> Also, their sample size of 2000 is extremely small compared to a population in a country. I don't believe it effectively works as they claim, but they put this news out just to get attention from public.
Oh certainly. This about the fourth Slashdot article on it and we've been doing it for years, so it's in no way new. Three years from now they'll announce their chickcaptcha idea, which we launched on 5,000 production sites 18 months ago.
We have data on millions of logins. I gave you two examples, then explained we have data on millions.
We ran this in "logging only" mode on a major network of web sites for two years before we started including it in the "accept or decline" decision, so we have millions of records in the database. Here's what those millions of records say:
For attempts that would have tripped this parameter, had it been switched active, those same attempts normally tripped other time-tested parameters. The other parameters have been tested for sixteen years on tens of thousands of sites - we know they work. The newer keyboard and mouse parameters give results that agree with the results from the known-good parameters.
Since you're asking about sample size, the sample size of our known good parameters is on the order of 2-3% of all web logins.
> Think of this not as a way of identifying an individual, but of screening out those who are obviously NOT that individual. > This problem is _much_ easier to solve.
Absolutely. What we do with Strongbox, anyway, is start with "this person is claiming to be _____". Then we can start checking various parameters. Rather than list of our exact parameters and algorithm, I'll stick with the analogy:
Does the height match? Does the weight match? Does the age range match? Does the race match? Does the clothing style match (skater vs. biker vs banker)? Does the hair length match? Does the hair style (curly, straight, etc.) match? Does the hair color match? etc. or about 12-15 parameters.
Note that none of the parameters listed above is extremely selective. But let's say each parameter can reject 75% of imposters. Here's the result after each test:
Test 1: 25.00 % of imposters remain. Test 2: 6.25 % of imposters remain. Test 3: 1.563% of imposters remain. Test 4: 0.391% of imposters remain. Test 5: 0.098% of imposters remain. Test 6: 0.024% of imposters remain. Test 7: 0.006% of imposters remain. Test 8: 0.001% of imposters remain. Test 9: 0.0004% of imposters remain. Test 10: 0.0001 % of imposters remain. Test 11: 0.00002% of imposters remain. Test 12: 0.00000% of imposters remain.
After 12 tests, 99.99999% of imposters have been caught by one of the broad tests, none of which are all that specific.
> Even though one could have similar typing style, I doubt that it is always the same on every keyboard.
Several numbers can be used to describe "typing style". Some of those numbers are remarkably consistent. In other respects, you end up with two profiles, ie John on his iPad" and "John at his desk". Those match up with other parameters like OS patch lvel, browser version, plugins, etc. You, on your ipad, type in a certain way, on a certain version of the device, using a certain browser with certain plugins, etc. Most likely, the identity thief is in a different country, using a different browser on a different patch level, and types differently. So we can say "John should be either type at about interval 52 iPhone 2 in Idaho on AT&T, or type about 78 on a HP desktop connecting with Comcast, again in Idaho.
> If this authentication system can detect that, it is great; otherwise, it could be a big failure instead.
For Strongbox, this aspect is neither perfect nor a failure, but is one parameter that's considered. Very much like considering someone's height and weight when trying to recognize your spouse. You can see someone from far away and if the height and weight don't match, that's not your spourse. If the height matches, the weight matches, the skin tone matches, the clothing style matches, the hair length matches, the hair color matches, the hair style (curly, straight, etc.) matches, and she says "hey baby", that's probably your spouse.
If you hadn't tried it, you'd think that might be a problem. In fact, it's not.
I've been sick, I've been injured. My COO has been sick a lot. We log in to systems using Strongbox maybe four times per day. Four times per day times about 400 days = 1600 logins for each of us. We haven't been locked out based on keyboard and mouse yet. Looking at millions of user logins, the keyboard and mouse indicators closely track the other indicators we use. By that, I mean if the real user scores 41-52-07 and they are in the US, when see a log in attempt with a score of 24-92-18 that attempt will come from China.
Different devices really aren't a problem. It's a lot like recognizing your family members while they are wearing different outfits. A twenty-something black lady, pregnant, with medium length braids sitting in my couch is probably my wife. Without my glasses my vision is 20/100 but I could almost always distinguish an intruder vs. my wife. Most likely, an intruder would look nothing at all like my wife.
That's a good analogy for how we use this type of technology in Strongbox. We start with the fact that they claim to be John or whoever the account holder is. We don't have to identify who they are, just whether or not they look like John. Certain characteristics of his typing style are pretty consistent across different keyboards. We combine that with location, browser choice, etc. to see if the person claiming to be John probably is actually John or not.
