Just to preempt the peanut gallery here, I am using "hash" in a very loose sense here to encompass any "one-way" destructive transform that is highly resistant to chosen collision attacks. Note that, for this particular application, the input field can be restricted and the output field expanded to make such attacks infeasible or even impossible (probabilistically impossible, in an asymptotically approaching zero percent chance of a collision even existing sense of the word).
I once had someone try to "prove" me wrong using a single invocation of whatever CLI version of SHA they had lying around. That's not the point at all. I don't care about quibbling over terminology; I care about it being 2016 and simple database breaches of login credentials routinely causing massive direct and indirect damage.
The "actual reality" is that companies cannot be trusted to perform the hash properly on their end and several have openly admitted to losing plaintext passwords. The actual reality is hashing is not all that computationally expensive in today's world, and many modern processors have specialized instruction sets that could be exploited for this purpose. The actual reality is that hashing, in the general sense of the term, does not need to significantly decrease entropy (though obviously improperly implemented hashing can.)
The "actual reality" is that client-side hashing is easily auditable, whereas properly implemented server hash (in combination with a finite limit on the password field) prevents a read-only database breech from instantly translating into access to all accounts (although it does enable offline attacks, so everyone with weak passwords will be compromised as soon as the attacker can get around to cracking their hash.) None of this would interfere with a challenge-response scheme or any other additional security measures from being implemented, if one wished.
The actual reality is that measures such as these would have significantly mitigated a lot of the damage and collateral damage from many of the high-profile breaches we've seen in recent years.
These are trivial, basic facts presented as a back-of-the-napkin proof of concept scheme that any halfway bright CS sophomore could easily verify, but for the benefit of readers who may not be aware, these are facts that you have asserted to be untrue. Although you still refuse to provide any details whatsoever.
You are a stubborn and/or ignorant fraud mindlessly apologizing for the incompetents running your industry, people who have screwed over millions of users with their incompetence. Just a little FYI for all readers out there.
It allows anyone to encipher messages without any possession of secret information.
Yes, but it's worth noting this doesn't allow you to encipher information without preshared information. You require CAs and such to be pre-loaded and trusted ahead of time.
If you've made that leap of trust, why not make a much easier leap of trust of using a friend's connection get your initial set of symmetric keys? Why not use an automated telephone service, and a little slip of paper that came with your new computer?
The "secret information" is, in fact, very easy to come by and only needs to be done once. All keyservers would need to be compromised for the session to be compromised, and because it's stateful and there's no reason not to immediately generate new keys for each server you talk to, that compromise would have to be retroactive (i.e. based on some logs someone has been stealthily maintaining on ALL keyservers used) for it to be a truly catastrophic breach.
This can be used on top of or alongside asymmetric solutions for the exceptionally lazy, paranoid and/or ignorant. By all means, if you want to put 100% of your trust in your magical "one-way" mathematic functions remaining one-way for your entire lifetime, you should be free to. I am only addressing those readers who would give a damn about pursuing a truly robust system, one that isn't vulnerable to a single RSA weak key class discovery or a single rogue CA to bring down.
Nothing you offer does that when you remove the shell game of punting of responsibility and convenient ignoring of underlying reality.
The "underlying reality" is we've already needed to increase the size of RSA a few times, and ban various classes of weak keys. That's because with any system where the asymmetric key is the weakest link, you are always playing with fire because you have to assume that no shortcuts in the future will be found.
For a zero known plaintext attack of encryption of random data (as would routinely occur in a WOT symmetric key exchange system), we're as certain as certain can be that symmetric algorithms are secure. Such a scheme is literally the most robust scheme imaginable short of an OTP.
We have no good reason to be nearly so confident about RSA or other asymmetric solutions remaining similarly secure a decade from now, even in the absence of quantum computers.
It allows this to occur in a completely untethered, unlimited and untraceable manner.
Vague hand-waving nonsense. There is no tethering or limit or tracing involved in my system except for the very first time you need a set of keys. For an organized person, this is literally a once in a lifetime process. For a less organized / knowledgeable person, this would only need to be done every time a new device was purchased.
Please don't tell me you're about to drag out some nonsense about being "limited" to the amount of non-volatile you have at your disposal.
We know nothing of the sort. There is ZERO evidence in existence to support this assumption. NONE.
Ok, uh, well they have implemented Shor's algorithm. They know for a fact that it works. And they've been using it on progressively larger numbers. Yes yes, those numbers are still very small. But building a proof of concept device, and then watching as the underlying tech improves and the proof of concept devices become a little stronger (if still miles away), does not constitute "zero proof". It means we can be certain it's not impossible in principle, and it also indicates that researchers haven't lost interest yet.
Your opinions are your opinions.
And your "opinions" are liberally seasoned with crumbs of stuff that look suspiciously like lies.
Changing the default passwords accomplishes nothing as long as lazy jackasses (like you, as it happens) refuse to transmit, store and verify them properly.
To clarify, I was saying that was the leakers' (be they Russians or Martians or a disgruntled DNC employee) first-order motive. Their second-order motives of helping Trump or sowing seeds of chaos don't interest me all that much and I'm highly suspicious of anyone who is more concerned about these motives than examining and debating the content of the leak itself.
