Re: some thoughts about Oracle's security breach (by SAP)

2007-03-23 Thread John Ioannidis
On Fri, Mar 23, 2007 at 02:29:14PM -0800, Alex Alten wrote: > It seems to me that this could have been prevented (or better damage > control) by: > 1) encrypting the files Encrypting the files would not have served any purpose; the decryption key would simply have been part of the customer crede

some thoughts about Oracle's security breach (by SAP)

2007-03-23 Thread Alex Alten
It seems to me that this could have been prevented (or better damage control) by: 1) encrypting the files 2) putting in place good access controls (policy adjudication and enforcement) examples: if more than 100 files / week then raise alert if customer access inc

Forwarded: REMINDER - comment period on NIST's hash function requirements to end in 5 weeks on 4/27/07

2007-03-23 Thread Steven M. Bellovin
From: Shu-jen Chang <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: REMINDER - comment period on NIST's hash function requirements to end in 5 weeks on 4/27/07 Date: Fri, 23 Mar 2007 14:12:42 -0400 X-Mailer: QUALCOMM Windows Eudora Version 5.1.1 NIST published a draft requirements and evaluati

Re: Interesting new stego application

2007-03-23 Thread "Hal Finney"
Udhay Shankar N <[EMAIL PROTECTED]> writes: > http://news.bbc.co.uk/2/hi/technology/6361891.stm > > A technology that can "hide" information in plain sight on printed > images has begun to see the first commercial applications. > ... > Fujitsu's technique works by taking advantage of the sensitivi

Interesting new stego application

2007-03-23 Thread Udhay Shankar N
http://news.bbc.co.uk/2/hi/technology/6361891.stm Hiding messages in plain sight Mobile phone reads an invisible code The phone can read invisible images on printed paper A technology that can "hide" information in plain sight on printed images has begun to see the first commercial applications

Re: virtualization as a threat to RNG

2007-03-23 Thread "Hal Finney"
Dan Geer wrote: > Quoting from a discussion of threat posed by software virtualization as > found in Symantec's ISTR:xi, released today: > > > The second type of threat that Symantec believes could emerge is > > related to the impact that softwarevirtualized computers may have on > > random numb