PKI - invalid policy

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Moving Certificate Services Hello I have an issue where i need to move my Certificate Services to another computer as the one that it is currently on is going to be de-commisioned / reinstalled. I can only find information on the moving of the certificates when keeping the same server name as the one that is curently there. Unfortunately, i do not have this. I am moving from SERVER01 to SERVER02 SERVER02 needs to remain named this for other purposes and SERVER01 is going to be renamed SERVER03 and going to be in another physical location with a different operating system installed. Can anyone point me in the direction of a useful document etc for this Regards Gareth Collins Tag: PKI - invalid policy Tag: 92975
  - 2
    - is this Hexi-, Deci- or IS4v adresses http://0000000000330.211 I have received several email messages (showing free (gmail) return addresses). I got no response from the OL group. They have an odd looking http address in the body of the email. I do not click on such things, But I actually do not know what this kind of link is, or what it might do. There are a couple of variations, such as this: <A href="http://0000000000330.211.0x0000000009E. 000000000000000000174"> or <a href="http:// 0x00000000000D8.00000000000323.0x000000000000000000000009E. 124"> or <a href="http://0000000000330.211.0x0000000009E. 000000000000000000174"> It looks like a loopback, a physical memory address, or some port, an executable. Or is this Hexi-, Deci- X n base IP address. I am not sure where else to post this type of question. Thanks for your assistance. -- Respectfully, Roger Howland RogerH@theJobDr.com.(noSPAM) Tag: PKI - invalid policy Tag: 92962
  - 3
    - How to have system service to access network I have a VB app that i runs from a LocalSystem service with CreateProcessAsUser: The app gets the token of the service so it runs under LocalSystem too. When i call in my app that as said run from the Localsystem service to: WNetAddConnection2, i get error 1312 (ERROR_NO_SUCH_LOGON_SESSION) In my opinion since a LocalSystem service does not have access to network. Can i make the app that run from the LocalSystem service to access Network so that WNetAddConnection2 will work? I run it on XP pro and Vista - same problem. (The app and The service must keep running under LocalSystem - i do not want to change that) Thanks! Tag: PKI - invalid policy Tag: 92961
  - 4
    - Disable Proxy settings in Internet explorer through Group Policies I would like to know if there is a setting within Group policy that will allow me to disable the LAN settings so users cannot change our proxy server in order to bypass. Any help would be great! Thanks! Tag: PKI - invalid policy Tag: 92955
  - 5
    - Infection via Website There's a website I know of... as soon as you visit it, your anti- virus (AVG in my case) starts setting off warnings. The site is clearly trying to install spyware/viruses (apparently it is well known for doing this). As someone studying to become an MCSE I am curious in the specifics of how the site is trying to infect computers. IE: is it using java to do this? Active x? applets? scripts? I know it manages to get a few files onto my harddrive (the files being on my harddrive are what actually triggers the AVG warnings). How does it activate those files and get them running in memory/startup? Can Active X/Java/etc/etc make changes to your registry? Do you fully need to turn off these IE settings to be truly safe? etc etc... If anyone could give me some very basic info, or point me to some good (brief & to the point) links, it would be much appeciated. Thanks in advance Tag: PKI - invalid policy Tag: 92953
  - 6
    - DRA certificate on smartcard - vista I configured a gpo to allow efs exclusively with smartcards on a vista box in a windows 2003 domain with a single domain running win2k3 sp1. The DRA is also using an EFS recovery certificate that is on a smartcard. I use the same box both for the user encrypting the file and the DRA trying to recover/restore the file. When I try recovering the file with the DRA designated user I'm prompted to insert a smartcard but when I inset the DRA smartcard I get a error message stating that the "wrong card is inserted." When I insert the user's card everything works fine. Checking the file encryption properties lists the designated DRA certificate as the recovery certificate (certificate thumbprint) as detailed in the appropriate admx file Any Ideas? -- Yariv Bashan MSecurity Tag: PKI - invalid policy Tag: 92952
  - 7