This goes pretty much for any leak where liars are exposed. Very distasteful, this obsession with tattletales and this protectionism so frequently extended to liars.
We have massive data showing the efficacy of MMR in the form of macro-view epidemiology. Or do you think it's just a huge coincidence that all of the societies that had large MMR vaccine campaigns saw massive drops in the infection rates of those disease?
Andrew Wakefield is a proven fraud. If you're going to be a crackpot, at least come up with a story that a 10 second Google can't debunk.
British government to refuse separate vaccines to be administered
Separating vaccines is moronic and cruel. The body's immune system is "on/off". It doesn't give a shit about being "ganged up on". I've heard firsthand how kids who get separate vaccines, if they are prone to side effects like a mild fever, will get those side effects after every single vaccination instead of just the one time, and this makes perfect sense to anyone who understand how our bodies actually work.
The numbers aren't increasing. Autism and autism-spectrum is a catch-all term popularized by members of the less scrupulous softer sciences. It's this generation's "ADHD".
Do you think that there was a massive ADHD epidemic in the 1980s-1990s too? What, in your considered opinion, was the cause of that epidemic? Fluoridated water, maybe?
1. Double blinding is not nearly as important for vaccines as for other trials because the time periods involved are very long and the lab tests involved are pretty objective. Safety is indeed tested for extensively, and the lack of blinding almost certainly increases short term nocebo effects.
In other words, if it were double-blinded, vaccines would almost certainly look even better on paper because a significant percentage of the reported fevers, etc. would be shown to be completely unrelated to the vaccine, but we have very, very little reason to suspect that the placebo effect would magically keep people from getting sick (or from reporting it) years later.
2. I don't really require double-blinding to convince me that, for instance, the smallpox vaccine worked. The fundamental science behind the mechanism of action is obviously sound; it's just a matter of differing efficacies.
I fully support the right of nurses to say bullshit in their time off from work as long as they are required (under penalty of losing any nursing license) that they are not speaking in their capacity as a nurse and/or that science has disproven everything that they are about to tell you.
I fully support the right of anyone to say and do want they want about vaccines as long as you wear some sort of special T-Shirt or sign around your neck warning immunocompromised people to stay away from them. Parental rights, unfortunately, should be respected except in fairly extreme cases, but at the very least special classrooms should be maintained so that they cannot come in contact with immunized children (unless they have a doctor's note stating that they suffer from a disease that makes vaccination too dangerous.)
Your right to punch ends where my face begins, etc.
Prior to one of their bigger leaks (possibly the Diplomatic Cables one, I forget), Wikileaks asked the USA gov to help sorting out the sensitive information. They refused. Whether you want to admit it or not, the USA is also the reason why Assange is holed up in an embassy. What he may or may not have done in Sweden is irrelevant; America refuses to offer any assurances that Assange will not be taken into custody (for doing his job as a reporter, albeit not always entirely competently).
So I really think we need some middle ground between "good reporter" and "bad reporter" here. I think "harrowed reporter" and "intentionally sabotaged by Washington reporter" are useful terms to introduce as well.
It's a bit disingenuous of you to imply the Cablegate thing was purposefully engineered by Assange. He may not have handled the encryption as well as he should've, but he wasn't the one who revealed the decryption key to the world. And if he wasn't threatened by Washington to begin with, he never would've needed his "insurance" files and he might have had more time to properly vet and properly distribute the material to newspapers.
At this point, I really don't begrudge Assange a bit of spite. He gave America plenty of chances to play fair and abide by its own first amendment, and Hillary responded by asking (perhaps half-jokingly) if we couldn't "just drone this guy?"
So, um, fuck her, fuck the people who work for her, fuck you for thinking that revealing a bit of office gossip is at all important for us to be worrying about, and fuck you again for blaming Assange for every one else's fuckups (including but not limited to the reporters who openly revealed the passphrase for the cables.)
And fuck Assange if he really did rape that Swedish woman, although I can't say the circumstances in that case are entirely un-suspicious.
If "Superimposition" was real Feyman style Superimposition (all possible states simultaneously), then it wouldn't matter how long it was in superimposition, it would pass through the key at some point in that state. You wouldn't need to make it last 10x longer, you could make it last 10x shorter and it would still find the solution.
Is that true? I never sat down and digested the implications of the algorithm but it's listed in Wikipedia as having O((log N)2(log log N)(log log log N)) complexity, which doesn't quite look like "instantaneous" to me.
Asymmetric schemes are as a practical matter absolutely necessary.
No they aren't, as I've explained at length in other posts. Web of trust approaches combined with intelligent hashing can be used to automatically generate session keys known only to the two parties without any single point of failure (all of the trusted servers would need to be compromised) and without any need for manual intervention.
The only thing asymmetric buys you, in terms of hassle for the end user, is the ability to not to have to worry about a transferring around a (fairly small) master keyfile or passphrase. But even this initial setup could be easily accomplished using a trusted friend's secure connection, either locally or you call them up on the phone and exchange a shared passphrase that way. An automated system can be set up by phone for people to bootstrap off of.
If your going to ask others you have no control over to "get to work" on something you kind of have to provide compelling evidence to support your position if you expect anyone to pay attention to you or spend their time on it.
