Slashdot Mirror


User: lwiniarski

lwiniarski's activity in the archive.

Stories
0
Comments
48
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 48

  1. Re:Fine by me.. on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    Oh yeah...since you are afraid of keyloggers maybe you'd like this product

    "Passprotection",

    Introducing "Passprotection" - Keep your disk encrypted and avoid entering your bootpassword at everyboot. Now no one can use a keylogger to detect your bootuppassword..This makes your disk safer!!!! and keeps the disk encrypted so your data will still be safe!!! Get yours now...Install it everywhere!!!

    and all it does is reenable the boot-bypass at each startup, so you never have to enter the boot prompt.

    So..according to your logic, this ought to be safer right? The disk is still encrypted and you can't use a
    keylogger to detect the password...

  2. Re:Why is he modded down? on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    No. It's you that doesn't understand. Do you think you need the passphrase the second time?

    Now you just converted fort-knox encryption to kiddie-encryption..AND YOU ARE TOO STUPID TO REALIZE IT ....wait...where do you work again??

  3. Re:Not such a big hole. on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    You are absolutely correct, and I agree that it isn't a big hole..just a temporary way to get by the encryption, by people who know, If not used then it's not dangerous...but while you seem to understand the dangers of having it stolen there are lots of people who don't get it.

    http://slashdot.org/comments.pl?sid=318069&threshold=4&commentsort=0&mode=nested&cid=20872393

    he doesn't see the problem...

    Now suppose I advertise a new product..."Passprotection",


    Introducing "Passprotection" - Keep your disk encrypted and avoid entering your bootpassword at everyboot. Now no one can use a keylogger to detect your bootuppassword..This makes your disk safer!!!! and keeps the disk encrypted so your data will still be safe!!! Get yours now...Install it everywhere!!!


    and all it does is reenable the boot-bypass..at each startup, so you never have to enter the boot prompt.

    Yes that would be evil..but judging from the ridiculous crypto-kiddie comments I've seen I bet some of them would think
    it actually increases their security..

  4. Re:Fine by me.. on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    This guy doesn't understand public key cryptography. and the fact
    that he is modded up so high is evidence that a lot of slashdotters
    don't understand it either...

    The best analogy I can come up with, is this is the equivalent of leaving
    a copy of your housekey under the doormat..and then claiming it's not
    a security problem, because you could not leave the key unless you
    already had the key...and sadly, he doesn't even understand that he
    is leaving a copy under the doormat.

    Someone who doesn't already know the passphrase can't use it to get access to the drive.

    Wrong....it makes it billions of times easier to crack...
    Here is why

    http://slashdot.org/comments.pl?sid=318069&cid=20877683

    Read his messages to see someone who goes from complete denial..to revealing a complete
    naivety..to grudgingly admission..(probably still not understanding it)

    http://slashdot.org/comments.pl?sid=318069&cid=20854711
    http://slashdot.org/comments.pl?sid=318069&cid=20857859
    http://slashdot.org/comments.pl?sid=318069&cid=20860575

    Now..here he "proves" that it's not open..(showing utter naivety)
    http://slashdot.org/comments.pl?sid=318069&cid=20871667

    and again claiming that you need the password to break the
    encryption

    http://slashdot.org/comments.pl?sid=318069&cid=20871721

    Finally here he admits [ barely ] that he never understood what was going on..but then starts
    with war stories about keyloggers would work too......blah..blah.....

    http://slashdot.org/comments.pl?sid=318069&cid=20882731

    I seriously doubt he ever got it....except at the most superficial level

  5. Re:Not turned off by default on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    Because..sadly..you are..wrong and are too stupid to understand the implications of what
    you are doing...

    It's like leaving the key under the rock outside your house and then claiming that's
    not a security problem because you couldn't do it without having the key in
    the first place.

  6. Re:This attack will not work on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    First...I did talk about the boot loader..here near the bottom

    http://it.slashdot.org/comments.pl?sid=318069&cid=2087768

    It's disingenous to say that I didn't describe in great detail, exactly what would be necessary

    Second..

    It's you who (crazily I might add) assumed that the disk might "magically" change from encrypted to
    plain text. ..that was honestly funny... I never imagined you would be so incredibly naive.
    Well you sure "proved" me wrong....hahahaha. I'm not sure that you get it yet that the data
    on the disk doesn't change when you enter the password.

    So...

    first you deny my attack would work..repeatedly...and "prove" it [ snicker ]

    then you FINALLY admit my attack would work....say it didn't explain it in detail
    (see above) then mention that other attacks would work too so therefore I'm the one who didn't understand?

