat/announcing-rsa-distributed-credential-pr… Any suggestions of what might be worth $150,000 in all of this? At a basic end, this seems to be similar to storing every other character of a suitable hash on two nodes (preferably running heterogeneous architectures). RSA's ability to 're-randomise' suggests the ability for the two machines to be able produce a plaintext version of the password, which obviously seems particularly dangerous, especially if somebody is sloppy and backs up both nodes to the same location. Is there any distributed encryption algorithm that could be done that would allow straightforward credential verification as well as the ability to re-salt a hash securely without knowing the plaintext?

I like this article. But this sentence is odd. > […] with an academic pedigree from RSA Labs, you know, the guys who invented much of the cryptographic ecosystem we use today. Appeal to authority fails a little bit when RSA opens random Excel attachments from unknown untrusted sources - attached to an email that have to be retrieved from the junk mail folder. (http://blogs.rsa.com/rivner/anatomy-of-an-attack/) EDIT: As other commentators point out, I am wrong to suggest that anything coming from RSA Labs is somehow "weak" because someone at RSA fell for a phishing attack. I do find it odd that a security article suggests "These people are good; they did 'this thing' which everyone uses". That's not a great way to approach choosing crypto components. Even experts make mistakes.

> Even more importantly, RSA did not issue a denial (though I concede that they may have later on, I just haven't googled it yet): Here is RSA's denial (emphasis added): "RSA, as a security company, never divulges details of customer engagements, but we also categorically state that we have never entered into any contract or engaged in any project with the intention of weakening RSA’s products, or introducing potential ‘backdoors’ into our products for anyone’s use." https://blogs.rsa.com/news-media/rsa-response/ Yes, this leaves leeway for "oh, we just didn't know that they were backdooring us". But do you have proof that RSA was actually aware of the consequences of implementing the NSA's "suggestions" (and did it anyway for the $$$), and not just really naïve about it?

RSA doesn't scale the same way as a symmetric encryption algorithm, though. It took a rather heavy duty cluster for its day months to crack RSA-512 ( http://web.archive.org/web/20070621021111/http://rsa.com/rsalabs/node.… ). NIST itself states that RSA-1024 should no longer be considered secure ( https://blogs.rsa.com/rsa-768-factored/ press release regarding RSA-768 being factored, because NIST's pages are part of the shutdown ). While your numbers are true for a traditional crypto algorithm, factorial based problems don't scale the same way.

What RSA's SecurID customers really want to know is what specific information regarding SecurID got compromised, and what are the implications for the security of SecurID itself. Which neither RSA's official post[1], nor Gartner's writeup, seems to tell me. (Knowing the details of how RSA got spearphished is interesting, I suppose, but it leaves out the really important bits.) [1] http://blogs.rsa.com/rivner/anatomy-of-an-attack/

RSA has posted a more detailed account to their blog: Anatomy of an Attack http://blogs.rsa.com/rivner/anatomy-of-an-attack/

MailChimp founder here. Here's a little back story to Alter Ego, since it does tend to confuse people. There was a time, not long ago, when email providers were under attack and suffering from some major breaches (http://www.cauce.org/2011/04/epsilon-interactive-breach-the-fukushima-… It's hard to describe the feeling of helplessness when you watch industry peers get systematically attacked like that. We wanted to do whatever we could to prevent that by providing 2FA protection to our customers. We researched RSA and other solutions. It seemed way too costly to ship key fobs to millions of users (our larger users could afford it, but not our vast majority of small business users, who are the ones who need the most help w/security). Still, we ordered the RSA hardware and fobs to try it out. While the equipment was all en route, RSA was breached (http://blogs.rsa.com/anatomy-of-an-attack/). To be safe, they told us we had to wait for new hardware to be re-issued. There's that feeling of helplessness again. We decided not to wait, and to just roll our own 2F app because we could make it free and easier than most (2 critical requirements for our SMB user base). It's important to note that Google Authenticator wasn't yet open for integration (trust me--we badly wished for it). There were only rumors that they might open it up, and frankly, we couldn't wait for them to decide. Now we all know that it's been opened up, which is nice. And fwiw, in the…