Slashdot Mirror
IBM using Napoleon Dynamite Quote to Encrypt Data
schmack writes "A developer discovers a quote from the movie Napoleon Dynamite is being used as the cipher key by IBM to publish encrypted XML at this year's Wimbledon grand slam. But is this a rather glaring lapse in security or an easter egg for curious hackers, many of whom would surely be fans of the quirky movie?"
on whether or not they were encrypting anything important. If they were then they were idiots.
slashdot troll = you make a compelling argument I do not like the implications of.
I don't really see this as a "lapse" in security. I mean, it was an XML file with updated scares, not a SQL database with every known Social Security Number. The application in question (a flash scoreboard) doesn't exactly call for some kind of PKE scheme.
Idiots!
If you read the article, you'll see that he found the key in the flash applet that presented the data to the website visitors. So even if they used a truly random key, it would be worth no more, since the client could just read the flash file (de-assemblers for flash is out there. Search on google.), and get the key. So really, there is no point of better encryption, because the determined people will get the key anyway.
Remember that flash runs on your computer. Thus, the encryption key has to be on your computer so the flash application can decode the XML file and show you the results. As long as Trusted Computing does not excist, there is no way to stop a determined person from getting the key. Thus, using a stronger key would not make it more difficult. It is not like the key was discovered by accident. The writer of TFA was looking for the key in the flash file...
Nothing here to see, please move along!
Assembling etherkillers for fun an profit
It was totally retarded, why do people like it?
Look, it's all right there:
Q. Why do people like it?
A. It was totally retarded.
You're, uh, one step away from Yoda-speak.
roman_mir, don't be jealous that I've been chatting online with babes, all day. Besides, we both know I'm training to become a cage fighter.
"People that quote themselves in their signatures bother me" - athakur999
Not sure why exactly they would want to encrypt the scores as they flew over the network though. The scores are public knowledge...who cares if they are sniffed? Technology demonstration? Wanted to use the 'encryption' buzzword perhaps?
Blar.
I see even so called Linux friendly IBM is blocking Linux users out because there is no Flash 8 for Linux yet. Oh well maybe next Wimbledon. Is there a Flash player 8 out for Mac?
Star Trek, there maybe hope.
Hm....so what you're saying is that if it's a lapse in security then it's a lapse in security but if it's an easter egg then it's an easter egg? I like the way you're thinking!
I wonder if the guy who cracked this has nunchuck skills and bowhunting skills too.
But why is the rum gone?
Whoever he wants to be. Gosh!
I ain't modding him up, but I won't mod him down either.
I really like the movie, granted it was annoying at times the first run through.
I imagine one of the reasons it's popular because it's a movie about "losers", you don't really see that too often. Even when you do, they characters aren't really losers, just perceived that way (and usually not perceived that way by the final reel).
-William Shatner can be neither created nor destroyed.
....the worst post ever made.
Please, ITninja, like anyone could even know that.
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
it is much more fun to talk about than it was to actually see it. which is one marker of a cult classic.
putting the 'B' in LGBTQ+
If what they were sending was important then it is definately the former, if it's something which they meant for people to have a go at then it'll be the latter.
Captain Obvious to the rescue once again!
Would you kindly mod me +1 insightful?
It's a diversionary tactic, gosh!
How do you keep a bunch of computer nerd hackers in suspense?...
We're looking for a good English to English translator. Would you be available soon?
If you can read this sig, you're too close.
>If a project doesn't require strong encryption, does it require encryption at all?
That is an insightful question.
Historically, weak encryption had a niche for information whose value dropped sharply over time. If you have a lame algorithm that a cluster of supercomputers can crack in a week, you can still safely use it for messages like "unit 3, fall back to hill 41, await instructions".
Sports scores might fall into that category, though the problem in this particular case was not weak encryption, it was a failure of key management.
The other niche is information that you don't want to leak, but that nobody will pay enough to get cracked. No crook motivated by money would crack 40-bit encryption to get the number of your prepaid credit card with the $100 limit. The problem with this idea is the number of crackers motivated by ego rather than money.
Some people have believed that weak crypto makes sense if the most cost-effective attack on the data is to attack something other than the crypto. This was the reasoning behind WEP, "Wired Equivalent Privacy". The idea was that since anyone could tap a wired network, the crypto didn't need to be strong. This failed because the crypto was not just weak but sloppy, causing it to collapse into near-zero protection, and because the threat models weren't comparable. The "cost" of tapping a wired network includes showing your face and getting into the building. Wardriving is much safer for an eavesdroper.
All these ideas are nonsense today because strong crypto is just as easy to deploy as weak crypto, except in the world of puny embedded devices.
This was hilarious! http://www.atomfilms.com/sw/content/anakin_dynamit e
What an amazing grasp of the obvious!
Dynamite was the most deft satire of high school life that I've ever seen. There are a ton of people that are twentysomething or younger that DONT'T like the movie, but in my experience, most do. And the older you get, the more you're removed from todays High School experience, the less likely that you'll enjoy the movie.
Is it not possible that this was a randomly generated key that simply happened to be a Napoleon Dynamite quote?
--Those responsible for the cipher key in question, have been sacked.
We apologize for the inconvenience.
A m00se once bit my sister...
.
== WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??
Scripts of popular movies such as the Star Wars trilogy are obvious things to include in a cracking dictionary.
Amen!
I've seen this on some of my external servers - long lists of dictionary attacks. For a while someone was trying to log into executioner. Before an IP filter was added, we would get tons of login attempts in the logs. Quotes were always in there, including things like Darth quotes (Ifylofd, Tfiswto, Issapinfs, Ysnhcb, and the l33t spelling variants of words and phrases). It became a bit of a game to figure out who could guess the quote based on the attempted password. If you think the first letters of a quote are protection, you are in for a rude awakening when you get back into the office next week. (Happy 4th of July to those in the States)
+++ UGUCAUCGUAUUUCU
Do you know first-hand that this is true and is the policy?
No. Well, yes it is, but it's not only a 'geek artifact'. On the Internet, if we need any cryptography at all, we need the strongest cryptography we can find, because we never know how capable our adversaries are. Actually, we know a little about our adversaries' capabilities: any adversary is capable of at least every attack that has ever been published, and possibly some attacks that haven't. Whenever we design a system using strong cryptography, we are designing the system with knowledge of current attacks. However, the system will be subjected to both current attacks and future attacks, so we need a margin of security[1] that is large enough that we can have confidence that the system will not be practically breakable while it is still in use.
Basically, we need strong cryptography because designing systems against future, unknown attacks using knowledge of current, known attacks. This is harder than it looks.
-----
[1] By "margin of security", I mean, loosely, the difference between the limit of computing power that we assume will be available to any adversary, and the amount of computing power that we assume will be required to break the system.
http://outcampaign.org/
They should have used Jar Jar Binks and Westly Crusher quotes. Nobody wants to remember them.
Table-ized A.I.
Because Linux only runs on x86.
http://outcampaign.org/
Okay my guesses are Ifylofd -> I find your lack of faith disturbing Tfiswto -> The force is with you Issapinfs -> I sense a presence I have not felt since... Ysnhcb -> You should not have come back. So, how did I do?
There's plenty of people who don't like, or haven't seen, Napoleon Dynamite, but there are others who think it's one of the funniest movies they've ever seen. If everyone thought it was a fantastic movie, then it wouldn't be a cult classic.
Duct tape is like the Force. It has a light side, a dark side, and it holds the universe together.
You fail at life, but you win on /.