    Hey..Newsflash...I always understood EXACTLY what was happening...at every level.

    I'm teaching you something...pay attention.

  7. Re:This attack will not work on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    Will work.. The manufacturer even admits it...once again...from the manufacturers response to the article..


    The scenario you describe is more or less the intended one, and you identify the risk inherent in the feature. If someone enables the bypass and the volume is immediately stolen, then the volume is open. However, this window is usually very small. The people who use it understand the risk.


    Okay...I'm tired of this...if the manufacturer own admission can't convince you that you are wrong..
    , I certainly can't

    Yes a keylogger would work..but this is a disk encryption product. The idea of a disk encryption product is
    (I can't believe I'm explaining this) that if the computer is stolen, then no one can read the disk...and this
    is the one time, that if you stole the computer that someone COULD read the disk. And the manufacturer admits
    it . So it is relevant.

    keeping a stolen disk unreadable is the whole FUCKING point of disk encryption. Otherwise, if your disk can't be stolen,
    then then who gives a SHIT about disk encryption!!...IF the DISK is on fucking PLUTO.. then adding disk encryption
    wouldn't make much FUCKING MUCH SENSE THEN WOULD IT!!!!

    [ whew ]

  8. Re:This attack will not work on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    I never said the data on the disk changes...Is that what you think happens when you supply a password..?

    hahahahahahahahaha....

  9. Re:sooo lesseee on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    Don't understand the question..You can't.

    But if you catch the drive at exactly the right time... And freeze it's contents by shutting
    off the power) Anyone who knows how bootloaders work and knows public key cryptography) will be
    able find the password necessary to decrypt the drive.

    At any other time.. the stolen drive would be a brick...The NSA couldn't read your data.

  10. Re:This is how it works on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    NO. The data is ALWAYS encrypted...it's just that when given the right password, the operating
    system can decrypt it..and the boot loader which needs to decrypt it, so it can load the
    operating system.

    But I appreciate your honest attempt, but it's not quite that simple as just putting the drive in another computer. It would take
    a little work to decrypt it, but I'll bet I could do it. It might take awhile, but I believe I could do it, and I'm SURE someone who
    worked for the manufacturer could,

    But I could never break PGP in a million years. and the manufacturer can't either. No one has has discovered a method

    First--think about it what happens on a remote-reboot.

    Windows is encrypted just like everything else.. 99.999% of the disk is encrypted.. only the very small bootloader (a few K) isn't

    How can a remote-bootup work? Obviously it must somehow know enough to to decrypt the entire operating system..That's how windows re-starts
    (which is encrypted with everything else)....no password is supplied initially before windows loads..How can it know this?

    Short answer ---the password is supplied by saving it --in plain text on an unencryted part of the disk.

    It's like saying - Hey my house is has this unbreakable lock--
    ( but this time and this time only..i'm gonna leave the combination under the rock
    by the door..and change the combination as soon as I know you got in.)

    here is a short description of how PGP works -

    PGP has a public key and a private key. It is possible to create a message for only
    a select group of people..by using multiple public keys..and 1 private key. Now the cool thing
    is that only the select group can read the message..each by using their own private key..which
    WAS NEVER USED IN THE ENCRYPTION....Think about this for a second...Only 1 private key was used,
    but multiple people can read read the message. It's like telling 10 different random people..
    Hey..your private key (that I've never seen) will work on my door, and only a few others
    can get in...but everyone else, can't

    My Aunt actually had a clever system that allowed multiple people into her yard using
    keylocks that allowed the samething...but I'll leave you to figure that out.

    Thats why you can have multiple users..each with a unique password...and the password is
    never stored..rather the anti-password or public password is stored...and when the private
    password is combined with the anti-password(s) it can decrypt the drive.

    So.....for the remote-reboot

    Yes..the drive is still encrypted. But when you enable pre-authentication a special ONE-TIME user
    is created with a public and private key and he is added to the list of people who can access the drive..

    Now, normally the secret password is never stored, but must be supplied by the user..at the bootloader
    process...otherwise 99.9999% of the disk couldn't be seen...but this time the secret key is saved..on
    the disk..unencrypted..

    So for the unattended bootup..the bootloader sees a flag which tells it ahha..unattended bootup..set the
    user to ONE-TIMEUSER and the PASSWORD to ONE-TIMEUSERS-PASSWORD..Now we have the info necessary to decrypt
    the drive... and finally remove ONE-TIMEUSER from the list of valid users..

    So here's how I would beat the encryption.

