Security quotes of the week

Intel and Nokia were pushing MeeGo, and I talked to their security people at the show. The MeeGo security architecture seems to be more about protecting the device from the user than protecting the user's data from malicious code. The architecture's security goals align more with those of the access providers and content providers.

Oh well. I have a nice batch of more serious problems in the pipeline, but still waiting on vendors, so that's it for now :-)

In eCryptfs, this hash is calculated to unlock the main key that is used for eCryptfs and is then thrown away (it can always be regenerated when the user logs in). If the user changes their passphrase, they must decrypt and re-encrypt the eCryptfs key (this is done automatically by PAM). Under Windows, to deal with potential user login passphrase changes, they instead decided to store all prior (SHA1) hashes of the user's passphrases, even lacking a salt. So all the clear-text user login passphrases are recoverable with a standard rainbow table, in parallel. O_o