    - Password Protect Hard Drives Hi, last year i was doing something and i somehow managed to put a password on each of my installed hard drives and every time i wanted to access one it would ask me for a password before opening the drive. it was perfect but at the time i didn't really have a use for it. i do now but i don't have a clue now how i did it. i'm wondering if anyone knows what i'm referring to and where i may get information on how to do this again. what's happening now is i am sharing my wireless router and users are able to see my files because i myself share between my laptop and desktop and i want to prevent others from being able to access my files without killing their connection to the internet. thanks everyone. eric6556 Tag: PKI - invalid policy Tag: 92949
  - 8
    - 560 Errors I've applied a GPO with locked down NTFS permissions. I'm receiving 560 failure log events on numerous .dll files located in the Windows\System32 folder. I grant full access to the accounts having problems (network service, local service, and domain service account) and verify through the effective permissions tab that the accounts have full access to the dlls. I keep receiving the 560 errors, but it appears my application (WSS 3.0) works properly despite the dozens of 560 object access errors. Am I missing something? Tag: PKI - invalid policy Tag: 92946
  - 9
    - AVS and Firefox in hidden mode? A scan with Gmer last version of a machine running genuine Windows XP Home Edition with SP2 installed showed two ***hidden*** processes belonging to Active Virus Shield and Firefox. Here are the pictures: http://img363.imageshack.us/img363/3492/gmer01lg8.jpg http://img117.imageshack.us/img117/7841/gmer02ib2.jpg Is that normal or should we worry? Thank you very much. Giulio - Rome Tag: PKI - invalid policy Tag: 92943
  - 10
    - set permission for shared folders Hi all, I tried to set up a shared folders to our office network. I want to set permission for shared folders. But I can only set up access password to the individual files, not a wholed folder. can anyone help with setting up a permission to whole folder? Tag: PKI - invalid policy Tag: 92941
  - 11
    - It is not advertising spam! PrivacySafer 2007 message is not advertising spam. We only want to let more people use it and keep data security for more people. Deter malewares to steal people's private data. Please understand. Thanks. If more people like it, please tell me. Thanks. Tag: PKI - invalid policy Tag: 92928
  - 12
    - PrivacySafer 2007 Released - Manage your all passwords and protect your privacy in secure way! Hello all, PrivacySafer 2007 can manage your all passwords(Windows network logon, your e-mail account, your homepage's ftp password, online passwords, your bank account, etc. etc. etc.) in a secure way and protect your private data(bussiness docment, personal photos, secrets etc) and deter malewares(keylogger, Trojans etc). Main features: - Strong Security - Multiple User Keys - Portable and runs on all windows system - Easy Database Transfer - Support of Password Groups - Time Fields and Entry Attachments - Auto-Type, Auto-login into your app(game,email,ftp etc), Global Auto-Type Hot Key and Drag&Drop - Intuitive and Secure Windows Clipboard Handling - Searching and Sorting - Strong Random Password Generator - Creates a virtual encrypted disk and protect your privacy - Encryption is automatic, real-time (on-the-fly) and transparent. Download PrivacySafer 2007 from http://sebsolution.com/yhlsecure/download.htm Enjoy Jeff Tag: PKI - invalid policy Tag: 92924
  - 13
    - Options for Deploying Root and Int Certs to clients not part of do What are the options for for deploying root and int ca certs to clients that are not part of your domain? For the clients that are part of the domain, do the root and int ca certs automatically get deployed once you setup the certificate services infrastructure? Thanks in advance Tag: PKI - invalid policy Tag: 92919
  - 14
    - Locking out a specific user from a specific client Hi hope someone can help. I am trying to prevent a domain user account from logging in to a specific client workstation. any help on this would be most appreciated. Tag: PKI - invalid policy Tag: 92909
  - 15
    - Wireless Security (WZC) Dear all, Anyone knows if there are any updates to the way WZC works. This post dated 2005, and i tested some of them but it does stands. http://www.microsoft.com/technet/community/columns/cableguy/cg1102.mspx "How Wireless Auto Configuration Works For the initial scan of available networks, Wireless Auto Configuration performs the following process: 1. Wireless Auto Configuration attempts to connect to the preferred networks that appear in the list of available networks in the preferred networks preference order, if the preferred networks are configured to automatically connect (the Connect when this network is within range checkbox is selected on the Connection tab for the properties of the preferred wireless network). 