Amazon PayPhrase

Amazon has announced a new payment system, Amazon Payphrase. It has two interesting security properties:

• Participating websites will not obtain the credit card information
• Deliveries will only be sent to the address set up at Amazon

Stealing the passphrase or the PIN used for authorizing the checkout won't help cybercriminals so much because they cannot trigger a delivery of the goods to an address of their choice. It seems to me that the system is as secure as Amazon itself. As Amazon has my credit card data anyway I gain a little security because the other websites don't get my credit card number.

Small websites might be happy to be relieved from the burden of credit card handling.

Centralizing the sensitive information will also help when security is to be added to the handling of sensitive information, like using a hardened browser, for example.

Kaspersky wants to end Internet Anonymity

In an interview with zdnet Asia Eugene Kaspersky suggests to put an end to internet anonymity. He says "I'd like to change the design of the Internet by introducing regulation--Internet passports, Internet police and international agreement". Well, first this won't happen because it would be way to expensive. Even if an established system like OpenID would be used as the source of the identity management required here all ISPs and website operators would have to adopt their software. Second, it should not happen because anonymity is sometimes a part of freedom.

However the present system of website logins is a mess and should be fixed by using a voluntary identity management system.

Cnet reports that Comcast have a similar initiative where they disconnect users with infected PCs. This is also problematic, but it sounds a little better becasue it's good internet citizenship not to act as a springboard for internet criminals.

Realistically spaking, the responsibility for PC security remains with the vendors, not with the users as long as the systems are too complicated to be fully managed by the end users.

Secure Online Banking

The Swiss company Crealogix has announced the CLX.Sentinel, a USB device which promises secure online banking. As I was with them team that developed it, it's no surprise that I like it.

But here is why: It uses a smart card to verify the user identity and set up a SSL connection to the bank. Thus, man-in-the middle attacks are prevented. As an additional security benefit it uses an internal list of legitimate banking sites so that phishers can't use the null prefix issue. The CLX.Sentinel won't connect to anything that's not on its list, so the browser infections are next to impossible.

The software is installed on the flash memory inside the token, so it can't be patched and it contains countermeasures against debugging and code injection at runtime.

I believe that this amount of countermeasures is needed nowadays.

Linux Botnet

The Register reports a new linux server botnet originally reported here. It is not yet clear how the servers are infectected. The purpuse of these servers is to serve malware from an additional webserver installed on listening on port 8080. It seems to me that people look at their web forum security again very closely: Not only can be used to exploit a server, but also if it is possible to post links at public discussion sites it is also possible to post links to such malware.

Massive Credit Card Data Theft

Credit card data of more than half a million people have been stolen. I don't think that such events can be avoided unless the architecture of web servers is fundamentally changed to make them more error-resilient.

Webcam Security

A collegue has asked me to make a webcam accessible to his iPhone. Unfortunately, the images from the webcam are displayed by a Java applet, if the browser announces itself as a "mozilla". So I had to take a look at the protocol.

Passwords are sent in cleartext. Upon a successful login the client receives a "key", also in cleartext, which is then used as a directory on the web server. Fortunately, no sensitive data is protected by this mechanism...