Inverse square would apply if it were radiative (far field) and omnidirectional. Inductively coupled coils that are also harmonically tuned get the best of both inductive and radiative fields.
>charging would have to be via beamed RF energy instead of magnetic induction.
At low frequencies or short distances they are almost the same thing. "Near field" is within about a wavelength or two, which at 30 Mhz is about 10 meters. So there's not really a hard cut off between induction and RF, more of a large gray area where you can say "this range generally behaves more like an inductor". There's no reason an "inductive" charger can't be tuned for charging devices within six to ten feet - anywhere in the room.
"If this were the case" - if what were the case? If our devices helped us out in those awkward moments?
It is a valuable skill to have. Not all of us have it. Some of us are more skilled in relational calculus. A moment ago, a coworker stopped by my office. We have apparently worked together via email, but never met in person. I had NO idea what we worked on. When she said "thanks for all your help on that" I had no idea what she was talking about. An onscreen reminder of our last email or two would have been welcome.
Some commenters seem to be missing the important point that it presents SUGGESTIONS - it doesn't send an automated reply as if it were from you.
The other day I ran into an acquaintance a I hadn't seen in a while. I had not kept in touch, and I don't remember what's going on in other people's lives, anyway, so I had no idea what to say. (Ie "sorry to hear about your mom" or "how do you like the new job?"). Had I heard any news about him and his family lately?
I remarked to my wife that it would be cool if I had something like Google glass with an app that would automatically (and quickly) pull up his last three Facebook posts to give me a clue. Not INSTEAD of genuine human interaction, but to help jump-start a conversation.
Might they move a few hundred meters across city lines to save $4 million X 20 years = $80 million. Yes!
This is very visible where I live, in Bryan / College Station, Texas. A large portion of both cities is within a mile of the border between them. Driving through the area, it's obvious which city has traditionally been friendly to businesses and which hasn't. The College Station side has new towers being built a couple hundred feet from the empty, decaying buildings in Bryan. A few years ago Bryan figured it out and is now attracting new investment. The downtown Bryan area has switched from hookers and gangs to restaurants and boutiques, but most of the city is still suffering from the fact that businesses preferred College Station for so many years.
Two other people did CD changing on YouTube. I don't have anything to add. Maybe one day I'll get a chance to post my DMX lighting stuff. the main thing I can tell you about that is it you do not need the DMX shield. All you need is a MAX485 and the connector.
The court has decided that in order to do their job most effectively, it's best that they give congress a chance to do theirs first. While congress is in the middle of debating the issue, it's counter-productive for SCOTUS to provoke pointless power struggles all the time. See "the chief justice has made his decision, now let him enforce it".
It's quite possible that congress will address the issue and there will be no need for SCOTUS to get in their face. If congress passes something that's not acceptable, SCOTUS has positioned themselves to have the last word.
Are you under the impression that Chrome changes the file associations? All they've done is treat PDF the same way browsers have always treated jpg - as content the browser is able to display natively.
Thanks for the reply. I was thinking that maintenance technicians would need to have access to the system, but you're right, that's not necessary. Assuming the display is separate, a $25 board could be replaced as a unit without increasing cost much, given the cost of the tech's time. That certainly simplifies assuring the customer that the unit hasn't been tampered with.
Generally, Arduino is a good way to interface the physical world with software. Other commenters mentioned an autopilot and a 3D printer, both examples of controlling motors or servos with software, based on sensor input.
One project I did was for controlling stage lighting, with programmed sequences of effects being "DJed" in real time. I prototyped an out-of-band management interface for web servers. It could power cycle servers and provide console access. I used a similar system to have computer controlled Christmas lights and 4th of July fireworks.
Another project was controlling a CD burning robot, to burn hundreds of CDs.
In general, pretend you had a robot that could run around doing anything you want, controlled over the network or pre-programmed, so the software side can detect the environment through sensors and then take physical actions through its gpio.
Slashdotters know about a lot of different small hardware. Suppose you wanted to build a gas pump controller with a touch screen based on Android. One issue is that in order to protect customers before certifying the pump, the department of weights and measures wants to see that the gas station owner can't easily manipulate the device to show an inflated reading. What kind of hardware would you consider?
The benchmarks I've read, which were reviewed by the kernel mailing list, indicated that dm-cache has the best performance in many cases. My gut feeling is that I'd rather use bcache, but I don't know why.
