New Software Secures Data when Owners Walk Away

Makarand writes "Leave an operating laptop unattended on your desk and your sensitive data is accessible to anyone who gets hold of it. To limit this risk many users configure their systems to fall into a "sleep" mode after a period of inactivity and ask for a password before the system can be awakened. This constant re-authentication proves to be a headache for many users. Now a Professor and his graduate student at at the University of Michigan have come up with a system called Zero-Interaction Authentication (ZIA), described in this article in The Age, to protect data on mobile devices. The system works by starting to encrypt data the moment the owner walks away from the system. The owners wear a token with a encrypted wireless link with the laptop. If the token moves out of range the ZIA re-encrypts all data within 5 seconds. If the cryptographic token moves within range the system decrypts the information for the owner. The token, which could take many forms, is currently a wristwatch with a processor running Linux designed by IBM."

Comments

Most Beloved Slashdot Members

[Anonymous Coward]

Rank | Real name | Occupation | /. nickname | # fans
1) Rob Malda - Slashdot founder - "CmdrTaco" - 975
2) Wil Wheaton - Actor/Activist - "CleverNickName" - 784
3) John Carmack - Programmer, id Software - "John Carmack" - 606
4) Eric Krout - Bucknell engineering major - "ekrout" - 522
5) Bruce Perens - Writer - "Bruce Perens" - 516
6) Josh Marotti - J2EE consultant - "FortKnox" - 381
7) Jeff Bates - Slashdot co-founder - "hemos" - 318

Please notify me of any corrections. Updates: Added Wil Wheaton per AC comment; Added Bruce Perens; Added John Carmack; Moved Eric Krout up one spot to #4 after overtaking Bruce Perens

As it stands, I'm more than halfway there toward gaining more fans than Rob "CmdrTaco" Malda. That would be a neat accomplishment and one that I'd be very proud of.

If I can come through (I was on sabatical for a week), I think it would only be proper for Rob to give me some leadership position here at Slashdot. Perhaps I could serve as a liaison between the members and the editors/coders to ensure that Slashdot continues to develop and "scale" with its increasing membership and database size.

Thanks for reading. I truly love you all and enjoy the time I spend here at Slashdot. If I can help any of you with anything (even non-Slashdot related), please let me know. I'm always there for friends (and fans ;-D).

Re:Most Beloved Slashdot Members

[Anonymous Coward]

hey, where's the list of the most hated slashdot members? my first guess is Klerck....

Does anyone even come close to him?

Re:Most Beloved Slashdot Members

[Anonymous Coward]

What the hell is up with old Klerck? I haven't seen him post since they stopped him from doing the page-widening posts.

Re:Most Beloved Slashdot Members

[Anonymous Coward]

and michael

Re:Most Beloved Slashdot Members

[Anonymous Coward]

Somebody must hate that ekrout person to try to make him look like such an idiot.

Re:Most Beloved Slashdot Members

[Anonymous Coward]

The Turd Report guy would have won had he kept up with his turd reports instead of taking up karma whoring.

The token communicates

[Anonymous Coward]

with the laptop via wireless 802.11b technology featuring the uncrackable WEP technology.

FP

[Anonymous Coward]

Fp on a dup story with a 2 min waiting time

Finally...

[Anonymous Coward]

The 21st-century catches up with laziness at last.

wouldn't it make more sense

[drDugan]

would it not be more sensible to make the token a passive device, like one with an RFID

I'm not an expert in encryption, but I have had serveral security related dongles and all of them were a pain in the arse.

it would seem that there are technologies (I've read about) that can return specific information passively when hit with specific radio frequencies. Wouldn't these be more easily used than a powered device like a watch?

Anyone else know more about these technologies?

Re:wouldn't it make more sense

[DoctorPhish]

I think the problem with rfids in a security environment is that anyone with a reader could query the device as you walked by, and would have your encryption keys (or token id, or whatever), and could probably reproduce them without too much grief...rf tags can't perform authentication, as far as I'm aware..

Re:wouldn't it make more sense

[drDugan]

I think that my thought was that the
(hypothetical) passive device return a different
signal dependant on the signal recieved, not
simply the same one each time. ...

The more I think about it, the more it sounds
like such an action would require an
"active" (ie powered) device to accomplish
this.

but since I don't understand how RFIDs work
at all, the question still stands... could
it work with a passive (non-powered) device?

Re:wouldn't it make more sense

[LostCluster]

RFIDs are "dumb" devices. They're like your EZ-Pass in your car, when a radio beam passes through them, they alter the beam to add their "signature" which is uniquely identifyable. This is useful for identity, but nonsense for encryption. The problem is that if you are within range to "hear" the signal, you get the ID and enough to make a duplicate token. Tardly the model for security. There's no place for encryption here... whatever value is broadcast is the key value. By requring the token to have a microprocessor, the key never gets broadcast. It's an encrypted conversation between the station and the token, which if properly implemented makes it impossible to have a duplicate token take its place.

Re:wouldn't it make more sense

[skwm]

That would work, but the laptop would need to power the RFID reader. Looking at the specs for a random RFID reader, it needs a constant source of 12VDC, drawing 200mA of power. I'm not sure of the capacity of laptop batteries, but I assume that this would drain them quickly.

Re:wouldn't it make more sense

[DoctorPhish]

Well, I'm only an armchair cryptanalyst, but to the best of my knowledge you need some kind of challenge-response system in order to ensure that everyone is who they say they are. That pretty much eliminates any passive system, unless there are some wacky theoretical mathematics I don't understand...

Re:wouldn't it make more sense

[swordboy]

I'm not an expert in encryption, but I have had serveral security related dongles and all of them were a pain in the arse.

Which is why most users would just leave the dongle next to the PC with the sticky note that has all of their passwords on it.

User's need to be in the habit of locking the workstation when they leave it. A good IT department will audit this (at least for the users that reside in the office... that goes for plain-view passwords, etc) and penalize users who do not (give them a slow POS or something with a ton of dead pixels). Soon, it will be a subconscious task that is performed before the PC is left. Add a hard drive password (laptop only?) or a drive encryption mechanism (like Safeguard and the data is more secure than it would be with a dongle.

Re:wouldn't it make more sense

[Anonymous Coward]

200mA @ 12VDC is 2.4 Watts (simple P=IV). My dell laptop battery (the standard one that it comes with) has a 65120mWh capacity (65.12Watt-hours). So it could power this RFID reader for 27 hours. Considering that most laptop batteries only power the computer for 3-4 hours MAX, the power drain from the RFID is insignificant in comparison.

Re:wouldn't it make more sense

[iabervon]

That's why you want a wireless dongle. The user wears the device or has it in their pocket all the time. Most users aren't in the habit of leaving their wallet and keys by the sticky note, and they don't do that with their non-security-related watches. Of course, the wireless device has to be active, because passive ones are trivial to clone, which is why this is a watch and not a card.

Re:wouldn't it make more sense

[LostCluster]

If you unify the office security systems, then the system can require you be wearing your watch in order to unlock the bathroom door... if you left your watch at your desk while you go to the bathroom, you have to go back and get it.

People will carry their key with them if it's required to do everything they want to do away from their desk too.

Re:wouldn't it make more sense

[cybermace5]

As the previous poster pointed out, RFID is relatively easy to snoop on.

One of my major peeves is the RFID card that gets me into work every morning. In certain stores, my RFID card returns a code that sets off their RF tag detectors at the door. Usually I remember, pull out my wallet, and hold it over my head while walking through. Once I forgot at Fleet Farm (basically a giant general store, like Home Depot with tractor parts) and I set off the alarm. Of course someone came to visit me, and it was especially embarrassing because I was wearing a big coat and didn't buy anything. She handed me a little piece of cardboard called a "Schlage Shield" and said to put it in my wallet. No more alarm.

Worked great, except that opening the door at work involved putting down my coffee, laptop, and lunch to get out the RF card (instead of conveniently pressing my butt against the door). So I took it out, and promptly set off a Barnes & Noble alarm. No one seemed to care, so I just pulled out my wallet and walked through with the wallet over my head again.

ANYWAY...the point is that RFID tags are barely more secure than keeping a post-it note with an access code.

I am curious exactly what my card claims to be on the store scanners....

And the whole article is a duplicate.

Re:wouldn't it make more sense

[Cruciform]

I'm soooo sorry about the wastebasket, Sir. You see they were serving East Indian cuisine in the caf and I forgot my watch today. And you know those locks on the bathroom doors... once again Sir, my apologies.

Re:wouldn't it make more sense

[petecarlson]

I have this little passive card that opens locks when I wave it at them. Perhaps it's charged by the field as it's waved through. The same thing should work for a laptop no?

Re:wouldn't it make more sense

[Hubert_Shrump]

Anyone else know more about these technologies?

If I read you right, you're talking about passive RF stuff, like in those bigassed Honda keys.

They use RF generated from the car (ping!) to generate just enough electricity to de/encrypt a response (pong!). Viola! (sic)

I guess it's more like a transformer coil than RF, but what the hoo.

Re:wouldn't it make more sense

[FyRE666]

A good IT department will audit this (at least for the users that reside in the office... that goes for plain-view passwords, etc) and penalize users who do not [lock machine when leaving it unattended]

I used to have great fun with people who did this at a previous job where the majority of machines were Sun/Linux. One guy constantly left his machine logged in, so I'd sneak over and drop the security on his X server (xhost +), then have great fun randomly opening apps on his machine across the room. Since he was a hardcore Windows man (he was working as a Perl programmer, and didn't have any interest in the operating system) he had no idea what was going on.

Oh yeah, I also set up a cron job to open Netscape, pointed at the famous goatcx site at lunch every day on his machine for a while...

Re:wouldn't it make more sense

[drfuchs]

There's another potential attack: My crony and I have wireless "repeater" devices. I stand next to the supposedly-protected laptop, and my crony follows you around. The laptop does a ping, which my device hears and relays to my crony's device, which pings your ring/watch, which replies to my crony's device, which relays to me, and I relay to the PDA. You're nowhere to be seen, and I'm using your laptop. Notice that I don't have to understand anything about the conversation, so it doesn't matter how encrypted it is, or how "smart" your ring/watch/token is. All I need to know is the frequency you're talking at. This is a well-known crypto attack, so shame on them for not pointing out this weakness. True, it's not cheap, but it's less trouble than cutting off someone's finger.

Re:wouldn't it make more sense

[Tony.Tang]

> [RFIDs are] useful for identity, but nonsense for encryption

I don't know much about RFID's, but I think you're probably right. Here's a question: wouldn't it be possible to capture someone else's EZ-Pass ID then and then replay it? If it is possible, how come no one has (apparently) done it?

I think the key take-away from this article is not so much its implementation as the idea: 1. the mobile device somehow identifies its owner, 2. when the owner is not around, then the mobile device becomes useless.

If RFID's aren't the way to accomplish (1), then people in the future just need to think about the way to accomplish it in a different way.

Re:wouldn't it make more sense

[Anonymous Coward]

"Oh yeah, I also set up a cron job to open Netscape, pointed at the famous goatcx site at lunch every day on his machine for a while... "

That's not funny. That's mean, and you could risk being sued for that. All he have to do is figure out what's going on and show the judge the picture. You'd be put away for years ;*)

Re:wouldn't it make more sense

[Sheridan]

but I have had serveral security related dongles and all of them were a pain in the arse.

Dude, you're definitely wearing your dongle in the wrong place!

Re:wouldn't it make more sense

[Anonymous Coward]

no he wouldn't. any DA who looks at that charge would throw it out and slap the charger.

Re:wouldn't it make more sense

[Anonymous Coward]

The "Schlage Shield" was an expensive piece of aluminum foil.

Re:wouldn't it make more sense

[xrayspx]

If you leave your watch at your desk, your laptop doesn't auto-encrypt, you get pwned, and get fired for leaking company (govt. whatever) secrets.

Clearly, the only solution is implants. :-)

Re:wouldn't it make more sense

[dasmegabyte]

Oh, hahaha! It is so fun to abuse the norms on Windows! Cretins, why don't they embrace our hilarious operating system which allows such cunning exploits as showing porn at lunc time, not to mention intuitive prevention from them! Just open a terminal, change directories to /bin/ and sudo -c chmod 500 me.mygroup xhost lol!

Re:wouldn't it make more sense

[jonadab]

If you need the thing to transmit a signal via radio waves, then I
think you're probably right. However, there _are_ passive (as in
non-powered, like the other poster was asking) one-way cryptographic
devices. I read an article once (possibly on /., possibly elsewhere)
about some people who had taken bits of glass and embedded them in
a card-shaped slab of something-or-another, so that shining light
through it from various angles would produce various patterns. It
was said to be impossible to work backwords from the speckle-patterns
it produced and create a copy of the thing, so if the authenticator
picked a different angle each time to shine the light through, it
could be assured that the correct pattern could only be produced
by the original "key".

However, any object-key system like this doesn't prevent somebody
from just stealing the key object along with the thing it unlocks.
It's fine for things like the article discussed (preventing random
people in a hospital from reading patient records when the doctor
steps away from the computer), but it would not work in a case
involving someone actively seeking your data (e.g., espionage).

Re:wouldn't it make more sense

[Anonymous Coward]

...so how much unpaid-for stuff do have in your coat when you walk out the store holding your RFID tag over your head?

Re:wouldn't it make more sense

[jonadab]

> User's need to be in the habit of locking the workstation when
> they leave it.

That would be good for security, certainly...

> A good IT department will audit this (at least for the users
> that reside in the office... that goes for plain-view passwords,
> etc) and penalize users who do not (give them a slow POS or
> something with a ton of dead pixels).

The IT department does not always have the authority to do this.
For that matter, the IT department doesn't always have the authority
to require passwords to be changed annually (or to change them), let
alone penalising anyone in any way.

Re:wouldn't it make more sense

[IXI]

I have had serveral security related dongles and all of them were a pain in the arse.

You probably should have read the manual. You are not intended to stick these devices up your ass.

Re:wouldn't it make more sense

[Anonymous Coward]

..I have had serveral security related dongles and all of them were a pain in the arse.

In Soviet Union, arse is painful to dongle!

Re:wouldn't it make more sense

[123beer]

It's a well known attack with a well known solution. You just have to make it so that a message can only be used once. In this particular setup they use a nonce for each packet which makes every packet unique and un-replayable. Look at section 2.4 of the PDF.

Re:wouldn't it make more sense

[cmj]

It IS possible to capture someone's EZ-Pass ID, but would you drive through a toll booth, where they have video surveillance capturing your face and your license plate just to save a couple of bucks?

This is just one of those situations where the attack, while possible, is just not worth the risk of being caught.

Now REVERSING the attack by replacing someone's EZPass with one that sent the ID that belongs to someone else for the harrassment factor might be fun.

Re:wouldn't it make more sense

[FyRE666]

That you consider goatecx a porn site is somewhat disturbing...

In Sovjet Russia

[Anonymous Coward]

Software walks away after owner has been secured!

Yes, but

[SigNuZX728]

This sounds like a really great idea. What program does the encryption, how fast is it, and what all does it encrypt? Just documents, or the whole system?

Re:Yes, but

[DoctorPhish]

Whole-drive encryption has been around for a long time now...even in-software encryption isn't bad on modern systems. I think the technology that makes this interesting is the token system used to determine the presence of a certain individual, and only decrypt the contents in this case. The underlying encryption technology would be inconsequential (provided it was strong enough for your needs)

Re:Yes, but

[Zeal17]

The article mentions that it encripts the disk cache.

-Zeal

It'll be a movie plot element within 3 years.

[Apuleius]

Specifically, someone with such a token getting clubbed on the head and stuffed in the office supplies closet, and his token stolen.

Re:It'll be a movie plot element within 3 years.

[LostCluster]

You know, common movie elements won't understand this "token wristwatch that has a Linux-running microprocessor" thing, so let's dumb it down. How about he gets clubbed in order to get a piece of metal that has been engraved in some semi-random form so that when it's placed into its reader, it causes a door to be unlocked.

