The Emacs Network Security Manager

Emacs 25 will have a network security manager. You know — the thing that nags you when you visit https pages with invalid certificates and annoys all y’all so much.

firefox
The Firefox security manager

Yay.

Designing a thing like that is a minefield. On one hand, you have professional security professionals who seem to insist that the sky is constantly falling and that the only secure thing one can do is to snip the Ethernet cable, pour concrete over the computer and then bury it in a volcano.

On the other hand, you have, literally, everybody else: People who don’t care about network security at all, and if you so much as ask them a simple question once, they get mad and send you email about how mad this makes them.

So! Into the breach.

The network security manager in Emacs 25 (merged into trunk last week and switched on today) checks certificate validity, STARTTLS downgrade attacks, unencrypted sending of passwords via IMAP, POP3 and SMTP, and does certificate/public key pinning for self-signed certificates.

nsm
The Emacs Network Security Manager

If you’re paranoid, you can make it do certificate pinning for validated certificates, too, so that you can see when the NSA man-in-the-middles your traffic by getting a Certificate Authority to issue a forged certificate for the domains you are visiting. That’s not on by default, because we are not paranoid.

It allows you to save all these “security exceptions” for the session or permanently. And that’s where the professional security professionals will balk.

The argument is that if we allow the user to accept unverified connections, there is no security, because users always just says “yes” to everything. While that argument may be valid, the other side of the coin is that failing to communicate can also have negative ramifications.

Only the user can really say whether visiting a web site that has a problematic certificate is justified or not. When visiting an email archive to find the answer to a technical question — perhaps it is. When visiting your bank — probably not.

So: I hope that the network security manager we’ve implemented is sufficiently non-intrusive that people won’t feel it necessary to switch it off, and I hope that it’s encompassing enough that it offers some added security against snooping.

If you want to start using it now, pull down the development version of Emacs.

Making SVG images in Emacs

While working on the Emacs Network Security Manager, it was suggested that Emacs implement a visual hash for certificates.  It turned out to be a not-unproblematic idea, so I didn’t do that, but by then I had already written an SVG library.

While staring at it, it occurred to me that it would be kinda neat if the image created would update in real-time.

So I did that.

I think this library will probably end up on GNU ELPA.

Today’s Best Email Confidentiality Signature

Isn’t it fascinating that people thing they can send you things and attach a “confidentiality signature”, and that supposed to be binding for the recipient?

Fascinating, but deeply deluded.

NOTICE OF CONFIDENTIALITY: The information contained in or attached to
this email is private and confidential, is protected from disclosure
and is intended only for the person to whom it is addressed. Review,
reproduction, or use of this information by unintended or unauthorized
recipients is prohibited. If you have received this email in error,
please notify the sender, delete it from any and all your computer
systems, and do not read, retransmit, retain, print, publish,
distribute, disclose or copy this information, or take any action in
reliance thereon. This also means that it's expected that the content
of this message will not be shared with others without the consent of
the sender.

Make Free Money Now

I was rooting through the Cupboard Of Mysterious Odds’n’Ends a month back, and I found a major stash of pre-Euro money.  It must have been in there for years and IMG_0342years.  I vaguely remember thinking that I should, perhaps, bring it with me to an airport sometime to put into those “spare change” charity things, but I forgot, of course.

I thought the notes were worthless by now, but I binged about a bit, and it turns out that they’re not really.  There are several businesses that exchange them still.  Nothing in Norway, but lots in the UK.  I selected Leftover Currency, because nothing says “trustworthy bankers” more than green text on a black background.  I put the money into an envelope with instructions to deposit the money into my Paypal account, and sent it off to the UK.

Putting cash into an envelope felt very old skool.  If it’s lost, it’s lost.  On the other hand, I didn’t know that I had the money, anyway, so if it’s lost, it’s lost.

But behold!

DSC00982Money!  For me!  Haha!!!

I’m guessing the rates they’re giving me leaves them a healthy profit margin, but that’s fine.

(This has not been a paid advertisment.  Or has it?  I mean, they gave me money, and now I’m flogging their URL.  Hm…)