The current benchmarks have one huge failing, though. They test random IO by doing truly random IO all over the disk. Real random writes, in real workloads, is concentrated mostly in a relatively small number of blocks, such as the database and log files. That's important because the caching systems put the frequently accessed blocks in cache. True random benchmarks, with no blocks being frequently accessed, counteracts what the cache is doing. What's needed is a set of benchmarks run with random IO within four files of a few GBs each , to simulate a database, mail store, or other frequently accessed region of the disk.
Okay I chose a bad example. On the other hand, I've been to fairly large conferences where reliable bandwidth was an issue. IA2000 comes to mind. I wouldn't be surprised if organisers and vendors could use backup / more connectivity at events like certain Ren Festivals. A few months ago an event organizer posted an Ask Slashdot about bandwidth for a pot fest of some sort, maybe a reggae festival, I don't recall exactly what.
Google will bid $ pi billion for whatever spectrum they find suitable.:)
You keep posting that crap for every other article. You're being sarcastic, right? You know tea party people think government is basically incompetent, incapable of say, launching a shopping web site, right? Conspiracy theorists, on the other hand, believe the government is secretly controlling everything, that they run everything. So pretty much opposite ideas of what government is. Here's a cheat sheet for you:
Believes government is incapable of setting up an insurance shopping web site: tea party Believes government can hack your phone to spy on you with the battery removed: conspiracy theorist
Funny how rather than the realistic idea that the organizers of an event might have use for internet access, TFA assumes some ultra-rich lady would bring her own internet. At say, the Super Bowl, do you think maybe the broadcast crews, the security team, the merchandising companies etc. might want reliable internet access? Nah, I'm sure just some random guy in seat 44K would be the customer.
This author sure had to work hard at playing stupid to come up with this attack against Google, didn't they.
I said "for some workloads" twice. Specifically those "localized" workloads would include a web server with a MySQL database, a mail store, or other frequently accessed files - a very, very common workload. The database and other frequently accessed files end up on SSD while the large, sequentially accessed files such as videos stream from spindles.
I also said "up to" - in some cases it might not be 100 times as fast, but "only" ten times as fast.
For some common types of workload, bcache (or dmcache) makes a big difference.
Slashdot Mirror
> Also, their sample size of 2000 is extremely small compared to a population in a country. I don't believe it effectively works as they claim, but they put this news out just to get attention from public.
Oh certainly. This about the fourth Slashdot article on it and we've been doing it for years, so it's in no way new. Three years from now they'll announce their chickcaptcha idea, which we launched on 5,000 production sites 18 months ago.
We have data on millions of logins. I gave you two examples, then explained we have data on millions.
We ran this in "logging only" mode on a major network of web sites for two years before we started including it in the "accept or decline" decision, so we have millions of records in the database. Here's what those millions of records say:
For attempts that would have tripped this parameter, had it been switched active, those same attempts normally tripped other time-tested parameters. The other parameters have been tested for sixteen years on tens of thousands of sites - we know they work. The newer keyboard and mouse parameters give results that agree with the results from the known-good parameters.
Since you're asking about sample size, the sample size of our known good parameters is on the order of 2-3% of all web logins.
> Think of this not as a way of identifying an individual, but of screening out those who are obviously NOT that individual.
> This problem is _much_ easier to solve.
Absolutely. What we do with Strongbox, anyway, is start with "this person is claiming to be _____". Then we can start checking various parameters. Rather than list of our exact parameters and algorithm, I'll stick with the analogy:
Does the height match?
Does the weight match?
Does the age range match?
Does the race match?
Does the clothing style match (skater vs. biker vs banker)?
Does the hair length match?
Does the hair style (curly, straight, etc.) match?
Does the hair color match?
etc. or about 12-15 parameters.
Note that none of the parameters listed above is extremely selective. But let's say each parameter can reject 75% of imposters. Here's the result after each test:
Test 1: 25.00 % of imposters remain.
Test 2: 6.25 % of imposters remain.
Test 3: 1.563% of imposters remain.
Test 4: 0.391% of imposters remain.
Test 5: 0.098% of imposters remain.
Test 6: 0.024% of imposters remain.
Test 7: 0.006% of imposters remain.
Test 8: 0.001% of imposters remain.
Test 9: 0.0004% of imposters remain.
Test 10: 0.0001 % of imposters remain.
Test 11: 0.00002% of imposters remain.
Test 12: 0.00000% of imposters remain.
After 12 tests, 99.99999% of imposters have been caught by one of the broad tests, none of which are all that specific.
> Even though one could have similar typing style, I doubt that it is always the same on every keyboard.
Several numbers can be used to describe "typing style". Some of those numbers are remarkably consistent.
In other respects, you end up with two profiles, ie John on his iPad" and "John at his desk".
