Endpoint

9/18/2014
01:06 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Google Backs New Effort To Simplify Security

New organization Simply Secure aims to promote and shape more user-friendly security and privacy technologies on the Internet.

Google today announced its support for a newly formed organization called Simply Secure that hopes to eliminate the nagging security and privacy tradeoff of complexity that plague Internet users.

While there are plenty of tools available today for securing users' content, communications, and online activity, they are often too hard for users to use or implement correctly, Google's Meredith Whittacker, open research lead, and Ben Laurie, senior staff engineer, wrote in a blog post today:

They introduce extra steps or are simply confusing and cumbersome. (“Is this a software bug, or am I doing something wrong?”) However elegant and intelligent the underlying technology (and much of it is truly miraculous), the results are in: if people can’t use it easily, many of them won’t. We believe that people shouldn’t have to make a trade-off between security and ease of use. This is why we’re happy to support Simply Secure, a new organization dedicated to improving the usability and safety of open-source tools that help people secure their online lives.

Simply Secure plans to work with open-source teams, designers, and researchers to determine how to make these security tools easy to use. Among the efforts they say they plan to collaborate with are Open Whisper Systems, The Guardian Project, and Off-the-Record Messaging, "to make them easier to understand and use," the Google team says.

"We feel that plenty of tools are being built already, we just want to help make them better," Ben Laurie, Google senior staff engineer, said in an email exchange.

Laurie says the organization will look at how to best integrate design and user testing in open source software development and provide information on how to do just that.

"We have not absolutely nailed down the first projects, but it is likely they will be in the messaging area, particularly IM since the real-time and one-to-one nature of that environment makes it more tractable for early experiments," Laurie says.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/19/2014 | 10:13:31 AM
Re: How do we simplify security?
It took several hours for me to upgrade to iOS 8...ugh.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
9/19/2014 | 9:48:21 AM
Re: How do we simplify security?
Yes to your point about new iOS 8 security features. That is, assuming current iphone users can get through the update process, which requires a ton of storage (5.8 GB).  Moral of the story, is anything ever really simple in consumer tech any more?  
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/19/2014 | 7:27:59 AM
Re: How do we simplify security?
Maybe they will adopt the Apple model of keeping it simple yet functinoal ... I guess the new iOS security features will be a good test for that.
Charlie Babcock
50%
50%
Charlie Babcock,
User Rank: Ninja
9/18/2014 | 9:36:19 PM
How do we simplify security?
Hopefully, security can be simplfied. I'm curious whether the project will try to apply security from some new vantage point or simply coordinate the use of more tools.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
9/18/2014 | 3:33:56 PM
Re: Hard to argue against the concept...
Ha!  You are so right!  Sometimes it feels like we are stuck in a infinite loop.  Solution to vulnerability -> Solution implemented -> Vulnerability found in solution.  Rinse and repeat.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
9/18/2014 | 3:30:24 PM
Re: Hard to argue against the concept...
The interesting point here is that there are some good tools out there for users to secure their stuff. That's good news. But the tools just aren't user-friendly enough, so regular (non-tech security) users give up on them or don't even know they exist. Mainstreaming this stuff would be a big step.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/18/2014 | 3:24:05 PM
Re: Hard to argue against the concept...
I agree, Google would be one of the mandatory players in this effort. It should be an industry wide effort to succeed.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/18/2014 | 3:22:28 PM
Re: Hard to argue against the concept...
I know and I agree. The only problem we will face is that the next day somebody will find a vulnerability in it and we are back to square one.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
9/18/2014 | 3:20:38 PM
Simple, secure and easy to use
If we can simplify security that puts security concerns out of our minds they would be the ultimate situation I want to be in. Today, we either do not care until we get hit, or get bug down and lock everything down which leaves end users frustrated.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
9/18/2014 | 2:48:30 PM
Re: Hard to argue against the concept...
The holy grail of security, ease of use and high certainity of security, I wish them the best of luck.  I have a feeling that at some point in the near future someone will come up with a fool proof product that works well and stays out of the users way and the rest of us will be smacking our foreheads saying "Dang, I should have thought of that".
Page 1 / 2   >   >>
Google Engineering Lead on Lessons Learned From Chrome's HTTPS Push
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
White Hat to Black Hat: What Motivates the Switch to Cybercrime
Kelly Sheridan, Staff Editor, Dark Reading,  8/8/2018
PGA of America Struck By Ransomware
Dark Reading Staff 8/9/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-3937
PUBLISHED: 2018-08-14
An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability...
CVE-2018-3938
PUBLISHED: 2018-08-14
An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow, resulting in remote code execution. An attacker can send a malicious POST r...
CVE-2018-12537
PUBLISHED: 2018-08-14
In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
CVE-2018-12539
PUBLISHED: 2018-08-14
In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code. Attach API is enabled by default on Windows,...
CVE-2018-3615
PUBLISHED: 2018-08-14
Systems with microprocessors utilizing speculative execution and Intel software guard extensions (Intel SGX) may allow unauthorized disclosure of information residing in the L1 data cache from an enclave to an attacker with local user access via a side-channel analysis.