55

In theory, if all servers and connections to them were perfectly secure (impossible) and trustworthy (not true), neither one would be more "secure" than the other - mainly because the developer(s) of the website are in full control of the content of the site. Since Flash and the JS is served to clients, the server would have to serve malicious content to the ...


52

I heard this example during one of the guest lectures back in my grad school. I think it is simple enough since I've myself used it many times, to explain ZKP to people with almost Zero Knowledge of crypto/math. Let's say that I want to convince you that I have a superpower to count the exact number of leaves on a tree, within a few seconds. I want to ...


32

In addition to WillS' excellent answer, a couple more differences that affect security: Flash is a product, while HTML5/Javascript is a specification. With a product (and especially a closed-source one), you always depend on the vendor to play a game of whack-a-mole (which Adobe is doing admirably, but long term it is a losing battle). A specification can ...


6

The best demonstration of zero-knowledge proofs I have come across is "Applied Kid Cryptography, or How to Convince Your Children You Are Not Cheating" by Moni Naor, Yael Naor, and Omer Reingold. They examine a simple but real-life cryptographic problem: how to convince people that you know the solution to a Where's Waldo puzzle without releaving any ...


6

Going out on a limb here, I believe in testing by regular drills and Red Team simulated attacks. If the Red Team succeeds in social engineering or other kinds of compromise, the awareness is nil. Reasoning: KPIs and surveys and whatnot measure and report averages. The attacker is not interested in averages, he's going to attack (citing from a recent comment ...


6

A rudimentary training program should minimally educate users on critical issues. Measuring its effectiveness provides the opportunity to ensure that users are getting the relevant information they need to do their jobs safely and effectively. Send out a survey that assesses awareness of job-specific information security issues and see how your employees ...


4

This is called an end-to-end confirmation attack. The idea is simple: Instead of attempting to decrypt the content of packets, an attacker who manages to observe both ends of the communication channel tries to find patterns in the traffic to match outgoing and incoming data in order to deanonymize users. This can be done by correlating the volume of ...


3

Since you mention that you use smartcard features of your Yubikey to store the PGP encryption key necessary to access the pass database, I would say that it is okay to keep TOTP shared secrets in pass alongside other password data. TOTP is a mechanism to ensure 2-factor authentication, so as long as you require the Yubikey to decrypt them, you are still ...


3

Just use TLS, please. Trying to roll your own security like that is a recipe for disaster. Really. As Scheiner law goes any person can invent a security system so clever that she or he can't think of how to break it. Even if you were a smartest of all cryptographers ever alive (in which case you really wouldn't be asking), it is unlikely you'd get it right --...


3

The good answer is this story: The notable case is the “Ali Baba’s cave” metaphor used to illustrate the basic mechanisms behind a zero-knowledge proof: the prover must convince the verifier about his/her knowledge via an interactive protocol, but at the same time a casual onlooker must not gain any information about the secret knowledge. From the book: ...


2

SANS Secure The Human now publishes lists of KPIs for you to consider: https://securingthehuman.sans.org/resources/metrics They split it up into "Tracking" metrics (who has completed the training) and "Impact" metrics to try to measure the impact training has had. number of people successfully phished over time number of people reporting phishing number ...


2

What we decided for one KPI is the amount of incidents reported. In the current phase, we say we want more incidents to be reported: not enough people report/are aware they should. When the amount rises, this will mostly be because of increased awareness. From a certain point (no real steady increase in reports) we will switch to Less incident reports means ...


2

This is explained in the second sentence on your link: For example, suppose the attacker controls or watches the Tor relay you choose to enter the network, and also controls or watches the website you visit. In this case, the research community knows no practical low-latency design that can reliably stop the attacker from correlating volume and ...


1

Security tends to be a compromise with usability. How secret is the data that "slave" users are handling in a brand new account, exactly? Is it worth hand delivering the password to end users, checking their id, then burning the note? Email is not perfect, but is it really that insecure? What about if you only send emails to providers that you ...


1

Sending passwords in a mail is not good under any circumstances. As I see, the best thing you can do is send a one time link in the email so then user navigates to your externally exposed interface(web?) and create a password. To secure the email you can use PGP.This is a good guide. This requires some burden of configurations in the user's end. If you are ...


1

I do this very successfully using 2 methods: Mix training with small 'escapes', moments that attract attention with a joke or something unrelated to the main (probably boring for them) subject. This is like hitting their refresh button. Be interactive. Do not present your case like an advocate in a court of law. Ask them what they think, make them state ...


1

I would like to start this post by mentioning that I expect a downvote from the OP, and possibly a flag, as this question is in fact part of an elaborate straw man which was originally an argument which resulted in my posting of this question. No need to get into that here. But I will certainly answer the question. I would also like to note that Steffen has ...


1

Your question is broad and I will try to answer part of it. In my opinion the move to the web, disabling of Flash and Java etc does not make the whole system safer. It just shifts the fragility and exploits to other kinds of attacks. While we currently have lots of attacks at the OS level and application level (buffer overflows etc) we will have more logic ...


1

Kudos on the rsa mixing analogy. A great find. The zkp mostly depends on an operation of some sort, with the verifying party being able to dictate some terms that the opposing party can use. Of course this is very dependent on the question being asked in the first place. The peggy victor secret door combination wouldn't work if the question was phrased as ...


1

With awareness, what we seek to achieve is a basic understanding of threats and responses. It differs from training and education which pushes for more detailed understanding and knowing the rationale behind the various measures taken. Therefore, the key to promoting awareness is simply through exposure. The more the staff are exposed to such security ...


Only top voted, non community-wiki answers of a minimum length are eligible