Those match up with other parameters like OS patch lvel, browser version, plugins, etc. You, on your ipad,
type in a certain way, on a certain version of the device, using a certain browser with certain plugins, etc.
Most likely, the identity thief is in a different country, using a different browser on a different patch level, and types differently.
So we can say "John should be either type at about interval 52 iPhone 2 in Idaho on AT&T, or type about 78 on a HP desktop connecting with Comcast, again in Idaho.
> If this authentication system can detect that, it is great; otherwise, it could be a big failure instead.
For Strongbox, this aspect is neither perfect nor a failure, but is one parameter that's considered. Very much like considering someone's height and weight when trying to recognize your spouse. You can see someone from far away and if the height and weight don't match, that's not your spourse. If the height matches, the weight matches, the skin tone matches, the clothing style matches, the hair length matches, the hair color matches, the hair style (curly, straight, etc.) matches, and she says "hey baby", that's probably your spouse.
If you hadn't tried it, you'd think that might be a problem. In fact, it's not.
I've been sick, I've been injured. My COO has been sick a lot. We log in to systems using Strongbox maybe four times per day.
Four times per day times about 400 days = 1600 logins for each of us. We haven't been locked out based on keyboard and mouse yet. Looking at millions of user logins, the keyboard and mouse indicators closely track the other indicators we use. By that, I mean if the real user scores 41-52-07 and they are in the US, when see a log in attempt with a score of 24-92-18 that attempt will come from China.
Different devices really aren't a problem. It's a lot like recognizing your family members while they are wearing different outfits. A twenty-something black lady, pregnant, with medium length braids sitting in my couch is probably my wife. Without my glasses my vision is 20/100 but I could almost always distinguish an intruder vs. my wife. Most likely, an intruder would look nothing at all like my wife.
That's a good analogy for how we use this type of technology in Strongbox. We start with the fact that they claim to be John or whoever the account holder is. We don't have to identify who they are, just whether or not they look like John. Certain characteristics of his typing style are pretty consistent across different keyboards. We combine that with location, browser choice, etc. to see if the person claiming to be John probably is actually John or not.
"A new record" is false because while the unpublished raw score for the Tesla was 5.4, the same unpublished raw score for the Ford Mustang was 6.2.
Or maybe not. Since it's unpublished, I, you and Elon Must don't know if it's a record high or an A-.
Inverse square would apply if it were radiative (far field) and omnidirectional.
Inductively coupled coils that are also harmonically tuned get the best of both inductive and radiative fields.
>charging would have to be via beamed RF energy instead of magnetic induction.
At low frequencies or short distances they are almost the same thing. "Near field" is within about a wavelength or two, which at 30 Mhz is about 10 meters. So there's not really a hard cut off between induction and RF, more of a large gray area where you can say "this range generally behaves more like an inductor". There's no reason an "inductive" charger can't be tuned for charging devices within six to ten feet - anywhere in the room.
"If this were the case" - if what were the case? If our devices helped us out in those awkward moments?
It is a valuable skill to have. Not all of us have it. Some of us are more skilled in relational calculus. A moment ago, a coworker stopped by my office. We have apparently worked together via email, but never met in person. I had NO idea what we worked on. When she said "thanks for all your help on that" I had no idea what she was talking about. An onscreen reminder of our last email or two would have been welcome.
I saw the sarcastic GP of your post as its parent.
Some commenters seem to be missing the important point that it presents SUGGESTIONS - it doesn't send an automated reply as if it were from you.
The other day I ran into an acquaintance a I hadn't seen in a while. I had not kept in touch, and I don't remember what's going on in other people's lives, anyway, so I had no idea what to say. (Ie "sorry to hear about your mom" or "how do you like the new job?"). Had I heard any news about him and his family lately?
I remarked to my wife that it would be cool if I had something like Google glass with an app that would automatically (and quickly) pull up his last three Facebook posts to give me a clue. Not INSTEAD of genuine human interaction, but to help jump-start a conversation.
Might they move a few hundred meters across city lines to save $4 million X 20 years = $80 million. Yes!
This is very visible where I live, in Bryan / College Station, Texas. A large portion of both cities is within a mile of the border between them. Driving through the area, it's obvious which city has traditionally been friendly to businesses and which hasn't. The College Station side has new towers being built a couple hundred feet from the empty, decaying buildings in Bryan. A few years ago Bryan figured it out and is now attracting new investment. The downtown Bryan area has switched from hookers and gangs to restaurants and boutiques, but most of the city is still suffering from the fact that businesses preferred College Station for so many years.