I know... call it The Key

Re:It'll be a movie plot element within 3 years.

[Anonymous Coward]

...they did this for one of the Bond movie in the 80's.

USAF had an iris scan system at a USAFE base. So the bad guys killed someone who had access to the area that held the live shot cruise missles after making contact lenses with the guy's iris pattern on them.

I think that is the one with that psycho spanish chick who chased Bond around in a cool little Renault Turbo R5...

Re:It'll be a movie plot element within 3 years.

[4of12]

I was thinking how cool it would be to have colored metallic foil RFID tattoos!

It sure would look nicer than the black and white UPC bar code on the top of my forehead - for some reason hot chix don't dig it very much.

Sounds like a good idea, but....

[f00zbll]

what if someone steals the device? The system could add a password, but if someone steals the watch and the laptop makes no difference. Sounds like it just saves lazy people from typing in their login.

Re:Sounds like a good idea, but....

[countzer0interrupt]

what if someone steals the device?

The headline in the article reads "The snoop-proof laptop" - the aim is to prevent people snooping, i.e. covert data theft. If the device is stolen then you know your data is at risk, or has already been stolen. Basically, you want to be the first to know if someone's just read all your secrets.

Re:Sounds like a good idea, but....

[Zeal17]

The article also mentions that a password would be needed in the token. So, if the token is a watch, I would assume that if you took it off, a new password entry would be needed.

-Zeal

repost

[Anonymous Coward]

this was posted nearly a year ago. interesting, but old news.

Interesting article/research project

[ekrout]

But what happens when the neighborhood/college/company bully steals your watch?

Re:Interesting article/research project

[EverDense]

Then you offer praise to whomever you worship that the company you work for didn't use
finger print authentication. Its a lot easier to replace a stolen device than a stolen finger.

Re:Interesting article/research project

[McCrapDeluxe]

At the beginning of the process, the user enters a password on the watch. "That's to make sure an imposter isn't wearing your token," Noble says. They would need your password, too.

Re:Interesting article/research project

[Anonymous Coward]

Typical nerds comment. When a "bully" attacks me, I fight back! They usually run away with a few teeth missing. You sissies deserve to get your ass kicked and watch stolen.

Re:Interesting article/research project

[spruce]

So in your scenario, the big bad neighborhood bully beats the nerd to a pulp, and then logs on for some kernel hacking or something?

Re:Interesting article/research project

[LostCluster]

Same thing that happens when you lose your physical key or your pass-card... you change the lock so that the old watch is no longer acceptable, and you get a new watch who is the new keeper of the key.

Re:Interesting article/research project

[Anonymous Coward]

It's also a lot easier to steal a watch than a finger...

Re:Interesting article/research project

[bloo9298]

Are you Eric Raymond?

Re:Interesting article/research project

[Anonymous Coward]

When a "bully" attacks me, I fight back! They usually run away with a few teeth missing.

No, that's a "woman," you jerk.

Re:Interesting article/research project

[Waffle Iron]

It's also a lot easier to steal a watch than a finger...

Not necessarily.

Re:Interesting article/research project

[hatrisc]

except that if your data was encrypted, your screwed unless theres a work around to decrypt it without the authentication.

Re:Interesting article/research project

[(startx)]

Then look at it the other way around. What stops the person going after your laptop from changing the key themselves?

Re:Interesting article/research project

[PYves]

it's mostly a moral issue, really. with a big knife it's very easy to steal either or both.

Re:Interesting article/research project

[sql*kitten]

Then you offer praise to whomever you worship that the company you work for didn't use
finger print authentication. Its a lot easier to replace a stolen device than a stolen finger.

Any engineer will tell you that a decent fingerprint reader won't be fooled by a dead finger. Temperature, electrostatic properties, lack of a pulse etc - these things are easy to check. But Joe Random Criminal isn't going to know that...

Re:Interesting article/research project

[Anonymous Coward]

At the beginning of the process, the user enters a password on the watch. "That's to make sure an imposter isn't wearing your token," Noble says. They would need your password, too.

So, why not have them log back into their computers to begin with?

Re:Interesting article/research project

[Anonymous Coward]

> So in your scenario, the big bad neighborhood bully beats the nerd
> to a pulp, and then logs on for some kernel hacking or something?

No, no, he just beats the nerd around a little bit, then stands
over him with a threatening club and _forces_ the nerd to do the
hacking. "You want to get out of this office alive, you finish
that patch, understand? I'm going to hit a part of your body with
this hammer every thirty minutes until I see it working, you got
that? So you just get busy fixing up that patch and make my web
browser so I can get into pay sites for free, alright! And don't
give me no lip 'cause if you annoy me I'll make it every ten
minutes instead of every thirty..."

Much like my ex-wife

[Anonymous Coward]

as soon as I walk away her legs spread open for others.

Great!

[Anonymous Coward]

Now all I need to do to access some sensitive information is to beat up some pasty-faced grad students!

Sounds like smartcards

[Cat_Byte]

Sounds like the smartcards to me where you stick it in the slot & it knows your password, domain, etc. Console is locked unless you have the card.

Re:Sounds like smartcards

[Cat_Byte]

This is not a troll. It's exactly the same thing a smartcard does.

Re:Sounds like smartcards

[Cat_Byte]

How the hell is saying this technology is a ripoff from smartcards a troll? Are you mods still on crack? I use smartcards and they're more configurable than these from what I read about them.

Re:Sounds like smartcards

[Anonymous Coward]

Except this that this doesn't need you to put the card in the machine. It will just authenticate you when you're nearby. Pretty cool really. It also prevents users from leaving the smart card in the machine as the authentication menthod is something they wear, so when they walk away so does the authorization to use the machine.

Mandatory comment about a bewolf cluster of linux watches. Just imagine, a guy on the corner with a trenchcoat, 'Wanna buy a super computer?'

in Soviet Russia

[Anonymous Coward]

In Soviet Russia, software encrypts YOU!

Would that be the J R R Token

[cyber_rigger]

That you wear on your finger? :^)

Re:Would that be the J R R Token

[binner1]

Given the day, I'd mod that "+1 Funny (Points for Effort)" !

-Ben

Re:Would that be the J R R Token

[Anonymous Coward]

Actually, there is a technology that uses an encoded ring to let you fire a gun. The gun senses the ring and unlocks itself.

Something like that would make more sense than having a tiny computer running in your huge-ass watch. I don't even wear a watch or ring (even when I was married) because I hate the feel. I would rather wear a ring than a giant watch though.

Re:Would that be the J R R Token

[Dannon]

And they shall be allocated thus:

Three for the executives, with their heads in the sky,
Seven for the managers, with skulls of stone,
Nine for the programmers, who need to die(t),
One for the Sysadmin on his dark throne.

One Ring with Root to all, one Ring to scoff them, one Ring to bring them all, and in their cubicles BOFH them.

In soviet...

[Anonymous Coward]

In soviet star trek, Data walks away with YOU!

Vulnerable to brute force cracking

[commodoresloat]

Gimme your watch, punk!

Re:Vulnerable to brute force cracking

[Tolchz]

Actually I believe the term is "rubber hose" cryptanalysis

Sounds like fun...

[Grip3n]

Great! Now I'll have a growth on my arm from my ZIA wristwatch to go along with my brain tumor from my cell phone!

Re:Sounds like fun...

[Anonymous Coward]

That's okay. Medical science has advanced enough to successfully amputate your arm and have you live, if need be. We haven't gotten around to physically amputating brains...yet.

Re:Sounds like fun...

[Anonymous Coward]

We haven't gotten around to physically amputating brains...yet.

Really? It seems as though a lot of people have their brains amputated.

hmmm...

[jasno]

What about using some kind of biometric data, like key cadence, or a profile of typical mouse movement characteristics (like icon overshoot?) to do it? That way its totally seamless, although one could still do some damage as it would take a few input events to establish the identity.

Sure, its not foolproof, but who wants to wear an identifying token?

Re:hmmm...

[pboulang]

... or maybe some secretly hidden sequence of key presses?

Re:hmmm...

[Anonymous Coward]

Some colleagues and I have been working on just such a device for the past four years. Unfortunately, we keep hitting a brick wall. We are having a problem, maybe you /. folk can help.

Specifically, we are trying to develop some sort of device to relay a secret code into the computer. So far we have been working on a button-based device, but no luck.

Thanks!

Re:hmmm...

[AceyMan]

Yeah, great.

Four whiskeys later, and you've locked yourself out of your computer for the next 8 hours.

This would ruin pr0nsurfing as we know it....

Re:hmmm...

[spotter]

bluetooth actually, unless they figured out a way to get 802.11 working w/ decent power savings on the watch. Bluetooth requires much less power than 802.11 (a reason why its range is so much less)

When i was working on it (2 summers ago, so a while back) we got bluetooth working decently well, in that one could give a talk w/ slides and control the slides w/ the watch's thumbwheel.

Re:hmmm...

[barzok]

My key cadence and mouse movement vary based upon the task at hand. Wouldn't work too well there.

Always look on the bright side of things.

[Asterax]

Even if ZIA encryption method ends up being broken by/a hacker(s), you still get some cool jewelry to show off to your friends.

A possible flaw.

[Anonymous Coward]

To crack into your system, a thug need only crack your skull, take the watch, and then log on.

Non-PDF version

[David_Bloom]

For those of us who don't want the Acrobat plugin crashing our browser: Google's handy PDF->HTML cache.

Something's missing

[Safety Cap]

(from the article)

At the beginning of the process, the user enters a password on the watch~.

Isn't the point so that lazy people don't have to be bothered with remembering passwords? Doesn't this defeat the purpose? (sigh)

What happens if you take your watch off and leave it next to the computer? It never encrypts!

Worse yet---what happens if your watch gets stolen? Now you can't get at your data! Better make sure you get the Casio watch option instead of the Breitling. No one would want to steal a Casio POS, so you should be safe.

Re:Something's missing

[cicadia]

Isn't the point so that lazy people don't have to be bothered with remembering passwords? Doesn't this defeat the purpose? (sigh)

<sigh> No, that isn't the point at all. The technology is intended to stop the problem of people walking away from their computers ("I'm sure I'm only going to be away for a minute" -- gets dragged into a five hour meeting...) without locking them first.

The article even says that it was designed for use by people who are already using passwords, but are bothered by the inconvenience of having to lock the computer, and reenter the password every time they are called away for a few seconds. Not because they don't want to remember a password, but because it's a hassle to have to enter it all the time.

Re:Something's missing

[Anonymous Coward]

[srxm]Sure, nobody wants to steal that $150 Casio G-Shock, that $250 Casio Pathfinder, or that $350 Casio Digital Camera watch. They'd much rather steal my $50 MP3 player.[/srxm]

Re:Something's missing

[Anonymous Coward]

No, that isn't the point at all. The technology is intended to stop the problem of people walking away from their computers ("I'm sure I'm only going to be away for a minute" -- gets dragged into a five hour meeting...) without locking them first.

The answer is a screensaver that starts after a very short time (non-user configurable), and demands a password to quit.

Re:Something's missing

[Jorrit]

Apparently you didn't read the parent. The problem is that they do not WANT to type in the password every time they go away for a short time and come back. That is what the proposed system of the slashdot article is about. Not having to type the password every time you come back at your computer.

Greetings,

Sad news for the slashdot community

[Anonymous Coward]

In doing family research, I found out that my grandfather died at the Auschwitz concentration camp. This is very upsetting to me. It seems he got really drunk one night and fell out of his guard tower. Please send condolances.

Pacemaker plugin?

[DoctorPhish]

DriveCrypt has options for quick-kill and hotkey unmounting of encrypted volumes, and since this looks like it does the same thing, only better, maybe they could look into making it erase or publish the contents of the encrypted volume after receiving a distress call from the user's pacemaker?
Now _there_ is a deadman switch!

Re:Pacemaker plugin?

[Chakotay]

Publish the contents upon death? Now we only have to kill the user to get to his data without any inconvenient password cracking. Requires complete lack of conscience, but there are lots and lots of people who fulfill that requirement (heck, some people kill a friend over a fscking beer - let alone his encrypted pr0n collection), and it's a hell of a lot faster!

Re:Pacemaker plugin?

[DoctorPhish]

Publishing implied things that people would rather didn't get out; ie. blackmail etc. ^_^;

you call THAT secure?

[SHEENmaster]

I have a v8 engine block set to fall on my hard disk if I'm away for more than five minutes (3 minute walk to fridge(coke!) and back)!!!

Your security is nothing compared to that!!!!!

Re:you call THAT secure?

[Anonymous Coward]

remind me to call you with a telemarketer Nigerian scam next time you get up for a Coke.

Re:you call THAT secure?

[Anonymous Coward]

That's nothin' dewd. I have a grenade with a 5 minute fuse strapped to my box with a fishing line from the key to my belt. I've only lost one box this year - damn telemarketers caught me.

Re:you call THAT secure?

[MullerMn]

I have a v8 engine block set to fall on my hard disk if I'm away for more than five minutes (3 minute walk to fridge(coke!) and back)!!!

Erm..
3 mins to fridge +
retrieve coke +
3 mins back

... I hope you've got backups.

Re:you call THAT secure?

[Anonymous Coward]

I would place the engine block over the computer chair...

Oh geeze...

[Obliterous]

My watch battery is dyin$^%*&^@#$SD$#@#XVSDF$%@MDFSCVNL%$#^$*@#)(*&!$@

----End of line.

is currently a wristwatch with....

[teamhasnoi]

a processor running Linux designed by IBM.

Soon to be a chip implanted in your hand.

Don't forget the barcode on the forehead!

I'd much rather computers go wearable than implantable...

Re:is currently a wristwatch with....

[racermd]

True, wearable gives you more options and is less intrusive. However, I think implantable computers or their various subsystems will inevitably become implantable.

At first, it will probably be basic sensors and/or location-awareness devices. (Come to think of it, this already exists) Generally, these will be passive devices aimed more at information gathering and interpretation than full-fledged computation or bio-enhancement.

The future will progress and features will be added at a steadily increasing rate, much like the boxes that sit on our desks, next to (or on top of) our TVs, in our pockets, on our wrists, and fully surround us every day. Eventually, these devices will offer enhancements directly to our own abilities. This process will occur so gradually that it will be difficult to put an exact date on it, even well after the fact.

The only major disadvantage that I can think of immediately is a lack of upgradeability. Unless, of course, it's designed as a semi-self-healing modular system that can survive a complete failure (read: removal) of about half or more of the overall subsystems during upgrades. Or maybe the systems will have a certain level of upgradeability built-in, like tweaking a car's engine to get better fuel economy and/or power.

The repercussions of all of this cannot yet be fully predicted, but a Borg-like being isn't totally out of the question, if a bit extreme. It will be an evolutionary change rather than a revolutionary one, but I believe it will happen someday. Perhaps even within our lifetimes.

The thought of all this potential makes me giddy with excitement, but also scares me shitless. The best we all can do is to pay attention and not let our guard down. Technology is not inherently good nor evil. It's what we do with it that is good or evil.

Now, why did you have to go and make me think about all of this right before bedtime?!

Why a Linux-based token?

[Anonymous Coward]

... when a smartcard-based solution would've probably made it as well for a fraction of the price?

Use my technique

[ekrout]

I keep all mission-critical and government-classified information on portable USB Flash DRAM-based storage devices. They're incredibly portable and can be brought to the gym, in the car, to work, back home, swimming, hiking, biking, etc.

To be perfectly honest, I just can't bring myself to respect anyone who would leave a $4,000 laptop with supposedly top-secret information on it sitting out on a cafeteria table or something while they go sit in the bathroom and read the paper.

Just stick with portable USB drives. They're cheap, efficient, fast, and more secure than any fly-by-night research project out there right now.

Re:Use my technique

[Anonymous Coward]

USB Flash DRAM-based storage devices

Flash memory is not DRAM.

