Andy Cunningham

Overheard at a US airport:

“Excuse me, sir,” said the TSA officer, pointing to the young female, “She does not need to have her ID out, she’s a minor.”

Dad: “How do you know she’s a minor if you don’t look at her ID?”

Meanwhile, Adam Laurie (of hotel safe cracking fame) has proven the new UK ID cards to be a waste of time and tax payers money…

I love working in security.  Being good is so easy when there’s this much crap around.

Computer Security, my professional field, has hit the headlines over the last few weeks.  The loss of 25 million bank records by the British government is remarkable for the scale of the loss, and the ease with which it happened.  But I think the importance of is has been driven (no pun intended) home by Top Gear presenter Jeremy Clarkson.

Clarkson, in his usual tactful style, commented that he couldn’t see what the fuss was about, and published his own bank account details in the newspaper.  Details here.

Predictably someone used them to create a direct debit from his account – to a charity, rather than themselves.

An interesting point here is that the bank clearly acted upon instructions other than those of the account holder, which me wonder how carefully banks check things like Direct Debit mandates.  Not very, I suspect.  Will they cough up the money that was stolen as a result of them acting on false instructions, or will they blame Clarkson for being a loudmouth?

The good thing to come out of this, hopefully, is people realising how serious this is!

I just received an email, the subject line of which started with “DO NOT DELEAT”.  It went on to make a bunch of wild security claims about a product (there’s no 100% security, ever), and mis-spelled the name of my employer (it’s only three letters, surely getting them in the right order isn’t that hard).

I  deleated it.  Right after I added them to my “try not to buy from this company” list.

This YouTube Video is scary.60 seconds to get into a hotel safe.

Wednesday night’s BBC TV featured a documentary on the subject of ID theft, and is scary even to someone who works in the security business.

Most ID theft is worryingly low-tech. Scan someone’s rubbish for a couple of utility bills and a bank statement and you’ve got enough proof of your ID to get a loan on a £12,000 car. Credit Card mag stripe writing is a minimal investment. And, at the higher end, scanning wireless networks and installing malware on PCs is a great way to catch all the information you want.

Be careful out there, folks. Specifically,

• Don’t let bars keep your credit card behind the bar if you’re running a tab. How can you trust them to not spit in your dinner if they won’t trust you to pay the bill without running for it?
• Shredanything with any financial information on it. A single credit card receipt can have the card number and your signature. That’s all a criminal with an accomplice needs.
• Complain at stores that double-swipe cards. Petrol stations are a favourite culprit for this – or used to be. If they’ve done the chip and pin bit, that’s all they need. I’m going to start telling stores that swipe my card twice that I’m calling the police.
• Watch out for ATM machines. I’m going to start being more careful about using non-local machines and try to use the one down the road as much as possible.

It’s a sad state of affairs when airline staff think it’s OK to lie to passengers to enforce a security rule that barely makes sense in the first place.

Meanwhile, this announcement “This is the captain speaking”, definitely comes under the heading of stories where no-one will ever find out the truth. Was he just bored with working his notice, or was there really a problem?

LeftLaneNews has an interesting article on using laptops to defeat security on modern vehicles.