Noncombatant

It would be cool if someone would donate to him a domain. Downloading PuTTY involves relying on greenend.org.uk (which isn't obviously connected with PuTTY). You can check your download using the hashes provided on the site; but if the download has been messed with, then the hash is untrustworthy too. https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea…

https://noncombatant.org/2016/06/20/get-into-security-engineering/ is an amazing overview of security engineering and provides some resources to get started

Fun fact: the google engineers responsible for this decision were repeatedly accused of being NSA plants as a result: https://twitter.com/sleevi_/status/668911789841608706 Chris Palmer also wrote a really great blog post about this: https://noncombatant.org/2015/11/24/what-is-hpkp-for/

It doesn't seem that PuTTY has made very effective use of this or managed to explain the problem to most of their users. http://noncombatant.org/2014/03/03/downloading-software-safely-is-near… http://noncombatant.org/2014/03/05/followup-to-downloading-software-sa…

At first I thought "The title is bait.... what a waste of time, etc...". Clearly the problem isn't HTTPS, it is the current CA structure. I then went on Chris' site (http://noncombatant.org/) and there he summarizes it well: "The problems are social and economic more than technical. The technical problems are in usability, not in cryptography. In general, security people should start learning about usability." I still argue that the is no 'usability' problem, but rather 'ignorance'. The fact that https has been hailed as 'secure' to the user (who has no formal understanding of what 'secure' is) is what has led up to the problem he is venting about...

As a software engineer you're more than half of the way there. A lot of people pivot into this industry with almost zero experience because it's pretty fun and they end up learning computer science along the way. I'd first start by reading this blog https://noncombatant.org/2016/06/20/get-into-security-engineering/ and everything it links. Then study them to start getting a breadth of knowledge in the security space. In parallel, I'd recommend studying real security vulnerabilities in products that use technologies that you have a background in. For example, if you are interested in both Web technologies and C++ ,I'd start studying Google Chrome, specifically it's Javascript engine V8 [1]. There is an entire cottage community of both offensive and defensive people looking for vulnerabilities in chrome so it's a good way to get started because there's a lot of information out there. One amazing thing about security engineering is that you get to learn how all of these amazing technologies work at a deep level, because you need to understand it almost as well as the developer to find security vulnerabilities in it. For example, I have a very deep understanding of how technologies like RTC, Browsers, Sandboxes, and the IOS operating systems work from auditing their code and finding security vulnerabilities. [1] https://bugs.chromium.org/p/chromium/issues/list?q=Security_Severity%3…

This and "Security Engineering as Caring-For" [0] have been the guideposts in my security career, helping me think about what I should work on (or not) and reminding me why I keep working on bad days. Essays like these aren't just moral admonishments; they offer a way to find deeper meaning in your work or figure out what work would have meaning for you. Personally and politically, there can be so much more to your tech career than just "puzzles and math." [0] https://noncombatant.org/2016/03/27/security-as-caring-for/

Please don't encourage security nihilism[1]. There are very real measures people can take to protect their privacy, and convincing people otherwise creates harm. [1] https://noncombatant.org/2016/01/28/against-security-nihilism/

Has much changed since this? https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea… Related comments: https://news.ycombinator.com/item?id=9577861

Reminds me of this article posted back in 2014 by Chris Palmer https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea…

That's because putty.org isn't the official site for PuTTY. Think of it like "friendly" domain squatting, then despair at the security implications. See https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea… (but many of the points have been resolved)

https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea… https://news.ycombinator.com/item?id=7334269 https://news.ycombinator.com/item?id=11234589

Unfortunately, pinning doesn't solve everything. https://noncombatant.org/2015/11/24/what-is-hpkp-for/

Which is also not on HTTPS. I read this "old" piece about PuTTY the other day and it still seems just as absurd: https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea…

so windows users might finally be able to download a verifiable/signed and maybe "trusted" application to use ssh with? (https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea…

It looks nice. I suggest that all http requests to redirect to https (also enabling HSTS and preload it into browsers HSTS list), it makes admins easier to suggest the software for their users. On the other hand I wouldn't suggest a closed source software for ssh for my users, but that's just me. However it's hard to suggest putty for Windows users either since it's virtually impossible to download it securely [1]. I think the most secure suggestion is cygwin+openssh also it's the most inconvenient. [1] https://noncombatant.org/2014/03/03/downloading-software-safely-is-nea…

Is there anything Google (or the Chromium team) could do to simplify an out-of-the-box "maximum privacy" mode based on the docs linked from the post? https://www.google.com/chrome/browser/privacy/whitepaper.html https://noncombatant.org/2014/03/11/privacy-and-security-settings-in-c…

Regarding Chrome, here's a good place to start: https://noncombatant.org/2014/03/11/privacy-and-security-settings-in-c… There are also people who use Chromium, or particular configurations of Chromium, instead of Chrome. That's fine. But don't use forks of Chromium, no matter who maintains them, even if it looks like a sizable effort. You don't want your browser to be any number of days behind the Chromium patch cycle. I use the browser integration for 1Password on OS X (I might not if I was on Windows). I'm generally not that worried about localhost privilege escalation. I am very worried about how well I can reason about cloud-based storage of any sort, and how it will interact with things like my browser. KISS: keep your secrets out of cloud systems and your backups offline. If you're very sophisticated, I like Tarsnap for online backups. But you have to be very sophisticated to use it.

Please note, I am not accusing any specific person of being a government spook intent on weakening security, but I can’t help notice the parallels in this situation with what is known about how Internet standards get compromised Except that's exactly what the author is doing. Otherwise why did I have to wade through the first 50% of this blog post? Palmer's blog on the subject [1] is well-reasoned and makes the motivations for the decision clear. Slepak may not like those reasons, but adding a veiled accusation of stoogery to an otherwise weak rebuttal just makes you look like an asshole. I'll requote Palmer's fundamental assertion: However, it is not possible for a low-privilege application to defend against the platform it runs on, if the platform is intent on undermining the application’s expectations. To try would be futile, and would necessarily also violate a crucial digital rights principle: The computer’s owner should get to decide how the computer behaves. Dell and Lenovo let their customers down in that way, but for better and for worse, it’s not something that a web browser can fix. I can appreciate this argument. Today it's pre-installed certificates, but tomorrow it'll be some malware that hijacks the owner's machine in some other way. If Chrome's responsibilities expand to include the security of the entire system, it would place an impossible burden on its engineers. [1] https://noncombatant.org/2015/11/24/what-is-hpkp-for/

On one hand, Dell seems to think there is a market of people willing to pay to install Firefox. Whoever conducted that research probably found people trusting Firefox than IE or Chrome or Opera. That's just my guess. I have heard people saying "web download is broken. You first have to use some browser like Chrome or IE to install Firefox, but what if that IE version is compromised? What if people click on the wrong mozilla.org by googling and instead installed a malicious, modified Mozilla firefox?" Maybe Dell read HNs and thought "yeah let's help the poor souls out there!" (http://noncombatant.org/2014/03/03/downloading-software-safely-is-near… On the other hand, this charging practice is ridiculous. I can understand some people are not technical at all (espeically the elders and new computer users), but come on, this is a ripe off. If you already created a custom image to load into every hard drive you sell to your customer, modify that image by adding Firefox. How much effort is that, Dell? edit: Does Dell's installation bundles with third-party addons? Remember the old toolbar spam? It would be interesting one day Dell decides to sell Tor installation service.