Slashdot Mirror


User: Otto

Otto's activity in the archive.

Stories
0
Comments
2,221
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 2,221

  1. Signing vs. encrypting... on 20,000 Zombie PCs -- $3000 · · Score: 1

    You weren't paying attention to the SHA/MD5 articles last week?

    Most public/private key systems merely sign a hash of the message (apparently, signing is computationaly *expensive* per byte compared to the current method). All the attacker has to do is intercept your payment authorization (pay X to Y), change a few bits so that the hash comes out the same and now it says to pay A to B.


    Signing and encrypting are the same thing. In signing, I'm simply encrypting a hash of the message itself. Solution: Use a better hash, or just don't freakin worry about it since the SHA/MD5 crap last week still won't be enough to fake a small message along the lines of "Pay X to Y".

    In order for your attack to work, the attacker would need to be able to create a message in the format of "Pay A to B" that produces a hash which is identical to "Pay X to Y". Not only that, but He'd have to be able to determine what B is in advance. Realize that he can't fake my signature, which is an encrypted hash of "Pay X to Y". Even if we assume that the message is really "Pay X to Y" and not some binary form of same, faking such a thing is still utterly impossible. Unless the message is long, you can't figure out a hash collision with any meaningful value. And if it's a small message, the odds of finding one go as close to zero as you can possibly get.

    In other words, signatures are way safe for anything where you're not signing actual executable code or something with a little more range in which to produce your faked message.

    The only products idea that I've seen that looks fairly secure is a smart card in place of the bank card / credit card. It contains the secret key, and does the work of signing things

    How is this any different from what I proposed? Keep your private key on you, on the smart card. The key doesn't get output, instead a hash gets fed in and an encrypted hash comes back out. The smartcard does the processing. The public key is still stored at the bank.

  2. Bank account security is not based on secrets... on 20,000 Zombie PCs -- $3000 · · Score: 2, Informative

    The security of my bank account is not based on secret codes or passwords or account numbers or any other blamed thing.

    Every check you writing contains the account number and the routing number and everything else needed to withdraw money from that account. If somebody creates a fake check using that info, and withdraws money from my account, then that is is no way my fault and I'm entitled to reimbursement of those funds.

    Likewise, somebody doing the same thing electronically is not my fault either. There is nothing essentially different in the transaction. Fraud is fraud.

    Bank accounts have never been based on secrets. It might not be smart for me to give out my account number to everybody, but it's something I do every time I write a check or use a debit card or use one of several forms of payment. I *must* give my account number to somebody I want to pay from my bank account.

    Is this a flaw in the system itself? Yes, absolutely. But until everybody moves towards public/private key authentication and so forth, it's just the way things are.

    The public-private key method is the only solution to this sort of thing that I'm aware of. To "write a check" or make a payment of any sort, I form a message that essentially says 'Pay so much to this person, using this transaction number, on this date' and encrypt it using my private key. Then I give it to that person. They give it to their bank. Their bank gets my public key from my bank (it's a public key, they can give it to anybody who asks for it), verifies the message is valid (since it's signed by my private key, my public key can decrypt it and it validates itself that way), and does the transaction. My bank also verifies the same message before releasing the cash from my account. Unforgeable money transfer accomplished.

    Sounds great? It's a long ways off.What's needed is:
    -Every account holder to have a public/private keypair.
    -Banks have the public key, people have the private key on some sort of device.
    -Device allows transfers of cash from one person to another, probably by simply plugging in a key or wirelessly or whatever. You can think of a thousand ways to do this.
    -Banks need a protocol to transfer public keys around, and all have to agree to some form of standard.
    -Etc, etc, ad infinitum. It gets more complex the more you think about it. If you assume that the electronic cash transfer happens in real time (eliminating "float"), then it's actually slightly easier. If not, then you get the concept of people transferring funds that was just transferred to them before telling the bank about it, and it gets hella complicated. But it's all doable with the crypto, it's just complex.

  3. Re:Game theory... on Did You VoteOrNot.org? · · Score: 1

    The cost is the time & money (gas, whatever) you gave up to go cast a ballot. Its not much, but its more than the benefit, which is (nearly)zero.

    Yes, but you can't generalize and place a cost on somebody's time and effort without analysing it in each case. Furthermore, the benefit can be much higher than zero depending on how the individual feels about it. If it costs somebody a nearly zero to vote (say their voting location is next door to their workplace, so it's just the time to walk next door) and they get a really good feeling out of voting, then the benefit can outweigh the costs in their specific case.

    In other words, without specific measurable quantities, which vary with each case, you cannot say that the costs are larger. You can't generalize the cost vs. the benefits so easily as you are doing here.

