Vitty

Sometimes mediocre encryption is better than strong encryption and sometimes no encryption is better

Sat, 26 Dec 2009 00:16:54 GMT

Совершенно неожиданную для меня позицию занял Брюс Шнайер в нашумевшей истории. Нет, я даже во многом с ним согласен. Но от Шнайера... не ожидал. Видимо, надо прочесть вторую книгу.

Сегодняшнее

Fri, 18 Dec 2009 14:48:28 GMT

К вопросу о security

Sat, 12 Dec 2009 22:46:32 GMT

(via avva)

Cormac Herley, Microsoft Research:

It is often suggested that users are hopelessly lazy and unmotivated on security questions. They chose weak
passwords, ignore security warnings, and are oblivious to certificates errors. We argue that users’ rejection
of the security advice they receive is entirely rational from an economic perspective. The advice offers to
shield them from the direct costs of attacks, but burdens them with far greater indirect costs in the form of effort.
Looking at various examples of security advice we find that the advice is complex and growing, but the benefit
is largely speculative or moot. For example, much of the advice concerning passwords is outdated and does little
to address actual treats, and fully 100% of certificate error warnings appear to be false positives. Further, if
users spent even a minute a day reading URLs to avoid phishing, the cost (in terms of user time) would be two
orders of magnitude greater than all phishing losses. Thus we find that most security advice simply offers a
poor cost-benefit tradeoff to users and is rejected. Security advice is a daily burden, applied to the whole
population, while an upper bound on the benefit is the harm suffered by the fraction that become victims an-
nually. When that fraction is small, designing security advice that is beneficial is very hard. For example, it
makes little sense to burden all users with a daily task to spare 0.01% of them a modest annual pain.

( статья целиком )

Вообще, скорее соглашусь.

Школьный проект

Tue, 08 Dec 2009 23:57:14 GMT

Хотел было удалить пост про школьный проект, но передумал. Пусть висит для истории, мы хорошо тогда поработали.

Запоздало-рабочее

Mon, 20 Oct 2008 20:56:21 GMT