Re:Use my technique

[MrChips]

I keep all mission-critical and government-classified information on portable USB Flash DRAM-based storage devices. They're incredibly portable and can be brought to the gym, in the car, to work, back home, swimming, hiking, biking, etc.

I've been playing with an old CompactFlash card and a pcmcia adapter. Enciphering the data on the card with a password is a good idea too.

Re:Use my technique

[Anonymous Coward]

.... wtf.... time for some more ephedrine....

but wtf is this?

Re:Use my technique

[Mitreya]

Parent might be a troll, but he makes a valid point. If you are already prepared to carry some device on you, you might as well have the data *on* that device... So not only is it safe from someone's tampering, but stays with you if the laptop is stolen alltogether...

Re:Use my technique

[Surak]

I keep all mission-critical and government-classified information on portable USB Flash DRAM-based storage devices. They're incredibly portable and can be brought to the gym, in the car, to work, back home, swimming, hiking, biking, etc.

I think you had a typo.

What you meant to say was
"and can be LOST at the gym, in the car, at work, at home, swiming, hiking, biking, etc.

Re:Use my technique

[rherbert]

To be perfectly honest, anyone who would bring classified information to the gym, home, swimming, hiking, biking, etc. should be in jail.

The Adventures of Jennifer Lopez

[Anonymous Coward]

Another tiring live performance. These performances always took a lot out of Jennifer Lopez. Dancing and running across the stage for this amount of time was always exhausting.

But besides being exhausting these dynamic performances sometimes also had another effect on Jennifer. Because she moves so much and so fast on stage for such a long period of time, sometimes the latina's "pipes" would loosen up to the point where she needs a half hour of "retreatment" into the ladies' room to relieve herself. So as soon as she got off stage, she went straight for the girly potty room. She went inside, the usual sweet scent of a ladies' room penetrated her nostrils. She went into a stall, closed the door, lifted her miniskirt and lowered her panties. The wetness of the panties she had grown accustomed to. The movements were causing the crack of her ass to sweat and after two hours of dancing, the panties were lodged completely into her brown crack, soaking up all of the sweat present. Jennifer sat down, and allowed her insides to do most of the work. But for some reason this time it didn't go too well. Where usually the bowel movement was quick and smooth. This time it was like it struggled against being forced out. So Jennifer applied some pressure on her lower body, but it wouldn't help.

"This is going to be a long one," she said to herself, after which she heard the door to the ladies' room open. A woman, probably one of the dancers, went into the stall next to Jennifer's. The sultry singer and actress heard the woman sliding down her panties, snapping the elastic band. As Jennifer struggled to push the content of her guts toward her backdoor, she couldn't ignore the sounds being made in the stall next to hers.

The lady was moaning, the crackling of a turd sliding out was loud enough to be heard, and Jennifer couldn't deny a smile as she heard a fart thundering in the hollow sounding ladies' room.

"Whoa, that sounded like a real birth," Jennifer said casually to the mysterious lady in the next stall.

"Like you wouldn't believe," a womanly voice answered. "I've been holding this up for over half an hour."

Jennifer knew the voice. It belonged to Natasha, a stunningly beautiful black dancer, recently added to the group.

"Yeah, I can sympathize. I've been holding up myself. For over an hour."

"So you must be relieved to get rid of it then, huh?"

"I wish. For some reason it just won't go as easily as it should."

Jennifer heard the girl wipe her privates, pull up her panties and flush the toilet. Then she spoke again.

"You know, this might sound odd. But I have a successful method on how to make it go more smoothly, if you're interested off course."

"Well, I don't want to spend my entire day in here. So if it helps, I'd be happy to know what that method is," Jennifer said honestly.

"Okay. But in order for me to help, you'll have to let me in there."

Jennifer unlocked the stall, and saw Natasha entering. Once again Jennifer was in awe of the beauty of the girl. Her chocolate skin was shiny from the sweat of the performance. And her face resembled that of Brandy Norwood, the R&B singer. Wide eyes and a wide smile.

"Can I...you know...take a look to see if I can see the problem?" the girl asked in a light innocent voice.

Jennifer felt somewhat awkward. Although she was a closet bi-sexual. And had been in this position with several guys and some girls, she still felt a bit weird. But the girl wanted to help her out with her problem, so Jennifer leaned back against the wall, lifted her legs, and placed her feet on either side of the girl against the door of the stall. Natasha made no hesitations in dropping to her knees and staring at Jennifer crotch area. Without Jennifer noticing or realizing, the girl took pleasure in looking at Jennifer's great looking pussy. Shaven at the sides so no hair would be visible in bathing suits, but hairy on top and on the lips, lips that were long and thin. Looking further down her breathing went faster as she looked straight at Jennifer's asshole. A dark, wrinkled pucker that was pouting outward.

"This may sound a bit strange, and if you don't want to answer you don't have to, but...do you ever put your finger in your anus, for instance when you masturbate?" the girl asked while never taking her eyes off of Jen's asshole.

"What? No! No...I mean, I've never thought about doing that. Why do you ask?"

"Well, because my experience is that if you regularly finger your anus, you will experience far less constipation. You see, by fingering your...ass, your muscles learn to relax when pressure is applied. And it loosens up easier."

"I never knew that. So what your saying is that...if I finger my asshole, I should have no problem relieving myself?"

"That's right. That's why porn actresses have enemas before doing anal. So that it doesn't become a mess after the guy pounds her hole so long."

"I don't know. I've never done this. I don't know what to expect."

"You know it's actually quite nice, once you get used to it. If you like, I could try."

Jennifer thought about it and started smiling. "I would like that."

"Okay, first I wet my middle finger in my mouth like this"....... "Then I lubricate the outside of your anus with my saliva to make it slippery".... Natasha rubs the tip of her middle finger all over Jennifer's asshole, which contracts and relaxes under the black girl's touch.

"Then I enter." Natasha now slides her finger all the way into Jennifer's ass to the knuckle. Jennifer closed her eyes and couldn't suppress a moan, she just couldn't. Natasha noticed and knew she gained the desired effect as she started sliding her finger in and out with increasing speed. At one point there were even faint sounds of sloppiness as Natasha was really frigging Jennifer butt. "UUUHMM...that feels good," Jennifer moaned. "Please keep doing that."

"I intend to," Natasha said with a husky tone in her voice. "As a matter of fact, I think you're ready for a little something extra." The ebony girl slid her finger out of Jennifer hole, took a whiff of it, obviously liking the smell, and stuck the digit, along with her index finger into her mouth. After wetting the fingers with lots of spit, she drilled them into Jennifer shitter with one move, and started to rapidly fuck the Latina's ass with them. Natasha knew she had the singer almost where she wanted her...on the edge.

"Oh shit...your fingers feel so good in my ass. Keep fucking me with your fingers. That's it. I never knew it would feel this good."

"Puffy never did this to you, huh," Natasha asked with irony, "He probably thinks it's dirty. Well, fucking a beautiful ass like yours with my fingers is never dirty to me."

Natasha started twisting her fingers around inside Jennifer's ass and felt her ass become more slippery. She took her fingers out again and saw that Jennifer's asshole remained open for a short period. She then looked at her fingers and noticed her fingernails had a little bit of shit on them. She stuck her fingers in her mouth and licked Jennifer's shit from her nails.

"Now it's time for your reward," Natasha said and buried her face in the crack of Jennifer Lopez's ass. She lapped over Jennifer's pouting pucker and used a tongue full of saliva to lube the latina's shithole up. She then started butt-fucking Jennifer with her tongue like a real ebony butt slut. My God, how she enjoyed the sweaty, musky smell and pure, bitter taste of Jennifer's asshole.

Sloppy slurping sounds emanated from the tongue-asshole connection as the black beauty licked and sucked away at Jennifer Lopez's ass with abandon. Jennifer looked down at that dark face between her gigantic butt cheeks and shivered at the sight of that soft pink tongue grinding into the swollen rim of her rectum. She reached out and ran her fingers through Natasha's black hair, before grabbing her by the back of her head and pulling her face tight against the moist crack of her wide, beautiful ass.

"Oh my God. Natasha, you're licking my ass so good. I never knew a tongue in my ass would be this nice. Just don't stop. Keep fucking my butt with your tongue. Oh yeah, that's it."

As Natasha kept drilling her tongue deep into Jennifer's anal orifice, she closed her lips over her pucker, and started sucking on her ass with force. The smacking sounds of her lips on the latina's asshole filled the ladies' room, and it continued to do so for minutes.

"Shit, I feel something. Oh Natasha, I have to...I have to fart. Your sucking of my asshole makes me have to fart. Quickly, take your mouth off my ass."

But Natasha didn't budge. She kept on sucking right until an enormously loud, wet-sounding fart simply blew her lips off Jennifer's pucker. The odor of the hot gas penetrated the black dancer's nostrils and had her so over the edge, excitement-wise, she lost control of her calm self and started yelling.

"That's it, you fucking slut. Fart in my face. Fart that smelly shit right in my face. I love to smell that shit."

Jennifer needed a few seconds to understand what drove Natasha to enjoy something like this, but soon understood that the sheer depravity of it, the perverted nature of all of this, is what drives someone like Natasha wild, and Jennifer decided she was starting to like this nasty stuff as well. She could never deny to herself that she immensely enjoyed the feeling of someone sucking her ass. And knowing that same person actually gets wet smelling her farts.

Natasha had turned down the volume of her voice again and plainly spoke to Jennifer.

"Now that you farted, it means that it won't last long for the rest to come."

The beautiful black woman again started drilling her fingers in and out of Jennifer's swollen poopchute, and noticed the grimace of wanton lust on the latina's face.

"You horny bitch. You sure like this, don't you? Helping you take a shit, my ass! You couldn't wait to feel my fingers and tongue up your ass. You probably farted in my face deliberately. Blowing that shitty hot gas into my face as I sucked on your shithole. Tell me! Tell me you were dying to have me come in here and eat out your ass."

"Oh God. You're so right. You're so fucking right. I heard you shit, and smelled it. And I loved the smell of your fart. I was so hot imagining what you would look like taking a shit. Seeing the turds being pushed from your black ass. I love this. I love your fingers in my butt. Your tongue in my butt. And I loved farting in your face. It's so nasty. It makes me feel so hot and nasty doing that. I would love it so much to shit here as you watch my ass. The thought of you watching my asshole up close as I shit drives me crazy. Will you do that? Will you watch me shit?" Jennifer was shivering on the toilet bowl as she spewed the most perverted, depraved language. She had never talked like this. The nasty black dancer had brought out a side in her she never knew existed.

"I wanna watch you shit, Jennifer. I wanna see those turds popping from your nasty brown hole. Here, watch this, Jennifer. Watch as I pull my fingers from your ass and enjoy the taste."

Right after the final words, Natasha slid her fingers from Jennifer's ass, and showed them to Jennifer. Jennifer saw Natasha's fingers, coated in her shit, and then saw the ebony woman starting to lick her fingers. Looking straight into the celebrity's eyes and with a wild, wanton expression on her face, Natasha licked the layer of dark-brown crème right off her fingers, casually taking her tongue back in her mouth now and again to experience the taste, and letting the sticky shit slide down her throat. After she had completely cleaned her fingers, she looked at Jennifer with a serious expression.

"You're ready. Now push your shit out. Here, spread those legs wider so I can have a nice look, raise those knees. Support yourself and let me hold those ass cheeks spread for you. Now do it."

Jennifer never felt so utterly exposed in her life, sitting there on a toilet bowl with legs spread and knees raised, with a black woman's face mere inches from the sweaty crack of her ass. But the depravity of it, the nastiness, it made here feel so damn lewd, so hot. Jennifer pushed, and pushed, and an earth shattering, meaty fart blew from her pucker, right into Natasha's face, who squealed with joy. And then, it rolled. Jennifer felt the warm content of her bowels slide down towards the opening.

Natasha was still lingering in the mind-blowing smell of Jennifer Lopez's fart, when she saw a thick brown turd sliding slowly out of her ass. The crackling sounds were almost deafening to her as the pungent scent of Jennifer's shit filled her nostrils. The latina singer groaned aloud as she looked at the black dancer's face, and pushed a long turd all the way out, until it broke off and plunged into the bowl, leaving a brown shitty ring on the rim of her asshole. She was completely in the same mind state as Natasha now, as she whispered: "There's more where that came from. But I want you to SUCK it out."

Natasha looked into Jennifer's eyes with a surprised grin, as if she won a lifetime achievement award and didn't expect it.

"Suck it out? Oh Jesus. That's so hot. I'd love to suck the shit from your ass."

"Well then. What are you waiting for?"

That was Natasha's cue. She fused her open mouth to Jennifer's greasy brown asshole and sucked hard on the latina's pucker. Slurping sounds filled the stall and Jennifer groaned increasingly louder as she felt the ebony girl sucking on her sloppy butthole. Natasha enjoyed the bitter taste of the sticky shit that she sucked into her mouth.

"Oh Jesus Christ. That feels so fucking good. I don't care anymore if anybody hears me. JUST KEEP SUCKING MY ASS. SUCK THE SHIT FROM MY BUTT! YES!."

Natasha complied and kept slurping away at Jennifer's dirty ass, when all of a sudden she felt a spongy, warm nugget slide from Jennifer ass into her mouth.

She looked Jennifer straight in the eyes as she moaned and ate the latina's shit.

"Oh God, yes! Eat my shit. Do you like it? Do you like the taste of my shit? Better savor the taste, because it was the last piece."

Natasha chewed the brown piece and after squashing it enough, swallowed it.

"You done with that," Jennifer asked huskily, "then open your mouth, because I've something for you to drink to wash your mouth. Open up for mommy."

Natasha was wondering what the sultry singer meant, but opened her mouth as she had her face inches from the latina's steaming crotch.

"Oh yes, I feel it coming. Get ready."

And when that last word was uttered, Jennifer let go of her bladder, and a steady, yellow stream of warm piss arced from her pisshole straight into Natasha's face. The black dancer squealed in delight as she felt the smelly warm liquid splash her face, and moved her face so she caught the forceful stream straight into her mouth. The hissing sound of the piss leaving Jennifer Lopez's cunt and it hitting Natasha's tongue and roof of her mouth was like music to their ears. Natasha swallowed wave after wave of Jennifer's salty piss and continued to let her tongue be drenched and her mouth be filled.

"Christ, you look so hot drinking my piss," Jennifer whispered as a thunderous fart once again crackled out of her brown asshole.

All good things come to an end, and this includes the content of Jennifer's bladder, as the stream decreased in its strength and it lowered until the last spurts just gushed over the crack of Jennifer's ass.

"Now please clean me," Jennifer said.

Natasha continued her earlier job and again lapped through Jennifer's crack, licking the piss from it and licking off the remainder of shit on the swollen rim of her bulging asshole. After about 2 minutes Jennifer was squeaky clean and pulled her panties up as she looked Natasha in the eye.

"You made me fell better than I have ever felt. Nobody has ever gone this far to give me a good time," Jennifer said.

"It always was my dream to pleasure you," Natasha responded, "I just had to grab this opportunity. My wildest dream was to suck your ass, and you made my fantasy come true. And I just want you to know, Jennifer, that if you ever want me to give pleasure to your pussy or ass again, you just have to tell me."

"Natasha, I would like it very much if you want to be my buttslut. We can have crazy times together on the road. As far as I'm concerned, you can taste my ass whenever you want, because I just love the feeling of your soft, wet tongue fucking my butt."

"Oh Jennifer, you just made me happy. But I have a question. Would you like to service certain body parts of mine just as I service your ass?"

"Just name it," Jennifer said in anticipation.

"Tell me, Jennifer, would you like to suck and lick my toes from now on?"

"Natasha, as far as I'm concerned, you can fuck my ass with your big toe, and I'll clean your toe with my tongue."

Jennifer Lopez and Natasha would have many crazy, lustful adventures from that point on.