2. If there are no successful connections, Wireless Auto Configuration attempts to connect to the preferred networks that do not appear in the list of available networks, in the preferred networks preference order. This is done so that a Windows wireless client can connect to a hidden wireless network, one that is either not broadcasting its SSID or broadcasting an SSID of NULL. Configuring hidden wireless networks is used as a security measure to prevent malicious users from detecting and attempting a connection to a wireless network. However, the SSID is included in other types of wireless connection management frames and is easily discoverable by either capturing wireless management frames or using tools available on the Internet. 3. If there are no successful connections and there is an ad hoc network in the list of preferred networks that is available, Wireless Auto Configuration tries to connect to it. 4. If there are no successful connections and there is an ad hoc network in the list of preferred networks that is not available, Wireless Auto Configuration configures the wireless network adapter to act as the first node in the ad hoc network. 5. If there are no successful connections to preferred networks and there are no ad hoc networks in the list of preferred networks, Wireless Auto Configuration checks the Automatically connect to non-preferred networks setting. 6. If Automatically connect to non-preferred networks is enabled, Wireless Auto Configuration attempts to connect to the available networks the order in which the wireless adapter sensed them. 7. If all connection attempts to non-preferred networks fail or if Automatically connect to non-preferred networks is disabled, Wireless Auto Configuration creates a random wireless network name and places the wireless network adapter in infrastructure mode. After this, the wireless adapter is not connected to any wireless network but continues to scan for preferred wireless networks every 60 seconds. This behavior prevents the Windows wireless client from accidentally connecting to a wireless network that does not appear in the list of preferred networks. You are then prompted with the "One or more wireless networks are available" message in the notification area." Your help is appreciated Tag: PKI - invalid policy Tag: 92907
  - 16
    - history.... I have a similar question because i know i used to be able to go into windows explorer and see all the files and folders and see all the history of where everyone was.....i am having a similar problem and would like to find out why i cant open the history folder from in there????? please help i cant afford a pro right at this point but i do need to know what these kids are doing since summer is coming soon! Tag: PKI - invalid policy Tag: 92904
  - 17
    - block Proxy servers Hello all. I have a question about security. Kids are connecting to myspace, aim express and other similar chat web base chats. Is there a way to block this web-based aplications? I know my niece uses proxy servers like www.proxysf.com to get access and connect to myspace. I just don't want to hear an answer like. Take the computer away from her room, more discipline, or sit and talk to her. Done it all. botton line is we want to block access to all those web-base programs. i already use the Host file but doesn't work all the time. I though she wouldn't have access to aim express since I entered in the Host file, but she still get connected. Any advise pls. Thank you. Tag: PKI - invalid policy Tag: 92902
  - 18
    - Certificate chain Hello I have one problem with certificate chain in my windows CA setup. I have Windows Server 2003 R2 as offline standalone root CA. That CA has self signet certificate. Then I installed subordinate enterprise CA on Windows Server 2003 R2. I copyed request to root CA and then exported certificate for subordinate CA from root CA. After that I made request on IIS for certificate. So now I have Root certificate - Subordinate certificate - Web certificate in chain. And I use last certificate to secure access to IIS. But when user access site from outside and check certificate chain it goes only up to Subordinate certificate. Is that normal? Miha Tag: PKI - invalid policy Tag: 92895
  - 19
    - MS Update Schedule Does anyone know what Microsoft's schedule is for releasing updates? I know that the security updates are released once a month at 10 AM PST. Do they hold all security updates until the release day (and time) or are there times when they are released outside of the schedule? What about critical updates? I'm assuming that they are released as soon as possible but I wanted to make sure. Thanks, Suzie Tag: PKI - invalid policy Tag: 92891
  - 20
    - Smartcard retire policy workflow Any ideas on how to bulid/configure a smartcard retire policy workflow where the actual smartcard retirement is not done (executed) by the end user (smartcard owner) but rather by a designated entity (helpdesk or RA for example Thanks -- Yariv Bashan MSecurity Tag: PKI - invalid policy Tag: 92890
  - 21
    - windows shared computer toolkit I am planning to install this on our public computers. Question can you have it leave the admin account free to alter as desired, update, save doc, etc? Thank you Tag: PKI - invalid policy Tag: 92886
  - 22
