06.04.15

With SSH Keys on Windows the World Will be a Vastly Less Secure Place

Posted in GNU/Linux, Microsoft, Security, Windows at 11:27 am by Dr. Roy Schestowitz

“Our products just aren’t engineered for security.”

–Brian Valentine, Microsoft executive

Summary: Another warning about the grave consequences of putting SSH endpoints on an operating system which is compromised by design

QUITE a few readers (and also pro-Microsoft bullies) have written to us regarding yesterday's article about OpenSSH and Microsoft, the first PRISM company which also uses broken (by design) ciphers to act as passive back doors. Microsoft is losing and is getting left behind, hence it tries to ‘embrace’ the competition. It’s not a good gesture but an effort to entice people into Windows prison, i.e. inherent insecurity. OpenSSH is supposed to be all about security, which Windows is inherently (by design) not compatible with. Does anyone really want to put public and private keys on a machine that is remotely accessible by spies? That’s suicidal for a government, corporation, legal firm, journalist, etc.

“We already know, thanks to leaks from Edward Snowden, that spies in the West are systematically harvesting passwords of systems administrators and then use these to hijack/infiltrate entire networks.”Microsoft promotion sites continue to praise Microsoft, whereas other sites cautiously welcome the move [1, 2, 3, 4, 5, 6]. This has been mentioned in various news sites since we first covered it, some Linux-centric ones ones too [1, 2]. In Linux Questions, for example, comments included “welcome microsoft to the year 2000.” Or even: “It was nice having known about you, PuTTY.”

To set the record straight, if we correctly understand Microsoft’s plans (all they are at this stage is just speculative, as there is not even a timetable, let alone any code), there will be increased access by espionage-seeking, power-motivated spies to people’s SSH keys. This will decrease overall security. Windows will be the weakest link. We already know, thanks to leaks from Edward Snowden, that spies in the West are systematically harvesting passwords of systems administrators and then use these to hijack/infiltrate entire networks all around the world. All that Microsoft’s involvement can achieve in this case is an increase in compromised computer networks. Putting SSH keys on Windows is the technical equivalent of putting tanks on rhapsodies (rendering the tanks sinkable). █

Share this post: These icons link to social bookmarking sites where readers can share and discover new web pages.

Permalink Mail Send this to a friend

If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

Pages that cross-reference this one

What Else is New

Bogus Patents Which Oughtn't Have Been Granted Make Products Deliberately Worse, Reducing Innovation and Worsening Customers' Experience

How shallow patents — or patent applications that no patent office should be accepting — turn out to be at the core of multi-billion-dollar cases/lawsuits, with potentially a billion people impacted (their products made worse to work around such questionable patents)
EPO is Like a Patent Litigation (Without Actual Trial) Office, Not a Patent Examination Office

Examination of patent applications isn't taken seriously by an office whose entire existence was supposed to be about examination; bureaucracy at the top of this office has apparently decided that the sole goal is to create more demand (i.e. lawsuits) for the litigation 'industry'
Philippe Cadre From the French National Institute of Industrial Property (INPI) Wants to Join António Campinos

Yet another example of INPI's creeping influence if not 'entryism' at the EPO and this time too patent quality isn't a priority
Links 22/9/2018: Mesa 18.2.1, CLIP OS, GPL Settlement in Artifex/First National Title Insurance Company

Links for the day
Links 21/9/2018: Cockpit 178, Purism 'Dongle'

Links for the day
Criticism of Unitary Patent (UPC) Agreement Doomed the UPC and Patent Trolls' Plan -- Along With the Litigation Lobby -- for Unified 'Extortion Vector'

The Unitary Patent or Unified Patent Court (UPC) was the trolls' weapon against potentially millions of European businesses; but those businesses have woken up to the fact that it was against their interests and European member states such as Spain and Poland now oppose it while Germany halts ratification
It Wasn't Judges With Weapons in Their Office, It Was Benoît Battistelli Who Brought Firearms to the European Patent Office (EPO)

The EPO scandals deepen in light of a very major scandal which has occupied the French media for a couple of months
Links 20/9/2018: 2018 Linux Audio Miniconference and Blackboard's Openwashing

Links for the day
Links 19/9/2018: Chromebooks Get More DEBs, LLVM 7.0.0 Released

Links for the day
Links 18/9/2018: Qt 5.12 Alpha , MAAS 2.5.0 Beta, PostgreSQL CoC

Links for the day
Today's European Patent Office (EPO) Works for Large, Foreign Pharmaceutical Companies in Pursuit of Patents on Nature, Life, and Essential/Basic Drugs

The never-ending insanity which is patents on DNA/genome/genetics and all sorts of basic things that are put together like a recipe in a restaurant; patents are no longer covering actual machinery that accomplishes unique tasks in complicated ways, typically assembled from scratch by humans; some supposed 'inventions' are merely born into existence by the natural splitting of organisms or conception (e.g. pregnancy)
The EPO Has Quit Pretending That It Cares About Patent Quality, All It Cares About is Quantity of Lawsuits

