6 ms·

RSA is a subsidiary of EMC. This means that a boycott of Greenplum, Pivotal, VMWare, Isilon, Mozy, and MANY others would probably be included. I just don't see

by fintler 13y ago

RSA is a subsidiary of EMC. This means that a boycott of Greenplum, Pivotal, VMWare, Isilon, Mozy, and MANY others would probably be included. I just don't see an effective boycott of this scale happening -- especially when most of their customers just care about the product cost and benefit. Also, it can probably be argued that trying to secure your systems against a targeted intrusion from the NSA using technical means is pointless and a waste of money (throwing money at the EFF might be more effective). Having said that, is there an good alternative to SecureID? The only thing that seems to come close is CRYPTOCard, but it looks like they have closer ties with the NSA than RSA does. A yubikey also looks nice, but I don't like how it needs to be plugged in as a keyboard -- a device that is kept physically separated from the login machine would be ideal. OTP apps on a multi-purpose device (mobile phone) also isn't something I consider to be secure.

ZoFreX 13y ago
In terms of effectiveness: Boycotting all EMC subsidiaries > boycotting just RSA > doing nothing Nothing wrong with keeping it small scale and only boycotting RSA, if the alternative is doing nothing at all.
- ballard 13y ago
  My bad, the parent comment's logic contains multiple fallacies: False dichotomy of a slippery slope all-or-nothing boycott with the all option there is another false dichotomy of "limited alternatives." Sounds like rationalization BS for doing nothing to me. If the options were so "limited," why isn't there more crowdfunding of open source hardware &| software security modules?
  - fintler 13y ago
    Since you feel there are other alternatives, do you know of any hardware tokens that haven't been influenced by the NSA? A device with a broken usage model (USB or writable SmartCard interface) isn't acceptable since it defeats the entire purpose of using it in the first place.
    - jessaustin 13y ago
      Would you care to further explain how USB or writable smartcards are "broken" for this application? ISTM that with stingy enough trust models (i.e. the device shouldn't trust the host nor should the client trust the host or the device...) something could be done.
ballard 13y ago
No problem: NetApp or ZFS-based solutions, Asana, Xen, Tarsnap and open source soft tokens. There are plenty of alternatives that include more alternatives (ie solving the problem by modifying requirements) than a narrowly-defined class of product so there is no such thing as "only X options." It's the false dichotomy fallacy. The choice is to make an effort instead of making excuses, because doing nothing has the appearance and effect of condoning the behavior. Silence gives consent. A wise (wo|)man will make more opportunities than (s|)he finds. - Francis Bacon
- fintler 13y ago
  The Aladdin Etoken looks pretty nice. It seems that their FIPS 140-2 Level 3 is basically a full blown HSM. However, it's the same company that makes CRYPTOCard (do a search for "fortezza" to read up on the history). Edit: The parent to this post originally said "Aladdin Etoken" instead of "open source soft tokens". Open source software tokens aren't really acceptable since you need to run them on a multi-purpose device which has several paths to exploit. It's not a "false dichotomy" if there aren't any reasonable options. I'm not willing to settle for a device that doesn't solve the only problem it exists for.
fragsworth 13y ago
> Also, it can probably be argued that trying to secure your systems against a targeted intrusion from the NSA using technical means is pointless and a waste of money (throwing money at the EFF might be more effective). You're assuming that the NSA is unwilling to do things that are illegal. The (legitimate) fear is that your competitors may have ties to the NSA, who can then target you illegally, which can greatly benefit your competitor and damage your business. Good security has now been made vastly more expensive because the government has to be assumed to have built nearly every high-budget attack vector they could. The cost of defending your business from this is very high, and we're all going to end up paying for it.
- fintler 13y ago
  > You're assuming that the NSA is unwilling to do things that are illegal. > Good security has now been made vastly more expensive Most (all?) companies won't be able to outspend the NSA when it comes to security. So, my point is that trying to compete with them by spending more is pointless. We won't pay for it, because we can't afford it. Lobbying seems to be the only course of action left which might be effective.