  4. Re:Will it ever happen for the iPod? on Rockbox Plans Open Source Firmware For iRiver Gear · · Score: 1

    http://ipodlinux.sourceforge.net

  5. They're not offering anything for voting... on Did You VoteOrNot.org? · · Score: 1

    It is illegal to offer anything in exchange for voting.

    They're offering a chance at a prize for registering to vote, not to actually vote. Minor, but important, difference.

  6. Game theory... on Did You VoteOrNot.org? · · Score: 1

    It's not in your interest to vote, at least not from a game theory perspective. Voting takes effort, and the benefit you recieve directly from your act of voting is insignificantly small comparatively.

    This is a judgement call, I'd say. I don't think that you can actually quantify the loss due to effort involved here and say whether it's higher or lower than the benefit. At least not in the general case, as the amount of effort needed is going to vary among different people, as is the quantitative impact of your vote, which varies depending on location and the relevant laws in your state and so forth.

    Now, most places do use voter registrations as the pool from which they draw jurors, and if you view being selected for jury duty as a negative, then it could very well be not in your interest to register to vote, much less to vote, from a game theory perspective.

  7. Fake contact info... on Spammers Are Early Adopters of SPF Standard · · Score: 1

    I admit that a spammer signing up for domains using zombied proxies and fake contact info is going to make it difficult to track 'em down that way. But you really have to take on one problem at a time, here.

    You might consider bitching at the registrars and the system that allows somebody to buy a domain name with fake, unverified information and stolen credit cards. Something really should be done about that as well, don't you think?

  8. Re:Appearantly, some people missed the point... on Spammers Are Early Adopters of SPF Standard · · Score: 1

    Heh, so when a spammer has a SPF record that states the IP sending the spam (some Chinese proxy) is valid, what will that get us? Proof that they really are sending it from China?

    Well, yes, but it's also proof that they really owned the domain that sent the email, because it's the domain's SPF entry that told you it was legit. Which means you can try to track down the owner of that domain.

  9. Appearantly, some people missed the point... on Spammers Are Early Adopters of SPF Standard · · Score: 4, Insightful

    If spammers are now forced to identify themselves in their emails, by means of having a domain and publishing SPF records for that domain, then good.

    That was the entire point.

    In combination with anti-spam laws, now we have the ability to actually identify the spammers flooding our inboxes and take legal action against them for doing so.

    There is no technological means that will allow random people to email you and yet prevent them from emailing you spam. Technology is simply not capable of distinguishing spam from non-spam with a 100% success rate. We can get really close, but there will always be false-positives and false-negatives in any system. And any system is vulnerable to clever hacking around the filter. You can make it terribly difficult to do so, but you can't make it impossible.

    The goal of SPF never was to stop spam, it was to force somebody who sends you email to be accountable for doing so, by providing a method to track down who they are. At least, it's a good start for this sort of thing.

  10. Strong Bad's "techno" song... on Live Nightclub Hacking · · Score: 1

    When reading this article, did anybody else get the song from the Strong Bad "Techno" email start playing in their head? Because when he starts talking about "programming" a song live, that is how I imagine it must sound like. :)

  11. Re: Close but no cigar on Both Tea And No Tea - Updated Hitchhiker's Game · · Score: 1

    If you BUY the sandwich as Dent you can't get it as Prefect, rendering it unrecoverable.

    As I recall, if you buy it as Dent and put it in the thing your aunt gave you, then you'll have it when you're Ford (it's in the thing, and the thing follows you around).

    And you can go back to any of the later scenarios, even after you've beaten that scenario, once you acquire real tea and not Artificial Tea Substitute. You don't have to remove your common sense particle in order to get the real tea either, you have to do that in order to have tea and no tea simultaneously.

    In any case, I remember reading a comprehensive guide to all this many moons ago, and one thing I do remember was that once you reach the dark, it's impossible to screw up unrecoverably. All the dead end scenarios happen before you get to the dark. It may take some massive effort to actually win, depending on how bad you mess things up, but it's winnable at that point.

  12. Invalid questions... on The End of Encryption? · · Score: 1

    Normally, I'd agree with you. However, P?=NP is a slightly different kind of problem, as it's almost a metaproblem. It's a problem about other problems.

    See, unlike your example, the terms are well defined in something we do know about. Essentially, it breaks down to the fact that people came up with problems to which nobody could find a good answer to. So instead of solving them, which was proving inordinately difficult, they decided to start describing them differently.

    This led to grouping them, which eventually led to classifying them, which eventually led to a new kind of problem since they couldn't prove that their classifications actually had any real meaning. They couldn't figure out how to prove P != NP.

    So my point here is that P and NP are not really terms that are poorly defined. They are extremely well defined, mainly because nobody could work out how to really get good solutions to the problems that they are describing in the first place.