The tone of my post made it fairly clear, I thought, that this was obviously a futile argument. Even if I had highly compelling evidence and thirty years of experience, it still would probably be a lost cause due to the massive amounts of laziness and inertia involved here. I'm lamenting our inability to adhere to the precautionary principle. It would be so easy, in principle, to supplement the current system but in practice it'll never happen.
We know a quantum RSA break is simply a matter of time. We don't know what tech advances will suddenly appear in the future, but we do know that if any country had a breakthrough there would be a very strong incentive to invest billions into it, even if they just got a few years' work out of it. And even it never happens, for whatever reason, asymmetric computing has always had many more question marks hanging over it. We can't be sure there won't be a new class of weak RSA keys discovered tomorrow, but we can be fairly confident that a powerful (i.e. much faster than brute force) zero-known plaintext attack for AES is not going to pop up tomorrow.
You see, this is what I'm talking about. I don't know for a fact that it was the Russians. If this were a case of conservatives yammering on about Russian-conspiring-with-Democratic-candidates conspiracy theories then every single leftist in America would pull a muscle from rolling their eyes too much. The left spent decades dealing with that rubbish.
But more importantly, I don't care if it was the Russians, and I don't care if it was a "hack". Hack is just a scary word for leak, those things that have been helping to keep devious politicians in check (somewhat) for hundreds of years. A hack would be very easy to frame, and hacks are often instigated by insiders anyway (which makes it an ordinary "leak", first and foremost) and I wouldn't be any less interested in the contents of the emails if it were the Russians who handed them to us. It is obvious enough, through the Clinton camp reaction, that these emails are largely and probably entirely genuine.
Motive: Helping us determine whether or not Hillary Clinton can be trusted when she promises something or makes a public stand.
I'd say that's a pretty goddamn honorable motive, but some people seem to think that by definition it can't be honorable if the evidence paints her in an unflattering light because Trump must be stopped at all costs.
I swear to fucking god, it's like it's 2004 again and asshat conservatives are trying to lecture us on why we're not supposed to ever criticize the president during wartime.
No no, material would be provided from multiple servers and combined together with a well designed hash. You could have one server in the EU, one in the USA, one in Russia, one in Cuba and one in China if you were feeling paranoid. You would have a separate preshared key for each, and your browser settings could specify minimum number of keyservers you require to consider a connection secure. The point is all off the servers would have to be compromised bad things to happen. Such a scheme could be made to be as strong as its strongest link, not as weak as its weakest link.
I'm handwaving away some details here and there might be better ways to do this; I'm merely pointing out that it's feasible and in principle could be made to be quite robust.
You can't share your AES encryption keys with the world because it's the same key you'll be using to decrypt the data you want to receive.
Yes, but as I briefly explain in my addendum, you would only need to set up a few different preshared symmetric keys with multiple trusted keyservers (this could be done over the phone, using a trusted friends' connection, whatever) to build a robust replacement for our current system that wouldn't need to touch asymmetric encryption for authentication or encryption that should theoretically remain secure as long as at least one of the keyservers involved in a signing or encryption operation remains uncompromised.
This is a back of napkin proof of concept thing; there's an entire article on Wikipedia called "Post-Quantum Computing Cryptography" that I haven't even skimmed yet. I merely mean to illustrate that it's possible and, once the infrastructure was there, shouldn't be a pain in the ass to use once you get used to the idea of copying over a small master keyfile (or arguably you could use a single passphrase, if the hashing were set up properly and you were confident enough in your ability to think up a very strong passphrase.)
...yes, but right now if I want to log into Google or Amazon using a secure authentication method that doesn't involve asymmetric encryption, I don't have that option, do I?
If I'm wrong and I do have that option then I guess I really need to be reading up on the latest TLS specs...
Preemptive clarification: There are a lot of ways to do this (and I don't claim to be an expert on this sort of thing), but one obvious way to accomplish this in a relatively painless fashion would be through heavy use of purpose-built hashing algorithms combined with symmetric encryption. Each session key would be built using material received over an encrypted connection (utilizing preshared keys abd hashing and challenge-response stuff only; no RSA) from multiple trusted key servers hashed together. In this way, the website you're talking to wouldn't be able to reconstruct any of your master keys and each trusted key server would be ignorant of the preshared key you use to communicate with the others.
There are lots of niggling details here, but I just wanted to make a quick point that a solution based solely on hashing and symmetric cryptography wouldn't imply having to set up a separate preshared key with each and every site or service you use.
Could we please get to work on getting everything on the web compatible with a stateful encryption scheme (out of band preshared keys and signing schemes that aren't entirely reliant on any form[1] of asymmetric cryptography) now ? Instead of waiting 10-20 years and then suddenly finding out, oh crap, some government has finally has built a quantum computer powerful enough to crack RSA/ECC?
No? Oh well. I tried.
1. Yes yes, there are some asymmetric schemes that aren't known to be vulnerable to efficient quantum algorithms, but there will always be a buttload of lingering question marks over any scheme that doesn't involve shared secrets.
Until the US has a different voting system for presidents, you're stuck with the two big party candidates, with third party candidates simply acting as proxies.
