Slashdot Mirror


User: skiman1979

skiman1979's activity in the archive.

Stories
0
Comments
652
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 652

  1. Re:People definitely neglect science... on Parents Baffled By Science Questions · · Score: 2, Interesting

    I experience this all the time with my 3-year-old daughter. She hasn't quite gotten to the "why, why, why, why, why?" stage yet, but she does absorb a lot of information without actively trying to discover it. Often times when she misbehaves, instead of just yelling at her and putting her in a corner in timeout, I will sit down and talk with her:

    daughter: *cries*
    me: what's wrong, why are you crying?
    daughter: I sad with you
    me: why are you sad?
    daughter: umm... daddy yell at me
    me: why did daddy yell at you?
    daughter: because... cause I don't know, I just can't.
    me: you can't what?
    daughter: I want to play with my toys
    me: but it's dark out. It's bedtime. We don't play with toys for bedtime
    daughter: *cries*
    me: if you go to sleep nice and quiet, you can play with your toys in the morning
    daughter: *sniff* ok...

    I just try to get her to discover and communicate why she's upset and what she can do to fix it, instead of just flat out telling her "put the toy down and go to bed".

  2. Re:TrueCrypt on Encryption? What Encryption? · · Score: 1

    You can, I'm pretty sure, but then it's not truly hidden anymore - there's no obvious file hanging out, but anyone who did a forensic analysis of the drive would likely notice that instead of being full of unmapped fragments of old files, the unused space on your disk is full of random garbage. There is also a big catch - if you ever write to the NTFS volume while the hidden volume is not mounted, you will corrupt the hidden volume.

    Now I've never done a forensic analysis of a hard drive before so I might just not understand how it works, but how much different would random garbage (which is actually the hidden volume) look as opposed to free space that was wiped with a multi-pass disk wipe utility? Don't those utilities write random garbage to the disk repeatedly?

    Also, the big catch you mention, as others have including myself in an above post, is also true if the hidden volume was inside a truecrypt volume. If the truecrypt volume is mounted, but not the hidden volume, truecrypt may overwrite parts of the hidden volume because it's not protected by the mount. In fact, the OS itself may overwrite the hidden volume if it is not mounted (even inside the TC volume) because as far as the OS is concerned, the TC volume is only occupying 3GB of the disk, not 10GB (just as an example - 7GB hidden volume).

  3. Re:TrueCrypt on Encryption? What Encryption? · · Score: 1

    Two things to point out. First thing:

    So then an intruder would have to know that TrueCrypt was used, and then use the tool to scan the NTFS volume for hidden data

    Without knowing the password it would be impossible to detect the presence of the TrueCrypt hidden volume. Caveat: if the forensics analysis looks at the hard disk access logs (in the hardware) they could detect frequent access to "unused" portions of the volume.

    Second thing:

    I wonder if it would be possible to store this hidden volume directly inside the free space of an NTFS volume instead of inside a TrueCrypt encrypted volume?

    Unfortunately, actually using the "non-secret" portion of the volume risks overwriting parts of the "hidden" volume, because it can't be detected or located without having the password. In order to prevent this, you have to enter the password so that the secret volume can be located, then if anything tries to overwrite it the write can be blocked.

    Yes, I do remember seeing warnings about this in TrueCrypt's documentation.

  4. Re:TrueCrypt on Encryption? What Encryption? · · Score: 1

    Your point is cogent, informative, and well-written.

    Are you new here?

    I'd just add that TC state that their hidden volumes are indistinguishable from random noise, i.e. cannot be detected.

    It would seem I'm new wouldn't it? ;-) I've been around though. I don't remember how many years ago I joined, maybe somewhere around 2002.

  5. TrueCrypt on Encryption? What Encryption? · · Score: 4, Interesting

    A program called TrueCrypt achieves something close to this â" TrueCrypt allows you to encrypt a storage volume with two different passwords, so that one password provides access to "innocent-looking" data, while the other password provides access to the data that you really want to keep secure. If someone is compelled to give up their password, they could provide only the password that unlocks the "innocent-looking" data â" and there's no way, from examining the encrypted file, to tell that there is a second password guarding even-more secret data. (Of course, the "innocent-looking" data can't be truly innocent-looking, because it has to look like the kind of thing that someone would believe you might want to encrypt â" so it should look suspicious enough that you would genuinely want to hide it, but not bad enough to get you in real trouble if you're forced to reveal it!) The Achilles heel of this scheme is that just having TrueCrypt on your computer in the first place, would at least signal to an intruder that you're encrypting files. And even if they can't prove that you might have another "super-secret password" guarding more private data on your encrypted volume, they would certainly suspect it, if they already had grounds to be investigating you and if they knew anything about how TrueCrypt works. To provide true plausible deniability of any encryption at all, you need a program that already exists on lots of people's machines, so that an intruder doesn't suspect anything when they find it on your computer.

    It's been a while since I've used TrueCrypt, so maybe things have changed. I do remember the feature where you can have a 'hidden volume' inside your TrueCrypt encrypted volume, which sounds like what the quote above is talking about, that is protected by a second password. The thing with TrueCrypt is, at least the version I used around 2003, you don't have to have the software installed on the computer in order to use it. TrueCrypt can run entirely off of a flash drive or other removable media.

    From what I understand, the hidden volume's data is stored in the free space of the main encrypted volume, so the filesystem doesn't actually have handles to this data, something like that. I wonder if it would be possible to store this hidden volume directly inside the free space of an NTFS volume instead of inside a TrueCrypt encrypted volume? So then an intruder would have to know that TrueCrypt was used, and then use the tool to scan the NTFS volume for hidden data, rather than just seeing that there's an encrypted volume there, and suspect there may be hidden data as well.

