Slashdot Mirror
Kim Dotcom Wants Money From Google, Twitter For 2-Factor Authentication
Nyder writes "Kim Dotcom posted via Twitter, with a link to Torrentfreak, that he owns a security patent US6078908, titled 'Method for authorizing in data transmission systems.'" Techdirt points out that Dotcom isn't just asking for financial help: Instead, he's asking companies which use two-factor authentication "to help fund his defense, in exchange for not getting sued for the patent. He points out that his actual funds are still frozen by the DOJ and (more importantly) that his case actually matters a great deal to Google, Facebook and Twitter, because the eventual ruling will likely set a precedent that may impact them -- especially around the DMCA."
Update: 05/23 14:23 GMT by T : Why is this relevant to Twitter? If you're not an active Twitter user, you might not realize that (after some well publicized twitter-account hijackings), the company is trying to regain some ground on security. Nerval's Lobster writes
"Twitter is now offering two-factor authentication, a feature that could help prevent embarrassing security breaches. Twitter users interested in activating two-factor authentication will need to head over to their account settings page and click the checkbox beside 'Require a verification code when I sign in.'"
So will RSA now put a boot up his ass?
FUCK OFF Kim Dotcom.
You fucking wanker.
What is the definition of extortion, Alex?
I don't see Kim hopping on a US-bound plane to sue the infringing companies any time soon. They must be shaking in their boots.
a couple million dollars in the central bank of Nigeria that he needs our help to recover?
Sign a patent deal with them that if they will fully fund his defense, he'll agree to not sue anyone and when the case is over he'll turn the patent over to the public domain.
I seriously doubt Kim Dotcom is in a position to actually litigate his patent claim. Financially, that is.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
It bears mentioning that Kim Dotcom was once named Kimble Schwartz, who basically went from one moneymaking scheme to another. Kimvestor, for example, got him jailed for securities violations. YIHAT was a front of an organization that tried to rally people around hacking terrorists. The list goes on and on. About 15 years ago he was noted as being a fraud in the security space, despite claiming to be a hacker. I think he got lucky with Megaupload, but now he's back to his old usual failing-yet-highly-vocal self.
For your security, this post has been encrypted with ROT-13, twice.
See what happens.
"Here Lies Philip J. Fry, named for his uncle, to carry on his spirit"
"I believe in sharing knowledge & ideas for the good of society. But I might sue them now cause of what the U.S. did to me,"
Sounds like the typical ire most people have towards the US legal system right now. Including the US itself.
Join the Slashcott! Feb 10 thru Feb 17!
According to a first step, the user sends a qualifying identification of the data input apparatus together with a request for the generation or for the selection of a transaction authorization number TAN or of comparable password from a data file from the data input apparatus to an authorization computer. In a second step the authorization computer generates the transaction authorization number TAN or the comparable password or selects them form a data file. According to a third step, the authorization computer sends the transaction authorization number TAN or the comparable password over a second transmission path different from the first transmission path to a monitor, for example a pager. According to a fourth step, the user reads this transaction authorization number TAN or the comparable password from the receiver and enters the transaction authorization number TAN or the comparable password into the data input apparatus. According to a fifth step, this transaction authorization number TAN or the comparable password is transmitted to the authorization computer. According to a sixth step, the authorization computer verifies the validity of the transaction authorization number TAN or of the comparable password in order to establish or switch free, according to a seventh step, a connection between the data input apparatus and the receiver unit.
Some of those steps just don't apply to modern 2-factor authentication. In all two factor auth I'm aware of, you send your request, password, -and- generated key all at the same time. I'm mainly thinking of how my 2-factor auth works to sign in to work remotely - I have a fob that generates my key for me, I don't have to request it. I'm sure a properly motivated tech expert could skew things to make it look like this type of authorization is covered by this patent, though.
By 1998 there had been a fair amount of work in authentication. Anybody able to cite some prior work which proposes the user sending a device ID (a serial number or MAC address would do) and having that used to pick a transaction PIN which gets sent via a separate channel? Back then there was email already,
and voice phone, and snailmail, and some IM schemes. Can anyone cite, say, a scheme that generated an ID for someone on web but which sent a
separate email to validate it?
I consider the scheme to be rather obvious provided that there exist multiple channels for those who are to use it. (That's still a problem where the
same device gets used for both web and email for example.) There are more fast channels now, so something can be texted and separately emailed or
otherwise sent.
But we need some prior art here (in use or discussed) to demonstrate this.
Whatever you may think or say about Kim, he's got some interesting moves. (I don't yet have much of a viewpoint on him beyond what I just said, being too busy learning to make good popcorn and trying to follow what's what.)
Is this a really a plea for help, or extortion, or patent-trolling (the latter two might be synonymous)?
On the related matter, I've not read the whole law and am curious: Are violations of DMCA to be pursued under civil or criminal law? Or either one or both depending on circumstance?
