I work trying to secure small embedded devices. It is frustrating beyond belief. No one will pay for real security. Most end users don't understand it and wont pay for real security. Banks, utilities and even governments don't care if the loss caused by a breach is incurred by someone else. Managers might care but they aren't going to stick their necks out and do anything different since they can never be blamed for following "industry best practices"
Until the people who have the ability to fix security problems are the same people who will incur the loss when something goes wrong we will never have secure IoT devices, let alone secure public infrastructure.
The corrupt police wanted to look like they were working but they sure as hell didn't want to actually catch any bombers. If the bomb detectors actually worked then the police officer would have a suicide bomber in front of him who might detonate the bomb at the police check point instead of some crowded market.
If the UK is going to start jailing people for fulfilling useless government contracts then they are going to have to start building more jails.
I'm a Canadian programmer in my 40s. From my graduating class:
over half the students moved to the USA for higher pay
of those that stayed most have left the field for better pay, better working conditions or management.
There's a huge number of Canadians in the USA that could be lured back to Canada if you were willing to match their pay. Likewise if the pay was better and companies actually invested in training, not being on call on the weekends maybe more people would stay in the profession.
Basically: If there aren't enough qualified Candidates in Canada it's because the industry as a hole has kept wages and working conditions down for so long that people aren't choosing to stay in the industry.
(I also call BS on the no qualified people responding to job postings - Post how much you will pay. As an Embedded C programmer I'm not going to waste my time applying to a job that likely pays under $120K)
There is an excuse
When the people setting up the testing are essentially asking you to lie to them.
Had the testing been designed to reduce NOx emissions it would have been done on the roads with a sensor in the tail pipe. Hell, we should have sensors on the roads and cameras tracking cars that pollute too much but we don't. We have a certification process that all but has a blinking sign saying abuse me.
How many of you have helped fill out a request for proposal (a bid) for a service or product that was a long list of items half of which are stupid, irrelevant or just don't make any sense. When you first see these things your inclination is to ask the customer for a clarification but after speaking with customers you discover they really don't care and they just want you to check the box. The public cares about pollution, the VW engineers likely car about pollution, the certification process doesn't give a s*#t about pollution and the politicians who mandated the certification didn't care enough about pollution to even ask if certification would work.
VW cheated the certification testing but it appears most other car makers are making cars that are polluting significantly worse in real world conditions than when they are tested. If we want to get accountability and some change we need to start with the politicians (and maybe the bureaucrats) that allowed this system to develop in the first place.
As it melts it gets darker. The water flows through the snow to the bottom while the impurities generally stay on the surface. When we get the next snow fall the snow is bright and white again and then as it melts it gets darker again.
Now if the second melt doesn't melt all of the second snow fall be for another fall and you dig into the snow you will see two bands where the previous melts extended to.
However if a melt melts all the way past the last snow fall you will notice the snow surface suddenly get darker when all the impurities of the layers meet.
So if the snow has been melting faster on greenland than it has been accumulating I would expect the snow to be getting darker and the darkness "jumping" each time the melting reaches then next melt band.
At least that is my experience watching our weird Ottawa winters.
You missed the point. If both machines were critical then taking out either machine would suffice. The agent (or plane) now has to hit either room to thwart the British. A German bomber would have double the probability of success when the machines were in two rooms.
I worked in IT at a credit bureau. Everyone of us could have looked up any specific person in the files and there would have been no trace of it. I don't think anyone ever did. We had a couple of incidents in data entry and support people looking up people they knew. Considering how many people had access though the cases of abuse were very small. I suspect there has to be something about the environment that adds to people abusing the power.
Thank you for the links and for correcting me. Looks like I have some reading to do this morning and some looking into how secure Elliptic Curves over GF(2^n) are. The paper describes an attack on curves over GF(P) while most implementations I've seen in production devices use GF(2^n).
They are not talking about breaking AES or Two Fish encryption. They are worried about breaking the key agreement. Currently when a communication channel is set up the two parties agree on a key for encrypting the communication. This is normally done by Diffie-Helman (D-H) key agreement or one party could select a key and then give it to the other party using the other parties RSA public key. Both RSA and D-H are based on the difficulty of solving math problems that quantum computing should be able to easily solve. .
Your AES encrypted file on your hard disk is safe. What the NSA is doing is storing your conversations and the key agreement. Years from now they might crack the key agreement and then decrypt your communication.. .
Things like Elliptic curve Diffie Helman are secure. So your Black Berry communications will still be safe, not sure who else widely uses EC (your ZigBee electric meter in the USA and UK)
I do want my ISP shaping my traffic. I want short messages like an HTTP request getting priority, I want low latency for my games and zero jitter for my VoIP. What I want in net neutrality is I don't want my ISP to shape traffic based on who I'm communicating with. I don't want them to give their streaming service priority over NetFlix, their email over gmail, their streaming TV over ESPN or youtube.
