October 30, 2007

Leopard’s firewall, can you count on it?

Filed under: apple,firewall — admin @ 8:35 pm

Heise.de examined recently the firewall which comes with apple’s new OS X version “Leopard”. It looks like they really learned nothing from what other operating system developers had to learn in the past years. It’s hard to guess how Apple (or even just the people using it) wants still to claim that their system should be more secure than other after having a closer look on what they deliver as a so called firewall. Here the facts:

  • It’s not enabled by default. Microsoft have been blamed for that years ago, while releasing SP 2 for Win XP
  • If you have enabled it and upgrade to “Leopard”, it will get disabled. Microsoft had done this fault as well years ago.
  • If you enable it and request it to deny everything, so nothing else than to block anything which comes from outside to your computer, so called trustworthy services are still open and can be accessed. WTF? A firewall which is just useless?!
  • The only way you can really secure your firewall is to put hands on the firewall your self, without any “klick’n’bunti”. And this is certainly nothing that a so called Mac user wants to do, nor 99% percent of the people will understand or even just do it.

It certainly looks like Apple just released a firewall which is just useless for most of their users. And it looks like that usability (nice GUI’s as a top criteria!) have another time won over security. And it becomes again clear that you can’t have any security if you aren’t understanding what are you doing (while clicking).

So and what can you do as a Mac-User? You have to wait until Apple thinks that it is a security issue and will release an update. With FOSS anyone could release an update, and everyone could profit. Fortunately I’m not using anymore any closed systems. 🙂

Check out the whole story @ heise.de in German or in English.

October 9, 2007

Encryption seems to work…

Filed under: cryptography,law,privacy,skype,surveillance — admin @ 11:40 pm

In the last few days 2 news showed in a way that encryption really works. And therefore the government is looking for new ways to still gain access to your data:

  • In UK you can now be charged with up to 5 years of prison, if you don’t give away your password to encrypted data. Heise.de (German)
  • In nearly every newspaper in Switzerland there have been reports about the problem that drug dealers are using more and more Skype to communicate, which encrypts the traffic in a secure manner and the Skype company seems not to really want to work together with the government. Heute-Online (German)

The first news is indeed a shame and an attack on your right to not cooperate and not to charge yourself. However it is rather questionable how investigation teams can show that you really won’t have forgot your password.

The second one is in the context of security not that good: Skype is not a free/open protocol. It is still proprietary and the company won’t open the protocol nor the services. So if you’d like to communicate in a secure manner you have to rely on their integrity, that they won’t wiretap on their servers or change the software (like JAP did it) that eavesdropping is possible. Therefor we, on immerda.ch are encouraging people to use open protocols like Jabber or SIP (Hopefully to come soon 🙂 ) to be sure that no wiretapping is possible and that you are not depending on a company providing you the services for free and without any cooperation to the police.

Proudly powered by wordpress 4.9.8 - Theme by neuro