<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Simple Web Security</title>
	<atom:link href="http://simplewebsecurity.info/?feed=rss2" rel="self" type="application/rss+xml" />
	<link>http://simplewebsecurity.info</link>
	<description>Just another WordPress weblog</description>
	<lastBuildDate>Thu, 04 Jun 2009 17:00:28 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.1</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Should your company allow employees to forward their email to GMail?</title>
		<link>http://simplewebsecurity.info/?p=41</link>
		<comments>http://simplewebsecurity.info/?p=41#comments</comments>
		<pubDate>Thu, 04 Jun 2009 17:00:28 +0000</pubDate>
		<dc:creator>joel</dc:creator>
				<category><![CDATA[protocol]]></category>
		<category><![CDATA[confidential]]></category>
		<category><![CDATA[end-to-end encryption]]></category>
		<category><![CDATA[gmail]]></category>

		<guid isPermaLink="false">http://simplewebsecurity.info/?p=41</guid>
		<description><![CDATA[I came across this interesting discussion on whether or not companies should allow their employees to forward email to GMail.  Most of the concern is with security, as businesses share a lot of confidetial information through e-mail: Design docs, intellectual property, client information, even passwords into various servers.  Some say that even if the IT [...]]]></description>
			<content:encoded><![CDATA[<p>I came across this <a title="On Server Fault" href="http://serverfault.com/questions/12599/should-our-company-allow-employees-to-forward-their-exchange-email-to-gmail">interesting discussion on whether or not companies should allow their employees to forward email to GMail</a>.  Most of the concern is with security, as businesses share a lot of confidetial information through e-mail: Design docs, intellectual property, client information, even passwords into various servers.  Some say that even if the IT administrators disallow it, some employeees will figure out a way around it &#8211; they always do.</p>
<p>However, the answer to this question would be a lot easier if the company was already using <a title="SendItSecure E-mail Encryption" href="http://www.senditsecure.com">end-to-end encryption</a> for their e-mail, because the messages would still be encrypted on Google&#8217;s servers.</p>
]]></content:encoded>
			<wfw:commentRss>http://simplewebsecurity.info/?feed=rss2&amp;p=41</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>How to break into someone&#8217;s account</title>
		<link>http://simplewebsecurity.info/?p=38</link>
		<comments>http://simplewebsecurity.info/?p=38#comments</comments>
		<pubDate>Mon, 01 Jun 2009 02:06:32 +0000</pubDate>
		<dc:creator>joel</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[password]]></category>
		<category><![CDATA[protocol]]></category>

		<guid isPermaLink="false">http://simplewebsecurity.info/?p=38</guid>
		<description><![CDATA[It happened to Jeff Atwood&#8217;s Stack Overflow account: Someone broke into his account and logged in as him.  Fortunately, the hacker reported the problem to Jeff and did no malicous actions.  Very few &#8220;hackers&#8221; are this ethical.
Read the original post here, I Just Logged In As You: How It Happened.  It shows just how easy [...]]]></description>
			<content:encoded><![CDATA[<p>It happened to Jeff Atwood&#8217;s <a title="Stack Overflow" href="http://stackoverflow.com/">Stack Overflow</a> account: Someone broke into his account and logged in as him.  Fortunately, the hacker reported the problem to Jeff and did no malicous actions.  Very few &#8220;hackers&#8221; are this ethical.</p>
<p>Read the original post here, <a class="title-link" href="http://www.codinghorror.com/blog/archives/001263.html">I Just Logged In As You: How It Happened</a>.  It shows just how easy it can be to crack a password.</p>
<p><strong>Simple Security Tip #1</strong>: Use strong passwords with lots of characters, numbers, and symbols.</p>
<p><strong>Simple Security Tip #2</strong>: Don&#8217;t use the same password for every account you have.</p>
<p><strong>Simple Security Tip #3</strong>: Use <a title="Two-factor Authentication - Wikipedia" href="http://en.wikipedia.org/wiki/Two-factor_authentication">two-factor authentication</a> whenever possible. This makes it exetremely difficult for someone to break into your account.</p>
]]></content:encoded>
			<wfw:commentRss>http://simplewebsecurity.info/?feed=rss2&amp;p=38</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>Why People Avoid IT Security</title>
		<link>http://simplewebsecurity.info/?p=6</link>
		<comments>http://simplewebsecurity.info/?p=6#comments</comments>
		<pubDate>Wed, 13 May 2009 02:09:50 +0000</pubDate>
		<dc:creator>joel</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[it security]]></category>
		<category><![CDATA[protocol]]></category>