    First I'd take the drive and put it in as a second drive, then I'd look at the boot table and find the boot
    partion and then look at the boot-record and disassemble the program..it's pretty short.
    Look at the bootloader code. Find out where it stores the password. Perhaps this is all publicly available. somewhere..Good
    companies do this so people can check their code.

    Now I have enough to decrypt the disk...

    Your test was trivial, It's not THAT simple, (i.e. you need to find the rock that the combination was put, but thats a matter of
    looking at the code...breaking PGP would mean inventing quantum computing or discovering new math

  11. Re:Fine by me.. on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    Funny,

    But walking past someone's cube and seeing their computer reboot, then quickly turning it off..
    doesn't require a team of secret agents cutting off power to the city...although that would
    make a more realistic plot than most

    I'm not slamming the software, I'm just pointing out that remotely rebooting this software
    does open up a vulnerability that wouldn't normally be there..(and the manufacturer agrees).
    Lot's of people seem to be claiming that this is just as safe as any other time just because
    I had access. But it's not, because i (probably) don't have PHYSICAL access at exactly
    this time.

    Let's put it this way..if I had nuclear secrets on a the hard drive..I wouldn't be remotely
    rebooting it, and I'm pretty sure the manufacturer would agree.

  12. Re:sooo lesseee on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    Huh...You must have read an article about leprechauns and gotten confused..

    lemme explain it for you..

    Disk is encrypted..
    System boots up and asks for password..user supplies password and operating
    system then can read disk....operating system cannot read disk unless password
    is entered..Now the operating system can read the disk, and some other layer of
    authentication applies. This makes using the encrypted system "easy" as the
    encryption is transparent to all programs and the user..it's done by a low
    level driver. If the disk is stolen, then it can't be accessed because
    the thief doesn't have the initial password....except ...if pre-boot authentication is enabled...then for 1 reboot and 1 reboot
    only..the system will reboot w/o entering the password..

    [ from the manufacturer ] (if you had bothered to read the article)


    The scenario you describe is more or less the intended one, and you identify the risk inherent in the feature.
    If someone enables the bypass -and the volume is immediately stolen, then the volume is open. However, this
    window is usually very small. The people who use it understand the risk


    So, my point...is that while the window is small...it is also particularly easy to
    detect..(just by looking) and also most likely to occur when no one is around
    which is the worst time for it to happen...

    If you don't understand the above...please read it again until you do.

  13. Re:Fine by me.. on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    Okay, I understand that this is supposed to be for "remote" boots.

    So, I'm the janitor and wander by your office..I've tried to break
    into your computer before, but I never knew the password...When
    I attempted to take your disk before, I realized that it was
    encrypted, and I couldn't use it. I nearly got caught that
    time.

    Now, I and happen to see your computer reboot (you are not around).
    I know now that your data is likely vulnerable at this point. as
    you probably just set the bit for pre-boot-authentication.

    I unplug your network cable and remove your hard drive,
    Plug your harddrive into my system..Get the data and recheck,
    the pre-boot authentication. Put the hard drive back into your
    computer. Turn it on. it continues the reboot process..
    Except for the extra delay.....you never know I just got your data.

    I NEVER had to know your password and I also know
    that you aren't around. And I know the instant you
    are vulnerable quite easily just by seeing your
    screen go blank...or perhaps detecting you off the
    network.

    Yes, I do have to have physical accesss, but No, I don't
    need your password. If I'm fast enough, then you might
    not even notice...

    You'd probably only use this feature if you were away
    from the computer, AND that's the one time you DON'T
    want to use it...Seems like a dangerous combination.

  14. sooo lesseee on Undocumented Bypass in PGP Whole Disk Encryption · · Score: 1

    I'm working for secure-co ..supposedly I work on my own secret project, but
    my boss has secret info that I want to know, but he always logs off when
    ever he leaves...

    One day when my boss is gone, I see his laptop
    turn off automatically ..ahh...I seize the opportunity. ..I quickly unplug the network and remove the hard drive...boom I've
    got his info without anyone knowing, and better yet..no one is even around
    because it's all done remotely. I steal the data, and recheck the automatic
    authentication, and reconnect it back to the network and turn it
    off....quietly slip out of the room..

    Note...I never had to have access to his password..I just know that an
    automatic reboot, means vulnerability.

  15. Volatile != Unstable on Debian Refuses To Push Timezone Update For NZ DST · · Score: 1

    When I first heard about it, I mistakenly assumed volatile == unstable...

    No, the volatile repository is exactly what this is for -
    packages that need constant adjustment and update to work as advertised.

    I just learned about the volatile repository and it's the perfect solution, but
    sadly I, and I'm sure others, were unaware that this existed until now.