    Basically, P and NP are extremely well defined sets and there's rigorous proofs to show that if an NP-Complete problem turns out to be P, then P=NP. The question does have meaning, because if the answer to it could be determined, it would either eliminate or validate the classifications that have been setup to create the terms P and NP in the first place.

    It may not be provable, but either those groups have real significance as they are described or they do not. There's no real in-between state there.

  13. Re:Remember on Both Tea And No Tea - Updated Hitchhiker's Game · · Score: 3, Informative

    You think that's frustrating?

    Don't feed the dog a sandwich.

    That really blew my stack, about thirty hours later ...


    That one wasn't actually fatal, as getting eaten by the dog merely thru you back into the DARK prematurely. From the dark, there were 5 possible exits, and if you waited for the one where you became Ford Prefect, you could feed the dog a sandwich in that scenario, and then go do the warship scenario and this time you wouldn't be eaten by the dog.

    There were actually only a few unrecoverables, and all of them were very early in the game.
    -Get crushed in the house.
    -Don't follow Ford's directions and get blown up with Earth.
    -Forget to get the junk mail and you could not get the Babel Fish, or try too many times on the Babel Fish Dispenser and it ran out. And then you got killed because you couldn't understand what was being said by the Vogon later.

    But once you find the "dark" after being ejected from the Vogon's ship, you're essentially in the clear. Everything else is doable from that point onward, as long as you have your gown and your towel. Dying means that you go back into the "dark", and you can replay any of the failed scenarios by merely waiting until the right moment before exiting the dark.

  14. Natural Language Processing on Both Tea And No Tea - Updated Hitchhiker's Game · · Score: 1

    It would seem that in 30 years of Natural Language processing advancements and so forth, that it would be possible to revive text adventure type games.

    Minor problem with that is that NLP hasn't advanced that much in 30 years.

    I mean, you can do some advanced stuff nowadays like including whole dictionaries full of words so in the thing that no longer will "get" be needed and "pick up" or "acquire" or "grab the damn" will all be processed as the same thing, and you can even include heuristics so that the command doesn't always have to be (verb) (noun) (optional specifier) or something like that, but in essence the computer still doesn't really understand English and so there's always going to be some kind of default response of "Huh?" or "I don't know what you're talking about." or something along those lines.

  15. I know that... on Does Shareware X-Chat for Windows Violate the GPL? · · Score: 1

    But he isn't releasing the source code to the *Windows* version, which *is* a requirement of the GPL, if he's going to sell that version.

    I'm well aware of that, and I didn't say he was actually in the clear here... I was addressing the post above mine, which stated, more or less, that you can't sell GPL software at all. That's not true, and I was just pointing that out.

  16. You're wrong. on Does Shareware X-Chat for Windows Violate the GPL? · · Score: 2, Insightful

    imo tbh you can't be GPL compliant, use and compile 3rd party GPL code, and charge people money for it without the expressed consent of the contributing authors.

    Go read the GPL again.

    "You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee."

    There's nothing there with regard to pricing. You can take GPL'd code and sell it to your hearts content, as long as you include the source code with it. Note that it must be the compilable source code including makefiles or anything else that is needed to build the thing (section 3, GPL).

    Furthermore, anybody who obtains said copy that way then gets all the abilities as you, and you can't really prevent them from giving the thing away to the world for free, if they so choose.

    So he's fine to sell the thing. I'm not certain about the "shareware" model, but if he wanted to sell it boxed, for example, he'd be more than able to do so. As would anybody else who obtained a copy, really.

  17. Re:Well... on Gmail Cracks Down on Third-Party Notifiers · · Score: 5, Insightful

    because you want to control the ping to one every ten minutes.

    Two minutes. GMail's official Notifer checks every 2 minutes.

    The big deal is that they want third party apps to stop actually logging in and pulling the full HTML for the main page, and start copying what the notifier does, which is to pull down something much smaller, simpler, and less CPU intensive for google.

    Also, it prevents their statistics from being skewed by apps acting like actual people. What, you think they're not logging stats on this stuff?

  18. The reason for this is simple... on Gmail Cracks Down on Third-Party Notifiers · · Score: 2, Interesting

    What they really want is for third party clients to change the way they check for new messages.

    Look, the original thing that they had offered no easy way for a client to check for messages. So they created the Gmail notifier. Along with it, they created a low bandwidth simple way to check for messages. The Gmail notifier doesn't actually check the HTML version of the page. It pulls something down that is much simpler and less bandwidth/CPU intensive on their end.

    By breaking the old way of doing it, they're forcing these apps to change what they do in order to work. Most likely, these apps will *copy* what the gmail notifier program does to check mail. And that's likely fine with Google. Hurts them no more than if the person was using the real notifier, in that case.