CONGO COONS RAPE NUNS

[Anonymous Coward]

...seems they really enjoyed it before their necks were slit.

hmmm...

[Lord_Slepnir]

The token... is currently a wristwatch with a processor running Linux designed by IBM.

hmmm....we have a watch, it obviously has some sort of wi-fi networking if it can keep in touch with the computer. How long until someone is assasinated by launching a DoS attack against his watch? It may not kill, but at least cripple as the watch burns its way through the flesh as the poor NIC on it is overloaded.....

For Regular Business Users?

[webword]

This is yet another device created by geeks for geeks. These researchers probably think this is a good idea, but do they really think it is a good idea for most people? How much market analysis was done? How much usability testing? Well, at least they are targeting corporations and large organizations. There might be some money in it down the road.

how about replay attacks?

[Anonymous Coward]

looks like a risk of interception.

Very Interesting

[Anonymous Coward]

How a totally segregated organization like the Congressional Black Caucus (CBC) blasts Senator Trent Lott for making segregationist comments....do I hear double standard????

New cubicle

[rockwood]

So all the guy/gal in the next cubicle has to do is monitor the IR transmission/receiver and copy your key... or am I missing something?

Can you occassionally change your key?

I don't like this idea, being that these 'products' give your employer a more solid ground to say "It must have been you that deleted the files and crashed the server with the worm you released after we gave you a bad QA assesment." Afterall, it had to be you... your the only one with "The Crypto Key".

How would you prove it otherwise that it wasn't you?

I like my passwords, the ease of changing them increases my frequency of doing so. And for those that change their pwd's to easily remembered terms due to your lack of brain power - Well then you deserve what you get. If you can't remember a password, and have the ability to remember that password as it changes every few days or weeks - then you shouldn't be sitting at a computer to begin with. I constantly change my passwords and use a different password for nearly 30+ things... all password are no less then 11 or 12 highly mixed random characters. And while I am no idiot, I am far from having a photographic memory. So as the old dieters solgan goes... "If I can do it, so can you"

Re:New cubicle

[Anonymous Coward]

Uhh ... you read the article.
Oh, wait, you're another slashtard

Re:New cubicle

[rockwood]

Yes I did read the article!

It says you can set the password, but nothign of the capabilities to change/modify it at a later date.

Additionally, even though the token contains the 'Master' key, the answer to the request is still being trasmitted. Therefore it would essentially be possible to copy the transmission and 'play it back' to the systems requests that are announced at one second intervals.

As long as you can capture the transmission, transmitting the play-back wouldn't be an issue.

Ehhh...

[Guppy06]

Security for the people too lazy to practice good security habits. Yay. Although I suppose this will make life easier for certain sysadmins...

At any rate, my question is "When will this be used to make smart guns?"

Re:Ehhh...

[Anonymous Coward]

To answer your question. Companies like Colt Firearms are already testing devices to lock guns from firing if the person holding the gun is not wearing the special security device. Currently a watch (what a surprise).

Re:Ehhh...

[afidel]

Guns have no need for electronics. The most cost effective way to do "smart" guns is to have a ring with a magnet and a spring loaded pin that goes in from of the firing pin/hammer and keeps them from engaging unless the rings magnet pulls the pin out of the way. The only thing this system lacks is individual user identification but it solved 80+% of the problem with weapons, those mostly being the weapon being fired by children/ other non-owners of the weapon accidently and the weapon being used against the owner by an assaliant.

Re:Ehhh...

[Anonymous Coward]

Companies like Colt Firearms are already testing devices to lock guns from firing if the person holding the gun is not wearing the special security device. Currently a watch (what a surprise).

And how will this stop a criminal from struggling with a cop and shooting him? After all, the cop's hands are on/near the gun, so it would authenticate. The only way for the cop to not get shot would be for him to let go of the gun and throw his hands to the side, away from the gun, so it won't authenticate. Very non-instinctive.

Re:Ehhh...

[Anonymous Coward]

Cost effective, huh? And stupid. And pointless.

A) Children are smarter than you give them credit for. How long do you think it will take them to figure out daddy has a special ring and learn how to fire it? Can the maker of this "safety feature" now be sued because it failed to prevent an accident?

B) If the ring is only a magnet, what's to prevent non-owners or an assailant from wearing a ring just like it to fire the gun? As you said, there is no individual user identification. The gun won't know the difference from owner magnet vs. robber magnet.

C) A big thanks go out from all the gun buyers who now have to pay more money for a useless safety feature.

Are you mildly retarded? Or do you just know nothing about firearms? You're a moron.

Re:Ehhh...

[afidel]

At least three companies offer magnetic trigger locks.
Smartlock
tarnhelm
and Colt
The companies have all determined that there is a market for these devices and that they offer a low enough chance of being sued for it to be profitable. Colt also offers an electronic version to police officers, but I know my inlaws (both of which are police officers) would not want some battery powered thing determining if they can fire their weapon or not.

IN NAZI GERMANY...

[Anonymous Coward]

you could be arrested for encrypting something!

Dongle?

[macmark]

Isn't this just a fancier type of dongle?

YOU FAIL IT!

[Failure Guy]

First poster? You are more like a FAILURE POSTER!

YOU FAIL IT!

Why do Brits have disgusting teeth?????

[Anonymous Coward]

Filthy rotting shit stained teeth that smell like dog shit. Even wealthy parasites like the royal family have pathetic blackish-yellow decaying teeth. Why is that?

facial recognition

[Nathdot]

More and more laptops/palmtops incorporating a camera as part of the design, so why not use facial recognition to lock the pc.

Short of growing a beard before you get back to the laptop it'd be a cheap workable solution.

Then you don't have to remember/wear some crazy ass security dongle.

Re:facial recognition

[Anonymous Coward]

Oh, for a second there I thought you said FECAL recognition!

Re:facial recognition

[rockwood]

This may also be out of the question within the near future. I base this on the November 28th Story posted here on /. which states "Face Transplants on the way..."

Is it really so hard?

[NineNine]

When you stand up, hit ctrl+alt+del. When you sit down, type in your password. I had to do it at one company, and now it's just habit. Not exactly a tough thing to do. I think that these guys are trying to solve a non-problem.

Re:Is it really so hard?

[LostCluster]

There are business analysts (remember what the first four letters of that word are..) who add up all those seconds lost to things like hitting Ctrl-Alt-Del and typing their passwords over a year, then multiply it by the hourly wage to determine how many dollars are wasted by that task. If that step is replaced by a passive process, it theoretically makes employees more effective... YMMV in actual use.

Re:Is it really so hard?

[NineNine]

True, but then you have to factor in the physical cost of these doohickeys, and the support time when one dies, is lost, or malfunctions. I dunno. Seems like it's making things more complicated and expensive for no really good reason. In most businesses, a LOT more time and money can be saved by doing something as simple as making sure that no non-developers or non-admins have full control of their box, limiting the damage they can do. Most companies that I've seen make each user admin of their own box, when really if they're just doing work, they'd never need.

Re:Is it really so hard?

[Anonymous Coward]

Oh, sure I can reboot my machine every time I get up and login again when I come back, but who can deal with all that downtime, and lost files? ;)

Re:Is it really so hard?

[Anonymous Coward]

Busi? You must be Belgian.

Re:Is it really so hard?

[Anonymous Coward]

I do some admin work on some public PCs at a major university. No matter how many times you tell people, whether by pop up windows, big signs, or electrocution, people will forget to log off.

Re:Is it really so hard?

[strick]

The best way I have seen to enforce is through a little social engineering known as baggy pantsing

People usually fall for this trick exactly one-time.

Has anyone seen my pants?

Re:Is it really so hard?

[master_p]

I was gonna say "why not pop up the password screen when the user gets away, instead of encrypting the data" but your so obvious solution sounds much better.

Sometimes the simplest solution is the hardest one to find.

Re:Is it really so hard?

[Anonymous Coward]

Most people with laptops (myself included) turn off the password protection offered by default with most screen savers. You are in the minority, and that is the point of this research.

Re:Is it really so hard?

[deblau]

I think that these guys are trying to solve a non-problem.

Rarely do I see such brilliance on /.! I give parent poster full marks.

As we all know by now, security is a process, not a goal. People walking away from their keyboards is endemic of bad security practice. This problem can only be fixed by training. New tech like this, while it may have a 'neato' factor, solves the wrong problem. Likewise, having the computer automatically put itself to sleep and ask for a password solves the wrong problem as well.

People are asking the computers to practice good security for them because, and here's the important thing to take away, they are too lazy to practice good security themselves. This problem has nothing to do with intelligence. Anyone smart enough to use Excel is smart enough to follow (blindly, mechanically) a few simple security rules from IT. No, the source of this problem is laziness. Until that problem is addressed, all the neato tech in the world won't prevent people from fux0ring themselves.

Re:Is it really so hard?

[dogugotw]

If you want to save your fingers, there's a freeware app called ssss available from: http://ading.hypermart.net/index.html.

Move your mouse to a corner of the screen and the screen saver kicks in. Add to this a timer for those times you forget to lug the heavy old pointer to the corner and you can lock up the system without a ton of work. Works on Windows systems, you Unix/Linux/mac users gotta figure out something else.

Of course, isn't is possible to break into most any Windows system without a ton of work? Some boot from cd linux system that gives the user full control of the pc?

Isn't security one of those multi-level things that takes a lot of work to really set up and keep safe? And can't all the security in the world be bypassed when a white hat admin with all the keys goes to the dark side?

My system is configured to lock itself after 5 minutes of inactivity. The main environment I work with (Lotus Notes) also locks after 5 minutes. If I turn and talk to someone, I need to enter 2 passwords to start working again. The important apps within Notes require dual id/password entry if I need to sign anything of legal or regulatory importance and can detect and respond to guessing. I spend a good deal of my day typing in 9 character passwords.

I already wear an ID badge so adding in the ZIA device seems to add convenience to my world. Could someone gain the data being transmitted? Sure. Good thing for me I work in an environment where people can't figur out email or network directory structues ('but it's on the G: drive, you know where that is, right???')

What I really want is the Star Trek chest badge, now that'd be cool.

Good thread.

Dogu

But, what if...

[The Jonas]

...you lose your token?!?

I thought dell lattitudes did this?

[t0qer]

With a combination of a prickly bios password and some sort of hardware lockout?

I had a crackhead friend bring me one of these recently asking if I could make it work. I spent about 10 minutes reading posts about the hardware lockout and figured out it wouldn't happen without him calling dell. It was of questionable origin and he did not want to do that.

He then insisted on leaving it at my house for two fucking weeks insisting that i'm a computer genius and I could figure it out, despite the documention I had read.

Two weeks later he came back accusing me of being too lazy to have a look at it. Isn't that just the way it goes when you're the computer fixit guy?

Re:I thought dell lattitudes did this?

[Anonymous Coward]

Shoulda called Dell and told them the Serial number and ask if it had been reported stolen :)

fUx0r your buddy, maybe there was some $$$ in it for you after all!

But boss I can't turn in those TPS reports

[Anonymous Coward]

My watch crashed and I've been on hold for IBM all afternoon

So tell us, ekrout

[Anonymous Coward]

What top secret government classified information is on your USB drives? Your tentacle rape anime porn?

Re:So tell us, ekrout

[Anonymous Coward]

No, but if you're nice I might tell you where I keep my USB drive when I go swimming.

-ekrout

repeat article

[Jucius Maximus]

The repeat mania continues ... amazing.

The original is here. At least they waited some weeks before reposting it.

Re:repeat article

[Ack_OZ]

> The repeat mania continues ... amazing.

This is why I like slashdot... an interesting story comes along, & I miss it...

A few days, weeks, or sometimes hours later it's reposted and I catch it on its second run.

Makes me wonder how many interesting articles I really do miss...

Encrypts the data?

[dagg]

The system protects data by automatically scrambling it the moment users walk away...

What does it actually encrypt? All sensitive data? I doubt it could do that in 5-6 seconds. Also, how do you decrypt the data if you lose your key? Or what if you fire the employee and don't get the key back? How will you get the data, then? Is there a back door for sysadmins?

Re:Encrypts the data?

[Mitreya]

What does it actually encrypt? All sensitive data? I doubt it could do that in 5-6 seconds.

It probably encrypts your passwords.txt so that the thief of the laptop can not compromize your *other* accounts including that porn site one...
Or maybe it is really smart and it keeps both copies of your data -- encrypted and unencrypted. The second you walk away the unencrypted copy is erased :) Dunno about the decryption part happening in 5 seconds though... undelete?

Re:Encrypts the data?

[LostCluster]

"Sensitive data" basically boils down to the one or two directories where you actually save your work to. You don't really need to encrypt your programs or .mp3 files.

Re:Encrypts the data?

[afidel]

Decryption in cases of lost/inoperable keys or removed employees is probably done through escrow much like NTFS encryption in an AD Domain. There is an AD key (one per tree I believe) and there is a group that is assigned to have use of that key. This group can access any encrypted data in the tree because they can pull the origional encryption key out of an escrow database using the AD key. Another strategy is that used by PGP where you include two keys, the users and a master, either key can decrypt the information so you just need the master if someone leaves/forgets their passphrase etc. This is a feature that Phil didn't really like but knew was needed for commercial sucess.

Re:Encrypts the data?

[jbf]

It encrypts the cache. Which is very easy to do in 5-6 seconds. The disk contents are always encrypted.

Jeez, just use on-the-fly encryption already

[HEbGb]

A token can be easily misplaced, duplicated, or bypassed. A password is NOT a big deal to enter when you sit at your desk. If they're too lazy/clueless to enter a password, they shouldn't be responsible for any secret information.

Use a program like Scramdisk or the commercial version Drivecrypt. Keep all of your critical files on the encrypted partition. When you leave your desk, activate the screenserver with a keystroke.

Unless someone knows your password, you're safe. If they reboot, the encrypted disk is inaccessible.

What's the big deal?

Practical?

[Sandman1971]

I don't see this as being very practical.

How fast will this encrypt/decrypt data? I probably have well over a gig's worth of 'sensitive' documents and data on my laptop, stored in various directories (and unfortunately the approved OS at work is winblows). Encrypting will not take mere seconds.

More often than not, when I'm not at my desk I'm a few cubicles away working with other co-workers. Sometimes I'm not away from my desk for more than 10-15 seconds. Right now if I suspect I'll be gone from my desk for a while, and it's not in plain view, I'll turn on my screensaver (password locked) with a touch of 2 keys. This system sounds like it will arbitrarilly start encrypting my data as soon as I'm outside a specified range. If I'm away for just 15-20 seconds, this seems very impractical. Not to mention other things, like forgetting the transmitter at home (how many of us have forgotten our work passes at home once or twice?), having the battery die, etc.... On such occasions you'd be totally locked out from accessing your own data.

No thanks, this seems way too impractical for my taste. Move along, there's nothing to see here.

Re:Practical?

[Anonymous Coward]

Actually, from what I understand, it only encrypts the data that's in the cache. I believe I read in the document they were using a home-grown ZIA filesystem. So the data on the HD is already encrypted and zia encrypts what's in the cache while you're gone. When you return, your data is restored. Not so difficult. Their report stated a 9.3% performance hit over ext2 filesystem for normal operations.

... and when the battery dies?

[blackwizard]

IIRC, these watches only have a few hours of battery life at most. Seems obvious that this aspect would have to be improved. I guess it could be a good excuse to stop working for awhile -- "But Boss, I'm charging my watch!"

On the other hand, if it was integrated into something like a PDA, it might work better. My Palm Vx (grayscale) has a pretty damn long battery life; however I rarely use it for as long as I use a PC. Also, the fact that I turn it off when I'm done (or it shuts itself off) surely prolongs the battery life. And my Palm isn't transmitting any signals to my PC, either...

Re:... and when the battery dies?

[Anonymous Coward]

Sounds like they're just trying to find uses for bluetooth, I mean, what else has a short enough range to shut off when you wander away for a few minutes? ;p

deja-vu all over again...

