Re: AES in M2Crypto advice

On Thursday 05 June 2003 01:46 pm, Ng Pheng Siong wrote:
> IMHO, it is more important that the thief who steals the CEO's laptop
> or the subsequent black market buyer do not get access to the files on
> it.
>
> Install a crypto filesystem type thingy on the laptop and train the CEO
> to use it properly. Then just backup the disk image normally; sensitive

Surely.  But these days, that might be a tall order.  CEOs aren't known 
for openly accepting security technology (and its implied 
inconveniences).  So we'll start small; and when it dawns on him or her 
that the backups are more secure than the laptop itself, that's when we 
make our move!

But joking aside, I think your average corporate executive understands 
meatspace security much better.  For example, most will implement a good 
security system, perhaps with guards.  They will lock their office when 
they leave, and (presumably) they will never let their laptop out of 
their site, because they know how important it is.

But computer security is more mysterious and confusing, so I think it's 
harder for some executives to make a good informed decision (witness IIS 
deployment statistics).  That's why it's very important for crypto and 
security in general to be as user-friendly as possible as the mainstream 
world becomes dependent on it.  For example, bad passwords are human 
nature; and I think no amount of education will solve it.  That's why 
token-based authentication is smarter.  People know not to  lend out 
their credit card or house keys; and so they'll naturally guard their 
smart ID card for accessing the financial database or whatever.  
Personally, I can't wait for every PC to come with a smart card reader.

Anyway, that's enough OT for me for one day ;)

-- 
GPG: 03EE 9EB8 E500 874A F509  7B95 9B9A 84A1 26E9 4F79
http://www.ece.utexas.edu/~jhs/public_key.gpg

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQA+3u1Gm5qEoSbpT3kRAn4fAJ48yrzaEbeZUjM86HJfRbBFWrncCwCfQKf7
eeQRd/IUp6T8KyzyBI3OJLo=
=7+cL
-----END PGP SIGNATURE-----