> You're either trolling, or stupid, not sure which
I take it you're new to planet earth. The post to which you replied is a nice example of what we call "sarcasm".
Two other people did CD changing on YouTube. I don't have anything to add. Maybe one day I'll get a chance to post my DMX lighting stuff. the main thing I can tell you about that is it you do not need the DMX shield. All you need is a MAX485 and the connector.
The court has decided that in order to do their job most effectively, it's best that they give congress a chance to do theirs first. While congress is in the middle of debating the issue, it's counter-productive for SCOTUS to provoke pointless power struggles all the time. See "the chief justice has made his decision, now let him enforce it".
It's quite possible that congress will address the issue and there will be no need for SCOTUS to get in their face. If congress passes something that's not acceptable, SCOTUS has positioned themselves to have the last word.
Are you under the impression that Chrome changes the file associations? All they've done is treat PDF the same way browsers have always treated jpg - as content the browser is able to display natively.
Thanks for the reply. I was thinking that maintenance technicians would need to have access to the system, but you're right, that's not necessary. Assuming the display is separate, a $25 board could be replaced as a unit without increasing cost much, given the cost of the tech's time. That certainly simplifies assuring the customer that the unit hasn't been tampered with.
Generally, Arduino is a good way to interface the physical world with software. Other commenters mentioned an autopilot and a 3D printer, both examples of controlling motors or servos with software, based on sensor input.
One project I did was for controlling stage lighting, with programmed sequences of effects being "DJed" in real time. I prototyped an out-of-band management interface for web servers. It could power cycle servers and provide console access. I used a similar system to have computer controlled Christmas lights and 4th of July fireworks.
Another project was controlling a CD burning robot, to burn hundreds of CDs.
In general, pretend you had a robot that could run around doing anything you want, controlled over the network or pre-programmed, so the software side can detect the environment through sensors and then take physical actions through its gpio.
Slashdotters know about a lot of different small hardware.
Suppose you wanted to build a gas pump controller with a touch screen based on Android.
One issue is that in order to protect customers before certifying the pump, the department of weights and measures wants to see that the gas station owner can't easily manipulate the device to show an inflated reading. What kind of hardware would you consider?
The benchmarks I've read, which were reviewed by the kernel mailing list, indicated that dm-cache has the best performance in many cases. My gut feeling is that I'd rather use bcache, but I don't know why.
The current benchmarks have one huge failing, though. They test random IO by doing truly random IO all over the disk. Real random writes, in real workloads, is concentrated mostly in a relatively small number of blocks, such as the database and log files. That's important because the caching systems put the frequently accessed blocks in cache. True random benchmarks, with no blocks being frequently accessed, counteracts what the cache is doing. What's needed is a set of benchmarks run with random IO within four files of a few GBs each , to simulate a database, mail store, or other frequently accessed region of the disk.
Okay I chose a bad example. On the other hand, I've been to fairly large conferences where reliable bandwidth was an issue. IA2000 comes to mind. I wouldn't be surprised if organisers and vendors could use backup / more connectivity at events like certain Ren Festivals. A few months ago an event organizer posted an Ask Slashdot about bandwidth for a pot fest of some sort, maybe a reggae festival, I don't recall exactly what.
Google will bid $ pi billion for whatever spectrum they find suitable. :)
You keep posting that crap for every other article.
You're being sarcastic, right? You know tea party people think government is basically incompetent, incapable of say, launching a shopping web site, right? Conspiracy theorists, on the other hand, believe the government is secretly controlling everything, that they run everything. So pretty much opposite ideas of what government is. Here's a cheat sheet for you:
Believes government is incapable of setting up an insurance shopping web site: tea party
Believes government can hack your phone to spy on you with the battery removed: conspiracy theorist
Funny how rather than the realistic idea that the organizers of an event might have use for internet access, TFA assumes some ultra-rich lady would bring her own internet. At say, the Super Bowl, do you think maybe the broadcast crews, the security team, the merchandising companies etc. might want reliable internet access? Nah, I'm sure just some random guy in seat 44K would be the customer.
This author sure had to work hard at playing stupid to come up with this attack against Google, didn't they.
I said "for some workloads" twice. Specifically those "localized" workloads would include a web server with a MySQL database, a mail store, or other frequently accessed files - a very, very common workload. The database and other frequently accessed files end up on SSD while the large, sequentially accessed files such as videos stream from spindles.
I also said "up to" - in some cases it might not be 100 times as fast, but "only" ten times as fast.
For some common types of workload, bcache (or dmcache) makes a big difference.