Feeds

TSA makes a hash of 'no-fly' redress site

I'm not a terrorist and you know zip about net security

Security for virtualized datacentres

The Transportation Security Administration (TSA) website has not been hacked by identity thieves, despite appearances to the contrary.

The TSA recently created a website to enable people wrongly listed on its infamous "no-fly list" to establish that they were not a security threat. They were invited to submit detailed and confidential information, on a site hosted by a third-party, Virginia-based web design company spelled Desyne.

But as originally set-up, data was submitted to the site through an insecure link. Worse, people who used the site typically did so after they had been delayed from boarding a plane. And there was a good possibilty that they submitted the data from an airline terminal, an unfamiliar location where they might be more likely to stray onto a bogus network set up to trick the unwary.

To the astute, the TSA site had all the hallmarks of a bogus site run by conmen and designed to harvest personal information. After the shortcomings of the TSA's site were highlighted - by Chris Soghoian, the boarding pass generator hacker - the site was moved onto a secure server (https://trip.dhs.gov/index.html). Problems remain: the site is still outsourced and continues to use cookies (a practice that runs counter to federal policy).

The TSA's security SNAFU is reminiscent of the mistakes made last month by the UK government in establishing a MI5's terror status mailing list. In that case users were only submitting their name and email address whereas the TSA website invites submission of a full spectrum of confidential data, including their date and place of birth, drivers license details and passport number, making the TSA's slip-up even more galling. ®

Beginner's guide to SSL certificates

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.