  19. Alarm system display and remote control receiver. on What is this Strange Gadget in My Car? · · Score: 4, Informative

    The antenna clearly indicates it's to receive or transmit in some fashion.

    The crystal frequency of 6.775117MHz would put it at the 433 mhz frequency, which makes sense for such a device. The Op-amp makes it clear that it's doing something along these lines.

    The angle of the 7 segment display indicates that it was original intended to be mounted on the A pillar. The dots on the 7 segment display would facing the bottom of the unit, thus putting the antenna at the top. When mounted along the pillar, the angle of the 7 segment display would then be flat in relation to the driver, as the A pillar always leans in that direction.

    The KIA70 is a low voltage detector, probably detecting 2.7v (thus the "27P") and simply cutting the thing off when the voltage gets low, to prevent weirdness on the circut.

    Can't find anything about the S727G/OM-7003 IC.

    I'm betting B=Battery wire, I=Ignition wire, G=Ground wire. O and V I don't know, but they're probably some form of signaling wires back to/from the main unit.

    Anyway, I say it's an A-Pillar mounted remote antenna/display unit that hooks to a car alarm system somewhere else in the car. The case for it has been removed and discarded, most likely. It receives and possibly sends antenna signals for the system, as well as displaying status codes of some type from the main car alarm unit.

  20. HD Content on Mark Cuban on the future of HD Media · · Score: 1

    In his rant, he talks about how no one he's run into has ever uploaded or downloaded an HD movie from the net.

    Considering that many of the TV episodes of various series I see online are HD material that's been recompressed with Divx or Xvid or some similar format, I wonder what people he's been talking to...

  21. Geographic Projection on Composite Of Earth At Night · · Score: 1

    http://www.google.com/search?q=Geographic+Projecti on

    Looks to be a simple Geographic Projection, where the lines of latitude and longitude are made into squares. Simplest projection to do, pretty useless for any kind of real mapping. But it looks nice.

  22. Re:Geographic Distribution on Red Brains vs. Blue Brains? · · Score: 0, Troll

    And maybe liberals are caused by inhaling too much pollution. :-)

    No, it's that conservatives are caused by too much inbreeding. :-P

  23. Logic/philosophy on Cheating Made Easy · · Score: 1

    Yet when's the last time your saw logic or philosophy (which is just applied logic) mandated?
    These were required subjects in my college curriculum. Logic was a 3 semester set of courses, while general philosophy was only 1 semester, as I recall. All of them fell under the "Philosophy" dept. name and umbrella, but they mostly focused on logic, argument, proofs, etc, etc. The general philosophy class was more of a history type of class.

    Admittedly, this was for a computer science degree. The engineering degrees had slightly different requirements. I think they had only 1 semester of logic required, except for EE which required 2.

    This was late 90's, BTW.

  24. Re:Language is key on One, Two, Many - Language Shapes Thought · · Score: 1

    No, I can learn how to make a gun, plow a field, fetch water from a well from an Asian person with whom I have no common language - almost as easily as I could with an English speaking person.

    I posted previously to this topic that it's all about the willingness of the people to learn,and the access to information that they are willing to subject themselves to is what forms thought and intelligence.


    Yes, but you actually form thought in language.

    Yes, you can learn to make a gun with somebody you don't share a language with, but face it... most languages are very similar. Similar enough that you can make yourself understood via gesture and so forth.. Point your finger, make a *bang* sound, and they other guy knows what you're talking about. A gestural language, even an informal ad-hoc one, is still a language.

    Suppose the other guy had never seen a gun, and his language had no word for one. How are you going to describe it to him? How are you going to get him to understand how to rifle the barrel? Or worse, why you need to rifle it?

    Now imagine the problem involved with these guys who don't grasp the number 4... How are you going to tell this guy that he needs to fetch 4 buckets of water from that well?

    All communication occurs thru language. This is one of those "by definition" things... if you communicated, then the way you did it was a form of language, even if it's just a rudimentary basic form of gesturing. Complex thought... hell, even simple thought... takes the form of language. Usually spoken, but not necessarily. Ever work with people who have been deaf from birth? They think way differently, and it becomes appearant after you get to know them real well. Why do they think differently? Because they're thinking in sign language, and sign is not the same as spoken language is. It's not a one to one correspondance, although it's often represented as if it was. It's a bit hard to grasp for somebody used to spoken language.

  25. Re:But user experience will still suffer... on Real Cuts Prices for DRM-Restricted Music · · Score: 1

    The first instance of failure a user will see is while away from the computer, using the iPod - thus will not be able to update for at least a while.

    How do you figure? I mean, the plugin could easily check the version on the iPod and give a warning or go look for an update if it's the wrong version or some such thing.

    No idea whether it does that or not, but it needs to check the version anyway because 1st/2nd gen iPods are treated differently from 3rd gens and up.