That's only true if you're going to be stubbornly myopic about the whole thing. The more votes third parties get, the more politicians will sit up and realize that they might be able to make a name for themselves (and get revenge at an ossified party structure that many of them probably despise) by sponsoring legislation to abolish first past the post ballots, or at least start supporting an alternative wing of their party a bit more openly.
Besides, voters don't elect a president, they elect an electoral college whose members are pledged to vote for a certain candidate.
All the more reason not to throw away your vote on Trump or Hillary.
This message has been brought to you by the coalition of Republicrat douchebags.
Seriously, I can't fucking believe this is modded up, as if these are the only two people in the country who are running.
Plenty of countries have abolished first past the post elections. The first step in doing it over here is demonstrating an actual desire for a third party. Vote Johnson or Stein or whomever else you fancy. Don't let anyone win you vote by default because they claim to be the only not-Trump party. Lots of parties are the not-Trump party.
We've only seen Clinton's dirty laundry.... And there's a strong ethos that the media, who is the one typically digging for and exposing leaks, will pursue both sides more or less equally.
Yes, clearly the media is biased against Hillary, and for Trump. Where the fuck have you been?
If you want to argue Wikileaks specifically, go show me the person who says they brought Wikileaks anti-Trump material that they refused to publish. They can only use what they're given, and Trump doesn't have many political secrets, just personal ones (that are already being aired pretty effectively by the rest of the media at this point in time.)
Clinton's personal opinions are kept personal because they're irrelevant. It's the positions she campaigns on that will show how she'll govern.
That's donkey shit. That has clearly no bearing on the documents in question here, documents that Hillary refuses to comment on, which contain this quote:
Clinton: “But If Everybody's Watching, You Know, All Of The Back Room Discussions And The Deals, You Know, Then People Get A Little Nervous, To Say The Least. So, You Need Both A Public And A Private Position.”* CLINTON: You just have to sort of figure out how to -- getting back to that word, "balance" -- how to balance the public and the private efforts that are necessary to be successful, politically...
She is very clearly talking about working against things behind the scenes that she supports in public, or vice versa. This is worth knowing when considering her position on things such as the TPP. (Which is something I haven't quite made up my mind on myself, but you should be able to clearly see how many people might be interested in how Hillary's public vs. private positions on it may differ.)
Not all politics follow the Clintonian school of thought. Not every president we've ever had has engaged in these sort of two-faced antics. I think that the nature of information in the twenty-first century is such that, as a country and as a species, we should be looking for other ways to govern that do not involve baldfaced lies. It will be a gradual process and there will be plenty of deception involved in the foreseeable future, but it is conceivable that we could leave it behind.
I didn't say you were abandoning your principles by supporting a 3rd party.
I said you were abandoning your principles by endorsing the actions of a major power using spycraft to try and sway the election.
That was far from clear. Regardless, even if I were steadfastly against Russian involvement (and I'm not for it per se; I'm just not against these sorts of things coming out), that doesn't mean I should or could ignore the contents of the leak. Nothing is being sacrificed here.
Except few entities other than the Russian government have the resources to leak/hack on this scale.
Except for a disgruntled DNC employee who favored Bernie or disliked Hillary.
There's nothing new here. This is just a leak. If someone tells me there's poison in my glass and there is indeed poison in my glass, then the poison and how it got there becomes my primary interest. The motivations of the informant are something I'll get around to analyzing maybe if there's time. I'm not at all convinced of Russian involvement, and even if this were proven it wouldn't change my analysis of the situation except that we should probably step up counter-espionage a bit, because I don't particularly want a strong Russian intelligence presence to remain in this country. That doesn't mean that they didn't happen to do a good thing in this case, if indeed they are behind the leak.
Incidentally, one of the more effective ways to crack down on Russian intelligence capabilities in this country, if it really is something that bothers you, is to implement comprehensive immigration reform--something the left has been pretty steadfast in refusing to consider (other than the path to citizenship stuff, which is something that I do wholeheartedly agree with.)
The bit that really worries me is the very label "hacking". These things used to be known as "leaks", and they were generally acknowledged by freedom-loving people on both sides of the aisle (but more often on the left) to be necessary for a free democracy to remain free and healthy.
Now suddenly it's a "hack", which sounds much scarier. Yes, I get that in principle a leak can be an intentional act by a "good guy" on the inside while a hack could be 100% the work of some foreign "bad guys" but in reality, I'm sure the majority of hacks involve at least one insider i.e. they're fundamentally no different than the "leaks" of the previous generation. Certainly, we're not talking about nuclear launch codes or anything here.
This trend, in combination with the fact that people like James Clapper are still running things for the government instead of rotting in prison, is terrifying. The public and the political community isn't acting on the leaked information the way they should be and instead both sides of the aisle seek to hype up the bogeyman hackers supposedly responsible for this "destabilization".
When someone is revealed to have lied, or in this case to have actually endorsed routine lying as a broad political philosophy[1], that person should be the topic of our conversations. Not the messenger.
1. And no, that's not a description of all politics everywhere. Most politicians have some degree of shame insofar as they're not going to brazenly admit that their public positions aren't real, and most politicians will have a handful of genuine core positions they won't back away from. With both Clinton and Trump, I can see very little evidence that such positions actually exist.