  - fragsworth 13y ago
    > won't be able to outspend the NSA You don't need to outspend the NSA to have good security. You just need to spend more than you used to. One example, for instance, is Google now has to encrypt all traffic on its own internal lines.
MichaelGG 13y ago
Didn't RSA do this before EMC bought them? It's not clear how much, if any, involvement EMC has in RSA. Should we boycott Redis and RabbitMQ?
- fintler 13y ago
  I assume that EMC probably gutted the management of RSA when they bought them. So, if a boycott is going to happen, you should probably go after the primary decision makers. And no, I don't think a boycott of EMC is practical.
  - SwellJoe 13y ago
    "I don't think a boycott of EMC is practical." It's practical for me.
specialist 13y ago
I whole heartedly support public shaming. It's about perception management. RSA is no longer regarded as invincible, infalliable. I met some cocksure RSA shirts (sales engineers?) waiting for their espresso. I cheerfully congratulated them on their employer's security fobs getting pwned [1]. I'm sure they were visiting our company for damage control. They tried to play it off "Gee, whatever are you talking about?"; I'm sure everyone got the memo. I just looked them in the eye and said "Don't play stupid. I read the news." Their demeanor completely changed. Real contrition. Like everyone, I have some skin in this game. As an election integrity enthusiast, I'm exhausted by the techno utopian stooges promoting crypto as a cure all. The more the public understands the emperor has no clothes, the safer we'll be. [1] http://en.wikipedia.org/wiki/SecurID#March_2011_system_compromise http://en.wikipedia.org/wiki/SecurID#March_2011_system_compr...
wmt 13y ago
The message delivered is not just to EMC, but to the technology industry as a whole. While it might not hurt EMC if RSA sales drop, I'm willing to bet there are companies that would be seriously hurt if the public perception among their customers is that you're in bed with the NSA.
netman21 13y ago
Gemalto: http://www.gemalto.com/readers/tokens.html http://www.gemalto.com/readers/tokens.html Safenet: http://www.safenet-inc.com/data-protection/authentication/otp-authentication/ http://www.safenet-inc.com/data-protection/authentication/ot... Fortinet: http://www.fortinet.com/products/fortitoken/200CD.html http://www.fortinet.com/products/fortitoken/200CD.html
MacsHeadroom 13y ago
>is there an good alternative to SecureID? Twitter, Tumblr, Facebook, MIT, Stanford, Sony, Arbor Networks, 37 Signals, Twilio, (and many more) all use Duo Security as an alternative to RSA SecureID. https://www.duosecurity.com/success-stories https://www.duosecurity.com/success-stories Duo 2FA is easily the most secure[1], easiest to use[2], and most developer friendly multi-factor solution[3]. [1] https://www.duosecurity.com/security https://www.duosecurity.com/security [2] https://www.duosecurity.com/product https://www.duosecurity.com/product [3a] Almost all of Duo is open source. https://github.com/duosecurity https://github.com/duosecurity [3b] Duo's c development libraries and SSH/PAM packages are available in the official repos for major distributions like Debian/Ubuntu, REHL/CentOS/Fedora, SUSE/SLES, etc. http://packages.debian.org/search?keywords=duo+security&searchon=all&suite=testing&section=all http://packages.debian.org/search?keywords=duo+security&sear... [3c] Duo's REST APIs kick ass: https://www.duosecurity.com/api https://www.duosecurity.com/api
- fintler 13y ago
  Gemalto FOBs with Duo's backend. This seems very reasonable. Thank you!
- droopybuns 13y ago
  The only downside to Duo is Jon Oberheide's previous collaborations w/ Charlie Miller, ex-nsa'er & advocate of the "no more free bugs" movement. Minor nitpick, but if we're shaming companies in the security community, I think it's worth calling out some of the security celebrities whose stances contribute to the privacy destroying activities of the NSA. He and people like the gruqg are enablers of the government's destruction of our privacy. I agree with you though. Duo is one of the best alternatives out there. Jon's collaborations w/ Miller were years ago. Perhaps I'm being a bit to grudgy.
_golgo13_ 13y ago
If you're looking for something that is not another RSA style OTP solution check out LoginTC. https://www.logintc.com/docs/connectors/ https://www.logintc.com/docs/connectors/ The approach leverages the smartphone for what it is, a connected device with rich user experience interaction. https://www.logintc.com/docs/platform/multi-factor-flow.html https://www.logintc.com/docs/platform/multi-factor-flow.html Full disclosure: I'm a co-founder at Cyphercor the builders of LoginTC.

