103

The NSA is a composite organization, that comprises several sub-entities called "directorates" with various scopes and goals. The NSA, as a whole, is supposed to have a multitude of roles; its signal intelligence role (often abbreviated as SIGINT, i.e. spying) is the one most people talk about, and is supposed to be handled by the SID (as "Signal ...


102

PGP was considered dangerous because it could have allowed Soviet spies and military officers to plan the nuclear annihilation of the western world without the CIA realizing what's happening before it's too late. Time for some history. During World War II, the importance of cryptography for military use became apparent. Being able to crack enemy ...


76

Let me summarise what you are seeing: someone navigates to a typo-squat site (goggle.com) the browser is then flooded with numerous pop-ups, warning windows, etc. eventually, the anti-virus starts to detect malware the machine crashes It is difficult to think that there are young technology professionals now for whom that sequence is new and strange. For ...


22

For a long time, cryptography was something used by spies and armies, and was weak, and a lot of the weakness was tentatively fixed by keeping algorithms and methods as secret as can be. That's security through obscurity, which is BAD, but, to be honest, algorithms from the pre-computer era were so weak that they needed secrecy; security through obscurity ...


12

The state of the art was non-existent. At the time of the Pentium Pro, the World Wide Web was four years old. Widespread use of shared hosting was about ten years in the future; if you suggested that people would want to run untrusted code provided by random third parties, they'd look at you like you'd grown a second head. Memory protection was about ...


11

OrpheanBeholderScryDoubt This isn't authoritative, since I couldn't find a reference, but I found the commit where the string was introduced dated 1997/02/16. The earlier version used the string OpenBSDbcrypthashfunc, since it was designed to be used with OpenBSD (it is the default on OpenBSD). The new string keeps the same initials OpenBSD (...


10

Unix passwords, with the old DES-based crypt() function, were limited to 8 characters (and the high bit of each byte was ignored). Thus, a lower limit of more than 8 characters would simply not have worked. The driving force for a minimal password size is brute force efficiency: small passwords are unconditionally weak because trying out all combinations of,...


9

This might not be exactly the same as what was in the first Netscape release with SSL, but you can find one early list by running an emulated Windows 95 system from a 1996 install disk at win95.ajf.me and look at the built-in site certificates (Control Panel - Internet Properties - Security tab): AT&T Certificate Services AT&T Directory Services AT&...


6

It is illegal to export 128 bit symmetric encryption or certain levels of asymmetric. PGP exceeded these limits. These export control laws are why some security firms have clean room teams that build strong encryption without any US educated employees working on the team. Technically, if you learned about high strength encryption in the US, you are not ...


5

How bad? Not very. None of the common remote attack vectors existed when the bug was introduced: the "shellshock" parsing bug pre-dates CGI and DHCP by about a year, and pre-dates SSH by two to three years. Remote-access programs such as telnet and rsh don't have the command restriction ability that SSH does, so although a "shellshock" attack could ...


5

Tldr This is what the little research I did was able to find. Most of these dates are as you can read in the longer version, based on the first submitted draft of the respective protocols and not the first time they've been talked about. I hope this might help in your work anyway, and that it might help when doing further research. SSLv1 - November/December ...


4

Take a look at "Crime by Computer" by Donn B. Parker (Scribner, 1976; ISBN-13: 978-0684155760). In it, Mr. Parker describes several early computer crimes, including the first documented computer instance of the infamous "salami slicing" scheme that was parodied in the movie Office Space. All of these crimes took place because of human error of some type ...


4

Back in late 1980s the NSA had a branch called the National Computer Security Center (It may still exist today). The job of this "center" was to help enterprises on the budding forefront of information technology stay secure. Some of the main things they did were: test hardware of major vendors for defects that could leave them vulnerable, test software of ...


4

After a couple minutes in Google, I find that Leslie Lamport appears to be the first to talk about MitM analysis in terms of communication security. The work was published in 1981, but there is evidence of his thoughts on the matter as early as 1979. First published work describing the ideas: here.


4

The reason for this is mostly that "the web" is not a singular thing, with a singular designer. It's a complex structure, who's purpose shifted over decades. We want more from the web today than we wanted back in the 80's, just like we want more from our phones today than we did back in the 80's. Furthermore, the architectural idea that a server instructs ...