Actually what I want from net neutrality is my ISP to only be an ISP and not be allowed in the content business.
Utilities would love you to use batteries the way you describe. In Ontario they make more money per kWh at the off peak price (12-14 cents*) than at the peak price. This is because at the peak time the utilities are paying more per kWh to the generation plants. On a hot summer afternoon the price utilities pay in Ontario can climb well over a dollar while on a windy winter night it can go negative. Texas utilities are mandated to pay up to $7000 per mWh ($7/kWh) and they did pay this price once this year.
-- Disclaimer: I work for a company that sells devices to utilities to shift consumers electric consumption away from peak usage times.
*The Ontario electric bills lie about your cost per kWh. The cost they show is what they call the "generation cost". There are three other items that add another 4 cents. A 2 cent per kWh delivery fee, a 2 cent debt retirement fee and the tax. (there is also a connection fee which monthly but varies based on the number of days in the month but they can't call it a daily fee)
If I don't give a shit about a website that wants me to log into it I'm not going to create and memorize a new password. Most site administrators need a little more humility. Your site is not important enough to me for me to go to the trouble of creating a new password. If your site is mildly interesting I will use a common password that I use on all mildly interesting sites. Unless your password policies piss me off. Then the password will be P@ssword123.
For the 4 or 5 sites that it would cause me personal pain or monetary loss if I was impersonated I will use 4 or 5 random words. I will use those 4 or 5 words all lower case and with no spaces or punctuation because that makes it easier for me to remember. For these sites I will also disable any kind of alternate password retrieval. I don't think it's that hard to figure out my mother's maiden name, my city of birth or my first public school.
You need to be random and unpredictable. If I know what algorithm you use and I know your source of entropy it doesn't matter if you get perfect randomness or not because I (or the NSA) could also get the exact same random number.
The NSA has been attacking random number generators for a long time now. Even if you start with a well seeded random number generator there are still risks. Crypto functions based on the extended Euclidean algorithm (El Gamal, DSA) reveal your private key if anyone can find a relation between two random numbers used in two separate signing operations.
In claiming a copy right there is an implicit contract with society that at the end of the copy right you will release the art to the world. How will video game makers do this if the machines to run there games no longer exist? How will the BBC do this for Doctor Who if they have lost some of the episodes. Nintendo should prove that it still has the means to release these games to the public domain or lose the copyrights.
When I was working for a very reputable 3 letter company, I had a "customer" ask us to hack a security device. There was a feature that had me stumped so I phoned the manufacturer of the device who put me in touch with their supply of this feature. The supply explained how unbeatable their product was and how to implement it. Now the implementation had one difficult step and I asked what would happen if that step was missed and was told how it would render the product vulnerable. The maker of the device had skipped this step so getting into the device was easy after that. I told the truth the whole time, even stated my intentions and still everyone helped me.
Of coarse my employer never validate the identity of the "customer".
2pm in Washington is not 2pm to an observer in Chicago. The concept of NOW is relative to the observer. There is no breaking of the laws of physics here and no proof of insider trading.
That make me feel dirty when I actually give money to these big media companies by going out to the theater and paying for content. I shouldn't be sitting in a movie worrying about how the $10 I just paid is going to be spent repressing me.
I use Certicom's ECC Libraries everyday mostly for ECMQV (key agreement with user authentication) and also signatures. They charge nothing or almost nothing for the use of their patents in some industries. They do charge for their libraries and acting as a CA. For embedded devices with limited resources and bandwidth I can do things that are simply in-feasible with RSA. Certicom's math is beautiful. The curves that they chose and the neat properties they have make it possible to perform asymmetric encryption on devices with tiny amounts of RAM. I hate patents but I have no moral objection to paying Black Berry for what they provide.
If you are in North America your energy provider is most likely using ZigBee Smart Energy. That is a mostly open standard in that anyone can read the spec. but only ZigBee members can change it. The spec uses Elliptic Curve Cryptography for key exchange and authentication and AES for message security. It's pretty darn secure but unfortunately much harder to set up than the Z-wave.
Users seem to choose convenience over security every time until after they have been attacked.
Disclaimer - I'm working on a ZigBee thermostat right now.
I'm currently working on Smart Energy products for consumers homes (ZigBee). We have devices working and interoperating in the US and else where at 2.4 GHz. The UK wants to use 900MHz because at the physical layer it has better range. I was kind of hoping the UK would give up on doing things their own way. This doesn't give me much faith.
