History, Security

Laws stopped cousin-marriage, not mobility

2 Comments

Collecting huge datasets for analysis has since the beginning of time been a good way to find insights. Recently some theories about safety and longevity of cousin marriage are being challenged by the power of big data systems:

researchers suggest that people stopped marrying their fourth cousins not due to increased mobility between different regions, but because the practice became less socially acceptable

“Less socially acceptable” is another way of saying laws against it were being passed. According to the seminal book on this subject, by someone with the same name as me, mathematical modeling show how those laws against cousin marriage were based in prejudice, not science.

Forbidden Relatives challenges the belief – widely held in the United States – that legislation against marriage between first cousins is based on a biological risk to offspring. In fact, its author maintains, the U.S. prohibition against such unions originated largely because of the belief that it would promote more rapid assimilation of immigrants.

Immigrants were barred from continuing their historic practices, much in the same way prohibition of alcohol criminalized Germans for their breweries and Irish for having distilleries. Keep these reports and books in mind the next time someone says cousin marriage is a concern for human safety or longevity.

Energy, Security

More people dying in a fire: petroleum-based skin products to blame

Leave a comment

An investigation has started to reveal that the practice of putting a distillate of petroleum (parrafin) on your body can lead to a very painful fiery death.

Firefighter Chris Bell, who is a watch commander with West Yorkshire Fire and Rescue Service, says the actual number of deaths linked to the creams is likely to be much higher.

“Hundreds of thousands of people use them, we’re not sure how many fire deaths might have occurred but it could be into the hundreds,” he said.

His concerns were echoed by Mark Hazelton, group manager for community safety at London Fire Brigade.

He said many fire services do not have forensic investigation teams able to properly assess the role of paraffin cream in fires.

In brief, repeated use of a petroleum-based oil in a cream causes soft furniture to become filled with the highly flammable substance. It’s essentially (pun not intended) pouring gasoline on your bed and chair, albeit very very slowly. Then when a fire starts, the outcome of dousing flammable oil is predictable. Product manufacturers haven’t yet been held accountable for this alarming rise in deaths linked to their ingredients.

History, Poetry, Security

Amazon’s About Face on GovCloud: “Physical Location Has No Bearing”

Leave a comment

Amazon never seemed very happy about building a dedicated physical space, kind of the opposite of cloud, to achieve compliance with security requirements of the US federal government.

AWS provides customers with the option to store their data in AWS GovCloud (US) managed solely by US Persons on US soil. AWS GovCloud (US) is Amazon’s isolated cloud region where accounts are only granted to US Persons working for US organizations.

That’s a very matter-of-fact statement, suggesting it was doing what it had been told was necessary as opposed to what it wanted (destroy national security requirements as antiquated while it augers towards a post-national corporate-led system of control).

While that might have seemed speculative before now, Amazon management just released a whitepaper showing its true hand.

The other two “realities” are “Most Threats are Exploited Remotely” and “Manual Processes Present Risk of Human Error”…

I want you all to sit down, take a deep breath, and think about the logic of someone arguing physical location has no bearing on threats being exploited remotely.

First, vulnerabilities are exploited. Threats exploit those vulnerabilities. Threats aren’t usually the ones being exploited via connectivity to the Internet (as much as we talk about hack back), vulnerabilities are. Minor thing, I know, yet it speaks to the familiarity of the author with the subject.

Second, if physical location truly had no bearing, the author of this paper would have not bothered with any “remotely” modifier. They would say vulnerabilities are being exploited. Full stop. To say exploits are something coming from remote locations is them admitting there is a significance of physical location. Walls being vulnerable to cannon-balls does not mean cannons fired from 1,000 miles away are the same as from 1 mile.

Third, and this is where it truly gets stupid, “Insider Threats Prevail as a Significant Risk” again uses a physical metaphor of “insider”. What does insider mean if not someone inside a space delimited by controls? That validates physical location having bearing on risk, again.

Fourth, this nonsense continues throughout the document. Page six advises, without any sense of irony “systems should be designed to limit the ‘blast radius’ of any intrusion so that one compromised node has minimal impact on any other node in the enterprise”. You read that right, a paper arguing that physical location has no bearing…just told you that blast RADIUS is a critical component to safety from harm.

Come on.

This paper seems like it is full of amateur security mistakes made by someone who has a distinctly political argument to make against government-based controls. In other words, Amazon’s anti-government paper is an extremist free-market missive targeting US-based ITAR and undermining national security, although it probably thought it was trying to knock down laws written in another physical location.

Something tells me the blast radius of this paper was seriously miscalculated before it was dropped. Little surprise, given how weak their grasp of safety control is and how strong their desire to destroy barriers to Amazon’s entry.

Security

SHA-1 versus SHA-2 performance tests

Leave a comment

Moving to SHA256 has become an increasingly common topic ever since SHA-1 went through the bad news cycle of being vulnerable faster than brute-force. Even in cases where not relevant, such as authentication mechanisms (SCRAM), it feels like only a short time from now regulators will push a SHA-2 family as minimum requirement. For most people that means moving to a 256 bit key length (SHA256) sooner rather than later.

Will SHA256 cause a performance issue when replacing SCRAM-SHA-1? It’s hard to say, given that many variables are involved in testing, yet generally we expect a 50% performance change with 256 bit key length of SHA-2 compared with 160 bit key length of SHA-1.

Assuming proper construction a larger bit size means more possible combinations, which means strength through slowing down brute force attempts. A cryptographic hashing algorithm is only as great as its ability to make truly unique, non-guessable, hashes. So here’s a way for you to compare speeds:

ubuntu17:~$ openssl speed -multi 2 -decrypt sha1 sha256

The 'numbers' are in 1000s of bytes per second processed
sha1            176979.32k   479049.54k  1017926.06k  1451719.34k  1652667.73k
sha256          144534.98k   302692.57k   576607.91k   697034.07k   740136.28k