		<guid isPermaLink="false">http://simplewebsecurity.info/?p=6</guid>
		<description><![CDATA[Because it&#8217;s too hard.
Most of the time, anyway.  And for good reason &#8211; there&#8217;s a LOT of things to think about.  In fact, there are probably lots of things you&#8217;re doing wrong right now when it comes to securing your computer, e-mail, data, mobile phone, bank account, credit card info&#8230;the list goes on.
So how do [...]]]></description>
			<content:encoded><![CDATA[<p>Because it&#8217;s too hard.</p>
<p>Most of the time, anyway.  And for good reason &#8211; there&#8217;s a LOT of things to think about.  In fact, there are probably lots of things you&#8217;re doing wrong right now when it comes to securing your computer, e-mail, data, mobile phone, bank account, credit card info&#8230;the list goes on.</p>
<p>So how do we bring sense and simplicity to an online world filled with so much complexity?  Start with the simple things:</p>
<ul>
<li>Don&#8217;t share your passwords</li>
<li>Don&#8217;t believe e-mails that ask for personal information (these phishing attempts)</li>
<li>Don&#8217;t install apps you don&#8217;t need, or from sites you don&#8217;t trust</li>
<li>Install good anti-virus software</li>
</ul>
<p>If we protect ourselves from just the simple things, then we have a much smaller chance of being the next victim of opportunity of a casual hacker.  And, if everyone would better <strong>educate themselves</strong>, then malware and other online security problems would be a lot less prevalent.</p>
<p>Do you agree?  What do you do to stay safe online?  Let me know in the comments.</p>
]]></content:encoded>
			<wfw:commentRss>http://simplewebsecurity.info/?feed=rss2&amp;p=6</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>Can they steal my fingerprint?</title>
		<link>http://simplewebsecurity.info/?p=31</link>
		<comments>http://simplewebsecurity.info/?p=31#comments</comments>
		<pubDate>Sun, 08 Mar 2009 04:32:43 +0000</pubDate>
		<dc:creator>al</dc:creator>
				<category><![CDATA[protocol]]></category>
		<category><![CDATA[biometrics]]></category>

		<guid isPermaLink="false">http://simplewebsecurity.info/?p=31</guid>
		<description><![CDATA[I recently attended a conference on information security where the President of our company was giving a presentation on biometric security. Since our version of biometrics uses fingerprints a number of fingerprint related questions came up. One of them surprised me so I thought I’d do a short blog post on the subject. Folks were [...]]]></description>
			<content:encoded><![CDATA[<p style="margin: 0in 0in 10pt;">I recently attended a conference on information security where the President of our company was giving a presentation on biometric security. Since our version of biometrics uses fingerprints a number of fingerprint related questions came up. One of them surprised me so I thought I’d do a short blog post on the subject. Folks were concerned that we “stored their fingerprints” and might be able to use them for some nefarious purpose. That’s a reasonable concern particularly because we say that we store fingerprints but in fact, we don’t actually store an image of the fingerprint. It would be big, hard to use and very slow to access.</p>
<p class="MsoNormal" style="margin: 0in 0in 10pt;">All the fingerprint verification security systems I know of actually use a “template” as opposed to using an actual image of the fingerprint. So what’s a template? Your fingerprint is made up of the fine “friction ridges” on your fingertips. You have similar ridges on your palms and even on the soles of your feet. Scientists believe that they are there to aid in grasping objects and possibly to amplify the vibrations that allow you to discern fine textures on a surface. Whatever their reason, they appear to be unique to each individual; even identical twins don’t share fingerprints. The details of the shape of the ridges, the places where they start and end and the way that they split and join are called “minutiae”. Most of these features are found near the center of your fingerprint. When a fingerprint is scanned a gray-scale image is captured and a sophisticated computer program identifies the key minutiae and how they relate to one another and produces a mathematical representation of your fingerprint called a template. The template is easy for the computer to deal with where an actual image would be very clumsy. You could think of your template as a complex and long digital password.</p>
<p class="MsoNormal" style="margin: 0in 0in 10pt;">For the folks at the conference who were concerned about a security system saving their fingerprints, well, they can relax. The thing that’s saved isn’t an image of the fingerprint and just as importantly, the template cannot be used to backward engineer an image of your fingerprint. The template is a brand new entity that was created using data from your fingerprint but just like a picture of a leaf isn’t a leaf; a template isn’t your fingerprint.</p>
<p class="MsoNormal" style="margin: 0in 0in 10pt;">A nice article on the history of fingerprints can be found at <a href="http://www.onin.com/fp/fphistory.html">http://www.onin.com/fp/fphistory.html</a></p>
]]></content:encoded>
			<wfw:commentRss>http://simplewebsecurity.info/?feed=rss2&amp;p=31</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Company Secret or Company Gossip?</title>
		<link>http://simplewebsecurity.info/?p=27</link>
		<comments>http://simplewebsecurity.info/?p=27#comments</comments>
		<pubDate>Fri, 06 Feb 2009 04:28:16 +0000</pubDate>
		<dc:creator>al</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[business]]></category>
		<category><![CDATA[encryption]]></category>
		<category><![CDATA[it security]]></category>