Slashdot Mirror
Just to preempt the peanut gallery here, I am using "hash" in a very loose sense here to encompass any "one-way" destructive transform that is highly resistant to chosen collision attacks. Note that, for this particular application, the input field can be restricted and the output field expanded to make such attacks infeasible or even impossible (probabilistically impossible, in an asymptotically approaching zero percent chance of a collision even existing sense of the word).
I once had someone try to "prove" me wrong using a single invocation of whatever CLI version of SHA they had lying around. That's not the point at all. I don't care about quibbling over terminology; I care about it being 2016 and simple database breaches of login credentials routinely causing massive direct and indirect damage.
The "actual reality" is that companies cannot be trusted to perform the hash properly on their end and several have openly admitted to losing plaintext passwords. The actual reality is hashing is not all that computationally expensive in today's world, and many modern processors have specialized instruction sets that could be exploited for this purpose. The actual reality is that hashing, in the general sense of the term, does not need to significantly decrease entropy (though obviously improperly implemented hashing can.)
The "actual reality" is that client-side hashing is easily auditable, whereas properly implemented server hash (in combination with a finite limit on the password field) prevents a read-only database breech from instantly translating into access to all accounts (although it does enable offline attacks, so everyone with weak passwords will be compromised as soon as the attacker can get around to cracking their hash.) None of this would interfere with a challenge-response scheme or any other additional security measures from being implemented, if one wished.
The actual reality is that measures such as these would have significantly mitigated a lot of the damage and collateral damage from many of the high-profile breaches we've seen in recent years.
These are trivial, basic facts presented as a back-of-the-napkin proof of concept scheme that any halfway bright CS sophomore could easily verify, but for the benefit of readers who may not be aware, these are facts that you have asserted to be untrue. Although you still refuse to provide any details whatsoever.
You are a stubborn and/or ignorant fraud mindlessly apologizing for the incompetents running your industry, people who have screwed over millions of users with their incompetence. Just a little FYI for all readers out there.
It allows anyone to encipher messages without any possession of secret information.
Yes, but it's worth noting this doesn't allow you to encipher information without preshared information. You require CAs and such to be pre-loaded and trusted ahead of time.
If you've made that leap of trust, why not make a much easier leap of trust of using a friend's connection get your initial set of symmetric keys? Why not use an automated telephone service, and a little slip of paper that came with your new computer?
The "secret information" is, in fact, very easy to come by and only needs to be done once. All keyservers would need to be compromised for the session to be compromised, and because it's stateful and there's no reason not to immediately generate new keys for each server you talk to, that compromise would have to be retroactive (i.e. based on some logs someone has been stealthily maintaining on ALL keyservers used) for it to be a truly catastrophic breach.
This can be used on top of or alongside asymmetric solutions for the exceptionally lazy, paranoid and/or ignorant. By all means, if you want to put 100% of your trust in your magical "one-way" mathematic functions remaining one-way for your entire lifetime, you should be free to. I am only addressing those readers who would give a damn about pursuing a truly robust system, one that isn't vulnerable to a single RSA weak key class discovery or a single rogue CA to bring down.
Nothing you offer does that when you remove the shell game of punting of responsibility and convenient ignoring of underlying reality.
The "underlying reality" is we've already needed to increase the size of RSA a few times, and ban various classes of weak keys. That's because with any system where the asymmetric key is the weakest link, you are always playing with fire because you have to assume that no shortcuts in the future will be found.
For a zero known plaintext attack of encryption of random data (as would routinely occur in a WOT symmetric key exchange system), we're as certain as certain can be that symmetric algorithms are secure. Such a scheme is literally the most robust scheme imaginable short of an OTP.
We have no good reason to be nearly so confident about RSA or other asymmetric solutions remaining similarly secure a decade from now, even in the absence of quantum computers.
It allows this to occur in a completely untethered, unlimited and untraceable manner.
Vague hand-waving nonsense. There is no tethering or limit or tracing involved in my system except for the very first time you need a set of keys. For an organized person, this is literally a once in a lifetime process. For a less organized / knowledgeable person, this would only need to be done every time a new device was purchased.
Please don't tell me you're about to drag out some nonsense about being "limited" to the amount of non-volatile you have at your disposal.
We know nothing of the sort. There is ZERO evidence in existence to support this assumption. NONE.
Ok, uh, well they have implemented Shor's algorithm. They know for a fact that it works. And they've been using it on progressively larger numbers. Yes yes, those numbers are still very small. But building a proof of concept device, and then watching as the underlying tech improves and the proof of concept devices become a little stronger (if still miles away), does not constitute "zero proof". It means we can be certain it's not impossible in principle, and it also indicates that researchers haven't lost interest yet.
Your opinions are your opinions.
And your "opinions" are liberally seasoned with crumbs of stuff that look suspiciously like lies.
Changing the default passwords accomplishes nothing as long as lazy jackasses (like you, as it happens) refuse to transmit, store and verify them properly.
To clarify, I was saying that was the leakers' (be they Russians or Martians or a disgruntled DNC employee) first-order motive. Their second-order motives of helping Trump or sowing seeds of chaos don't interest me all that much and I'm highly suspicious of anyone who is more concerned about these motives than examining and debating the content of the leak itself.