    - Folder permissions It has been a long time since I have had to change permissions and I admit I am a little rusty but, I have a shared folder on my server. Every folder has permissions assigned to it. I am seeing an increasing amount of users accidently grabbing and draging the folder into the folder above or below. What kind of permissions could I use that would prohibit this?? Thanks -- Mark Tag: PKI - invalid policy Tag: 92885
  - 23
    - SMB Shares Dangerous? Appologies for the x-posting but I posted this at microsoft.public.win2000.security and got no response so hoping for a better response here. :) -- A number of our employees access our windows servers using either mapped drives or UNC paths with vpn. I am somewhat concerned that accessing our servers this way may pose a security risk as a number of viruses proliferate through network shares. The shares are password protected so users do have to authenticate to access them but as far as I know once they have authenticated, their credentials are cached for a period of time. Also with mapped drives in particular I believe login information is saved permanently. I'm wondering what others thoughts are on this matter and if anyone can point me to any articles that confirm or deny the risk (or lack there of) for using mapped drives and/or UNC paths. Finally if there is a risk, are there other alternatives? Thanks Brad Tag: PKI - invalid policy Tag: 92883
  - 24
    - Execute File Auditing on a File Share Greetings! I have a situation in which I would like to audit the execute file object access type on files within a file share as opposed to a directory on the local server. I have enabled the 'Audit Object Access' policy on both the host and client machines and have set the Audit permissions on the directory. I am able to view the audit permissions from either the host or client successfully. However, when accessing files within the directory the audit events do not show up in the Event Viewer for either the host or client. Is it even possible to audit file access events over file shares? Thank you, Ryan Tag: PKI - invalid policy Tag: 92876
  - 25
    - General Recommendations I am wondering if anyone can share their experiences or recommendations for accomadating developers on a production network with security in mind. Basically they want to run SQL and IIS on their workstations with default installations. They have full admin on their workstations. This of course makes the security admins nervous but what are the options. Tag: PKI - invalid policy Tag: 92867
- Next
  - 1
    - How to Prevent Users from Moving Folders Windows Server 2003. I have a shared folder set up so that certain users can only read and create files. They cannot delete or rename files within this folder. However, they can move entire subfolders out of this folder (which has happened by mistake). How can I set access privileges to prohibit a user from moving files and/or folders out of a shared folder? -- Dr. Doug Pruiett Good News Jail & Prison Ministry www.goodnewsjail.org Tag: PKI - invalid policy Tag: 92863
  - 2
    - Permission is missing after 2-3 days I'm try to give permission for userA to access folder in c:\Program Files\AirPlusXXX\DB But after 2-3 day that user can't access to c:\Program Files\AirPlusXXX\DB, I'm check permission on this folder but userA is disapper ? Any body know how to solved problem. Tag: PKI - invalid policy Tag: 92852
  - 3
    - How do I destroy hardrives if "not me" trys access? Its not that important...but i'm curious..would like to hear some serious ideas on hard drive destruction if someone other than yourself accesses your PC. I thought of acid but that would be pretty complicated and wiping with the Peter Gutman algorythm takes too long... even on a SATA RAID0 10,000 RPR array. I want an immediate wipeout..like fire...based on a wrong password? Common guys.. you know what im talkin about.. Tag: PKI - invalid policy Tag: 92851
  - 4
    - I hear there is a new internet in the works? Whats that about? Is this form of internet really that bad? Any comments please... Tag: PKI - invalid policy Tag: 92848
  - 5
    - Mail authentication I received a mail following mail. Can I believe this? Is it from microsoft? Microsoft Award Team 20 Craven Park, Harlesden London NW10 United Kingdom Ref: BTD/123/05 Batch: 401238E Dear Winner, The prestigious Microsoft and aol has set out and sucessfully organised a Sweepstakes marking 2007 anniversary we rolled out over Â£5,000.000.00 (Five million Great Britain Pounds) for our year Anniversary Draws. Participants for the draws were randomly selected and drawn from a wide range of web hosts which we enjoy their patronage. The selection was made through a computer draw system attaching personalised email addresses to ticket numbers. If you ignore this, you will regret it later. Microsoft and AOL are now the largest Internet companies and in an effort to make sure that Internet Explorer remains the most widely used program, Microsoft