Slashdot Mirror


User: bigberk

bigberk's activity in the archive.

Stories
0
Comments
1,130
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 1,130

  1. Re:enigmail/pgp/gpg on Silent Circle Follows Lavabit By Closing Encrypted E-mail Service · · Score: 1

    Nobody mentioned Thunderbird with built-in SMIME capability!

    Supports full public key crypto with no extra extensions needed. Generate a self signed certificate, and a big key (it can support 8192 bit RSA).

    Now you've got end to end crypto. Use Thunderbird with any ISP including gmail with IMAP and SMTP if you want; they won't have a clue what's being sent through anyway.

    For additional security, I think Thunderbird supports storing the crypto on a hardware token (smart card) but I haven't tried this.

  2. What are jail-worthy crimes? on Pirate Bay Trial Ends In Jail Sentences · · Score: 5, Insightful

    Yeah so we've known for some time that running a file sharing site for illegally redistributed content is bad news from a legal liability standpoint ... but I am still surprised by what kinds of activities in our modern age get you jail time.

    Is the fundamental issue "loss of money"? Well, the executives of the big banks in the world -- men like Charles Prince (Citigroup), Angelo Mozilo (Countrywide - collapsed), Alan Schwartz (Bear Stearns - collapsed) -- have lost far more money. They have lost money for investors, customers, and more recently taxpayers and even your children and your children's children. The damage caused by the systems they were responsible for is far greater han any of these file sharing misdemeanors. This is like comparing an out of control leaf fire in someone's backyard to the carpet bombing of a city.

    But what happens to investment bank executives who lost ridiculous sums (we're talking trillions) and ruined the lives of many? Probably nothing... hell, the previous Goldman Sachs CEO was put in charge of the US Treasury Department (Paulson) where he proceeded to redistribute public money to colleagues. Some may argue that men like Paulson, Greenspan, and Bernanke are committing acts of treason by taking money out of the national treasury and diverting it into the hands of the wealthiest elite, the top 1% of society.

    But don't expect to see any of these men in jail any time soon. Because in this world, the people who commit the grandest acts of financial theft and destruction are rewarded with lavish salaries and pensions, while the jails are filled with pot smokers, shoplifters, and guys who run file sharing web sites.

  3. Re:dot-ca remains in the dark ages on Canadian Domain Name Registrants To Get More Privacy · · Score: 1

    In my experience this is not true, I also own .CA domains. I never provided a driver's license to CIRA. Also I did recently update an address in my WHOIS, it was relatively painless. True that you have to log in and confirm through CIRA but otherwise the system has worked fine for me... could be that these bad experiences mentioned are based on older (legacy) registrations, back when there was higher security for different tiers of .CA domains, such as provincial, then national level which required extra checks.

  4. Re:Epic Fail? on Canadian Domain Name Registrants To Get More Privacy · · Score: 1

    You can get 20/5 Mbps for $50/month? OK well now I am very jealous of American broadband. In Ontario, Canada (most densely populated region of the country) I am paying $45/month for Rogers cable internet 7 M/512 K ... it's the upstream that is ridiculously poor on pretty much all residential options I have looked at. And I think it's consistently lame across Canada, because I have family out west that pays a bit less but still has no better upstream than this.

  5. Re:Security implications? on NXP RFID Cracked · · Score: 4, Insightful

    Implications: The Philips/NXP proprietary CRYPTO1 stream cipher is broken. This means that any card which relies on this algorithm to encrypt data being transmitted, can have that encrypted data compromised. It appears that the keys can also be compromised, so the whole card can be "cloned". This compromises the essence of the smart card, which is not supposed to be reproducible because private keys are supposed to remain secret. If the card in question was an access card to a corporation's secure facilities (and Mifare is very much used for such things) then these access cards can now easily be copied, cloned.

    I don't think that CRYPTO1 use is limited to contactless (RFID) cards. Presumably, any smart card (whether wireless or not) that uses CRYPTO1 to protect data is now compromised.

    It's tough to pinpoint the security implications because it depends on what cards out there in the world (and there are a TON of Mifare cards in use!) ... and where CRYPTO1 is being used to protect sensitive data.

