I am the ghost of groovymother.com. Woooooo!

Just Fancy That

We believe it is not in the best interest of the consumers, merchants and overall payment industry to publish the details of product designs describing potential attacks however remote those might be. Even if these attacks are difficult to be accomplished it gives the bad guys a leg up on research they would not have to do and encourages bad behavior.

— Verifone in 2007 in response to security research showing their UK “Chip & PIN” credit card readers were insecure.

In less than an hour, any reasonably skilled programmer can write an application that will “skim” – or steal – a consumer’s financial and personal information right off the card utilizing an easily obtained Square card reader. How do we know? We did it. Tested on sample Square card readers with our own personal credit cards, we wrote an application in less than an hour that did exactly this.

[…]

Don’t take our word for it. See for yourself by downloading the sample skimming application and viewing a video of this type of fraud in action.

— Verifone in 2011, after Square reduced their fees for credit card processing to well below Verifone’s rates.

Quick cryptogeek note

I’m stopping using my old PGP key (0×8C80C35F). It’s been active for 12 years, and I had set it to expire later this year, so I’m retiring it now.

In its place is 0×1A5FFE23 which I will use for personal purposes for the next five years. It has been signed by 0×8C80C35F (as well as the CACert root key), so should be considered trustworthy. Almost all personal mail from me shall be signed with this key.

PS. I am not being rubber-hosed as I type this.

The Debian SSL fubar farrago - some light perspective

If you have a Debian or Ubuntu box and used it to generate an SSH key in the last couple of years, due to a rather heinous bug, there’s a high chance you have one of roughly 260,000 keys.

To put this in perspective, if your account was protected by a 4 lower-case-character password, it would be harder to brute-force access (26⁴ = 456,976).

For the sake of the internet, follow the instructions to update the keys on your servers forthwith.

Something I Learned Today Going Through Security at Logan Airport

When they say that, due to relaxed heightened security measures, you can only take “travel sized toothpaste” through the security checkpoint when flying, offering to squeeze out the excess toothpaste from your regular sized tube until it weighs less than 3oz won’t cut it.

But the unamused reaction to my offer from the TSA agent was fun, so I think I’m going to purchase another full sized tube and offer again on my flight back.