On Fri, 22 Sep 2006 20:56:54 +0100, Mark McIntyre
<markmcintyre@spamcop.net> wrote:
>>Yeah, you might say that. I had to deal with C2 security on SCO Unix
>>so I have a clue how such things should work.
>
>Apparently not, if you think that SCO Unix is capable of it, and
>Windows is not - wander over to the NTSC webpile sometime and find
>out.
It's NCSC. Been there. Done that. Microsloth apparently passed C2
security using NT 3.51 and 4.0. I don't think they've bothered with
W2K, XP, or Server 2003 because the governmint dropped the C2
requirement.
>Its also worth verifying buzzwords before using them as ammo in
>debates. C2 is pretty simple to meet.
SCO bought C2 from Secureware. It was anything but simple to meet in
1993(?). Maybe today, but not back then. My involvement with C2
security was primarily trying to live with it as it was an integral
part of SCO Unix and could not be easily disarmed or bypassed.
Eventually, SCO disabled parts and pieces that were driving users
nuts. Convenience comes first again.
>>In my never humble
>>opinion, methinks Windoze is designed for user convenience first and
>>foremost.
>Then your opinion in this matter is junk. I don't intend to enter into
>a flame war with you tho, so I'll just threadplink the topic.
No problem, but I do enjoy technical flame wars, especially when I'm
right. The more trivial and obscure the topic, the better.
>>>Lets bear in mind
>>>that any OS can be cracked if you have access to the right tools.
>>
>>The C2 level of SCO Unix could not. There was no concept as root,
>>adminstrator, supervisor, supreme user, or system god with C2.
>I disagree that this contradicts my previous statement, even if it
>were relevant (which its not). If you have obtained a suitably
>privileged login to the system, you've cracked it. It need not be able
>to wipe the f/s or read all files (heck, its trivial to configure the
>Administrator account in windows the same way as you suggest).
Fine. I'll conceed that gaining entry to a user account does somewhat
compromise the system. However, I was talking about tweaking the
registry which requires administrator level permission.
>>Not any, but most that allow this can be bypassed.
>
>Any that don't have some hardware support for encryption of the
>operating system.
I once was on a rampage over why backup tape manufacturers don't
bother to encrypt their tapes. The resultant discussion expanded into
encrypted filesystems and hardware encrypted hard disks. It seems
that encryption tends to randomize the data on the drive. Modern hard
disks and tape drives use statistical algorithms to guess whether the
garbage waveform read from the drive or tape is a zero or one. That's
the only way to obtain the current levels of tape and drive densities.
However, if the transitions or bits are randomized, the data
extraction algorithms have problems and tend to generate bad guesses.
Hardware encryption would be nice, but apparently at the price of
increased drive and tape errors. Note that this does not apply to EFS
(encrypted file system) which encrypts the stored data blocks and not
the native data transitions on the drive or tape. Of course,
convenience is more important that security to Microsoft, so they are
removing some encryption features from Vista:
|
http://www.itnews.com.au/newsstory.aspx?CIaNID=34961
--
# Jeff Liebermann 150 Felker St #D Santa Cruz CA 95060
# 831-336-2558
jeffl@comix.santa-cruz.ca.us
#
http://802.11junk.com jeffl@cruzio.com
#
http://www.LearnByDestroying.com AE6KS
WPA-PSK - can it be copied? 
Linear Mode