This goes pretty much for any leak where liars are exposed. Very distasteful, this obsession with tattletales and this protectionism so frequently extended to liars.
Andrew Wakefield is a proven fraud. If you're going to be a crackpot, at least come up with a story that a 10 second Google can't debunk.
British government to refuse separate vaccines to be administered
Separating vaccines is moronic and cruel. The body's immune system is "on/off". It doesn't give a shit about being "ganged up on". I've heard firsthand how kids who get separate vaccines, if they are prone to side effects like a mild fever, will get those side effects after every single vaccination instead of just the one time, and this makes perfect sense to anyone who understand how our bodies actually work.
The numbers aren't increasing. Autism and autism-spectrum is a catch-all term popularized by members of the less scrupulous softer sciences. It's this generation's "ADHD".
Do you think that there was a massive ADHD epidemic in the 1980s-1990s too? What, in your considered opinion, was the cause of that epidemic? Fluoridated water, maybe?
1. Double blinding is not nearly as important for vaccines as for other trials because the time periods involved are very long and the lab tests involved are pretty objective. Safety is indeed tested for extensively, and the lack of blinding almost certainly increases short term nocebo effects.
In other words, if it were double-blinded, vaccines would almost certainly look even better on paper because a significant percentage of the reported fevers, etc. would be shown to be completely unrelated to the vaccine, but we have very, very little reason to suspect that the placebo effect would magically keep people from getting sick (or from reporting it) years later.
2. I don't really require double-blinding to convince me that, for instance, the smallpox vaccine worked. The fundamental science behind the mechanism of action is obviously sound; it's just a matter of differing efficacies.
I fully support the right of nurses to say bullshit in their time off from work as long as they are required (under penalty of losing any nursing license) that they are not speaking in their capacity as a nurse and/or that science has disproven everything that they are about to tell you.
I fully support the right of anyone to say and do want they want about vaccines as long as you wear some sort of special T-Shirt or sign around your neck warning immunocompromised people to stay away from them. Parental rights, unfortunately, should be respected except in fairly extreme cases, but at the very least special classrooms should be maintained so that they cannot come in contact with immunized children (unless they have a doctor's note stating that they suffer from a disease that makes vaccination too dangerous.)
Your right to punch ends where my face begins, etc.
Prior to one of their bigger leaks (possibly the Diplomatic Cables one, I forget), Wikileaks asked the USA gov to help sorting out the sensitive information. They refused. Whether you want to admit it or not, the USA is also the reason why Assange is holed up in an embassy. What he may or may not have done in Sweden is irrelevant; America refuses to offer any assurances that Assange will not be taken into custody (for doing his job as a reporter, albeit not always entirely competently).
So I really think we need some middle ground between "good reporter" and "bad reporter" here. I think "harrowed reporter" and "intentionally sabotaged by Washington reporter" are useful terms to introduce as well.
It's a bit disingenuous of you to imply the Cablegate thing was purposefully engineered by Assange. He may not have handled the encryption as well as he should've, but he wasn't the one who revealed the decryption key to the world. And if he wasn't threatened by Washington to begin with, he never would've needed his "insurance" files and he might have had more time to properly vet and properly distribute the material to newspapers.
At this point, I really don't begrudge Assange a bit of spite. He gave America plenty of chances to play fair and abide by its own first amendment, and Hillary responded by asking (perhaps half-jokingly) if we couldn't "just drone this guy?"
So, um, fuck her, fuck the people who work for her, fuck you for thinking that revealing a bit of office gossip is at all important for us to be worrying about, and fuck you again for blaming Assange for every one else's fuckups (including but not limited to the reporters who openly revealed the passphrase for the cables.)
And fuck Assange if he really did rape that Swedish woman, although I can't say the circumstances in that case are entirely un-suspicious.
If "Superimposition" was real Feyman style Superimposition (all possible states simultaneously), then it wouldn't matter how long it was in superimposition, it would pass through the key at some point in that state. You wouldn't need to make it last 10x longer, you could make it last 10x shorter and it would still find the solution.
Is that true? I never sat down and digested the implications of the algorithm but it's listed in Wikipedia as having O((log N)2(log log N)(log log log N)) complexity, which doesn't quite look like "instantaneous" to me.
Asymmetric schemes are as a practical matter absolutely necessary.
No they aren't, as I've explained at length in other posts. Web of trust approaches combined with intelligent hashing can be used to automatically generate session keys known only to the two parties without any single point of failure (all of the trusted servers would need to be compromised) and without any need for manual intervention.
The only thing asymmetric buys you, in terms of hassle for the end user, is the ability to not to have to worry about a transferring around a (fairly small) master keyfile or passphrase. But even this initial setup could be easily accomplished using a trusted friend's secure connection, either locally or you call them up on the phone and exchange a shared passphrase that way. An automated system can be set up by phone for people to bootstrap off of.
If your going to ask others you have no control over to "get to work" on something you kind of have to provide compelling evidence to support your position if you expect anyone to pay attention to you or spend their time on it.
The tone of my post made it fairly clear, I thought, that this was obviously a futile argument. Even if I had highly compelling evidence and thirty years of experience, it still would probably be a lost cause due to the massive amounts of laziness and inertia involved here. I'm lamenting our inability to adhere to the precautionary principle. It would be so easy, in principle, to supplement the current system but in practice it'll never happen.