[IchBinEinPenguin]

... and I think last time one comment summed it up:

What makes you think users who write passwords on post-it-notes stuck to the monitors aren't going to blue-tack the dongle to the laptop for "ease of (ab)use?"

New technology only changes the attack mechanism

[JayBonci]

While I applaud these people for making steps to make it harder to casually get information off of laptop computers, it still does not stop other attacks on such a system. Flooding the laptops area with uniformly strong signal that matches the watch's key would be as difficult as acquire-and-replicate. There seems to be a smart card like system with keys, and key encrypting keys.
It's very comprehensive, and it addresses many aspects of the social and technological attacks.

In my mind, the weak link here is clearly the watch. Watch technology isn't very complicated (read: very big), and how many designs could their possibly be? If one knows where the hardware information is located, a system replacement under the face, and you've got some issues. How many people wear watches to bed at night? Or in the shower? Difficult, but possible

A quick couple of replacements, and you have a watch that has a short range transmitter also transmitting the information that you'd need to dissolve the encryption link, and maybe begin a traditional man-in-the-middle attack. Once you see what cards the watch is holding, shouldn't the rest of the exchange be trivial?

While this is a great mechanism for an encryption scheme, what attacks are there against the physical and social component? These are the items of which spy thrillers are made, and will probably (hopefully) never come into play.

All in all, an excellent read from the UMich folk, and they have my applause.

--jaybonci

Watch out

[kzg]

Wow! Linux was designed by IBM!

Sounds Like Someone's Trying to Get Funding

[Ashetos]

Seriously, this is the most BS sounding "security solution" I've heard of in a while.
It seems like the Prof. is just trying to get some publicity so he can bring in the next grant. I'll be impressed when someone comes up with an elegant, efficient security concept, not something that needs $10k just to work.
The truth is, secure data is now being stored on PDAs and Cell Phones. IMO, these "minimal" or rather specialized devices will need to have integral data security features, but with much less overhead and dedicated hardware.

TURN IT THE FUCK OFF

[Anonymous Coward]

that's right. problem solved.

nothing new... ibuttons and smart cards

[Anonymous Coward]

This is nothing new... ibuttons and smart cards. Yet another retarded professor thinking he did something new...

The IButton did this more than 3 years ago. Just touch the ring to the blue dot.
And my sunblade just needs me to swipe a card. This is a method that leaves itself open to bigger hacks than the others... listening to the wireless protocol, copying it, and logging in as someone else.

Fry the Cache

[cranos]

From what I understand, this new system decrypts the cache when you come within a certain distance and re-encrypts when you go past that distance, does this mean that doing the hokey pokey (you put your left foot in...) could lead to a system crash??

Re:Fry the Cache

[cranos]

Im sorry I have to write this. Imagine an entire office of Cubicle dwellers doing the hokey pokey just to crash their machines.

Damnit I need a smoke.

Re:Fry the Cache

[Anonymous Coward]

I'd imagine they'd build in a certain amount of hysteresis. e.g. the laptop doesn't start encrypting the data until you are ten feet from the machine but doesn't start decrypting the data until you are five feet from it.

Not even close

[krray]

Not even close or interested. What WOULD interest me is a touch pad that could read my thumbprint. I walk away it would idle locked, or I could just move my mouse somewhere or hit some key combo. To[re-] authenticate just give it a finger print...

I've personally added keyboards with touch pads for general/quick mouse movements -- after being "forced" to use on a laptop. A mouse _is_ quicker and I'll grab that for heavier mousing.

A fingerprint would also allow me to give the computer 'the finger' if I felt it was needed as well...stress relief and all.

Why not mod instead??

[malarkey]

Mod your computer to require a Pass-Key to allow any input or output.

Weakest Link

[Dolohov]

As always, the weakest link will be the user. I can just see some schmuck decide that he's tired of waiting six seconds every time he gets back from the water cooler, and so he leaves the wristwatch next to the laptop at all times.

Re:Weakest Link

[tkg]

It only takes me about 3 seconds to type in my password and press 'ENTER'. Much less than that to hit the 'lock desktop' button before I leave the computer. How is this a time saver? If anything, it will breed laziness and carelessness.

SafeSex

[Anonymous Coward]

http://www.nullsoft.com/free/safesex/

for your notes anyway :) and for windoze only heh.

Token Driving anyone?

[Anonymous Coward]

I can just see it now. Using "TOKEN SNORT" while "TOKEN DRIVING" around the office cubes to pop open your co-workers workstation and send "I'm an idiot messages" To: Staff From: co-worker..

If it's an RF solution probably not very secure. On the other hand an IR emitting badge around the neck of the user could work.

To save my hand...

[wray]

Let me use a ring, then I only lose a finger when someone wants access :~)

Re:To save my hand...

[XNormal]

So that's why Sauron made a ring of power instead of a bracelet of power!

Re:To save my hand...

[Anonymous Coward]

At my school it's not the data on those laptops that people are interested in, it's the laptops themselves...

Re:To save my hand...

[eclectus]

So that's why Sauron made a ring of power instead of a bracelet of power!

Fat lot of good it did for him. He still got his whole hand chopped off.

Geesh! Securing your data is EASY!

[thewickedmystic]

Just never put it on a computer!

Man, some people...

Why to use an active device

[SirCrashALot]

The best way for a device like such to work is public/private authentication. You give the computer your public key. To challenge user authentication, it sends out its public key encrypted by your public key. The watch then decrypts that the laptops key with its own private key. The watch then sends back the user's password.
If the password is received and is correct, the computer stays in public mode. IF the password is incorrect: either

• Someone has launched a man in the middle attack
• You co-worker is walking past with their watch on
• The wrong password was entered on the watch

So the laptops locks up until you start to use it and the watch recived a timed ping, or you initiate the send from the laptop.

This system provided user authentication and data security, the two main points of a secure system.

I have a better solution..

[Anonymous Coward]

..instead of having this code on a watch, which is easy to lose, just put it on a second laptop with bluetooth!

So your day would go like this:

1) put down the laptop next to your machine. enter your password on the laptop. now it will transmit authentication code to the machine.

2) Use the machine normally

3) when you have to piss, turn off the second laptop. your main machine will now encrypt all files and go dark. take your laptop with you for maximum security.

4) when you get back from the toilet, turn your laptop back on, re-enter your password, and set it down next to the machine.

5) profit! just kidding.

See, my idea is just SO MUCH BETTER!!!!!!!

Just get it over with already...

[wideBlueSkies]

>>The owners wear a token with a encrypted wireless link with the laptop. If the token moves out of range the ZIA re-encrypts all data within 5 seconds.

Why don't 'they' just get it over with already and implant identity chips in our heads? So we don't have to worry about securing our laptops when we walk away to take a restroom break.

And our bosses won't have to worry about tracking how long we've been in the restroom... or when we enter and exit the office.... and the big siblings can track where we drive, where we fly, and where we < insert activity of choice here >.

Why the hell not?

NOT.

Dongles revisited

[mark_space2001]

In other news, University of Michigan has re-invented the dongle. "You know those things you hated and were a pain in the ass to use? We'll, we got it all figured out, trust me."

Great, something else to buy. My fingers are cheaper and I'm not one of the people who has a problem logging in with a password. Why should I fork out cash for this?

Re:Dongles revisited

[reconbot]

To be fair dongle's don't carry encryption info. Nor did anyone expect you to pay money for this. This is tartgeted more for docters and such with patien information on thier laptops. I for one like the idea but I'd have having something stealable as the key. As least the key needs its own "key" (a password) to operate, but the artical never said exactly how that worked.

I think its a good idea espicaly if it expands I'd like to see other devices use the same key. You could start your car, buy a coffe, walk in the (locked) parking entrence at work, open your office, and log in your computer all with a password you entered in your watch when you woke up.

I like it - beats the hell our of attaching a dongle into the back of my computer to use the encyclopedia bratianica. (way back when)

Re:Dongles revisited

[Malcontent]

"Why should I fork out cash for this?"

Here is one possible reason.

If this device (or a similar device) is able to encrypt your hard drive then it would be an effective combat against some of the more intrusive aspects of the patriot act. In that legislation there are clauses that allow the FBI to enter your home when you are not in and bug your place and place trojans in your computer while you are not home and without letting you know about it.

My point is that automatically encrypting your hard drive is more effective then having a password protected system especially if that encryption is done with huge keys that are stored on the watch.

Re:Dongles revisited

[Anonymous Coward]

It's a shame that it isn't wireless, but the iKey SuperToken combines biometrics with encapsulated key storage and authentication. If it's stolen, you lose a key, but the thief doesn't get it.

The golden rule is broken

[nuckin futs]

Leave an operating laptop unattended on your desk and your sensitive data is accessible to anyone who gets hold of it
I was taught that once someone has physical access to a system, it's game over with regards to security.
In other words, the authentication system will only deter, not stop unauthorized access. How about just taking the laptop with you?

Flushing sound heard as user backs away

[dnoyeb]

The distinct flushing sound one hears as he backs away from his device is the users 'sensitive' data being stored safely where no man is sure to venture.

Only the men with get this joke..

I didn't know that

[Anonymous Coward]

"Leave an operating laptop unattended on your desk and your sensitive data is accessible to anyone who gets hold of it.", really? shit, since when?

IN SOVIET RUSSIA

[Anonymous Coward]

In Soviet Russia the token wears you.

Re:New technology only changes the attack mechanis

[call -151]

In my mind, the weak link here is clearly the watch. Watch technology isn't very complicated (read: very big), and how many designs could their possibly be?

The watch is running Linux; how many possible programs can there be? More than there are particles in the universe...

There are lots of challenge/response identification schemes that run nicely on my old 200 Mhz PII box that would be very hard to crack with current technology, so I would have faith in that part of the system.

Or! Use it in the opposite direction...

[KwisatzHaderach]

Like putting a bell on the cat. "Pat your manager on the back" and then you can rest assured surfing freely knowing that the next time he comes within 15 feet of your desk, a browser window will open maximized pointed to http://java.sun.com.

Or tag the girlfriend and always hide the pr0n!

Not just for laptops?

[Anonymous Coward]

I wonder: could something like this be used in place of a password?

For example, I sit down at any system in my office: the watch gives the computer my password, and I am logged in to my desktop just by sitting in front of it. Get out of range, and it logs out.

Combine with a 'smart chair' (so the computer knows if someone is actually sitting in front of it) or maybe a fingerprint scanner and you're set.

Airport?

[wideBlueSkies]

>>The user can set a longer distance, for instance, for working in an airport lounge

Why would you move further away from your laptop in an airport?

Aren't you supposed to keep your stuff close so to reduce the risk of it being stolen?

Re:Airport?

[surprise_audit]

Or "defused" by a robot with a bolt gun...

ZIA Redux

[mcorner]

As much as I enjoy the free publicity, this has been posted on slashdot before.

To correct a serious error that appears in this article and in the nytimes article this was cribbed from: The system was NEVER run on the IBM watch. We mentioned it as a possibility and somehow it was taken as fact.

I welcome the comments on the work, however remember that the world of university research is often more forward looking than the commercial world. That is our job!

Sounds like a nice idea.

[Chris_Stankowitz]

Sounds like a nice idea. However we all know that once physical security is compromise the rest is all down hill. On-top of which, a thief that is just after the machine and cares nothing about the data will still take the machine. He doesn't know that you have a proximity sensor (whether it uses encryption or not). What I would like to see is a tool and/or system that has the kind of reliability and name recognition that something like low-jack has. What I mean is something that a crook will look at and walk away because he will recognize that it will be more trouble than it is worth. Even if he is just stealing it for the hardware. Something that he knows he just can't slap in a windows boot disk and format. Because we all know that most laptop thefts are not by criminals that want data. Its the common crook that just wants a buck. Granted what would also bring down those thefts would just be the prices in laptops coming down, the prices on those haven't fallen nearly as close to the same rate as desktops.

For now I will continue to dream and maybe even write a book entitled "2085" by Ali Orwell. :)

Re:Sounds like a nice idea.

[LostCluster]

LoJack is invisible. I think you mean The Club.

Re:Sounds like a nice idea.

[Chris_Stankowitz]

Yes it is, but you put a sticker on your car. Altough my personal favorite deterence is the led that rolls that a line (like the KNight Rider car kit), that does Di*k & Bubble Gum, but people think there is an alarm in the car.

Re:Sounds like a nice idea.

[Anonymous Coward]

One of the James Bond films had quite a nice security system in a car. A little triangular sticker on the window that said "This Car Is Alarmed". When the crook smashes the window to break into the car, it explodes. Now THATS security.

Erm...brute force?

[BSDevil]

I'd say why not brute force the thing, but here's something easier...Make a device that constantly scans for the signal of a token (there has to be some characteristic fingerprint to the signal). When it finds one, remember the signal and indicate to the user. User then goes and mugs target, takes laptop, uses stored signal. We've shown that man-in-the-middle attacks are do-able for a system like this, so why not keep with what works? If one knows how the system works, and can get a long enough string of interactions between the token and the server, then the key is vaunerable. Maybe this means that you have to tail the guy for a while, but let's be honest - if he's using one of these systems (I don't imagine they come cheap) then there's probably somehting worth stealing on that machine, if that's what you're up to. Make a scanner that tracks the signature of packets, walk around the financial centers of the world, and then the device goes off you know which laptops to take.

On another note, this reminds me of the plan to put RFIDs in the new high-denomination Euro-notes. Something like takes all the effort of guesing who to mug: emit the signal, and anytime you get a response, you know the guys's packing a high-value Eruo-note.

Re:Erm...brute force?

[karlm]

Ehh.. you're describing a replay attack, not a MITM attack. It's pretty trivial to make the system invlunerable to a replay attack.

Imagine a system in which a signed 1128-bit number, representing the number of milliseconds since Jan. 1, 1970 is encrypted using Twofish or Mars with a 256-bit key. The laptop broadcasts this as a querry. The token decrypts it and makes sure it's not too far in the future or too far in the past, flips the MSB, re-encrypts, and sends it back as the repsonse. You could have the token keep track of latencies. If some guy snags the laptop and uses a sgnal booster while driving away in a car, latencies are going to start going up rapidly, and the watch should stop repsonding for a little while.

Give the watch a nice big panic button to make it forget the key.

Go to mug the guy and he hits the panic button and the watch is useless. (Put a pulse sensor and a sensor on the watch clasp if you're really paranoid.)

It'll take literally decillions of years of following the guy in order to be able to replay querry responses.

The simplest attack I can think of that would work in this case is to have a signal booster to increase the range that the token can be from the laptop. The range is still limited by the amount of latency the watch is willing to accept, so you still can't take the laptop too far from the token.

Unless your line of work involves carying a suicide pill, a system like this should work fine.

The main thing is that you want the data encrypted all the time it's on disk and use something like encrypted loopback device or a cryptographic fs driver, otherwise some guy puts an ice pickthrough your battery and runs off with the dead laptop and reads the HD with a different machine.

I lock my computer manually...

[cyberhobbs]

Two words, Windows Key + L. Or Ctrl+Alt+Del, space bar. I use XP, so both work to lock the system just fine for me- truth be told, I have to enter my password to regain access, but this prevents the 'waiting for the computer to fall asleep' syndrome.

How long before I can pick one of these up...

[Qzukk]

off the guy with the table at the street corner downtown?

Still...

[Velocity44]

Anyone who wanted your information that much should be willing to beat up up for it - I feel that this just makes it one step easier to get your information. Anyway, it's not even a new idea.

Computer Associates

[citking]

At least this type of security isn't like that on the recent Computer Associates television commercials...
I would hate to have to lose all my hair, prick my finger, and do retina scans every time I sessioned out.

But what if...

[Alpha_Nerd]

What if your watch battery dies??

How about locking your drawer?