		<guid isPermaLink="false">http://simplewebsecurity.info/?p=27</guid>
		<description><![CDATA[You’re a responsible person and you work for a responsible company. You’ve taken steps to make sure that your email system is secure so you use an email encryption system that ensures that all the confidential email that leaves your network is encrypted. That’s laudable and you at least recognize the problem but you’ve left [...]]]></description>
			<content:encoded><![CDATA[<p style="margin: 0in 0in 10pt;">You’re a responsible person and you work for a responsible company. You’ve taken steps to make sure that your email system is secure so you use an email encryption system that ensures that all the confidential email that leaves your network is encrypted. That’s laudable and you at least recognize the problem but you’ve left a huge hole in your security. If your system encrypts only email that leaves your network you are still vulnerable because most experts agree that the bulk of email theft happens INSIDE your firewall.</p>
<p style="margin: 0in 0in 10pt;">Consider for a moment the number of emails that are sent within your enterprise that have confidential content.Business plans, executive compensation, staff reductions, new policies under discussion, all of these are critical to your business but if your company secrets become company gossip it could go straight to your bottom line, and not in a “good way”.</p>
<p style="margin: 0in 0in 10pt;">So what’s the answer? The best place for your email security to start is right on your desktop. The logical time to encrypt your email is immediately after it’s written and before it is put in flight on your network.</p>
<p style="margin: 0in 0in 10pt;">SendItSecure provides email encryption and authentication that starts on your desktop. SendItSecure applies not only to enrolled users within your enterprise but extends to your clients and partners. For more information about email security that works inside your firewall as well as outside, check out our <a title="SendItSecure™ E-mail Encryption" href="http://www.senditsecure.com">simple secure e-mail service</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://simplewebsecurity.info/?feed=rss2&amp;p=27</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>A Little Background on Fingerprints</title>
		<link>http://simplewebsecurity.info/?p=23</link>
		<comments>http://simplewebsecurity.info/?p=23#comments</comments>
		<pubDate>Sat, 17 Jan 2009 04:26:10 +0000</pubDate>
		<dc:creator>al</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[biometrics]]></category>
		<category><![CDATA[it security]]></category>