and AOL are running an e-mail beta test. Your email address as indicated was drawn and attached to ticket number 008712345678 with serial numbers BTD/1234648302/06 and drew the lucky, numbers 11-21-23-39-41-47(10) which subsequently won you Â£500,000.00 (Five Hundred Thousand Great B ritain Pounds) as one of the 10 jackpot winners in this draw. You have therefore won the entire winning sum of Â£500,000.00 (Five Hundred Thousand Great Britain Pounds). The draws registered as Draw number one was conducted in Brockley, London United Kingdom on the 11th April 2007. These Draws are commemorative and as such special. Please be informed by this winning notification,to file your claims,you are to make contact with your designated agent who shall by duty guide you through the process to facilitate the release of your prize.To file for your claim Please Contact your fiduciary agent, Mr.Fredrick Holifield Microsoft Promotion Award Team Email: fre.holifield@hotmail.com You are advised to contact your fiduciary agent with the following details to avoid unnecessary delays and complications: Your Name (in Full), Country, Ticket Numbers, Batch Number, Serial Number,Lucky Numbers as indicated in this winning Notification and Phone numbers.Thank you for being part of this promotional award program. Our special thanks and gratitude to Bill Gates and his associates.We wish you the best of luck as you spend your good fortune.Thank you for being part of our commemorative year Anniversary Draws. Sincerely, Dr. Steve Jordan Microsoft Promotion Team -- Satendra Tag: PKI - invalid policy Tag: 92837
  - 6
    - bios locked up Hello, I have recently purchased an acer travelmate 2200 and it was working fine. I was using the internet when it entered hibernation mode. After turning it on after plugging it in to the mains adapter, it went to the bios password screen. I tried to enter my password, which i know, but i cannot type in the password box, reguardless of which keys i press, no characters appear in the box. Also, the keyboard functions such as; turning the moniter off still works, implying that the keyboard is still functioning correctly. Any ideas on how to bypass this or get it to work would be much appreciated ASAP as i need to be finishing AS coursework. If you suggest anything to do with cmos battery, please indicate its location. Thanks in advance Tag: PKI - invalid policy Tag: 92832
  - 7
    - AVG and text clipboard My AVG displays a little yellow popup whenever I copy some text to the clipboard. Can I turn that off? It just says "10 of 24 - Clipboard item collected" etc. This only started today. Tag: PKI - invalid policy Tag: 92828
  - 8
    - Look at the contents of a smart card? Is it possible to see what information is stored on a smart card? I got a couple of cards in my wallet that I want to take a look at. I looked at the api provided from winscard.dll but I can't find a function that could retrieve all the information. I have one card that has some kind of Java Cyberflex thing on it. Does that technology make it different to read information from that card? Tag: PKI - invalid policy Tag: 92827
  - 9
    - User is automatically locked out the user gets automatically locked out of a/d. have tried removing it from the domain and adding it back but that did not resolve it. if another user logs in on this laptop it doesn't do it to them. user does not want me to delete her profile and recreate it Tag: PKI - invalid policy Tag: 92823
  - 10
    - Digital certificate in outlook In outlook when I click on Tools Options Security and select my own certificate there is a reigstry entry in the registry at the following path HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion \Windows Messaging Subsystem\Profiles\Outlook\c02ebc5353d9cd11975200aa004ae40e In here there is a value 11020355 which contains some binary data. Now if I want to automate this process in an .exe and in my c++ code I want to associate the certificate that I have created with outlook email client is this possible? Are there any APIS or any way that I can do this? Thank you. Tag: PKI - invalid policy Tag: 92822
  - 11
    - Digital certificate in outlook In outlook when I click on Tools Options Security and select my own certificate there is a reigstry entry in the registry at the following path HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion \Windows Messaging Subsystem\Profiles\Outlook\c02ebc5353d9cd11975200aa004ae40e In here there is a value 11020355 which contains some binary data. Now if I want to automate this process in an .exe and in my c++ code I want to associate the certificate that I have created with outlook email client is this possible? Are there any APIS or any way that I can do this? Thank you. Tag: PKI - invalid policy Tag: 92821
  - 12