A new interview with Roberta Romano-Götsch, as well as the EPO's promotion of software patents alongside CIPA (Team UPC), is an indication that the EPO has ceased caring about quality and hardly even pretends to care anymore
Qualcomm's Escalating Patent Wars Have Already Caused Massive Buybacks (Loss of Reserves) and Loss of Massive Clients

Qualcomm's multi-continental patent battles are an effort to 'shock and awe' everyone into its protection racket; but the unintended effect seems to be a move further and further away from 'Qualcomm territories'
Links 17/9/2018: Torvalds Takes a Break, SQLite 3.25.0 Released

Links for the day
The Patent Trial and Appeal Board (PTAB) Helps Prevent Frivolous Software Patent Lawsuits

PTAB with its quality-improving inter partes reviews (IPRs) is enraging patent maximalists; but by looking to work around it or weaken it they will simply reduce the confidence associated with US patents
Abstract Patents (Things One Can Do With Pen and Paper, Sometimes an Abacus) Are a Waste of Money as Courts Disregard Them

A quick roundup of patents and lawsuits at the heart of which there's little or no substance; 35 U.S.C. § 101 renders these moot
“Blockchain” Hype and “FinTech”-Like Buzzwords Usher in Software Patents Everywhere, Even Where Such Patents Are Obviously Bunk

Not only the U.S. Patent and Trademark Office (USPTO) embraces the "blockchain" hype; business methods and algorithms are being granted patent 'protection' (exclusivity) which would likely be disputed by the courts (if that ever reaches the courts)
Qualcomm's Patent Aggression Threatens Rationality of Patent Scope in Europe and Elsewhere

Qualcomm's dependence on patent taxes (so-called 'royalties' associated with physical devices which it doesn't even make) highlights the dangers now known; the patent thicket has grown too "thick"
Months After Oil States the Patent Maximalists Are Still Desperate to Crush PTAB in the Courts, Not Just in Congress and the Office

Patent Trial and Appeal Board (PTAB) inter partes reviews (IPRs) improve patent quality and are therefore a threat to those who profit from spurious feuding and litigation; they try anything they can to turn things around
IAM, Watchtroll and the EPO Still Spread the Mentality of Patent Maximalism

The misguided idea that the objective (overall) should be to grant as many monopolies as possible (to spur a lot of litigation) isn't being challenged in echo chamber 'events', set up and sponsored by think tanks and pressure groups of the litigation 'industry'
Watchtroll and Other Proponents of Patent Trolls Are Trying to Change the Law Outside the Courts in Order to Bypass Patent Justice

35 U.S.C. § 101 (Section 101) voids almost every software patent — a reality that even the most zealous patent professionals have come to grips with and their way of tackling this ‘problem’ is legislative, albeit nowhere near successful (so far)
Links 16/9/2018: Windows Plays 'Nice' Again, Elisa Music Player 0.3 Beta and Latte Dock 0.8.1

Links for the day
Slamming Courts and Judges Won't Help the Patent Maximalists; It Can Only Make Things Worse

Acorda Therapeutics sees its stock price dropping 25% after finding out that its patent portfolio isn't solid, as affirmed by the Federal Circuitn(CAFC); the only way out of this mess is a pursuit of a vastly improved patent quality, thorough patent examination which then offers legal certainty
Patent Trolls Are Still Active and Microsoft is Closely Connected to Many of Them

A roundup of patent trolls' actions in the United States; Microsoft is connected to a notably high number of these
Advancements in Automobile Technology Won't be Possible With Patent Maximalism

Advancements in the development of vehicles are being discouraged by a thicket of patents as dumb (and likely invalid) as claims on algorithms and mere shapes
Battistelli “Has Deeply Hurt the Whole Patent Profession, Examiners as Well as Agents” and Also the Image of France

A French perspective regarding Battistelli's reign at the EPO, which has not really ended but manifests itself or 'metastasises' through colleagues of Battistelli (whom he chose) and another French President (whom he also chose)
António Campinos Needs to Listen to Doctors Without Borders (MSF) et al to Salvage What's Left of Public Consent for the EPO

Groups including Doctors Without Borders/Médecins Sans Frontières (MSF) and Médecins du Monde (MdM) have attempted to explain to the EPO, with notoriously French-dominated leadership, that it’s a mistake to work for Gilead at the expense of the public; but António Campinos is just another patent maximalist
The Max Planck Institute's Determination on UPC's (Unitary Patent) Demise is Only “Controversial” in the Eyes of Rabid Members of Team UPC

Bristows keeps lying like Battistelli; that it calls a new paper "controversial" without providing any evidence of a controversy says a lot about Bristows LLP, both as a firm and the individuals who make up the firm (they would not be honest with their clients, either)
Links 15/9/2018: Wine 3.16, Overwatch's GNU/Linux (Wine) 'Ban', New Fedora 28 Build, and Fedora 29 Beta Delay

Links for the day
Max Planck Institute Pours More Water on the Dying Unitary Patent (UPC)

The Max Planck Institute gives another sobering reality check for Team UPC to chew on; there's still no sign of any progress whatsoever for the UPC because even Team UPC appears to have given up and moved on