2016-002-Cryptonite-- or how to not have your apps turn to crap

This week, we find ourselves understanding the #Cryptonite that can weaken devs and software creators when dealing with #cryptographic #algorithms and #passwords. Lack of proper crypto controls and hardcoded passwords can quickly turn your app into crap.

Remember the last time you heard about a hardcoded #SSH private key, or have you been at work when a developer left the #API keys in his #github #repo?

We go through some gotchas from the excellent book "24 Deadly Sins of Software Security". Anyone doing a threat analysis, or code audit needs to check for these things to ensure you don't end up in the news with a hardcoded password in your home router firmware, like these guys: https://securityledger.com/2015/08/hardcoded-firmware-password-sinks-home-routers/

Book:

http://www.amazon.com/Deadly-Sins-Software-Security-Programming/dp/0071626751

Show Notes:

https://docs.google.com/document/d/1MUPj8CCzDodik61_1K8lCKywkv0JbfBkve20rxwbmzE/edit?usp=sharing

*NEW* we are on Stitcher!: http://www.stitcher.com/s?fid=80546&refid=stpr

TuneIn Radio App: http://tunein.com/r…/Brakeing-Down-Security-Podcast-p801582/

BrakeSec Podcast Twitter: http://www.twitter.com/brakesec

Bryan's Twitter: http://www.twitter.com/bryanbrake

Brian's Twitter: http://www.twitter.com/boettcherpwned

Join our Patreon!: https://www.patreon.com/bds_podcast

RSS FEED: http://www.brakeingsecurity.com/rss

Comments, Questions, Feedback: bds.podcast@gmail.com

Direct Download: http://traffic.libsyn.com/brakeingsecurity/2016-002-Cryptonite.mp3

iTunes: https://itunes.apple.com/us/podcast/2016-002-cryptonite-or-how/id799131292?i=360440391&mt=2

#11: Well, it's an audio thing...

We recorded our first episode yesterday, and I thought it went great, however, there is a small issue with the audio.  I failed to change the switch on the back of the Snowball Microphone to setting '3', which makes the mic take audio from both the front and the back. So my co-host sounds great, as he was in the 'front', but I sound like I'm 10 feet away.

We aren't audio engineers... if we were, we would not be doing security. So I get to add to my repertoire of vast and varied skills.  One of these days, we'll be doing video editing for technical segments...  I can only imagine how that's going to do.

Also, there was some content issues we'd like to address as well.  Our first podcast is on the subject of Hashes, what they are, how they are used, and we even talked about how to make them more difficult to find any info from them (e.g. passwords, PII, etc).  We talked about collisions, hash stretching, and adding salt to make them resistant to rainbow tables.

So my colleague will listen to it, and if he is okay with it, I'll post it on Monday. Don't expect a ton of production values, Probably intro and outro music.  And we probably won't have our first interview for a couple of weeks.

If you are interested in doing a 10-20 minute interview about a security topic near and dear to your heart, please let me know.  Twitter is probably the best way.  I can be found @bryanbrake, or you can message me on LinkedIn.

This blog will still be used to put up the show notes, which will have links to information that we talked about. We will try to find real info, and not just a ton of Wikipedia articles. :)  Also, we will use this for additional opinion articles that could be podcast episodes later on...

Have a great weekend, or hope you had a good one (depending on when you read this)...