full-disclosure - Can ISO15408 evaluated products be trusted?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Sat May 21 14:36:35 2005
From: nora15408 at yahoo.com (Nora Barrera)
Subject: Can ISO15408 evaluated products be trusted? 

--- Valdis.Kletnieks@...edu wrote:

> Ask the vendor for a copy of the evaluation report. 

But those reports do not contain any valuable
information for me. What kind of tests were done? How?
It looks like security by obscurity.

> Note that the EAL and PP interact - a CAPP
> (Controlled Access) evaluated at EAL4
> may actually provide less *real* protection than an
> LSPP (Labeled System) evaluated
> to EAL3 - the EAL4 just means they've done more work
> to prove the *provided* security works as
advertised.

What's the use of security functions if they can be
circumvented?

Yahoo! Mail
Stay connected, organized, and protected. Take the tour:
http://tour.mail.yahoo.com/mailtour.html