by fintler 13y ago

ZoFreX 13y ago

In terms of effectiveness: Boycotting all EMC subsidiaries > boycotting just RSA > doing nothing Nothing wrong with keeping it small scale and only boycotting RSA, if the alternative is doing nothing at all.

ballard 13y ago
My bad, the parent comment's logic contains multiple fallacies: False dichotomy of a slippery slope all-or-nothing boycott with the all option there is another false dichotomy of "limited alternatives." Sounds like rationalization BS for doing nothing to me. If the options were so "limited," why isn't there more crowdfunding of open source hardware &| software security modules?
- fintler 13y ago
  Since you feel there are other alternatives, do you know of any hardware tokens that haven't been influenced by the NSA? A device with a broken usage model (USB or writable SmartCard interface) isn't acceptable since it defeats the entire purpose of using it in the first place.
  - jessaustin 13y ago
    Would you care to further explain how USB or writable smartcards are "broken" for this application? ISTM that with stingy enough trust models (i.e. the device shouldn't trust the host nor should the client trust the host or the device...) something could be done.

ballard 13y ago

No problem: NetApp or ZFS-based solutions, Asana, Xen, Tarsnap and open source soft tokens. There are plenty of alternatives that include more alternatives (ie solving the problem by modifying requirements) than a narrowly-defined class of product so there is no such thing as "only X options." It's the false dichotomy fallacy. The choice is to make an effort instead of making excuses, because doing nothing has the appearance and effect of condoning the behavior. Silence gives consent. A wise (wo|)man will make more opportunities than (s|)he finds. - Francis Bacon

fintler 13y ago
The Aladdin Etoken looks pretty nice. It seems that their FIPS 140-2 Level 3 is basically a full blown HSM. However, it's the same company that makes CRYPTOCard (do a search for "fortezza" to read up on the history). Edit: The parent to this post originally said "Aladdin Etoken" instead of "open source soft tokens". Open source software tokens aren't really acceptable since you need to run them on a multi-purpose device which has several paths to exploit. It's not a "false dichotomy" if there aren't any reasonable options. I'm not willing to settle for a device that doesn't solve the only problem it exists for.

fragsworth 13y ago

> Also, it can probably be argued that trying to secure your systems against a targeted intrusion from the NSA using technical means is pointless and a waste of money (throwing money at the EFF might be more effective). You're assuming that the NSA is unwilling to do things that are illegal. The (legitimate) fear is that your competitors may have ties to the NSA, who can then target you illegally, which can greatly benefit your competitor and damage your business. Good security has now been made vastly more expensive because the government has to be assumed to have built nearly every high-budget attack vector they could. The cost of defending your business from this is very high, and we're all going to end up paying for it.

fintler 13y ago
> You're assuming that the NSA is unwilling to do things that are illegal. > Good security has now been made vastly more expensive Most (all?) companies won't be able to outspend the NSA when it comes to security. So, my point is that trying to compete with them by spending more is pointless. We won't pay for it, because we can't afford it. Lobbying seems to be the only course of action left which might be effective.
- fragsworth 13y ago
  > won't be able to outspend the NSA You don't need to outspend the NSA to have good security. You just need to spend more than you used to. One example, for instance, is Google now has to encrypt all traffic on its own internal lines.

