Security Vulnerability = Sexy Bug

Watching Billy Hoffman's JSConf talk, "Javascript, the Evil Parts". A favorite point he makes: security flaws in software are unintended software behavior, that is, they are bugs, albeit sexy because they relate to security. When a developer says security is not their problem, they are declaring that they are not responsible for bugs that happen to affect security. Fail.

Time for the tinfoil wallet, now

Wired Online has a piece on remote reading of RFID chips. Think credit cards and door badges. It includes a link to a manufacturer of wallets lined with conductive material.

Google apps for client documents?

Over on Slashdot someone posted a question on whether he should accede to his lawyer clients' desire to just use Google Apps for docs and email.

I have been a system administrator and a security consultant. There's a couple of questions one needs to ask oneself before making such a move:

1. How bad would it be for me if one of my documents or emails became public? Or, specifically, they got into the worst possible hands? What's my risk?
2. What are the likely consequences to my service provider if that happens? What's their incentive to keep my data secure?
3. What measures are available to me to secure my data? What will it cost me to secure my data?
4. Who has access to my data?

I don't even talk about threats, here. Whatever they may tell you, your service provider is a big black box to you, and you don't know about all the holes in that box.

As a system administrator, I had access to any data on our systems. Temptation.

Information security is about making your data cost more to access than it is worth to the person trying to steal it.