We know a quantum RSA break is simply a matter of time. We don't know what tech advances will suddenly appear in the future, but we do know that if any country had a breakthrough there would be a very strong incentive to invest billions into it, even if they just got a few years' work out of it. And even it never happens, for whatever reason, asymmetric computing has always had many more question marks hanging over it. We can't be sure there won't be a new class of weak RSA keys discovered tomorrow, but we can be fairly confident that a powerful (i.e. much faster than brute force) zero-known plaintext attack for AES is not going to pop up tomorrow.
You see, this is what I'm talking about. I don't know for a fact that it was the Russians. If this were a case of conservatives yammering on about Russian-conspiring-with-Democratic-candidates conspiracy theories then every single leftist in America would pull a muscle from rolling their eyes too much. The left spent decades dealing with that rubbish.
But more importantly, I don't care if it was the Russians, and I don't care if it was a "hack". Hack is just a scary word for leak, those things that have been helping to keep devious politicians in check (somewhat) for hundreds of years. A hack would be very easy to frame, and hacks are often instigated by insiders anyway (which makes it an ordinary "leak", first and foremost) and I wouldn't be any less interested in the contents of the emails if it were the Russians who handed them to us. It is obvious enough, through the Clinton camp reaction, that these emails are largely and probably entirely genuine.
Motive: Helping us determine whether or not Hillary Clinton can be trusted when she promises something or makes a public stand.
I'd say that's a pretty goddamn honorable motive, but some people seem to think that by definition it can't be honorable if the evidence paints her in an unflattering light because Trump must be stopped at all costs.
I swear to fucking god, it's like it's 2004 again and asshat conservatives are trying to lecture us on why we're not supposed to ever criticize the president during wartime.
Also, it should be obvious, but you're already trusting CAs to prevent MitM attacks.
No no, material would be provided from multiple servers and combined together with a well designed hash. You could have one server in the EU, one in the USA, one in Russia, one in Cuba and one in China if you were feeling paranoid. You would have a separate preshared key for each, and your browser settings could specify minimum number of keyservers you require to consider a connection secure. The point is all off the servers would have to be compromised bad things to happen. Such a scheme could be made to be as strong as its strongest link, not as weak as its weakest link.
I'm handwaving away some details here and there might be better ways to do this; I'm merely pointing out that it's feasible and in principle could be made to be quite robust.
You can't share your AES encryption keys with the world because it's the same key you'll be using to decrypt the data you want to receive.
Yes, but as I briefly explain in my addendum, you would only need to set up a few different preshared symmetric keys with multiple trusted keyservers (this could be done over the phone, using a trusted friends' connection, whatever) to build a robust replacement for our current system that wouldn't need to touch asymmetric encryption for authentication or encryption that should theoretically remain secure as long as at least one of the keyservers involved in a signing or encryption operation remains uncompromised.
This is a back of napkin proof of concept thing; there's an entire article on Wikipedia called "Post-Quantum Computing Cryptography" that I haven't even skimmed yet. I merely mean to illustrate that it's possible and, once the infrastructure was there, shouldn't be a pain in the ass to use once you get used to the idea of copying over a small master keyfile (or arguably you could use a single passphrase, if the hashing were set up properly and you were confident enough in your ability to think up a very strong passphrase.)
It's doable, is my point.
...yes, but right now if I want to log into Google or Amazon using a secure authentication method that doesn't involve asymmetric encryption, I don't have that option, do I?
If I'm wrong and I do have that option then I guess I really need to be reading up on the latest TLS specs...
Preemptive clarification: There are a lot of ways to do this (and I don't claim to be an expert on this sort of thing), but one obvious way to accomplish this in a relatively painless fashion would be through heavy use of purpose-built hashing algorithms combined with symmetric encryption. Each session key would be built using material received over an encrypted connection (utilizing preshared keys abd hashing and challenge-response stuff only; no RSA) from multiple trusted key servers hashed together. In this way, the website you're talking to wouldn't be able to reconstruct any of your master keys and each trusted key server would be ignorant of the preshared key you use to communicate with the others.
There are lots of niggling details here, but I just wanted to make a quick point that a solution based solely on hashing and symmetric cryptography wouldn't imply having to set up a separate preshared key with each and every site or service you use.
Could we please get to work on getting everything on the web compatible with a stateful encryption scheme (out of band preshared keys and signing schemes that aren't entirely reliant on any form[1] of asymmetric cryptography) now ? Instead of waiting 10-20 years and then suddenly finding out, oh crap, some government has finally has built a quantum computer powerful enough to crack RSA/ECC?
No? Oh well. I tried.
1. Yes yes, there are some asymmetric schemes that aren't known to be vulnerable to efficient quantum algorithms, but there will always be a buttload of lingering question marks over any scheme that doesn't involve shared secrets.
Until the US has a different voting system for presidents, you're stuck with the two big party candidates, with third party candidates simply acting as proxies.
That's only true if you're going to be stubbornly myopic about the whole thing. The more votes third parties get, the more politicians will sit up and realize that they might be able to make a name for themselves (and get revenge at an ossified party structure that many of them probably despise) by sponsoring legislation to abolish first past the post ballots, or at least start supporting an alternative wing of their party a bit more openly.
