At a conference, I probably filled out something with my postal address that has caused me to get a lot of CIO and CSO junk mail. For a long time, they thought my name was STEBREW, though lately it comes actually addressed to me. A lot of this stuff is horrifying to me, like the current issue of CSO that has the following quote (and I'm not making this up)

With their homes and neighborhoods in ruins or under threat, employees tend to concentrate on their personal life. But companies are surprised when it happens.

Today I got something from Verisign about using cryptography to secure my site from "evil internet bandits". I was probably aware of cryptography earlier than many people -- when I was in graduate school, my brother Phil and I compiled an implementation of Lucifer to exchange encrypted messages and I used early versions of PGP before RSAREF made it legal. I read Bruce Scheier's book Secrets and Lies when it first came out -- when cryptography was becoming more generally known. I particularly liked this bit in the preface

Readers [of Applied Cryptography, Schneier's first book] believed that cryptography was a kind of magic security dust that they could sprinkle over their software and make it secure. That they could invoke magic spells like "128-bit key" and "public-key infrastructure."

This advertisement is clearly aimed at these people. Here's the outside of the envelope

verisign-env.jpg

The inside of the envelop gets even better. The robot character at the bottom says, "Secret, powerful forces threaten your site... Defeat them with the strongest SSL encryption on earth." The best part is where the female character says, "Strengthen your encryption by 300 septillion times to deter internet bandits from intercepting your sensitive data." They even spell out 300 septilion as 300,000,000,000,000,000,000,000,000 in the letter, because all those zeros have to make a difference.

It's all wrong on so many levels. Attacking the encrypted communications are one of the least likely points of attack. Opponents are much more likely to focus on the systems that contain the un-encrypted data or use phishing and pharming attacks, where users are tricked into devulging their information securely to the wrong site. Yet this advertising aims at the naive administrator who is looking for some magic security dust to sprinkle on their e-commerce system. But, hey! You can even get a free 64-MB flash drive! Sigh...


StevenBrewer