Category Archives: security

GnuTLS v2.0

Posted on by

I released GnuTLS v2.0 yesterday, the announcement is available.

So now we can start thinking of nice stuff to have in the v2.1.x series. Integrating the PKCS#11 support is one. ECC support? TLS 1.2 may go into v2.0.x. Opaque PRF input support is planned. Some benchmarking and optimization could be interesting. Other ideas?

Youbico

Posted on by

Thought I’d let you know the reason why this blog has been silent for a while: Youbico. It is a new startup company that I’m involved in as head of R&D and investor. The idea is to sell a hardware USB dongle, the Youbico key, for user authentication. Initially we’ll target the OpenID community, but we are working with a number of companies looking to use the Youbico key for other applications.

That’s it basically. Again, check out our web site to find out more.

Buggy IMAP authentication on Nokia 6233

Posted on by

I bought a Nokia 6233 yesterday, because I lost my Nokia N80 a few days ago. One of its important features besides 3G and Bluetooth, for me, is the ability to read e-mail. Unfortunately, the devices has some serious problems with non-cleartext authentication in IMAP. What is strange is that SMTP authentication using CRAM-MD5 and DIGEST-MD5 works fine. Actually, there is more strangeness to it than this… Continue reading Buggy IMAP authentication on Nokia 6233→

TLS-AUTHZ Patent Concerns

Posted on by

I’ve implemented tls-authz in GnuTLS but there has been a long discussion of the patent situation for that technology on the IETF list. A few days ago there was a new IPR Disclosure with a patent license for this technology:

https://datatracker.ietf.org/public/ipr_detail_show.cgi?&ipr_id=833

I evaluated this license from a free software perspective, here is my writeup:

http://article.gmane.org/gmane.ietf.general/24690

Boycott scan.coverity.com!

Posted on by

Coverity is a tool to find security problems in code through static analysis. I’m sure it is a fine tool. There is a company behind it, Coverity Inc., and they run the tool on free software. A service like that seems like a good thing. Alas, the details of how scan.coverity.com imply that it is a bad idea for free software supporters to use the service. Here are the mistakes they made:

  1. There is no notification to the project maintainer that they found problems in the code.
  2. The problems they have found are not available publicly. (This _may_ be desirable, in case the problems they find are exploitable.)
  3. They require that any maintainer who wish to review the problems enter into a license agreement with Coverity, Inc. The license is very biased, and all the advantages are with the company, and none with the developer. Further, they can change the license at any time, and you are (presumably) forced to follow it anyway. (Read below for a copy of the license.)

This sends the message that the site is just advertisement for their commercial proprietary products and services. Possibly it could be even worse, it can be seen as a bargaining a’la “Your software is insecure, agree to our evil license and we’ll tell you how to fix it”.

Therefor I suggest that all free software maintainers boycott the scan.coverity.com service until they get their act together.

A reasonable way to change their service to something more acceptable, and potentially even turn it into a positive contribution to the community, would be to send the list of problems to the official bug maintainer address of each project.
Continue reading Boycott scan.coverity.com!→