    The fun, for the years ahead, will be in discovering where these implementations exist in the real world. In the software world we know that people are slow enough updating compromised software. Well this is HARDWARE we're talking about, with millions (or more?) deployed vulnerable smart cards, in a variety of potentially vulnerable settings.

  6. They broke Philips/NXP CRYPTO1 on NXP RFID Cracked · · Score: 4, Informative

    To clarify a few things. First of all this has been known for a few months. The earliest mention I saw was December 29, 2007: MiFare's CRYPTO1 algorithm mostly reverse-engineered. More information, including a slide show, is presented in this January 1, 2008 post: Mifare crypto1 RFID completely broken

    Quick background: NXP (Philips) creates a line of smart cards called "Mifare" based on proprietary protocols, including the CRYPTO1 cipher (undocumented, proprietary). There are a lot of Mifare cards deployed, and there is a huge element of security through obscurity especially if you rely on proprietary protocols, such as CRYPTO1 algorithm.

    This research, as linked above (and posted in this slashdot article... old news) shows that CRYPTO1 stream cipher is horribly broken, based on a terribly insufficient random number generator. Besides busting this example of security through obscurity, the target technology is actually deployed in a very wide range of uses. Meaning, this attack has many real world consequences.

  7. Re:Yet another wrong answer... on Spam Trap Claims 10x-100x Accuracy Gain · · Score: 1

    There is a huge black market in spam and marketing technologies, and this is what drives the persistent spam problem. The viruses and trojans which establish these botnets are written by professional programmers. The resources stolen by spammers (CPU and network) are leased out to other parties including for DDoS attacks and extortion. This is organized crime at work!

    Law enforcement has not taken the spam problem seriously because of this idea planted by some of the semi-legitimate spammers, that spam is a form of marketing and marketing is legal and in fact good for the economy, etc. Fighting spam technologies since 2000, I can tell you that the technologies used by spammers are growing increasingly sophisticated and alarmingly powerful.

    The criminal networks which have those resources for spam/marketing also have enough resources now, I think, to launch serious attacks against infrastructure. Yes I am saying that these spammers are a potential terrorist threat.

  8. Re:Terrorists? on Cryptography Expert Sounds Alarm At Possible Math Hack · · Score: 2, Insightful

    I agree, and I'd say the bigger threat in the context of this article is organized crime. Take for example the botnets/zombie networks, which are an advanced network technology made possible through software exploits. These technology attacks are leveraged for spamming, marketing, denial of service and other forms of extortion.

    As far as threats to the nation, the spam and popups are just the "tip of the iceberg".

    Obviously, the criminals use some pretty smart minds to seek and exploit software weaknesses. I think it's totally feasible that such a criminal group could be involved in more serious attacks that could compromise economic systems, national infrastructure, financial systems, etc.

  9. Re:Q2 LMCTF was the high point for me. on Games All Downhill Since Pong? · · Score: 1

    Can I still play it? I'd love to check it out. Are there still people on servers?

    I don't understand how such large numbers of players disappear from games. I used to religiously play Wolfenstein ET (Enemy Territory), which was fun because of all the servers and maps. These days I can not find any human players online.

  10. Re:which bankruptcy? on Novell to SCO - Pay Up · · Score: 1

    Here's as good a history as anything

    Those who bought SCOX during the ridiculous days of $15 to $19 a share have lost -99% of their money. The company used to be worth around $400 million, now less than $4 million
  11. Re:This will NOT raise awareness or work in any wa on TimeWarner DNS Hijacking · · Score: 1

    And, what is suggested here, is practically speaking quite simple to do. Configure your network so that problematic or high risk (infection indicating) packets raise alarm bells. Or even if you have nothing else, download full blocklist zones and grepcidr the lists to see if your own customers appear. All of this with minimal disruption to legitimate, uninfected hosts.

  12. Re:Get thee to 7-11 FFS on Where In the US Can You Get Just a Cell Phone? · · Score: 1

    On the topic of easy to buy prepaid phones from 7-11/WalMart ... I am coming from another country to visit California for a few days, and am thinking of buying a cell phone to use locally rather than bringing my own and incurring ridiculously high roaming charges. The ones I can buy at the retailers you mention, can one activate and use them without having an address and landline?