In my use I note there is a user identification (which fits what is used) or a device authentication (e.g. a creditcard number) gets sent. The key thing is the notion that some checking number is sent back by another path. There were fewer such commonly available in 1998 but this magic number gets played back. It looks to me like several schemes I've noted in use today are this kind of thing. However I suspect someone must know of old examples. A public discussion would do as prior art, but we need a reference. The scheme is not suppoed to need a fob, which is indeed different.
It baffles me that two-factor authentication patents can be valid. Haven't ATM machines always done that (One factor - the ATM card, the second factor is the PIN)? What about USB key+password decryption? I know the patent system is broken, but this should get thrown out when challenged. More interesting, what advice is Dotcom's lawyer giving him? Or does New Zealand legal system not provide lawyers to someone arrested there who can't afford one?
Actually is name was Schmitz not Schwartz but the rest is true: http://en.wikipedia.org/wiki/Kim_Dotcom
I'm pretty sure SecureID uses 2-factor authentication before Kim's patent. Where you enter the password, a token is generated and you have to enter the key before access is granted.
I guess the different maybe the token is automatically generated every min instead of being transmitted to to a secondary device. If his patent is validated in court, it's worth a lot more than the 50mil he asked.
5-factor weight gain- so that after eating one meal four more meals are ordered to make sure that the first meal was actually eaten.
Interesting point. There were fewer devices in '98 available to be used to receive a back channel message. Could this be a case of technology evolving so fast it obviates a patent before it has expired? What might have been considered non-obvious then would certainly be obvious now.
Ascalante: Your bride is over 3,000 years old.
Kull: She told me she was 19!
Guys, guys guys! This can only end up in OUR FAVOR. Let's see... Kim's company (mega.co.nz) is not a "non-practicing entity", so the only way Google and Twitter could avoid paying him whatever he asks, is to set some rules on what can be patented when it comes to software patents. Not as good as abolishing soft patents at all, but a win nevertheless.
So if he is admitting that he needs financial help with the defense of his current court battle, it would be a pretty reasonable assumption that he does not have the funds to initiate a second court battle. Sounds like a pretty empty threat, if you ask me.
"It's not whether you win or lose, it's how drunk you get." -- H. J. Simpson
"Fund my defense in return for me not suing you about my worthless patent" doesn't make you any less of a troll than "Pay me money in return for me not suing you about my worthless patent."
Look soon for a Presidential Executive Order finding that if you are an Enemy Combatant against the Entertainment State, any patent you possess is null and void - along with any sense of openness, honesty, or due process.
After having actually read the patent, it looks like Google Authenticator, for example is in the clear.
The patent states that the following must occur:
1.) User inputs a password
2.) Authenticating device receives the password from #1, generates a password, and sends this new password out-of-band to an external device. (Pager, phone, etc)
3.) Person then reads the password from the device
4.) Person inputs the new password into their computer
5.) Computer sends second password over to authenticating device.
6.) Authenticating device finally grants access.
Google authenticator works differently.
1.) User input password
2.) User inputs password read from device
3.) BOTH are sent over the network to the authenticating computer, at the same time.
4.) Authenticating computer grants access.
Note that Google Authenticator does not generate the 'multi-factor' password after receiving the first password from the user.
The multi-factor password is streamed passed to the (pager, phone, etc.) every X seconds.
It's an entirely different mechanism.
Which means that my already low opinion of this guy is now lower, as he's descended into obvious patent troll territory.
-- Sometimes you have to turn the lights off in order to see.
Note that Google Authenticator does not generate the 'multi-factor' password after receiving the first password from the user.
The multi-factor password is streamed passed to the (pager, phone, etc.) every X seconds.
No it's not. Google Authenticator implements TOTP which depends only on having a reasonably accurate clock and a previously-agreed-upon shared secret from which the codes are generated.
When one uses Google Authenticator, one gets a shared secret from Google (which can be easily input in the form of a QR code, though one can manually input it as well) and adds it to the GA app. When one wishes to authenticate to a service (e.g. a Google Account or any other service that implements TOTP), the app uses the current time and the shared secret to compute the code for that 30 second time period. The service that the user is authenticating to also had the shared secret and computes the code for the same time period. They should match. If they don't, the service will usually calculate the codes in a time window surrounding the current time (e.g. +/- 2 minutes) in case the client's clock has drifted.
TOTP (and Google Authenticator) do not rely on network access at all -- you can use Google Authenticator as a TOTP code generator for other sites without having anything going through Google at all. For example, I have a TOTP hardware token that had the shared secret programmed by the factory (they don't keep any record of the secret, unlike RSA -- they print it on a piece of paper that comes with the token and that's it). I configured my various TOTP-enabled services (e.g. a secure website) with the shared secret and require the TOTP code during authentication. There's no dependence on outside services or network connections at all. Very handy.
Not on either side of the issue, but if all his funds are frozen, wouldn't that also include any valuable assets he might own. Such as a patent...
...You sir, are the most brilliant programming exec I have ever met.
Of course, that really is kind of a backhanded insult, but still....
HA! I just wasted some of your bandwidth with a frivolous sig!
I stand corrected.
TOTP is still very much outside the realm of Kim's patent.
-- Sometimes you have to turn the lights off in order to see.