Slashdot Mirror
I work trying to secure small embedded devices. It is frustrating beyond belief. No one will pay for real security. Most end users don't understand it and wont pay for real security. Banks, utilities and even governments don't care if the loss caused by a breach is incurred by someone else. Managers might care but they aren't going to stick their necks out and do anything different since they can never be blamed for following "industry best practices"
Until the people who have the ability to fix security problems are the same people who will incur the loss when something goes wrong we will never have secure IoT devices, let alone secure public infrastructure.
He sold exactly what the Iraqis wanted.
The corrupt police wanted to look like they were working but they sure as hell didn't want to actually catch any bombers. If the bomb detectors actually worked then the police officer would have a suicide bomber in front of him who might detonate the bomb at the police check point instead of some crowded market.
If the UK is going to start jailing people for fulfilling useless government contracts then they are going to have to start building more jails.
I'm a Canadian programmer in my 40s. From my graduating class:
over half the students moved to the USA for higher pay of those that stayed most have left the field for better pay, better working conditions or management.
There's a huge number of Canadians in the USA that could be lured back to Canada if you were willing to match their pay. Likewise if the pay was better and companies actually invested in training, not being on call on the weekends maybe more people would stay in the profession.
Basically: If there aren't enough qualified Candidates in Canada it's because the industry as a hole has kept wages and working conditions down for so long that people aren't choosing to stay in the industry. (I also call BS on the no qualified people responding to job postings - Post how much you will pay. As an Embedded C programmer I'm not going to waste my time applying to a job that likely pays under $120K)
There is an excuse When the people setting up the testing are essentially asking you to lie to them. Had the testing been designed to reduce NOx emissions it would have been done on the roads with a sensor in the tail pipe. Hell, we should have sensors on the roads and cameras tracking cars that pollute too much but we don't. We have a certification process that all but has a blinking sign saying abuse me.
How many of you have helped fill out a request for proposal (a bid) for a service or product that was a long list of items half of which are stupid, irrelevant or just don't make any sense. When you first see these things your inclination is to ask the customer for a clarification but after speaking with customers you discover they really don't care and they just want you to check the box. The public cares about pollution, the VW engineers likely car about pollution, the certification process doesn't give a s*#t about pollution and the politicians who mandated the certification didn't care enough about pollution to even ask if certification would work.
VW cheated the certification testing but it appears most other car makers are making cars that are polluting significantly worse in real world conditions than when they are tested. If we want to get accountability and some change we need to start with the politicians (and maybe the bureaucrats) that allowed this system to develop in the first place.
As it melts it gets darker. The water flows through the snow to the bottom while the impurities generally stay on the surface. When we get the next snow fall the snow is bright and white again and then as it melts it gets darker again.
Now if the second melt doesn't melt all of the second snow fall be for another fall and you dig into the snow you will see two bands where the previous melts extended to.
However if a melt melts all the way past the last snow fall you will notice the snow surface suddenly get darker when all the impurities of the layers meet.
So if the snow has been melting faster on greenland than it has been accumulating I would expect the snow to be getting darker and the darkness "jumping" each time the melting reaches then next melt band.
At least that is my experience watching our weird Ottawa winters.
NTP is used directly or indirectly by most of the web. It's also a project that is largely maintained by a very small number of people.
You missed the point. If both machines were critical then taking out either machine would suffice. The agent (or plane) now has to hit either room to thwart the British. A German bomber would have double the probability of success when the machines were in two rooms.
put them in separate buildings?
That seems like doubling the probability of getting screwed by a bomb. Was there some reason they could replace either machine but not both of them?
I worked in IT at a credit bureau. Everyone of us could have looked up any specific person in the files and there would have been no trace of it. I don't think anyone ever did. We had a couple of incidents in data entry and support people looking up people they knew. Considering how many people had access though the cases of abuse were very small. I suspect there has to be something about the environment that adds to people abusing the power.
Thank you for the links and for correcting me. Looks like I have some reading to do this morning and some looking into how secure Elliptic Curves over GF(2^n) are. The paper describes an attack on curves over GF(P) while most implementations I've seen in production devices use GF(2^n).
They are not talking about breaking AES or Two Fish encryption. They are worried about breaking the key agreement. Currently when a communication channel is set up the two parties agree on a key for encrypting the communication. This is normally done by Diffie-Helman (D-H) key agreement or one party could select a key and then give it to the other party using the other parties RSA public key. Both RSA and D-H are based on the difficulty of solving math problems that quantum computing should be able to easily solve.
.
Your AES encrypted file on your hard disk is safe. What the NSA is doing is storing your conversations and the key agreement. Years from now they might crack the key agreement and then decrypt your communication..
.