  13. Re:What about the lid? on Economic Analysis of Toilet Seat Position · · Score: 1

    That's a very interesting article, it did surprise me. But I think a broader thing to take away from all this bathroom grossness is that, humans are exposed to all kinds of pathogens on a daily basis. It's just unavoidable. So just clean your bathroom more regularly - all surfaces.

    For instance, if you were to make a habit of move the toilet seat up or lid up and down, then you also have to touch the seat and lid (and get your fingers on the extremely dirty underside. Not to mention the crap you are adding to those surfaces as you use your filthy hands to move them.

    So closing the lid may be good for preventing splashing bacteria up into the air, but then your hands also end up dirtier in the process. So if you're closing the seat and lid, you had better be more careful washing and lathering your hands. And how about those sink taps that you touch with your filthy hands? The same taps you shut off, re-infecting clean hands. Right?

    If women insist that slobby men put the toilet seat down, then they should be aware that the man's hands are touching very dirty areas of the toilet seat, and then he is spreading those bacteria to other surfaces like the taps, door knob ... because he's probably not washing his hands too thoroughly anyway. If on the other hand the man leaves the toilet seat alone or leaves it up, the more hygienic woman can move it as desired and wash her hands leaving all surfaces with maximum cleanliness.

  14. Costs? on Simple Chemical Trick To Boost Battery Efficiency · · Score: 4, Informative

    I didn't see any mention of cost in the article. For instance looking at market aluminum prices, I am astounded to see that the price of the raw metal is increasing something like +23% per year. I don't know if relatively speaking the aluminum/zinc oxide is more costly than just zinc, but I think a greater point is... if the raw material costs are increasing at such a rapid pace (over 20% per year!) then just how "cost effective" will these batteries be in the long term?

    P.S. the skyrocketing metal costs, including important ones like copper and silver, are part of an ongoing commodity boom and response to out of control inflation in the USA and depreciating US dollar. The rapidly increasing costs of these metals will be reflected in goods we buy, like batteries.

  15. Re:LOL on A Chip on DVDs Could Prevent Theft · · Score: 0

    And $400 million in loss? These claims from the industry was so stupid. Just because CDs and DVDs don't sell as much as they used to doesn't mean the "losses" are from piracy - besides, any piracy losses are dominated by professional piracy, and those pros get around any content protection on the discs.

    My sense of the whole thing, they're probably losing money because the songs and movies suck and the discs are a big pain in the ass to use, backup, and enjoy.

    Keep adding all that content protection, I'll be their "brick and mortar losses" are only going to keep growing.

  16. Re:ssh rsync? on Online Storage 2.0: Six Sites Reviewed · · Score: 1

    rsync.net is a fantastic service. I use them for my home and business backups, it is (as implied) ideal for using rsync but the drives also map. With the open source developer discount I pay around $5 a month for 5 GB of space. Reliable service and expertly maintained, highly recommended.

  17. Re:Class action on 25 Percent of All Computers in a Botnet? · · Score: 1

    I suggested that the claimants bea few large businesses, not millions of small fish. Many businesses have suffered huge costs due to attacks coming from Windows platforms.

  18. Re:Request on 25 Percent of All Computers in a Botnet? · · Score: 5, Informative

    One interesting method is to query an anti-spam database using your IP address, and see if you are listed as a spam source. Quick checks can be done at robtex or dnsstuff.

    If your IP address shows up on PSBL, CBL, SpamCop, or WPBL your host is probably infected and a source of spam or other abuse.

  19. Class action on 25 Percent of All Computers in a Botnet? · · Score: 3, Interesting

    There could definitely be a class action lawsuit at some point facing Microsoft. That one company has a mass deployment of an operating system that is obviously dreadfully vulnerable to infection. Some might reasonably argue that Microsoft has an implied duty to provide a reliable operating system, as the backbone infrastructure of the modern computing world.

    Among the victims of the easily infectable Windows platform are:
    1) Large internet service providers, who suffer tremendous bandwidth costs due to DDoS attacks and spam
    2) Sites that have been forced offline or had skyrocketing costs due to DDoS attacks
    3) Businesses which suffer downtime due to networks congested with worm activity

    I think it is time for an ambitious group of lawyers to start barking up this tree. It wouldn't be so big a concern if it wasn't for the fact that Microsoft has made a specific effort to rollout their operating system as a foundation of the world's business computing. They are providing faulty infrastructure.