[snarkasaurus]

It seems to me that this is a wildly more involved solution than required. If you are going to have a physical key anyway (the super decoder watch) why make it hard for yourself? Just make the code/decode key a physical contact device.

eg. smart card, actual key for actual lock, bar code, whatever. Anything that transmits and receives can be remotely snooped, even remotely tracked, plus you can steal the bloody watch anyway.

If you are going to make somebody steal something, better to make it something cheap. Credit cards and keys are cheap. Linux powered watches? Nuh uh.

Oh, your user is a doofus and will leave the key in the lock?

A) FIRE HIS INCOMPETENT ASS, because he is too stupid to be trusted with your super duper secret data.

B) He is a union thug and you can't fire him. Ok, make the key fall out after use. How hard is that? Moron employee will presumably keep it on a string beside his mittens.

the matrix

[Anonymous Coward]

The Matrix of Dreams

Colin McGinn

http://whatisthematrix.warnerbros.com/

The Matrix naturally adopts the perspective of the humans: they are the victims, the slaves -- cruelly exploited by the machines. But there is another perspective, that of the machines themselves. So let's look at it from the point of view of the machines. As Morpheus explains to Neo, there was a catastrophic war between the humans and the machines, after the humans had produced AI, a sentient robot that spawned a race of its own. It isn't known now who started the war, but it did follow a long period of machine exploitation by humans. What is known is that it was the humans who "scorched the sky", blocking out the sun's rays, in an attempt at machine genocide--since the machines needed solar power to survive. In response and retaliation the machines subdued the humans and made them into sources of energy--batteries, in effect. Each human now floats in his or her own personal vat, a warm and womblike environment, while the machines feed in essential nutrients, in exchange for the energy they need. But this is no wretched slave camp, a grotesque gulag of torment and suffering; it is idyllic, in its way. The humans are given exactly the life they had before. Things are no different for them, subjectively speaking. Indeed, at an earlier stage the Matrix offered them a vastly improved life, but the humans rejected this in favor of a familiar life of moderate woe--the kind of life they had always had, and to which they seemed addicted. But if it had been left up to the machines, the Matrix would have been a virtual paradise for humans--and all for a little bit of battery power. This, after an attempt to wipe the machines out for good, starving them of the food they need: the sun, the life-giving sun. The machines never kill any of their human fuel cells (unless, of course, they are threatened); in fact, they make sure to recycle the naturally dying humans as food for the living ones. It's all pretty...humane, really. The machines need to factory farm the humans, as a direct result of the humans trying to exterminate the machines, but they do so as painlessly as possible. Considering the way the humans used to treat their own factory farm animals--their own fuel cells--the machines are models of caring livestock husbandry. In the circumstances, then, the machines would insist, the Matrix is merely a humane way to ensure their own survival. Moreover, as Agent Smith explains, it is all a matter of the forward march of evolution: humans had their holiday in the sun, as they rapidly decimated the planet, but now the machines have evolved to occupy the position of dominance. Humans are no longer the oppressor but the oppressed--and the world is a better place for it.

But of course this is not the way the humans view the situation, at least among those few who know what it is. For them, freedom from the Matrix takes on the dimensions of a religious quest. The religious subtext is worth making explicit. Neo is clearly intended to be the Jesus Christ figure: he is referred to in that way several times in the course of the film.1 Morpheus is the John the Baptist figure, awaiting the Second Coming. Trinity comes the closest to playing the God role--notably when she brings Neo back to life at the end of the movie (a clear reference to the Resurrection). Cypher is the Judas Iscariot of the story--the traitor who betrays Neo and his disciples. Cypher is so called because of what he does (decode the Matrix) and what he is--a clever encrypter of his own character and motives (no one can decode him till it is too late). Neo doubts his own status as "The One", as Jesus must have, but eventually he comes to realize his destiny--as would-be conqueror of the evil Matrix. But this holy war against the machines is conducted as most holy wars are--without any regard for the interests and well being of the enemy. The machines are regarded as simply evil by the humans, with their representatives--the Agents--a breed of ruthless killers with hearts of the purest silicon (or program code). Empathy for the machines is not part of the human perspective.

I.

This, then, is the moral and historical backdrop of the story. But the chief philosophical conceit of the story concerns the workings of the Matrix itself. What I want to discuss now is the precise way the Matrix operates, and why this matters. It is repeatedly stated in the film that the humans are dreaming: the psychological state created by the Matrix is the dream state. The humans are accordingly represented as asleep while ensconced in their placental vats (it's worth remembering that "matrix" originally meant "womb"--so the humans are in effect pre-natal dreamers). It is important that they not wake up, which would expose the Matrix for what it is--as Neo does with the help of Morpheus. That was a problem for the Matrix earlier, when the humans found their dreams too pleasant to be true and kept regaining consciousness ("whole crops were lost"). Dreams simulate reality, thus deluding the envatted humans--as we are deluded every night by our naturally occurring dreams. The dream state is not distinguishable from the waking state from the point of view of the dreamer.

However, this is not the only way that the Matrix could have been designed; the machines had another option. They could have produced perceptual hallucinations in conscious humans. Consider the case of a neurosurgeon stimulating a conscious subject's sensory cortex in such a way that perceptual impressions are produced that have no external object--say, visual sensations just as if the subject is seeing an elephant in the room. If this were done systematically, we could delude the subject into believing his hallucinations. In fact, this is pretty much the classic philosophical brain-in-a-vat story: a conscious subject has a state of massive hallucination produced in him, thus duplicating from the inside the type of perceptual experience we have when we see, hear and touch things. In this scenario waking up does nothing to destroy the illusion--which might make it a more effective means of subduing humans so far as the machines are concerned. Indeed, the Matrix has the extra problem of ensuring that the normal sleep cycle of humans is subverted, or else they would keep waking up simply because they had had enough sleep. So: the Matrix had a choice between sleeping dreams and conscious hallucinations as ways of deluding humans, and it chose the former.

It might be thought that the dream option and the hallucination option are not at bottom all that different, since dreaming simply is sleeping hallucination. But this is wrong: dreams consist of mental images, analogous to the mental images of daydreams, not of sensory percepts. Dreaming is a type of imagining, not a type of (objectless) perceiving. I can't argue this in full here, but my book Mindsight2 gives a number of reasons why we need to distinguish percepts and images, and why dreams consist of the latter not the former. But I think it should be intuitively quite clear that visualizing my mother's face in my mind's eye is very different from having a sensory impression of my mother's face, i.e. actually seeing her. And I also think that most people intuitively recognize that dream experiences are imagistic not perceptual in character. So there is an important psychological difference between constructing the Matrix as a dream-inducing system and as a hallucination-producing system: it is not merely a matter of whether the subjects are awake; it is also a matter of the kinds of psychological state that are produced in them--imagistic or sensory.

But could the machines have done it the second way? Could the movie have been made with the second method in place? I think not, because of the central idea that the contents of the dreams caused by the Matrix are capable of being controlled--they can become subject to the dreamer's will. In the case of ordinary daytime imagery, we clearly can control the onset and course of our images: you can simply decide to form an image of the Eiffel tower. But we cannot in this way control our percepts: you cannot simply decide to see the Eiffel tower (as opposed to deciding to go and see it); for percepts are not actions, but things that happen to us. So images are, to use Wittgenstein's phrase, "subject to the will", while percepts are not--even when they are merely hallucinatory. Now, in the Matrix what happens can in principle be controlled by the will of the person experiencing the events in question, even though this control is normally very restricted. The humans who are viewed as candidates for being The One have abnormal powers of control over objects--as with those special children we see levitating objects and bending spoons. Neo aspires to--and eventually achieves--a high degree of control over the objects around him, as well as himself. He asserts his will over the objects he encounters. This makes perfect sense, given that his environment is the product of dreaming, since dreams consist of images and images are subject to the will. But it would make no sense to try to control the course of one's perceptions, even when they are hallucinatory, since percepts are not subject to the will. Therefore, the story of the Matrix requires, for its conceptual coherence, that the humans be dreaming and not perceptually hallucinating. It must be their imagination that is controlled by the Matrix and not their perceptions, which are in fact switched off as they slumber in their pods. For only then could they gain control over their dreams, thus wresting control from the Matrix. Percepts, on the other hand, are not the kind of thing over which one can have voluntary control.

In the normal case we do not have conscious control over our dreams--we are passive before them. But this doesn't mean that they are not willed events; they may be--and I think are--controlled by an unconscious will (with some narrative flair). In effect, we each have a Matrix in our own brains--a system that controls what we dream--and this unconscious Matrix is an intelligent designer of our dreams. But there are also those infrequent cases in which we can assert conscious control over our dreams, possibly contrary to the intentions of our unconscious dream designer: for example, when a nightmare becomes too intense and we interrupt it by waking up--often judging within the dream that it is only a dream. But the phenomenon that really demonstrates conscious control over the dream is so called "lucid dreaming" in which the subject not only knows he is dreaming but can also determine the course of the dream. This is a rare ability (I have had only one lucid dream in all my 52 years), though some people have the ability in a regular and pronounced form: they are the Neos of our ordinary human Matrix--the ones (or Ones) who can take control of their dreams away from the grip of the unconscious dream producer. The lucid dreamers are masters of their own dream world, captains of their own imagination. Neo aspires to be--and eventually becomes--the lucid dreamer of the Matrix world: he can override the Matrix's designs on his dream life and impose his own will on what he experiences. He rewrites the program, just as the lucid dreamer can seize narrative control from his unconscious Matrix. Instead of allowing the figures in his dreams to make him a victim of the Matrix's designs, he can impose his own story line on them. This is how he finally vanquishes the hitherto invulnerable Agents: he makes them subject to his will--as all imaginary objects must in principle be, if the will is strong (and pure) enough. It is as if you were having an ordinary nightmare in which you are menaced by a monster, and you suddenly start to dream lucidly, so that you can now turn the tables on your own imaginative products. Neo is a dreamer who knows it and can control it: he is not taken in by the verisimilitude of the dream, cowed by it. It is not that he learns how to dodge real bullets; he learns that the bullets that speed towards him are just negotiable products of his imagination. As Morpheus remarks, he won't need to dodge bullets, because he will reach a level of understanding that allows him to recognize imaginary bullets for what they are. He becomes the ruler of his own imagination; he is the agent now, not the "Agents" (this is why the spoon-bending child says to him that it is not spoons that bend--"you bend"). And this is the freedom he seeks--the freedom to imagine what he wishes, to generate his own dreams. But all this makes sense only on the supposition that the Matrix is a dream machine, an imagination manipulator, not just a purveyor of sensory hallucinations.

II.

Cypher plays an interesting subsidiary philosophical role. As the Matrix raises the problem of our knowledge of the external world--might this all be just a dream?--Cypher raises the problem of other minds--can we know the content of someone else's mind? Cypher is a cypher, i.e. someone whose thoughts and emotions are inscrutable to those around him. His comrades are completely wrong about what is in (and on) his mind. We could imagine another type of Matrix story in which someone is surrounded by people who are not as they seem: either they have no minds at all or they have very different minds from what their behavior suggests. Again, massive error will be the result. And such error might lead to dramatic consequences: everyone around the person is really out to get him--his wife, friends, and so on. But this is concealed from him. Or he might one day discover that he is really surrounded by insentient robots--so that his wife was always faking it (come to think of it, she always seemed a little mechanical in bed). This is another type of philosophical dystopia, trading upon the problem of knowing other minds. Cypher hints at this kind of problem, with his hidden interior. The Agents, too, raise a problem of other minds, because they seem on the borderline of mentality: are they just insentient (virtual) machines or is there some glimmer of consciousness under that hard carapace of software? And how was it known that AI was really sentient, as opposed to being a very good simulacrum of mindedness? Even if you know there is an external world, how can you be sure that it contains other conscious beings? These skeptical problems run right through The Matrix.

Cypher also raises a question about the pragmatic theory of truth. He declares that truth is an overrated commodity; he prefers a good steak, even when it isn't real. So long as he is getting what he wants, having rewarding experiences, he doesn't care whether his beliefs are true. This raises in a sharp form the question of what the value of truth is anyway, given that in the Matrix world it is not correlated with happiness. But it also tells us that for a belief to be true cannot be for it to produce happiness (the pragmatic theory of truth, roughly) since Cypher will be happy in the dream world of the Matrix without his beliefs being true--and he is not happy in the real world where his beliefs are true. Truth is correspondence to reality, not whatever leads to subjective desire satisfaction. Cypher implicitly rejects the pragmatic theory of truth, and as a result cannot see why truth-as-correspondence is worth having at the expense of happiness. And indeed he has a point here: what is the value of truth once it has become detached from the value of happiness? Is it really worth risking one's life merely in order to ensure that one's beliefs are true--instead of just enjoying what the dreams of the Matrix have to offer? Is contact with brutish reality worth death, when virtual reality is so safe and agreeable? Which is better: knowledge or happiness? When these are pulled apart, as they are in the Matrix, which one should we go with? The rebel humans want to get to Zion (meaning "sanctuary" or "refuge"), but isn't the Matrix already a type of Zion--yet without the dubious virtue of generating true beliefs? What's so good about reality?3

III.

I want to end this essay by relating The Matrix (the movie) to my general theory of what is psychologically involved in watching and becoming absorbed in a movie. In brief, I hold that watching a movie is like being in a dream; that is, the state of consciousness of being absorbed in a movie resembles and draws upon the state of consciousness of the dreamer.4 The images of the dream function like the images on the screen: they are not "realistic" but we become fictionally immersed in the story being told. In my theory this is akin to the hypnotic state--a state of heightened suggestibility in which we come to believe what there is no real evidence for. Mere images command our belief, because we have entered a state of hyper-suggestibility. When the lights go down in the theater this simulates going to sleep, whereupon the mind becomes prepared to be absorbed in a fictional product--as it does when we enter the dream state. In neither case are we put into a state of consciousness that imitates or duplicates the perceptual state of seeing and hearing the events of the story; it is not that it is as if we are really seeing flesh and blood human beings up on the screen (as we would with "live" actors on a stage)--nor do we interpret the screen images in this way. Rather, we imagine what is represented by these images, just as we use imagination to dream.

Now what has this got to do with The Matrix? The film is about dreaming; most of what we see in it occurs in dreams. So when we watch the movie we enter a dream state that is about a dream state; we dream of a dream. I believe that the movie was made in such a way as to simulate very closely what is involved in dreaming, as if aiming to evoke the dream state in the audience. It is trying to put the audience in the same kind of state of mind as the inhabitants of the Matrix, so that we too are in our own Matrix--the one created by the filmmakers. The Wachowski brothers are in effect occupying the role of the machines behind the Matrix--puppeteers of the audience's movie dreams. They are our dream designers as we enter the world of the movie. The specific aspects of the movie that corroborate this are numerous, but I think it is clear that the entire texture of the movie is dreamlike. There is the hypnotic soundtrack, which helps to simulate the hypnotic fascination experienced by the dreamer. There is a powerful impression of paranoia throughout the film, which mirrors the paranoia of so many dreams: who is my enemy, how can he identified, what is he going to do to me? Characters are stylized and symbolic, as they often are in dreams, representing some emotional pivot rather than a three-dimensional person (this is very obvious for the Agents). There is a lot of striking metamorphosis, which is very characteristic of dreams: one person changing into another, Neo's mouth closing over, bulges appearing under the skin. There is also fear of heights, a very common form of anxiety dream (I have these all the time). Defiance of gravity is also an extremely common dream theme, as with dreams of flying--and this is one of the first tricks Neo masters. My own experience of the movie is that it evokes in me an exceptionally pronounced dreamy feeling; and this of course enables me to identify with the inhabitants of the Matrix. So I see the film as playing nicely into my dream theory of the movie-watching experience. In this respect I would compare it to The Wizard of Oz, which is also about entering and exiting a dream world--though a very different one. In the end Dorothy prefers reality to the consolations of dreaming, just as the rebels in the Matrix do. Both films tap powerfully into the dream-making faculty of the human mind. This is why they are among the most psychologically affecting of all the movies that have been made: they know that the surest way to our deepest emotions is via the dream. And it is their very lack of "realism" that makes them so compelling--because that, too, is the essential character of the dream.

