It happened on the second to last day of a wonderful family trip to Southeast Asia. I looked at my mobile phone in the morning and it had an alert that said something like “SIM not recognized.” I should have probably figured out something was remiss right then, but instead I simply assumed that my phone had tried to register on an unsupported network. As I was sitting down for breakfast suddenly 3 emails arrived in rapid succession that made me realize I was being hacked (time order is from b...

So I am still away on family vacation and following a self-imposed online diet, but even then it has been impossible to ignore the monster sized vulnerabilities disclosed today known as Meltdown and Spectre. And just to make sure nobody misreads my post title, these are bad. Downright ugly. They are pervasive, exploitable and a real longterm fix will likely require new hardware (one or more extra hardware bits in the CPU). So how can I possibly claim they are good? Here are four different way...

With the release by Wikileaks of the so-called Vault 7 CIA Hacking tools, the debate has once again turned to the effectiveness and role of encryption. As Zeynep Tufekci (you should absolutely follow her on Twitter) rightly points out, this is all about endpoint security and not about broken encryption. Now we are at the point where it gets interesting and one that I have been writing about for years whenever it comes to the relationship between privacy and general purpose computing. To repea...

While gathering up additional data for the next post on wealth, here are some thoughts on the Heartbleed security vulnerability. At USV we sent out a notice of the issue to all the heads of engineering as well as all of the CEOs. This was easy to do since as part of the USV network we have these groups pre-defined. It was immediately clear based on the severity of the issue that this requires CEO level attention. For an example of an excellent response from one of our portfolio companies, her...

So yesterday the Feds busted the guy behind Silk Road, the marketplace for drugs and other illegal things paid in bitcoin. The indictment reads like a screenplay for a movie or Breaking Bad style television series (not that I watched Breaking Bad, just basing this on the inevitable flurry of tweets about it that I had in my stream). There should be one key takeaway here: law enforcement is easier online, not harder as government would generally have us believe. It is basically impossible to o...

A few days ago I wrote about my support of the defense fund for Barrett Brown. One of the reasons regulators and legislators seem to think we need such over the top draconian sentences is because we have the wrong security model for payments in particular and authentication more generally. Information will continue to leak – that is it’s nature. It should not be possible for me to transact in your account simply by having information on your account. Instead we need to broadly embrace two fac...

Last week in Tech Tuesday I asked for topics to write about in my series on technology in startups. There seemed to be a fair bit of interest in security, so here we go. First off a disclaimer. As with any general purpose advice, you need to think a lot about what it is you are trying to do. The security requirements for a bitcoin startup are vastly different from those for a social media one. When you are just getting going you should treat security the same way as scalability: make sure you...

I was planning to write more on cyber security but then yesterday I read this harrowing letter from a prisoner at Guantanamo Bay (Gitmo). I don’t take his claims about his lack of involvement at face value. It is irrelevant. He has been held for a shocking 11 years and 3 months without a trial. That goes against everything we as a country should stand for. I wrote in 2010 that “I wish we had the courage to go ahead with a shutdown of Guantanamo, even if that results in releasing people who wi...

I have written previously about cyber security and cyber defense topics that have become more acute in the wake of several large scale attacks on banks and other companies. Unfortunately, law makers in DC are reacting the only way they seem to know how: by further broadening laws that are already overreaching and yet ineffective at the same time. In particular the House Judiciary committee is proposing changes to make the Computer Fraud and Abuse Act (CFAA) even more draconian. As a quick rem...

Securing your site or service has become ever more important as the number of attacks is rapidly on the rise. As I have written before on Continuations I am not a fan of overreaching security legislation as a response. If we don’t want to keep these efforts at bay it will help if we do a better job with security. Increasingly that means you are only as secure as some of your key vendors. In particular hosted email and DNS have proven to be big holes. If you use hosted email make sure that it ...