MichaelGG 13y ago

Didn't RSA do this before EMC bought them? It's not clear how much, if any, involvement EMC has in RSA. Should we boycott Redis and RabbitMQ?

fintler 13y ago
I assume that EMC probably gutted the management of RSA when they bought them. So, if a boycott is going to happen, you should probably go after the primary decision makers. And no, I don't think a boycott of EMC is practical.
- SwellJoe 13y ago
  "I don't think a boycott of EMC is practical." It's practical for me.

specialist 13y ago

I whole heartedly support public shaming. It's about perception management. RSA is no longer regarded as invincible, infalliable. I met some cocksure RSA shirts (sales engineers?) waiting for their espresso. I cheerfully congratulated them on their employer's security fobs getting pwned [1]. I'm sure they were visiting our company for damage control. They tried to play it off "Gee, whatever are you talking about?"; I'm sure everyone got the memo. I just looked them in the eye and said "Don't play stupid. I read the news." Their demeanor completely changed. Real contrition. Like everyone, I have some skin in this game. As an election integrity enthusiast, I'm exhausted by the techno utopian stooges promoting crypto as a cure all. The more the public understands the emperor has no clothes, the safer we'll be. [1] http://en.wikipedia.org/wiki/SecurID#March_2011_system_compromise http://en.wikipedia.org/wiki/SecurID#March_2011_system_compr...

wmt 13y ago

The message delivered is not just to EMC, but to the technology industry as a whole. While it might not hurt EMC if RSA sales drop, I'm willing to bet there are companies that would be seriously hurt if the public perception among their customers is that you're in bed with the NSA.

netman21 13y ago

Gemalto: http://www.gemalto.com/readers/tokens.html http://www.gemalto.com/readers/tokens.html Safenet: http://www.safenet-inc.com/data-protection/authentication/otp-authentication/ http://www.safenet-inc.com/data-protection/authentication/ot... Fortinet: http://www.fortinet.com/products/fortitoken/200CD.html http://www.fortinet.com/products/fortitoken/200CD.html

MacsHeadroom 13y ago

>is there an good alternative to SecureID? Twitter, Tumblr, Facebook, MIT, Stanford, Sony, Arbor Networks, 37 Signals, Twilio, (and many more) all use Duo Security as an alternative to RSA SecureID. https://www.duosecurity.com/success-stories https://www.duosecurity.com/success-stories Duo 2FA is easily the most secure[1], easiest to use[2], and most developer friendly multi-factor solution[3]. [1] https://www.duosecurity.com/security https://www.duosecurity.com/security [2] https://www.duosecurity.com/product https://www.duosecurity.com/product [3a] Almost all of Duo is open source. https://github.com/duosecurity https://github.com/duosecurity [3b] Duo's c development libraries and SSH/PAM packages are available in the official repos for major distributions like Debian/Ubuntu, REHL/CentOS/Fedora, SUSE/SLES, etc. http://packages.debian.org/search?keywords=duo+security&searchon=all&suite=testing&section=all http://packages.debian.org/search?keywords=duo+security&sear... [3c] Duo's REST APIs kick ass: https://www.duosecurity.com/api https://www.duosecurity.com/api

fintler 13y ago
Gemalto FOBs with Duo's backend. This seems very reasonable. Thank you!
droopybuns 13y ago
The only downside to Duo is Jon Oberheide's previous collaborations w/ Charlie Miller, ex-nsa'er & advocate of the "no more free bugs" movement. Minor nitpick, but if we're shaming companies in the security community, I think it's worth calling out some of the security celebrities whose stances contribute to the privacy destroying activities of the NSA. He and people like the gruqg are enablers of the government's destruction of our privacy. I agree with you though. Duo is one of the best alternatives out there. Jon's collaborations w/ Miller were years ago. Perhaps I'm being a bit to grudgy.

_golgo13_ 13y ago

If you're looking for something that is not another RSA style OTP solution check out LoginTC. https://www.logintc.com/docs/connectors/ https://www.logintc.com/docs/connectors/ The approach leverages the smartphone for what it is, a connected device with rich user experience interaction. https://www.logintc.com/docs/platform/multi-factor-flow.html https://www.logintc.com/docs/platform/multi-factor-flow.html Full disclosure: I'm a co-founder at Cyphercor the builders of LoginTC.