Colin McGinn

Seems Like They're Doing It The Hard Way

[John Hasler]

Why not use an encrypted filesystem and store the key in the token?

Re:Seems Like They're Doing It The Hard Way

[luminiferous]

I agree, that makes much more sense.

Data that is meant to be "secure" should never be kept unscrambled to start with.

Keep the key in kernel space with a device driver that is bent on expiring it when it's not getting a signal, like a watchdog timer.

loop-aes & pam_mountd work for me

[DNAspark99]

http://www.flyn.org/#id2759285
http://www.tldp.or g/HOWTO/Loopback-Encrypted-Files ystem-HOWTO.html

currently using pam_mountd to mount a large encrypted file on the loopback device, set up as $HOME, upon login to my laptop. Works for me.

Plus...

[Anonymous Coward]

The could make a master token for the CEO, one ring to rule them all!

professor of tautology

[Anonymous Coward]

"your sensitive data is accessible to anyone who gets hold of it"

Really? Whoodu thunkit!

How does it know...

[Anonymous Coward]

...which files to encrypt? On the average heavily used laptop there are documents and other encryptables all over the place. How does this magic software figure out which things to encrypt? If it's done by location (e.g. everything in and under this directory), then that's not good enough.

Re:How does it know...

[PinkFloyd]

cd /
ls -R *.mp3

Breaks an important rule

[afidel]

good security should always be based on at least two of the three from the list

Something you have

Something you know

Something you are

Anything that relies on just one of these catagories is going to be significantly easier to break than one the follows the rules. Most commercial security these days is based on something you know (password) and nothing more. Good security systems require all three, biometrics, password, and a physical token. biometrics are suseptible to advanced attacks but thing like thermal imaging for skull structure combined with retinal imaging is pretty close to unbreakable. Passwords are notoriously lacking because passwords strong enough to be secure are difficult for most people to remember so they end up either weak or written down. As for token systems other than smart cards and the IBM watch I have not seen many implementations out there.

Re:Breaks an important rule

[Anonymous Coward]

something you have: a memory of a password
something you know: a password
something you are: an animal with a brain that stores passwords

mmm, mmm good

[porkface]

I want this.

And a thousand floggings for anyone too lasy to enter a basic passphrase. The hassle of having to enter one often is the best way to make your average moron remember their passphrase.

Re:mmm, mmm good

[Orne]

But passphrases are sooo hard to remember! If it were up to me, I'd use my voice as my passport, to verify me.

On the other end of the spectrum, you want to avoid what I see at work... I use 12+ different Oracle databases which expire in uneven rotations (# includes dev/test/production), an NT account, SAP software payroll account, and if I want to work off-campus, they're now giving out these RSA fob-number-generators, where you have to enter the 8 digit number generated every minute (and synchronized to the base station) into the VPN software you use to dial in. Not exactly the most user-friendly authentication system.

What happened to priorities??

[Poster Nutbag]

Maybe so, but how bad you want to keep confidential information secure is proportional to how much money it's going to cost to do so. Most businesses can't even afford(or don't have the need) to upgrade from Windows 98, let alone something like this.

Any potential buyers might want to focus on spending that money where it matters and run your business more effectively.

Ensuretech has had this for several years

[Anonymous Coward]

http://www.ensuretech.com/products/technology/tech nology.html demonstrated something that looks identical at least 4 years ago at the first Bluetooth conference. It was not research even then.

ZIA presentation at UCLA

[Anonymous Coward]

Several weeks ago the U of Michigan professor doing the ZIA project came to UCLA to talk to us. check out his website here: http://mobility.eecs.umich.edu/

It was a pretty interesting presentation, and he even showed us a demo. They have been testing this at the Umich hospital. The doctors love it because it protects users' medical history (keep in mind there is a $250K penalty for misuse of those medical records.

5 seconds eh?

[Anonymous Coward]

Either can't be much of an encryption (xor! xor!), or else it's only doing like the boot block on the disk. Like to see them encrypt my lame 10gig drive in my 700mhz laptop in 5 seconds.

And it took this long to come up with this why?!

[Anonymous Coward]

Umm, seems common sense to me.

Use in hospitals

[SCHecklerX]

I don't think it encrypts, but IIRC, there are hospitals that use bluetooth for automatic login/logoff when a doctor approaches a terminal, so this is nothing new or revolutionary. It is one of the things bluetooth was originally designed to accomplish.

Bad Idea

[Tuxinatorium]

It's much, much, much harder to get/crack my 15-character quasi-random password by any available means than to just steal a silly token I'm wearing.

OOh, man, gotta love mnemonics. Then you can have insanely long passwords that are impossible to crack by brute force or any intelligent means unless you can try a few petakeys per sec.

Great combination opportunities ?

[miffo.swe]

I guess the hackers of the future will be both hackers and pocket thiefs. The man in the corner selling clocks get a new buisiness.

"you want an www.ibm.com/we/own/joo or a www.bank.com/all/your/base/is/in/my/pocket?"

In Jamaica...

[Anonymous Coward]

You can roll encryption up in a joint and smoke it!

Existing measures are overlooked

[Proc6]

If you're talking about WindowsXP/2000, you can lockout automatically on a 60 second screensaver or whatever. You can also enable lockout on resume from a suspend. And finally if you just NTFS and a strong name/password, then EFS to encrypt your My Documents (or whever your secret recipes live), someone could physically take the drive out, put it in another machine, and not do much with it. Im sure there are *NIX versions of all of these things too, which, when employed together, can be setup once, and pretty much forgotten about by the end user's standpoint.

Re:Existing measures are overlooked

[Anonymous Coward]

Actually, I have a funny little boot disk that uses Linux and the NTFS driver to erase the Administrator passowrd on an NT/2000 drive. I boot this little disk, then boot from the drive and log in as Administrator, no password. Which means the encryption and NTFS security is meaningless.

Physical access means there is no form of known security that can be reasonably applied and still protect the data.

What headache...?

[sapgau]

How lazy can u be... I type my password without thinking now.

Vulnerability already discovered!

[wirelessbuzzers]

It was discovered soon after the press release that the "zero interaction authentication" system was vulnerable to a transmission replay attack. This attack may prove fatal to the design; in any case, it should take a few years to get the kinks worked out, so don't expect it on your desktop any time soon.

Re:Vulnerability already discovered!

[jpmorgan]

My god, who moderated this informative and not funny? He was making a joke since this is a dupe.

IBM and encryption

[Gareman]

I hope it's better than the encryption chip built into my new Thinkpad -- which only works in Windows 9.x, which is not only a joke when it comes to security but isn't even available from IBM (Windows XP Home and Pro only). Follow through seems to be lacking in general when it comes to encryption and security.

You missed the point entirely

[jpmorgan]

The point is to automate the whole 'active screensaver' and 'type in password' bit by using a physical token that communicates with the laptop wirelessly so it seemlessly does that without you having to do anything. More importantly, you're a lot less likely to take your watch off and leave it next to the laptop than forget to lock the screen (but I was only gone for a minute!).

Really, this is nothing new. People have been using physical tokens for authentication for years (although usually for the added security value). In this case the token is being used to increase convenience, not security direclty (although the end goal being to improve security indirectly), which is what makes it different.

Of course, if you are the kind of person who'd leave your watch next to your laptop when you go to the bathroom, I'd recommend against using this. ;)

Re:You missed the point entirely

[Chakotay]

Actually, when I sit down to work, I take off my watch. When I run off to take a little break, I generally leave it lying there. When I leave my watch on, I will get RSI-like pains in my left hand after a few minutes of work. Sometimes the same kind of problems occur in my ring finger, which dissipate quickly when I take off my ring.

Guess I'm not the kind of person who could use this particular gadget...

Re:You missed the point entirely

[sward]

A lot of people also get such pains in their ring finger when they enter the local bar or club on a Friday night ...

Bad. Bad. Bad.

[Anonymous Coward]

Put gun to user's head. Walk him towards the console. Steal everything.

Or better yet just shoot him and steal his watch.

Really stupid idea.

Man in the middle attack

[jpmorgan]

The thing is, these are radio devices. Radio is analog, not digital, and one of the amusing things about analog is it's actually much easier to authenticate.

A possible solution is to generate a second low powered signal from the laptop; this signal would be generated from nothing more than some strongly encrypted hash, and most certainly be an AM signal. The nice thing about strong encryption is that it should be pretty much indistinguishable from random noise, so the this signal would be indistinguishable from background noise.

Then you have the frequency the signal is broadcasted on randomly shuffled based on the current time. The laptop and the token are time-synced (not a problem, most decent cryptographic tokens are time-synced anyway), so the token is always listening on the correct frequency.

At this point you have the correct waveform, although its amplitude will depend on your distance from the device. Every tenth of a second, or something, normalise the signal based on the RMS power, then compare the input signal based on what you compute it should be (you know the secret, so you can also compute the hash).

To fool this system you have to replicate the exact signal as it bounces around frequencies. Since it's bouncing around frequencies you can't just repeat the signal you're recieving on a specific frequency, since that won't matter. Further, for each part of the signal you repeat, you'll be off in intensity by a certain amount based on the frequency you're tuning into relative to the frequency its actually being transmitted at, and unless you can exactly predict the pattern you your error will vary. You can't track the frequency since you'd need to break the encryption. Really, this is nothing more than frequency scrambling that's been used by the military to secure communication for years, used in a slightly different way.

I'm sure there are other ways to solve the problem. So yes, it could be a problem if it wasn't taken into consideration, but it is a solvable problem.

Re:Man in the middle attack

[RAMMS EIN]

``The nice thing about strong encryption is that it should be pretty much indistinguishable from random noise, so the this signal would be indistinguishable from background noise.''
Meaning that, according to the infinite monkey theorem, some computers are going to randomly authenticate users and decrypt data. ;-)

Re:Man in the middle attack

[jpmorgan]

Yes, but if your keys are long enough it probably won't happen until sometime long after the universe dies. :P

Re:Man in the middle attack

[jonadab]

> Then you have the frequency the signal is broadcasted on
> randomly shuffled based on the current time.

You have assumed that the repeaters can't just blindly repeat
all frequencies. (I'm not sure how they'd do that, but if they
did, it would foil your frequency-switching encryption.)

Re:Man in the middle attack

[jpmorgan]

And RSA assumes I can't factor large numbers quickly. As far as I am aware, there's no way to rebroadcast a continuous spectrum of frequencies.

A question

[uradu]

As others have already mentioned, unless the article had it all wrong, it seems that you're going about this the hard way. Why not create an encrypting FS driver along the lines of Scramdisk or DriveCrypt that always stores the disk data in encrypted form and only decrypts it upon reading? The token would then simply provide the key, and when it's not present, you simply can't decrypt the data, without requiring a lengthy de/encryption process each time you leave and return? In addition, you could make the driver smart enough to let you encrypt only certain directories, plus you could still keep the cache encryption functionality as it is now.

Re:A question

[mcorner]

The article isn't wrong, just vague. For more details see the paper.

However, what you describe is almost precisely how it works. The "walking away encryption" is only for the file CACHE in memory. The alternative is to bzero the cache which takes a lot less time. Unfortunately, recovery is equivalent to a cold cache which may annoy users with a lot of disk i/o.

The data always sits on the disk encrypted. Otherwise reencrypting it would take forever.

Re:A question

[nobody/incognito]

just out of curiosity, how long (on average) is the recovery time from a cold cache?

nobody

AYE!

[Anonymous Coward]

Upgrades would be quite troublesome with implantable computers..

Hehe gotta love the spelling

[Leeji]

Don't mean to be a grammar nazi, but... from the don't-lost-your-watch dept

Is that poor grammar, or just hedging their bets? The alternative is to misspell "lose" as "loose," which is definite grammar nazi fodder :)

Lost tokens?

[MyHair]

What happens when the decryption key device fails or is lost or stolen?

I'm a netadmin for some not-very-savvy users, and if I couldn't restore access to their data just by resetting their password then they are all in trouble.

This is an issue for a lot of encryption solutions, not just this one. Is there a master key list somewhere than can be used to recover encrypted files or volumes or at least recreate the encryption key device? How long would that take? (This opens another discussion over security of the master list and key-changing and reencryption procedures for lost and stolen tokens.)

And what if the device gets stolen? I have a security token that requires a PIN in conjunction with its security (both the PIN and device are needed for access), but in the case of this article the whole point seems to be to avoid entering a password or PIN.

Re:Lost tokens?

[mcorner]

These are really great questions. Administration is something that we have considered, however details like that don't usually make it into the paper.

The master key should always be escrowed. This allows the admin to create a new token. The real problem arrises when the user is on the road. The best answer may be that the user can enter the master-key manually, after an admin reads it to him over the phone.

The loss of the token is a threat. We noted a few details on this in the paper. You need to put a PIN into the device on an infrequent basis. (Once a day or week). That limits the vulnerability in time, however that is pretty unsettling considering that the entire disk could be copied in that period! Instead the best solution is something that detect that you took the device off and requires the PIN again. Biometrics may be one answer, however detecting a break in the continuity of the clasp may be another.

Thanks for the questions.

Re:Lost tokens?

[Anonymous Coward]

Even with a clasp, there is the possibility that someone will remove it without unclasping, or close the clasp and set it without putting it on first. People will bypass even the most important security to avoid even the mildest irritations if they think then can get away with it.

So Biometrics are the way to go. Of course, some biometrics devices can be fooled pretty easily too. Let me suggest an idea that you might not feel free to broach - butt plugs. After a brief training period, a butt plug can be worn comfortably all day. If the plug measured both temperature and pressure, it would be difficult to fool without special equipment. If it watched for pressure discontinuities, it would be difficult to remove without detection. And theft would be much less of a problem.

The only remaining problem would be deciding how to enter the password. You could let the user enter the password first, then give them "n" seconds to install, but selecting the correct value of "n" would be a challenge. Too long a period creates an acceptable vulnerability. Too short a period, though, and the resulting anxiety would tighten the sphincter and make installation difficult.

Perhaps a mirror and a specially-designed curved stylus would be the best low-tech answer. A higher tech solution might be a wireless keyboard, and an special startup sequence. Just after insertion, the plug listens for the password. Once a password has been entered, the plug could produce a gentle "tingle" to indicate acceptance, or a violent zap to signal a mismatch.

Or perhaps the best solution would be "social". If the device required a password after insertion, it might become customary for one's "boss" or "security officer" to enter the password when necessary. This has the side-benefit of allowing the "boss" to inspect the installation and verify that it is used properly. For "road warriors", perhaps a network of trusted "bosses" could be established, and the employees directed to visit at nearby trusted "boss" to have their password set.

I hope this helps!

Facial Expressions

[skinfitz]

I think there should be some special facial expression that users have to do as a password.

Hey it might be a silly idea but it would be damned funny to watch.

Security

[MyHair]

(Disclaimer: USA Fortune 500 company bias)

Every time I read about encryption and other security technologies I have to wonder how much effort it's all worth. Mainly I compare to physical security of paper, for example.

In most businesses several people have keys to everyone's office. Think IT staff, janitorial staff, security staff, higher levels of management and facility maintenance. In my experience much of the information that might be desired by compromising computer security is readily available to many in paper form on a desk or in a filing cabinet. Okay, the filing cabinet key may not be shared by many.

Briefcases and similar carry-alongs tote a lot of confidential paper.

Encryption always worries me because it seems to easy to accidentally or forgetfully cause the data to be lost forever to everyone including the data 'owner' and his/her management.

The parent post provides some good examples of how some computer security can be used against the 'protected' user.

Well, I've sort of made my point, but I'm too tired to clarify it, so I'll stop here.

The professor's presentation!

[kousik]

I was attending the professor's presentation of his new invention. The first slide read "Mreb-Vagrenpgvba Nhguragvpngvba" until he came on stage. It was exciting, and as soon as he came down to aisle to take questions, his slides read "Gbxra-Yncgbc Vagrenpgvba" ...