Things like Elliptic curve Diffie Helman are secure. So your Black Berry communications will still be safe, not sure who else widely uses EC (your ZigBee electric meter in the USA and UK)
I do want my ISP shaping my traffic. I want short messages like an HTTP request getting priority, I want low latency for my games and zero jitter for my VoIP. What I want in net neutrality is I don't want my ISP to shape traffic based on who I'm communicating with. I don't want them to give their streaming service priority over NetFlix, their email over gmail, their streaming TV over ESPN or youtube. Actually what I want from net neutrality is my ISP to only be an ISP and not be allowed in the content business.
Utilities would love you to use batteries the way you describe. In Ontario they make more money per kWh at the off peak price (12-14 cents*) than at the peak price. This is because at the peak time the utilities are paying more per kWh to the generation plants. On a hot summer afternoon the price utilities pay in Ontario can climb well over a dollar while on a windy winter night it can go negative. Texas utilities are mandated to pay up to $7000 per mWh ($7/kWh) and they did pay this price once this year.
-- Disclaimer: I work for a company that sells devices to utilities to shift consumers electric consumption away from peak usage times.
*The Ontario electric bills lie about your cost per kWh. The cost they show is what they call the "generation cost". There are three other items that add another 4 cents. A 2 cent per kWh delivery fee, a 2 cent debt retirement fee and the tax. (there is also a connection fee which monthly but varies based on the number of days in the month but they can't call it a daily fee)
If I don't give a shit about a website that wants me to log into it I'm not going to create and memorize a new password. Most site administrators need a little more humility. Your site is not important enough to me for me to go to the trouble of creating a new password. If your site is mildly interesting I will use a common password that I use on all mildly interesting sites. Unless your password policies piss me off. Then the password will be P@ssword123. For the 4 or 5 sites that it would cause me personal pain or monetary loss if I was impersonated I will use 4 or 5 random words. I will use those 4 or 5 words all lower case and with no spaces or punctuation because that makes it easier for me to remember. For these sites I will also disable any kind of alternate password retrieval. I don't think it's that hard to figure out my mother's maiden name, my city of birth or my first public school.
You need to be random and unpredictable. If I know what algorithm you use and I know your source of entropy it doesn't matter if you get perfect randomness or not because I (or the NSA) could also get the exact same random number. The NSA has been attacking random number generators for a long time now. Even if you start with a well seeded random number generator there are still risks. Crypto functions based on the extended Euclidean algorithm (El Gamal, DSA) reveal your private key if anyone can find a relation between two random numbers used in two separate signing operations.
In claiming a copy right there is an implicit contract with society that at the end of the copy right you will release the art to the world. How will video game makers do this if the machines to run there games no longer exist? How will the BBC do this for Doctor Who if they have lost some of the episodes. Nintendo should prove that it still has the means to release these games to the public domain or lose the copyrights.
When I was working for a very reputable 3 letter company, I had a "customer" ask us to hack a security device. There was a feature that had me stumped so I phoned the manufacturer of the device who put me in touch with their supply of this feature. The supply explained how unbeatable their product was and how to implement it. Now the implementation had one difficult step and I asked what would happen if that step was missed and was told how it would render the product vulnerable. The maker of the device had skipped this step so getting into the device was easy after that. I told the truth the whole time, even stated my intentions and still everyone helped me. Of coarse my employer never validate the identity of the "customer".
2pm in Washington is not 2pm to an observer in Chicago. The concept of NOW is relative to the observer. There is no breaking of the laws of physics here and no proof of insider trading.
That make me feel dirty when I actually give money to these big media companies by going out to the theater and paying for content. I shouldn't be sitting in a movie worrying about how the $10 I just paid is going to be spent repressing me.
I use Certicom's ECC Libraries everyday mostly for ECMQV (key agreement with user authentication) and also signatures. They charge nothing or almost nothing for the use of their patents in some industries. They do charge for their libraries and acting as a CA. For embedded devices with limited resources and bandwidth I can do things that are simply in-feasible with RSA. Certicom's math is beautiful. The curves that they chose and the neat properties they have make it possible to perform asymmetric encryption on devices with tiny amounts of RAM. I hate patents but I have no moral objection to paying Black Berry for what they provide.
If you are in North America your energy provider is most likely using ZigBee Smart Energy. That is a mostly open standard in that anyone can read the spec. but only ZigBee members can change it. The spec uses Elliptic Curve Cryptography for key exchange and authentication and AES for message security. It's pretty darn secure but unfortunately much harder to set up than the Z-wave. Users seem to choose convenience over security every time until after they have been attacked. Disclaimer - I'm working on a ZigBee thermostat right now.
I'm currently working on Smart Energy products for consumers homes (ZigBee). We have devices working and interoperating in the US and else where at 2.4 GHz. The UK wants to use 900MHz because at the physical layer it has better range. I was kind of hoping the UK would give up on doing things their own way. This doesn't give me much faith.