		<guid isPermaLink="false">http://simplewebsecurity.info/?p=23</guid>
		<description><![CDATA[Fingerprints have been recognized as a unique means of identification since ancient times. The ancient Chinese used fingerprints to sign legal documents1. In the 1850s Sir William James Herschel was probably the first European who understood the value of fingerprints for identification. It obviously wasn’t an original idea but Herschel started using fingerprints while he [...]]]></description>
			<content:encoded><![CDATA[<p>Fingerprints have been recognized as a unique means of identification since ancient times. The ancient Chinese used fingerprints to sign legal documents<sup>1</sup>. In the 1850s Sir William James Herschel was probably the first European who understood the value of fingerprints for identification. It obviously wasn’t an original idea but Herschel started using fingerprints while he was an officer in the British Army stationed in India<sup>2</sup>. Herschel used fingerprints and whole hand prints on contracts during the time of the British Raj.<span> </span>Sir William’s biggest contribution was probably the fact that he realized that everyone has a unique fingerprint that never changes.<span> </span>He documented his own fingerprints over his lifetime to prove this.</p>
<p>About 50 years later Sir Francis Galton<sup>3</sup>, who we usually credit as being responsible for the modern study of fingerprints and fingerprint identification, developed a way to classify fingerprints so that it became practical for a person’s identity to the found in a directory of fingerprints. Galton’s system is basically the one we use today. The idea is that we first identify one or more large features in a fingerprint and then go on to compare the minutia that makes one fingerprint different from all others.</p>
<p><span>If you stop for a moment to consider, Galton’s classification system is what we would call a “sort” in computer terms.<span> </span>First we look at the larger classes, upon which we may have indexes, and then we look at the details to find a result.<span> </span>Fingerprints lend themselves to computer classification, digitization and abstraction.<span> </span>Since there is a lot of data in a fingerprint modern digital fingerprint recognition systems use “feature extraction”.<span> </span>Feature extraction simplifies the description of the data by creating combinations of variables that will accurately describe the fingerprint as data.</span></p>
<p><span><span>In practice we don’t record or save the actual fingerprint image.<span> </span>An abstraction of the image is reduced to a number of discrete data points that describe the fingerprint in a statistical, rather than a physical, form.<span> </span>This abstraction makes it almost impossible for the fingerprint to be reverse engineered and used fraudulently.<span> </span></span></span></p>
<p><span>Because of all these factors fingerprints make an ideal basis for positive identification that allows us to authenticate the sender of an email and also the recipient.<span> </span>SendItSecure uses a combination of biometric authentication and state of the art encryption to deliver a secure email system that is easy to use and can be deployed in a medium sized company in a single day.<span> </span>For more information go to… </span><a href="http://www.senditsecure.com/"><span>www.SendItSecure.com</span></a><span> .</span></p>
<p><span>1 &#8211; </span><a href="http://encarta.msn.com/encyclopedia_761573439/Fingerprinting.html"><span style="font-family: Calibri; color: #0000ff; font-size: small;">http://encarta.msn.com/encyclopedia_761573439/Fingerprinting.html</span></a></p>
<p><span>2 &#8211; </span><a href="http://en.wikipedia.org/wiki/William_James_Herschel#cite_ref-HersFD_0-3"><span>http://en.wikipedia.org/wiki/William_James_Herschel#cite_ref-HersFD_0-3</span></a></p>
<p><span>3 &#8211; </span><a href="http://en.wikipedia.org/wiki/Francis_Galton"><span>http://en.wikipedia.org/wiki/Francis_Galton</span></a></p>
]]></content:encoded>
			<wfw:commentRss>http://simplewebsecurity.info/?feed=rss2&amp;p=23</wfw:commentRss>
		<slash:comments>4</slash:comments>
		</item>
		<item>
		<title>Is That Really You?</title>
		<link>http://simplewebsecurity.info/?p=19</link>
		<comments>http://simplewebsecurity.info/?p=19#comments</comments>
		<pubDate>Wed, 14 Jan 2009 04:21:42 +0000</pubDate>
		<dc:creator>dan</dc:creator>
				<category><![CDATA[protocol]]></category>
		<category><![CDATA[authentication]]></category>
		<category><![CDATA[biometrics]]></category>
		<category><![CDATA[it security]]></category>

		<guid isPermaLink="false">http://simplewebsecurity.info/?p=19</guid>
		<description><![CDATA[Being able to easily recognize people has never been a gift of mine.  Many times I&#8217;ve been stopped in a store, or on the street, by someone that knows me, and I scratch the inside of my head, trying to figure out how I should know this person.  Is she someone from church, is she [...]]]></description>
			<content:encoded><![CDATA[<p>Being able to easily recognize people has never been a gift of mine.  Many times I&#8217;ve been stopped in a store, or on the street, by someone that knows me, and I scratch the inside of my head, trying to figure out how I should know this person.  Is she someone from church, is she the teller at the bank I always see, maybe the Subway sandwich artist?  I put on a forced smile, and say how nice it is to see her, and have a good day, and see you soon.  Oh, well.</p>
<p>Security, whether in our homes, schools, or our computer networks, is all about recognition.  Bank robbers, at least the smarter ones (if there is such a kind), try to disguise themselves so that they won&#8217;t be recognized from the surveillance footage.  Politicians, on the hand, want to be recognized, and, of course, re-elected next November.</p>
<p>Recognition is both an art and a science.  Humans have the amazing capacity to recognize each other through a complex processing of many sensory inputs.  From a person&#8217;s facial characteristics, tenor of the voice, and behavioral cues, we know who a person is.  Some of us are better at this than others, but it&#8217;s remarkable how good we really are at it.  The field of biometrics is all about automating the recognition process so that machines can do it based on pre-defined algorithms.  But algorithms aren&#8217;t particularly intuitive, and relying on computers to recognize us, whether through passwords or biometrics, will never be perfect.</p>
<p>Because we live in a digital wild west, we want our computer systems to recognize us before we impart any personal information or authorize a financial transaction.  Most often we do this with a user name and a password.  If the words we provide are recognized by the computer system, we&#8217;re in.  We could do the same thing with any number of attributes that are uniquely &#8220;ours&#8221;.  One of those is, of course, our fingerprint.  Computers can recognize us when we present a fingerprint because no one else has one like ours.  The cost of doing this has gone way down, and the accuracy of recognition has gone way up.  It&#8217;s no wonder that biometric recognition is quickly becoming a mainstream technology!</p>
]]></content:encoded>
			<wfw:commentRss>http://simplewebsecurity.info/?feed=rss2&amp;p=19</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
