Don't trust SSL certificates, says US cybersecurity adviser
Former White House cybersecurity chief views Anonymous 'more positively than most people'
By Ellen Messmer | Network World US | Published: 14:51, 20 September 2011
Former White House cybersecurity adviser Richard Clarke views hacktivist group Anonymous "more positively than most people", and insists that digital SSL certificates cannot be trusted.
The 60-year-old, who served for 19 years in the Pentagon, intelligence community and State Department, was a special adviser to President George W Bush on cybersecurity, having been appointed a counter-terrorism expert by President George H W Bush and President Bill Clinton.
Clarke said: "I think of Anonymous more positvely than most people, although I cannot endorse their breaking the law. They're not trying to steal intellectual property to give it to the competition - a lot of what is going on in the world is about that.
Related Articles on Techworld
"But a lot of what Anonymous is doing is highlighting vulnerabilities we see in the enterprise. But I'd just like to see this done legally. I'm not condoning law-breaking."
The ABC News commentator is also concerned about the threat to security companies after the compromise of SSL server certificate providers Comodo and DigiNotar.
"My take is that you can't trust digital certificates," he said. "And it's a turning point not just for digital certificates.
"In the attack on RSA, hackers are now going after two-factor authentication. Then they went after the defence companies, after having broken into a security company. That's a game-changer. I'm not going to bust into RSA, I'm going to bust into Lockheed. RSA says you can continue to have confidence in two-factor authentication. But how much confidence?
"Are you really going to rely on them? I wouldn't be happy relying on RSA two-factor authentication or an SSL certificate solution."
