Rubénerd!

My feedback regarding the latest episode of Security Now:

To whomever Gibsons and Laportes this may concern,

I'm not Bill Kurtis.

I thought I'd just throw a message over to you guys to clarify one point that was raised on Security Now Episode 181 "Crypto Rehash".

Steve, you commented that you failed to see the point of putting MD5 or SHA hashes on websites that offered downloads given that if a website was compromised the hash could easily be changed as well. I must admit I had never thought of it that way myself either; I had a hearty chuckle on the train along with you guys much to the bewilderment of my fellow commuters!

I would comment though that I was under the impression that hashes under download links are not provided for the purposes of verifying a file hasn't been tampered with for security reasons, but was instead provided so you could verify that the downloaded file had been received intact. As a FreeBSD user I download ISO images and regularly use the hashes to verify that the finished download wasn't corrupted while downloading before I burn a coaster with one. Not sure if this is really necessary, but it has alerted me to a couple of failed downloads in the past.

Thanks for the great show and all the effort and preparation you put into each one.

Most humbly and securely yours,
Ruben Schade in A Little Street in Singapore

--------------------------
THIS MESSAGE HAS BEEN SCANNED WITH SUPER AWESOME VIRUS SCANNER 2009. IT WILL SELF DESTRUCT IF DELETED.

Another quickie to serve as much as a reminder for me as a how-to post.

If you've configured the SFTP daemon on your target system to use a non-standard port as part of your security precaution mix, you can't pass this port number by appending a colon and the port to the address. Instead, use the SFTP options flag to declare the port:

% sftp -oPort [PORT] (USER@)[ADDRESS]

For example, to connect as user NotBillKurtis to a local 192.168.1.128 server on port 50000 you would enter:

% sftp -oPort 50000 NotBillKurtis@192.168.1.128

For those of you like me who use a flavour of UNIX (Mac OS X, FreeBSD, Linux...) but at some point are stuck using a Windows computer, the built in Command Prompt FTP client can throw you off for one simple reason: Windows goes against what everyone else does (yet again!) and defaults to ASCII for file transfers instead of binary. This means any non-plain text files you upload via FTP will become corrupted and unusable.

Little tip for those doing this, make sure once you've logged onto an FTP server to type the "binary" command first before you do anything else. Windows will confirm the change by printing "200 Type set to I".

Another small Windows platform difference along the lines of my ifconfig versus ipconfig post I also wrote this month that regular Windows users probably already know, but passing it on for what it may be worth. I'm not Bill Kurtis.

Microsoft's TechNet has more details.