    I wish some of this stuff was advertised a little more rather than buried
    in the documentation, but I'm glad I know now.

  16. Re:Talk about dumb on MIT Student Arrested For Wearing 'Tech Art' Shirt At Airport · · Score: 1

    and I'm surprised at all the people attacking her. Did you see the picture? It was a prototype board
    with a bunch of led's and a 9v battery..there was no damn putty..

    Here's the pic
    http://boingboing.net/images/cfa4827569_20070921device3.jpg

    She didn't walk in with a gun or a bomb..just a bunch of blinking LEDs, and the police thought it would be
    reasonable to used deadly force? Electronics != Bomb...or even pretend bomb. do we as a society think
    that it's reasonable for police to assume anything they don't understand is dangerous enough to warrant
    killing someone for? Should my life depend on my ability to explain something to an idiot with
    a gun? Or should we put the emphasis on the person with the gun to justify his action of using
    deadly force.

    And your comparison of a prototype board to a pretend gun...sheeesh.

    Your witchhunt attitude scares me ALOT more than the MIT student with an LED!

  17. vastly overlooked on Newest Energy Source — Pond Scum · · Score: 2, Interesting

    I don't think people realize that how important this is. I converted my van to run on
    raw vegetable oil and have been quite happy with it. I can easily see this replacing
    mineral oils in a relatively short time. It is becoming more and more popular as
    diesel prices keep increasing.

    Biodiesel is basically chemically altered vegetable oil that reduces viscosity
    (transesterfication) but is not necessary if you modify your diesel to reduce the viscosity
    by heating the oil to around 200F.

    While electric cars are super neato and probably our long term solutions, I can see
    imagine that it's gonna be pretty hard to make an electric powered jet airplane, but
    I think an algae oil powered jet airplane might be pretty reasonable. After all
    kerosene (used for jet fuel) is very similiar to diesel #1.

  18. 10%/year..Gotta call FUD/Bullshit on Solar Energy Becoming More Pervasive · · Score: 2, Informative

    I agree it's not economical, but 10%/year degradation is FUD.
    More like 1-2%/year for good panels in normal radiation.

    (10-20% over TEN years)

    Here's a graph..(read down)
    http://www.solarstorms.org/Svulnerability.html

  19. Re:What this really means on The End of the Free PCI Device List (Update) · · Score: 5, Funny

    - "PCI"
    - You just said "PCI" w/o permission.
    - But so did you. You said "PCI" w/o permission.
    - You just said "You said PCI w/o permission"
    - You just said "You said you just said PCI.."
    - You said "You said you said you said you said..
    (Stack Overflow..)

  20. Re:Could someone explain CDSA in more detail? on Intel Opens CDSA Source · · Score: 1

    CDSA sounds a lot like PAM. What does CDSA do that PAM does not?

  21. Re:Same old same old... on The End Of The Road For Magnetic Hard Drives? · · Score: 1
    Brief History according to Engineers (well not _ALL_ Engineers, but certain ones who shall remain nameless but are posting above this)

    100000 b.c. Early Engineers construct Earth

    1000 b.c. Greek Engineers invent Mathematics

    1600 a.d. English Engineers invent Calculus and legislate gravitational law.

    1940 a.d. American Engineers write some equations and invent Atomic Bomb and once again prove their superiority to theoretical physicists

    1960 a.d. Engineers take time out from inventing rock music and invent vaccine for polio

  22. Re:Where are they now?: Derive on Open Source Symbolic Math Program? · · Score: 2

    I don't know where they are.

    I was pretty impressed too. I remember my brother showing it to me. I pulled out the CRC book and entered the most complicated looking integral I saw, and I was amazed that it computed the integeral symbolically . (i.e. not some lame numerical integration by trapezoidal or simpsons rule)

    Seemed like magic at the time. This was probably on an 8088. I'll bet it was less than 400K. probably 1/100 the size of some of the others.

  23. Maple V and Mathematica and PC magazine on Open Source Symbolic Math Program? · · Score: 1
    silly little semi-unrelated trivia....

    I remeber when PC Magazine reviewed Math packages.

    They choose Mathematica and Maple V as the best; However they gave "Derive" ( a semi-obscure dos-fits-on-a-single-floppy-text-mode an honarable mention as it was the only one to get test gravitational potential problem correct and simplify nested radicals automatically but felt that that it interface and graphics were inferior to Mathematica and Maple V.

    I guess they considered getting the correct answer to be a fairly unimportant requirement. I've got the review on my "Hall of Shame" .

    I've never taken PC magazine seriously ever since