3

In my recollection, two big early CA players were VeriSign, founded out of RSA Laboratories, and Thawte, founded by Mark Shuttleworth, who went on to found Ubuntu. Equifax, in the credit reporting business, was also an early CA. GlobalSign claims to have been the first CA in Europe. Many of the current players in the CA space came later or acquired/...


3

It is not that the browsers are unwilling to include this PKI. But they will only include a PKI which gets regular audits and fully conforms to the rules of the CAB browser forum. Acording to this bug inclusion process in the Mozilla trust store (i.e. Firefox) was started 8 years ago and is still an ongoing process. For all the details see the bug itself.


3

In the old days, the grand father of all terminals was the Teletype model 33, one of the first ASCII capable terminal. AFAIK, the only protocol was: send the ASCII code for any key pressed print the character for any code received It is still what is provided for dumb emulators. No security involved here. They came terminal having screens. Manufacturer ...


3

Reformatting is not sufficient, you need to securely wipe the disk. Reformatting is like ripping the cover off a book; it's not pretty but all the info is still there. DBAN is a popular free tool for wiping hard drives. If the drive is SSD, you need other tools. Companies that care will usually not release systems with disks; they'll destroy the disk and ...


3

Alternatively, if I am incorrect about this: then in what way? You are comparing apples to oranges. The email Header is most closely equivalent to the physical mail Envelope - even better, the email Header represents routing information that is not accessible to the recipient in physical mail. So it's not correct to say that email client's access to "...


3

It's not that easy... Example 1 Let's take SQL Injections as an example. You see a site like example.com/?page=1 and you try to change it to example.com/?page=1'. Suddenly you get an SQL error printed. Is this a hacking method or an individual exploit? Example 2 Take a local kiosk system with an attached keyboard. By pressing Win+R, I was able to start a ...


2

A big reason for knowing outdated ciphers is so you can decrypt older documents that were made before the advent of modern cryptography methods. As a famous example, we have Kryptos, a sculpture by Jim Sanborn that's found outside the CIA offices in Langley. Kryptos has 4 different encrypted texts, 3 of which have been decrypted already, the 4th being one of ...


2

If you're doing reverse engineering, penetration testing, or generally involved in looking at things someone else has built, for some strange reason, folks always try coming up with their "own" encryption schemes, which are either flawed or embarrassing mis-interpretations of old ciphers, or just vanilla implementations of old algorithms. Beyond that, you ...


2

The IETF has a data tracker for its RFCs. This means that you can flesh out the development timeline by adding the various drafts for each RFC. And you can narrow down dates to the date of the first published draft. What this doesn't tell you when development for the first submitted draft of each RFC started. Also the "SSL" named protocols were not ...


2

When we learned about BLP in class, one of my classmates decided to email Dr. Bell and ask the question. Below is the response we got. Too bad you haven't happened on the couple of talks I've given on old war stories. During the oil embargo of 1972, was it?, I was driving an hour to work every day, from Worcester MA to Bedford. One's mind wanders. As I was ...


2

"SATAN has fallen from popularity after the height of its popularity in the 1990s. SATAN was released in 1995 and development has ceased. In 2006, SecTools.Org conducted a security popularity poll and developed a list of 100 network security analysis tools in order of popularity based on the responses of 3,243 people. Results suggest[3] that SATAN has ...


2

SMTP is a very, very old protocol, dating from the early days of the Internet when connections weren't reliable and security wasn't a major issue. Many of the issues with SMTP (open relays, unauthenticated senders, etc.) are the result of trying to provide reliable delivery on an unreliable network where everyone knew everyone else (or at least everyone ...


2

It is difficult to define when the word "computer" started getting traction and it is more difficult for the concept of "computer security". To my mind, the first incident in computer security is the process that sparked the invention of the modern computer. That was the work of Alan Turing on the machine that broke the enigma encryption. The Enigma ...


2

The chimpanzee's testimony More than 15 years ago I worked as a system admin on Tru64 an operating system developped on top of OSF/1 by Digital Equipment Corporation. This system was built on a 64bit architecture and made many serious advances in fundamental security. One of them was to permit to use DES to manage passwords up to a length of 16 characters. ...


2

According to Wikipedia the Arms Export Control Acts permitted (at the 1990's) only weak crypto to be exported outside the U.S.


Only top voted, non community-wiki answers of a minimum length are eligible