    - Creating local user account from ASP.NET (C#) Hi, I need to create local user accounts in windows (2000 or 2003) from an ASP.NET page. Our internal web server works with windows autentification and i am building a user manager page. It need to add, modifiy and disable account local to the machine. Can anyone put me on a track? Thank you Tag: PKI - invalid policy Tag: 92820
  - 13
    - MS VPN loses IP address and changes to 0.0.0.0 For Several months a windows XP machine has been connecting to a Windows 2003 server through the standard Microsoft VPN. Lately after connecting the IP address from the remote network changes to 0.0.0.0 and he can no longer work. Although I don't believe it's relevant he is working on a Sony laptop. Has anyone had this experience? We deleted the existing VPN client and re-created it. It worked for the afternoon and a portion of the next day. At this point I'm not sure if he is getting an address at all but the client says he is connected to the network. As an alternative is there another VPN client available from third parties which will hook directly into a Windows 2003 server rather than third-party hardware? Thanks in advance. -- SFeder Tag: PKI - invalid policy Tag: 92814
  - 14
    - cumulative permissions? Hello, I read from 2003R2 server help that NTFS permissions are cumulative. So does this mean that if user has a read access to a file via Domain Users Group (to which he is a member) and Full Controll because of Creator Owner rights (which he is) the result is that this user has full controll to the file? I've been testing this scenario and it happens that the user seems to have full controll while viewing Effective Access tab in the file properties but he cannot rename the file. There's no direct rights in the file. All access controll is inherited from parent folder. What am I missing here? Thanks -Will Tag: PKI - invalid policy Tag: 92813
  - 15
    - * FREE FLASH GAMES! * http://seo-optimizer.blogspot.com/ - Hours of fun gaming on the net, try not to game to much at work. :) Tag: PKI - invalid policy Tag: 92811
  - 16
    - What is registryclearxp? While fetching updates from Microsoft, I got a message that I had a serious error in my registry and had to go to www dot registryclearxp dot com (don't I think). Does anybody know what this is? It looks very suspicious to me. Thanks for any answer Anders Tag: PKI - invalid policy Tag: 92799
  - 17
    - Shared Folder Permission I have shared one folder and stored some xls files. Permission on the shared folder given as below; 1. Domain Users - Read-Only 2. Administrators - Ful Control I want the domain users not to copy the files from the shared folder to any where. How do I restrict? Any help would be greatly appreciated. Shanthi Tag: PKI - invalid policy Tag: 92796
  - 18
    - create my own forum free? Free Unlimited Storage Free Unlimited Bandwidth Free Free Subdomain Free More Skins Free No annoying pop-ups Free 99% Uptime Free Daily Backups Free Fast, Friendly Tech Support So,what's that? That's our free forum named http://support.forumgogo.com. We have the human_based management also provide you human_based forum service. You needn't,we won't ! This is a great site that is completely free, and can make some cool forums, here's an example of one, you can make your own topic, polls, and replies etc, and you can have an accout for every member. This next link is an example of a forum made from invisionfree. http://support.forumgogo.com Tag: PKI - invalid policy Tag: 92793
  - 19
    - "Copyrighting" photos online I would like to post photos to a website, however, when people right click on them, I want it to be able to say something like, "this photo is copyrighted" or "you can't copy this" etc; How do I go about doing this please - and at what point of the upload of photo? Thank you in advance. Tag: PKI - invalid policy Tag: 92787
  - 20
    - Bad security wins out? Excerpts from http://www.wired.com/politics/security/commentary/securitymatters/2007/04/securitymatters_0419 (Bruce Schneier)---Why are there so many bad security products out there? Why do mediocre security products beat the good ones in the marketplace? Economist George Akerlof wrote a paper called The Market for Lemons, which established asymmetrical information theory. He won a Nobel Prize for his work, which looks at markets where the seller knows a lot more about the product than the buyer. Akerlof illustrated his ideas with a used car market. A used car market includes both good cars and lousy ones (lemons). The seller knows which is which, but the buyer can't tell the difference, at least until he's made his purchase. What ends up happening is that the buyer bases his purchase price on the value of a used car of average quality. This means that the best cars don't get sold - their prices are too high. Which means that the owners of these best cars don't put their cars on the market. And then this starts spiraling. The removal of the good cars from the market reduces the average price buyers are willing to pay, and then the very good cars no longer sell, and disappear from the market. And then the good cars, and