1. Security is always an issue. It doesn't matter what you do, you always have to be alert.
2. Convenience tends to get in the way of security: the more convenient something is, the less secure it tends to become.
3. Transparency and honesty are the best way to handle security issues. Ignoring them or denying them only increases their negative impact (and reduces one's credibility.)
4. Security cannot be fully automated. A responsible person must always be in charge. Those who think that automatic face or fingerprint recognition are the best security tools must think who is in charge of programming and calibrating such devices... and how secure the process leading to that automated recognition actually is. Also, these days it is way easier to steal someone's face with the help of Facebook, latex masks and 3-d printers than stealing a good password.
5. The person in charge of security must act promptly once security is compromised. Any delay is unforgivable.
Now, specifically, what measures could other distros take to make their sites safer? Here are some:
a- Signing the final iso files.
b- Signing checksums.
c- Keeping such signatures in a very secure server.
d- Using HTTPS (SSL).
Those are some thoughts. Any others will also be welcome.
Don't forget that in the specific case of fingerprints, people think that fingerprints are uniquely identifiable, but in reality the captured print images can be very similar between different people (even without tricks like extracting and printing a mold of someone's fingerprint). With all of this in mind, I realize that my standard comment signature [below] may seem a bit ill-advised.
ResponderEliminar--
a Linux Mint user since 2009 May 1
Your observation about fingerprints is right. Still, I do not think your signature is ill-advised. First, not all Linux Mint releases were compromised; second, the professional way in which those at Mint HQ handled the problem shows their high level of commitment to Mint users. They can rest assured that Mint will get past this unfortunate issue.
EliminarGood post!
ResponderEliminarPV is right. Biometrics is not what people think it is. Similar faces unlock phones, for example.
I think the people at Mint handled the breech as very few do: with absolute honesty. I believe that the negative impact on Mint will be minimal thanks to that.
I totally agree. I was impressed by the honest and prompt response by those at Mint HQ. That shows that they value each Mint user and that each one of them counts. Instead of trying to fool everyone to save face, they disclosed the problem directly and investigated it quickly. You cannot say the same of big software giants these days.
EliminarWe can also learn from the convenience of using Wordpress. It's a very potent web site engine and very wide-used. It wouldn't be uncommon for someone who knows how WP stores everything (which by the way is pretty straight forward) to have no trouble finding security info (once it has breached inside).
ResponderEliminarYou want a well known though still cool way to check if a site might be running wordpress? Just add /wp-admin to the home url.
See this example:
http://www.myrath.com
that's a band page that runs wordpress. And this is where you would login as a user.
http://www.myrath.com/wp-admin
Many might say that changing the login directory would accomplish little against a hacker, but I'd say at least it shows you're trying xD.
Thanks for the trick! And I agree: you can't know if they will force their entry or not, but you can always try to make things more difficult for them.
Eliminar