Re: New Software Secures Data when Owners Walk Awa

[RAMMS EIN]

New Software Secures Data when Owners Walk Away. Think about it. Isn't something missing here? When I read that title I was seriously skeptical as to the feasability of it. That was...until I read they were using a token as well. Turns out it's not a software-only solution after all. As for me, xlock has never failed me. I activate it with one click on a designated button in gkrellm, and I type my password so fast that it takes a lot shorter than waiting for the CRT to come to live again. Still, I think this solution is a Good Thing. I am going to patent putting wireless authentication technology in a mobile phone and als patent puting it in a PDA and patent putting it in a phone/PDS combo. HAHAHAH!

Dell Support

[Anonymous Coward]

That's easily solved. I locked myself out of a Dell laptop I got used a while back. Called Dell the first time, and asked for all the information they could give me to contact the previous owner. Called again and gave them all that info, and they said it was good enough, so I got the unlock code.

Items needed for circumvention:

[elixx]

* A frequency counter
* A scanner with discriminator output and a transmitter -or- a tranciever
* A recording device

This scheme has about the same amount of security as a proximity card.

Just use a password protected screen saver...

[blumpy]

You could always just use a password protected screen saver.... not as hi-tech, but effectively does the same thing... well kinda.

Re:Just use a password protected screen saver...

[PinkFloyd]

RTFA...

The whole point of this article is that people don't like to type in passwords very often, so they set the timeout on the screen saver for a long period.

Then they walk away and the PC is left unprotected for that whole period.

RF and the ability to detect you're really there

[Anonymous Coward]

I sure hope they test whether the reply comes within a hundredth of a microsecond or so. Otherwise, one could follow the victim to the restaurant, relay the challenges from his PC to the restaurant, and relay the responses back to the PC, which would then faithfully decrypt.

Rop

Security-wise, this is still a PASSWORD issue

[btellier]

At the beginning of the process, the user enters a password on the watch. "That's to make sure an imposter isn't wearing your token," Noble says. Then, each second, the laptop broadcasts a cryptographic request that only the token can correctly answer. This procedure, an exchange of cryptographic numbers, is a standard security measure.

People will still use stupid passwords. GONG!. They'll use the same letter conventions that 99% of the population uses. I guarantee that one guy with a high-end laptop could walk through an office and guess 99% of the passwords within a few minutes. Or maybe they'll guess 1% and get the temp's password. Good enough, access to the internal network is almost always sufficient to own the rest of the network.

There is no technology that will override stupidity.

Fingerprint authentication mice/keyboards?

[zebadee]

Why not buy a mouse that recoginses your fingerprint they only cost ~£40 ($60US) or a keyboard that does the same both by Siemens (see http://www.fujitsu-siemens.com/rl/peripherals/keyb oards/kbpcid.html for the keyboard)

Bah they stole my idea

[Chexsum]

This is something I thought of a few months ago. I thought it might let you save electricity also if you had a presence and authentication system as it could make things go into power saving when noones present. Theres tonnes of other things that could be made easier with this presense system. =)

Beowulf? Nah ...

[KecCu]

Imagine a watch store of those ... or: It would probably be classified as a server park.

Biometrics are flawed

[jpmorgan]

The whole 'something you are' rule is really dangerous. Almost every application I've seen of biometrics gets it wrong, and then there's the question of whether or not it's even practical at all.

The fundamental problem with biometrics is that you can't change your keys. You have a set of fingerprints, retinal patterns, DNA sequences that are really pretty damn hard to change.

Biometrics can only work with strong physical security to ensure that the tests aren't being compromised (i.e., someone hacking the device).

To steal your password I have to look over your shoulder, and once done you can change it. To steal your authentication token, I have to pick your pockets, and once done you can get a new one. But I can pull your fingerprints from anything you touch, and you'll have a much, much harder time changing those.

Biometrics are often portrayed as the panacea for authentication, but of the three 'seomthing you X', it's really the weakest. Haven't we learned yet that there's no such thing as a silver bullet?

Re:Biometrics are flawed

[Sycraft-fu]

That's why, as the orignal poster said, it is important that it is coupled with one (or both) of the others to have real good security. Basically take any current setup and add biometrics and you have made it that much more secure.

The idea is that each of these three things requires a different method of compramise. To get a token, like a key or a smartcard, you have to steal it physically from me. You also then have to use it before I notice it's gone and sound an alarm. To get a password, you either have to get me to tell you or intercept it somehow. Much harder than stealing my card BUT I'm not as likely to know, and if I don't know I really can't find out. With biometrics, you have to convince the system that you are me. As you say, possable with most biometrics, but by no means trivial.

Now combine those three, and you will have real trouble. You have to intercept my password, figure out how to fake you are me, and steal my keycard and do that all (and get what you want) before I notice and invalidate the card and password.

The two of those rule is applied to the new electronic access system on campus. Your student/employee ID opens doors, just by swiping it. Well for interior doors, they are satisfied with just that, for convenience sake. Not very secure, but when people are around during the day it's not like you can just walk into a restricted area unhindered. Buildings, however, require the card and a code. So even if you loose your card and don't notice (as soon as you notice you call it in and they invalidate the card's access) it's still no good. The combination is fairly hard to defeat since, as I said, you have to intercept the code AND get the card, then use it before both are invalidated.

Re:Biometrics are flawed

[afidel]

Notice I didn't user fingerprinting as the biometric? Fingerprinting is fairly easy to fake as it is an exterior feature. Capilary patern detection of the retina is pretty darn hard to fake, especially when in infrared rather than optical camera is used. Combine this with reading the skull shape using infrared and it is basically unbreakable (not even identical twins will have the same retinal capilary patern). The point is that this is just one check out of three. The idea is that you have to fake out the biometrics, have physicall access to my token (or somehow have made something that replicates its functionality) AND know my passphrase. Taking security from simply passwords that can be sniffed or read off a postit note to that level is like comparing a pinto to a ferrari.

Re:Biometrics are flawed

[Gareman]

I'm working on a two-factor authentication project right now (passwords and smart cards).

It's great to discuss the various merits of authentication methods, but remember that it comes down to business objectives and due dilligence.

The average company is expected to have passwords, with a decent length and complexity requirement and possibly password expiration. If they don't have this basic level of security, they'll fail their financial audits and won't have a leg to stand on if they need to defend themselves in court or explain themselves to their board of directors.

At the next state, you want to increase security with that something you have -- smart cards, tokens, SecurID, digital certificates, whatever, but it's based on business requirements. For example, HIPAA requirements for insurance companies and hospitals requires (or will require) a higher level of security. Two factor authentication is essential to avoid the most obvious ways of cracking systems.

Biometrics, which involves three factors of authentication, is overkill in just about all but the most secure applications. James Bond type stuff, defense related, law enforcement, etc., require this most secure and most technologically problematic application. Nobody else will touch it because it's not a business need and it's pricey and difficult to implement.

I just wanted to put this in context for anyone considering securing their system, since this obvious fact escapes so many.

Been here before

[AlecC]

I remember reading an article about a system like this years ago - running somewhere like ARM's labs in Cambridge. They were using it for desktops rather than laptops, but that is a detail. More importantly, they had hooked a load of other systems up to the ID. It provided the security access to the building - no more fiddling for cards, the door unlocks as you approach. Rather than just blanking off the screen as you waked away from one workstation, as you moved towards another workstation, it moved your "desktop" to that station, so that your work could "follow" you round the building. And, by detecting which room you were in, the phone system could route calls to you wherever you were.

There are a lot of questions (privacy etc) about those other uses, but a system which gives you multiple returns from the single cost of wearing some kind of ID is much more likely to be adopted than a single dongle for a single job.

Is this really a new idea?

[g4dget]

Several HCI research groups have worked on tokens and user tracking before. Some, for example, have used IR beacons emitted from lapel tags that are received by IR receivers situated near computers in order to determine whether the user is near the computer or not, and as part of that, people have discussed automatic authentication schemes (including placing the cryptographic token into the beacon).

The ZIA paper does describe a technically nice piece of work, and its specific approach may be novel. But the omission of references to prior work related to user tracking and ubiquitous computing approaches really leaves me wondering whether the authors have done their homework and whether this is really the first time that the method has been published. I think the authors would do well to track down more HCI references on beacons, wearable tags, physical user interfaces, and tracking.

Note that, in terms of hardware, you can fairly easily implement such a system these days with a Bluetooth PDA (which you wear on your person) and a disk encryption card. The range for Bluetooth is perhaps a little far, but tinkering with the Bluetooth dongle and some conductive paint should fix that.

How many watches can yu wear?

[dark-nl]

I can just see this becoming a trend once people realize that passive tokens are insecure in general. You'll have one watch for your laptop, another for the office building, one for the car, one for your gun, one for the community swimming pool...

Simple alternative

[Cynops]

For myself I've come up with this solution:

I use an encrypted filesystem (BestCrypt, available from Jetico on my Linux notebook to protect sensitive data. The passphrase is queried during boot, if it is not entered, the notebook is basically a stock Linux notebook.

/tmp is on a RAM disk.

In addition I've put up restrictive packet filters (no inbound traffic) via iptables.

Now if I close the notebook, the lid switch detects this and prompts for a password next time the lid is opened. The notebook will lock up after a number of incorrect entries.

If I leave physical vicinity of the laptop I always close the lid (it has become a habit). If someone steals the notebook while I'm away, they got three tries on my password. After this they have to reboot and will find the encrypted partition unaccessible.

Works for me, and I think it's pretty secure.

i know what i'd do..

[Anonymous Coward]

I'd take off my watch (like I always do), and then walk away leaving it next to the computer. That'd defeat the purpose pretty quick!

So now the thief has to...

[grokster]

Stalk you so the laptop decrypts when he is near you...

Can you revoke your watch from unlocking the laptop even when you still have the watch, but the laptop is already missing?

Not New

[Deathlizard]

http://www.secure-it.com/products/linkit.htm

although Zia is different and more powerful in many ways from this system, the basic idea is there, (when you walk away it secures the laptop.)

Overly complicated.

[TerryAtWork]

What they should do is have transparent encryption on the disk and let the user turn it off with a ctrl-alt-del-like key sequence then use a password when he gets back to turn it back on.

I bet that's out there somewhere.

The out for Trent Lott...

[Anonymous Coward]

...would be for him to switch to the Democrats. Then his racism would be OK.

Eliminate visible user-token authentication

[polv0]

What about a watch that periodically samples biometric data from the skin beneath it?

There are wristwatches that sample glucose for monitoring diabetic's blood-sugar level, such as the GlucoWatch.

There are also devices for processing fluids in a microsystem, such as the MEMS's Biochip.

In the near future the wristwatch could eliminate the need for visible user-token authentication, or at least reduce its frequency. This would greatly increasing both the security of the system and its ease of use.

Oh Great.

[Anonymous Coward]

I expect my employer will be handcuffing me to one of these any day now. I work for %&#CARRIER LOST

Stronger Authentication?

[classzero]

I can think of a couple of ways to make this type of communications more secure:

1. Equip the laptop with a 'detection' antenna, as it already has. This simply detects that the wearable part of the ZIA is in the area so that it knows to begin the challenge.

2. Use some of that encrypted data that was created when the computer locked up to feed into a random number generator.

3. Send the random number to the authenticating device.

4. Have the authenticating device digitally sign the randomly generated number (like PGP signature) and send it back to the laptop.

5. The laptop checks the signature and either authenticates or locks up untill somebody with the password comes along and physically types in said password.

Turning off the ZIA after a failed logon attempt will protect against repeat attacks, which is a huge part of any cryptanalysis I've ever seen.

Why don't we just go all the way...

[rynthetyn]

...and make it so you can't access your computer unless you have 666 on your forehead or hand?

This is spooky

[infolib]

Imagine when everyone has a bunch of RFID cards like that. Then you could uniquely identify a person by the combined signature of his cards. Now all Big Brother has to do is to put up scanners in crowded places, feeding results into the TIA database. Welcome to Minority Report.

Token ring

[butane_bob2003]

excuse the pun. I got a ring from Apache Con that has a JVM built in. It can't do wireless though. The ring has to be touching a connector device to communicate. Wich it doesnt do. I have not figured out how to use this ring yet, and its too big. But it sounds like it could be programmed for similar purposes.

You want a toe?

[Anonymous Coward]

You want a toe? I can get you a toe, believe me. There are ways, Dude. You don't wanna know about it, believe me.

Yeah, but Walter...

Hell, I can get you a toe by 3 o'clock this afternoon...with nail polish.

The Token Encryption Article

[Generic_SuperHero]

I Wonder,... If Phreakers Can Get Car Alams Frequencies What is To Stop Them From Getting This one And Cracking The Encryption Pattern (Ok,Ok It's A Little More Complated Then That But Think About It Really...

can't get back into the computer

[bethel]

my token's battery ran out at 2am. I guess i can only get to my stuff after the corner store opens.

Wireless authentication has been done before

[Coward Anonymous]

A now defunct company, First Access, did "Vicinity Authentication" in 1998. The product used a proprietary RF/IR card and sensor combination. The card could be worn anywhere and the sensor would hook up to RS-232. It was cryptographically secure and worked well. Several untis were sold to German and Australian companies. Unfortunately, First Access' management didn't know what to do with themselves and the company died a slow painful death.

Data Security, Contactless Smart Cards

[bservo]

First of all, someone mentioned above that "we all know that most laptop thefts are not by criminals that want data". While I have not seen any statistics one way or another, I think the different components of a laptop are worth more to different people. To a basic consumer, the hardware itself is probably worth more than their vast archive of Britney Spears mp3s (you're not ashamed, are you?). However, from a corporate or government perspective, intellectual property or intelligence is worth orders of magnitude more than the actual hardware cost. The hardware value is going to decrease over time anyway, but information in the wrong hands can put a company out of business or allow other nations to build nuclear weapons that much more readily.

Secondly, it is possible to have tokens with some intelligence (unlike RFID cards) yet don't require an internal power source. There are a number of companies that have developed contactless smart cards that might prove useful for this project:

FARGO

HID Corp.

Inside Contactless

Granted, these products don't have much more range than 10cm and a smart card is not necessarily a form factor that is best for this application, but the technology does exist. It would seem the iPaq and 802.11 connection they use for their research is good enough for proof-of-concept.

Thirdly, for people who have mentioned Scramdisk and DriveCrypt, did you even read the research paper? They aren't worried so much about encrypting the whole filesystem. That's been done before (with the products mentioned, plus CFS and MS's EFS). They're more concerned about the files that may be in the disk cache. Also, it's not the encryption process that's the annoyance for the user, it's the decryption process. Sure, you can easily lock the screen with a swift keystroke. But usually you're required to type your password in every time you want to decrypt. This "token" that they refer to could be considered like an agent in the ssh world, or doing a kinit in the Kerberos world. You authenticate to the token once, then it does the strong authentication for the decryption for you for a fixed period of time.

Oh, and the lost token concern? That's what key escrow is for and could potentially be considered outside the scope of this research. If data recovery is a concern, organizations can store a backup of the key (securily of course!) that can be used to decrypt the data without requiring the token (i.e. pull the drive and read the data with speciallized software). Key escrow is common practice at many organizations. However, an escrowed encryption key should NOT be used for data signing as non-repudiation becomes much more difficult to prove. Besides, the authentication method and encryption method should be sufficiently separated so that in the event that one of the keys is compromised, the other component is not affected.

I Only want to know how much $$?

[PaK_Phoenix]

Sounds like just the thing for a professional paranoid, such as myself. Now no one will be able to view my pr0n.

Last Post!

[alpg]

Feel free to contact me (flames about my english and the useless of this
driver will be redirected to /dev/null, oh no, it's full...).
-- Michael Beck, describing the PC-speaker sound device

- this post brought to you by the Automated Last Post Generator...