so on until only the lemons are left. In a market where the seller has more information about the product than the buyer, bad products can drive the good ones out of the market. The computer security market has a lot of the same characteristics of Akerlof's lemons market. Good security design takes time, and necessarily means limiting functionality. Good security testing takes even more time. This means the less-secure product will be cheaper, sooner to market, and have more features. I see this kind of thing happening over and over in computer security. In the late 1980s, there were more than a hundred competing firewall products. The few that "won" weren't the most secure firewalls - they were the ones that were easy to set up, easy to use, and didn't annoy users too much. Because buyers couldn't base their buying decision on the relative security merits, they based them on these other criteria. Security testing is both expensive and slow, and it just isn't possible for an independent lab to test everything. A complex software product is very hard to test well. And, of course, by the time you have tested it, the vendor has a new version on the market. How do you solve this? You need what economists call a "signal," a way for buyers to tell the difference. Warrantees are a common signal. In reality, we have to rely on a variety of mediocre signals to differentiate the good security products from the bad. Reputation is a common signal - we choose security products based on the reputation of the company selling them, the reputation of some security wizard associated with them, magazine reviews, recommendations from colleagues, or general buzz in the media. All these signals have their problems. With so many mediocre security products on the market, and the difficulty of coming up with a strong quality signal, vendors don't have strong incentives to invest in developing good products. And the vendors that do tend to die a quiet and lonely death. -- The only reason some people get lost in thought is because it's unfamiliar territory. ...Paul Fix Tag: PKI - invalid policy Tag: 92786
  - 21
    - Internet Explorer 7 I recently upgraded to 7. Where do I locate the place to delete my cookies after doing financial transactions? Irene Tag: PKI - invalid policy Tag: 92783
  - 22
    - Why can't I post here? I have a troublesome security issue that doesn't seem to post, even though all the coorect steps seem to be followed. This is mostly a test. Thanks. Tag: PKI - invalid policy Tag: 92771
  - 23
    - What are "impersonate" keys I have an Averatec C3500 Tablet XP Pro computer that has a new hard drive and motherboard. It hasn't been on the Internet. I have installed Norton Internet Security from disk, and MSI Installer installer update (downloaded to another computer and installed from disk) that was necessary for that installation. Can anyone educate me as to the appearance of these keys in files called HIVESFT.INF and HIVESYS.INF? Thanks. From Hivesft.inf HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll","Impersonate",0x00010001,0 HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp","Impersonate",0x00010001,1 HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn","Impersonate",0x00010003,1 HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon","Impersonate",0x00010001,1 From HiveSys.inf HKLM,"SYSTEM\CurrentControlSet\Control\Lsa", "ImpersonatePrivilegeUpgradeToolHasRun", 0x00010003, 1 Thanks again. Tag: PKI - invalid policy Tag: 92770
  - 24
    - Lock Hard Drive Is there a way to lock the hard drive from downloads of any sort for the limited users and guest accounts? Our library has an old Gates donated computer that works that way and it never gets screwed up. The others are constantly needing maintenance due to downloads by patrons.The computers are all XP Home. Tag: PKI - invalid policy Tag: 92765
  - 25
    - Netscreen 25 L2TP I have read all the articles on the juniper site, and tried everything..... this is as close as I get..... I try connecting to my work from my XP SP2 computer (with the regedit in place) and on the Netscreen 25 I get this log... which means my computer is hitting the Netscreen, and almost making a connection....but then its being blocked. Rejected an IKE packet on ethernet3 from 209.**.**.**:***** to 216.***.***.**:*** with cookies *3*b*0*a*d*9*4*6 and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway. Can someone please help me with this!!! Juniper support has been less than helpfull, and Im on my 3rd ticket with them for the same issue..... It cant be this hard..... Thanks in advance for any help you bring! Hopefully this will help others as well Tag: PKI - invalid policy Tag: 92761

When I try to get a certificate I get the following error message:
The certificate has invalid policy. Error construction or publishing
certiviface invalid application policies: 1.3.6.1.4.1311.10.3.4

This happes with all of my certificates just different OIDs.

Thanks,
Ed

Top