Besides, voters don't elect a president, they elect an electoral college whose members are pledged to vote for a certain candidate.
All the more reason not to throw away your vote on Trump or Hillary.
This message has been brought to you by the coalition of Republicrat douchebags.
Seriously, I can't fucking believe this is modded up, as if these are the only two people in the country who are running.
Plenty of countries have abolished first past the post elections. The first step in doing it over here is demonstrating an actual desire for a third party. Vote Johnson or Stein or whomever else you fancy. Don't let anyone win you vote by default because they claim to be the only not-Trump party. Lots of parties are the not-Trump party.
We've only seen Clinton's dirty laundry. ... And there's a strong ethos that the media, who is the one typically digging for and exposing leaks, will pursue both sides more or less equally.
Yes, clearly the media is biased against Hillary, and for Trump. Where the fuck have you been?
If you want to argue Wikileaks specifically, go show me the person who says they brought Wikileaks anti-Trump material that they refused to publish. They can only use what they're given, and Trump doesn't have many political secrets, just personal ones (that are already being aired pretty effectively by the rest of the media at this point in time.)
Clinton's personal opinions are kept personal because they're irrelevant. It's the positions she campaigns on that will show how she'll govern.
That's donkey shit. That has clearly no bearing on the documents in question here, documents that Hillary refuses to comment on, which contain this quote:
Clinton: “But If Everybody's Watching, You Know, All Of The Back Room Discussions And The Deals, You Know, Then People Get A Little Nervous, To Say The Least. So, You Need Both A Public And A Private Position.”* CLINTON: You just have to sort of figure out how to -- getting back to that word, "balance" -- how to balance the public and the private efforts that are necessary to be successful, politically...
She is very clearly talking about working against things behind the scenes that she supports in public, or vice versa. This is worth knowing when considering her position on things such as the TPP. (Which is something I haven't quite made up my mind on myself, but you should be able to clearly see how many people might be interested in how Hillary's public vs. private positions on it may differ.)
Not all politics follow the Clintonian school of thought. Not every president we've ever had has engaged in these sort of two-faced antics. I think that the nature of information in the twenty-first century is such that, as a country and as a species, we should be looking for other ways to govern that do not involve baldfaced lies. It will be a gradual process and there will be plenty of deception involved in the foreseeable future, but it is conceivable that we could leave it behind.
I didn't say you were abandoning your principles by supporting a 3rd party. I said you were abandoning your principles by endorsing the actions of a major power using spycraft to try and sway the election.
That was far from clear. Regardless, even if I were steadfastly against Russian involvement (and I'm not for it per se; I'm just not against these sorts of things coming out), that doesn't mean I should or could ignore the contents of the leak. Nothing is being sacrificed here.
Except few entities other than the Russian government have the resources to leak/hack on this scale.
Except for a disgruntled DNC employee who favored Bernie or disliked Hillary.
There's nothing new here. This is just a leak. If someone tells me there's poison in my glass and there is indeed poison in my glass, then the poison and how it got there becomes my primary interest. The motivations of the informant are something I'll get around to analyzing maybe if there's time. I'm not at all convinced of Russian involvement, and even if this were proven it wouldn't change my analysis of the situation except that we should probably step up counter-espionage a bit, because I don't particularly want a strong Russian intelligence presence to remain in this country. That doesn't mean that they didn't happen to do a good thing in this case, if indeed they are behind the leak.
Incidentally, one of the more effective ways to crack down on Russian intelligence capabilities in this country, if it really is something that bothers you, is to implement comprehensive immigration reform--something the left has been pretty steadfast in refusing to consider (other than the path to citizenship stuff, which is something that I do wholeheartedly agree with.)
Which is why I've repeatedly said that people should vote for Stein or Johnson, not Trump.
This pathetic, myopic devotion to throwing all of one's weight behind the lesser evil for the next 4 years must stop.
The bit that really worries me is the very label "hacking". These things used to be known as "leaks", and they were generally acknowledged by freedom-loving people on both sides of the aisle (but more often on the left) to be necessary for a free democracy to remain free and healthy.
Now suddenly it's a "hack", which sounds much scarier. Yes, I get that in principle a leak can be an intentional act by a "good guy" on the inside while a hack could be 100% the work of some foreign "bad guys" but in reality, I'm sure the majority of hacks involve at least one insider i.e. they're fundamentally no different than the "leaks" of the previous generation. Certainly, we're not talking about nuclear launch codes or anything here.
This trend, in combination with the fact that people like James Clapper are still running things for the government instead of rotting in prison, is terrifying. The public and the political community isn't acting on the leaked information the way they should be and instead both sides of the aisle seek to hype up the bogeyman hackers supposedly responsible for this "destabilization".
When someone is revealed to have lied, or in this case to have actually endorsed routine lying as a broad political philosophy[1], that person should be the topic of our conversations. Not the messenger.
1. And no, that's not a description of all politics everywhere. Most politicians have some degree of shame insofar as they're not going to brazenly admit that their public positions aren't real, and most politicians will have a handful of genuine core positions they won't back away from. With both Clinton and Trump, I can see very little evidence that such positions actually exist.