Comments on: Security Review: Portable Computing http://cubist.cs.washington.edu/Security/2009/03/05/security-review-portable-computing/ Mon, 25 May 2009 11:35:08 -0700 http://wordpress.org/?v=2.8.6 hourly 1 By: alexmeng http://cubist.cs.washington.edu/Security/2009/03/05/security-review-portable-computing/comment-page-1/#comment-8139 alexmeng Fri, 13 Mar 2009 15:06:58 +0000 http://cubist.cs.washington.edu/Security/?p=1021#comment-8139 Something I have always wondered about portable security is even if there is application security and protocol security, but what about securing the authenticate of the user using the portable devices? I've noticed for laptops many people are use to setting a password. But I have also seen that smartphones for example, many people don't set passcodes to use them, making it easy for someone to possible steal from and impersonate them until the authorities are notified. This becomes a bigger concern when people began to integrate smartphones into their daily lives, storing their e-mail, contacts, website information, active web sessions to sensitive websites. Without securing the authentication of the user, using the portable device, the security in protocols or applications may be irrelevant. Therefore, as security increases in portable computing communications, so should user knowledge in securing their physical portable device! Something I have always wondered about portable security is even if there is application security and protocol security, but what about securing the authenticate of the user using the portable devices? I’ve noticed for laptops many people are use to setting a password. But I have also seen that smartphones for example, many people don’t set passcodes to use them, making it easy for someone to possible steal from and impersonate them until the authorities are notified.

This becomes a bigger concern when people began to integrate smartphones into their daily lives, storing their e-mail, contacts, website information, active web sessions to sensitive websites.

Without securing the authentication of the user, using the portable device, the security in protocols or applications may be irrelevant. Therefore, as security increases in portable computing communications, so should user knowledge in securing their physical portable device!

]]> By: Matt http://cubist.cs.washington.edu/Security/2009/03/05/security-review-portable-computing/comment-page-1/#comment-7875 Matt Sat, 07 Mar 2009 04:02:09 +0000 http://cubist.cs.washington.edu/Security/?p=1021#comment-7875 There's no silver bullet here. Even ingenious engineering will not be enough to prevent someone from simply forgetting a portable device in a coffee shop. And while encryption and polarized screens could potentially mitigate "shoulder surfing" and theft, they would not eliminate them completely (a determined attacker with physical access to a machine is capable of almost anything). And the usability cost would be higher even than Vista's UAC, which draws a lot of ridicule already. A better solution would be improved education about computer security. The specifics of encryption and security protocols wouldn't be necessary -- influencing practices like situational awareness to keep track of your items and who is around you can succeed even where clever security schemes can fail, since simple awareness can circumvent most crimes of opportunity anyway. The basic principles of guarding your mobile device could, in my opinion, be as simple as practices like locking your door at night or keeping in well lit areas when walking around at night. The biggest barrier to raising security awareness is presenting it as complicated and obfuscated, which will immediately put most of the population off of implementing a few simple practices. There’s no silver bullet here. Even ingenious engineering will not be enough to prevent someone from simply forgetting a portable device in a coffee shop. And while encryption and polarized screens could potentially mitigate “shoulder surfing” and theft, they would not eliminate them completely (a determined attacker with physical access to a machine is capable of almost anything). And the usability cost would be higher even than Vista’s UAC, which draws a lot of ridicule already.
A better solution would be improved education about computer security. The specifics of encryption and security protocols wouldn’t be necessary — influencing practices like situational awareness to keep track of your items and who is around you can succeed even where clever security schemes can fail, since simple awareness can circumvent most crimes of opportunity anyway. The basic principles of guarding your mobile device could, in my opinion, be as simple as practices like locking your door at night or keeping in well lit areas when walking around at night. The biggest barrier to raising security awareness is presenting it as complicated and obfuscated, which will immediately put most of the population off of implementing a few simple practices.

]]> By: devynp http://cubist.cs.washington.edu/Security/2009/03/05/security-review-portable-computing/comment-page-1/#comment-7873 devynp Sat, 07 Mar 2009 02:22:20 +0000 http://cubist.cs.washington.edu/Security/?p=1021#comment-7873 It's amazing how portable computing devices, such as laptops or cellphones allow people to be in contact with other people 24/7. More people find the need to have smartphones, because of its handy size. But most people don't realize that phones are less stable than computers. They don't have stable operating systems and contains a lot of patches, so it can be attacked more easily. It’s amazing how portable computing devices, such as laptops or cellphones allow people to be in contact with other people 24/7. More people find the need to have smartphones, because of its handy size. But most people don’t realize that phones are less stable than computers. They don’t have stable operating systems and contains a lot of patches, so it can be attacked more easily.

]]> By: Kevin Wallace http://cubist.cs.washington.edu/Security/2009/03/05/security-review-portable-computing/comment-page-1/#comment-7843 Kevin Wallace Fri, 06 Mar 2009 02:03:30 +0000 http://cubist.cs.washington.edu/Security/?p=1021#comment-7843 It will be interesting to see the security dynamic that emerges here next year as <a href="http://techfee.washington.edu/proposals/2009-098-1/" rel="nofollow">CSE wants to give every student a netbook</a>. It will be interesting to see the security dynamic that emerges here next year as CSE wants to give every student a netbook.

]]>