  20. Re:Rights granted by a creator on US Attorney General Questions Habeas Corpus · · Score: 1

    So do you think Life, Liberty and the Pursuit of Happiness applies equally to Islamic Americans (whether African or Middle Eastern)? Because the religious white community did not exactly raise a fuss when those Americans began losing their constitutional rights; were detained and held without trial by the government, because of potential "terrorist" involvement.

  21. Americans to get lesson on slippery slopes on US Attorney General Questions Habeas Corpus · · Score: 5, Insightful
    First they came for the Jews
    and I did not speak out
    because I was not a Jew.
    Then they came for the Communists
    and I did not speak out
    because I was not a Communist.
    Then they came for the trade unionists
    and I did not speak out
    because I was not a trade unionist.
    Then they came for me
    and there was no one left
    to speak out for me.

    Nobody seemed to care about Americans who have a middle eastern background, since those dark boys are the "bad guys" these days. Nope, not the Jews, or blacks, or gays... this time it's those dirty muslims! Nobody raises much of a fuss when they're harassed by the government and police, suspected as terrorists because in this post-9/11 world you gotta... I mean they wear turbans. Or something.

    Then people start to get a bit nervous about how the government is wiretapping everything. Or how ISPs are served warrants (secret warrants) for handing over private data, which can not be publicly disclosed. But hey they're probably just after those scary brown islamic people right, I am safe ... right? I'm a white christian, I'm probably safe.

    Oops what's this, the military/government is saying detained prisoners can not question the court process or raise objections. No habeas corpus for them? Well that's ok, we should detain them forever without trial! In this post 9/11 world you gotta...

    But wait a second. The US Attorney General tells the nation that US citizens do not have the right to question the legal process or authority of courts. That's citizens, as in YOU, not the brown muslim in gitmo. YOU don't have such a right. Now this doesn't sound cool... it's one of the foundations of western law. Could have sworn that US citizens were guaranteed that right. It seemed obvious.

    We should have started worrying when those brown boys began losing their rights. Now they are coming after YOU. Wow just like in the historical warning.

  22. Re:Temporary Solution on Fight Spam With Nolisting · · Score: 2, Informative

    The interesting thing about the solution is that it will increase costs for the spammer. Not quite, because spammers don't really pay for bandwidth. They steal the computing power and bandwidth from victims (virus infected machines) to set up botnets, and then leverage the stolen resources for their marketing business.
  23. Not as good an idea as it sounds on Fight Spam With Nolisting · · Score: 3, Informative

    This probably works in many cases, but as a mail system admin I can tell you that it can fail and will cause problems for legitimate mail delivery. Over the past few months I remember seeing a few messages stuck in my Postfix mail queue, that didn't ever seem to make it out to the recipient's MX. These were domains with deliberately non-functioning MX, and I could not figure out why Postfix was not trying the other MX even though it was up and running. In one case I also tried mailing the recipient domain through gmail, which ALSO failed after many days of retrying. Again I am not sure why the scheme failed to work, but it did fail through both Postfix and gmail which are two very legitimate mail servers.

  24. Non-local computing on Google, Microsoft Escalate Data Center Battle · · Score: 4, Insightful

    The aim for both of these giants is to shift people towards non-local computing, that is software and applications that run remotely rather than on someone's own computer.

    Early signs of this beyond the obvious google applications that require web access, are aggressive attempts by Microsoft to "activate" everything online. You are going to increasingly need network connections to run standard applications.

    I don't like that myself, since it hurts reliability and autonomy in computing. From a marketing perspective, there are huge benefits to centralized computing of course. Take gmail for instance, which lets google mine your private communications to gain insight into products and services which might interest you.

  25. My objection - it is MY computer on Is DRM Intrinsically Distasteful? · · Score: 1

    My objection is that this is MY computer - I own it, I paid for it, I run it, and I can pull the power plug on it. I will not load it with software that works against me.

    DRM sets up a mini battle going on within the OS/motherboard/applications. I refuse to let that battle happen, because this is my property to begin with. I just will not tolerate the insult of software that works against ME, the owner.