  6. Re:Comparing Apples to Oranges on US Cell Phone Plans Among World's Most Expensive · · Score: 1

    By way of example, I have a 4 line family plan that costs $31.87 per line. All 4 lines have:

    • $350 subsidy on the cost of the phone
    • Shared 1500 minutes peak airtime (we typically use closer to 8000 minutes total, but we never go over on peak airtime)
    • Unlimited 3G data
    • Unlimited SMS
    • Unlimited GPS/TV/Radio

    Now I look at what I get for $31.87/mo vs. what you get for 29 Euro/mo, and I am not seeing why I should be so outraged. Which is a shame really, because I do so enjoy getting worked up.

    I want your plan! My $70/month family share plan (2 lines) gives me only 700 shared minutes, unlimited nights/weekends/moble2mobile with NO data/messaging allowance. I actually have to pay per MB and per text/pic/video message. I do get a $100 discount toward a new phone every 2 years though... I suppose at least I get a 15% employee discount on my plan bringing it down to about $30 per line for the two I have.

    I need a new plan...

  7. Re:Stupid prices on US Cell Phone Plans Among World's Most Expensive · · Score: 1

    It's ridiculous some of the things the carriers charge so much for, at least from a technical standpoint. Without a messaging plan on my account, I'm charged $0.10 (may have gone up to $0.25) per message, incoming AND outgoing. Text messages should use a lot less bandwidth on the carrier's network than actual voice calls, but messages get charged a lot more.

    I guess it depends on what carrier you go with, and how much you complain too. I'm perhaps too lenient with my plan. I have a $70 per month family share plan (2 lines) with 700 shared minutes, unlimited nights and weekends, unlimited mobile2mobile with other customers from my primary line, and no messaging allowance. One of my coworkers has a family share plan on another carrier. He tells me he pays around $80 or so for 5 lines, with a shared data plan, Internet on all phones, a lot more minutes and other features. He's the type that will call up the carrier and complain about every last thing, play the carriers against each other, ask to cancel his account just to get free or discounted services, things like that. I guess he got lucky.

  8. Re:That's OK... on Working Off the Clock, How Much Is Too Much? · · Score: 1

    Always at your desktop I see. Slacking off again? This guy needs more work!

  9. Re:Depressing, but not uncommon on Student Sues University Because She's Unemployable · · Score: 1

    I think many Americans are made to work too long and hard, and get paid too little, for what they do. As I understand it, correct me if I'm wrong, there are some countries in Europe where it's not uncommon for employees to take a month or two off work at any given time just to take a break. Here in America, many supervisors would likely have you fired if you take a few minutes to have a siesta after lunch, or take a 5-minute break to check on your friends' bulletin messages on Myspace to clear your mind of stress from the job.

    Yes, I believe we Americans are doing it wrong.

  10. Re:Depressing, but not uncommon on Student Sues University Because She's Unemployable · · Score: 1

    I'd advise Ms. Thompson that with her achievements and attitude, she needs to lower her expectations. She mentions McDonalds sneeringly, but the fact is that they have a general corporate policy of promoting most of their talent internally. If she is as capable as she thinks she is and went to work there with the intention of proving herself (and the attitude to match), she could have a perfectly reasonable career. The same is true of any number of other employers that she probably considers below her social status. Of course, she won't.

    Exactly what I was thinking. I didn't RTFA (hey this is Slashdot :p) so I don't know what field she's actually in, but if she may eventually be looking to get into management, she could work up the ranks at McDonald's while doing work on the side at home, or volunteer work for non-profit organizations or schools (sysadmin at a high school, build a website for a charity, etc) to build up on her skills that she can add to her resume. She'll come out showing that she has management potential and can lead a team of people, even if that team doesn't do the work she is ultimately looking for.

    In my view, one of the main benefits of college is that it teaches you how to learn. Sure, you come out with a degree in Marketing or Computer Science or Psychology or any other field, but you don't (or shouldn't) go to college just to absorb information, but to learn how to teach yourself as well. She can use the skills she learned at college to apply to any job, even a management position at McDonald's. If she can show a hiring manager how she applied these skills in the real world, it can certainly help her to land the job she really wants.

  11. Re:Pedant Warning! on Scammer Plants a Fake ATM At Defcon 17 · · Score: 1

    Hey I was born and raised in northeast PA and I use 'bathroom' and 'restroom' interchangeably. If I'm talking to my 3-year-old daughter, it's 'potty' most of the time.

  12. It's no wonder they don't work on Security Certificate Warnings Don't Work · · Score: 2, Informative

    Companies don't even use security certificates properly. I've worked at several places in both the public and private sector where the IT folks didn't even get proper security certificates. So when you go to their websites, or some internal servers, you'd be greeted with 'invalid certificate' warnings and just take it as normal.

    One company I worked for was an IT security company whose main services were conducting C&A activities for government and private sector agencies. You can't even go to their company website (https) without getting an invalid certificate warning. You would think a company that is trying to get their name out there in the IT Security world would 'do it right.'

  13. Re:It's simple, really on Keeping Up With DoD Security Requirements In Linux? · · Score: 1

    I couldn't agree more. All those compliance checklists auditors use to "secure" systems really get in the way sometimes. Do you really want to have requirements for complex passwords with a 3 invalid attempt lockout and a screen saver with a 10 minute inactivity lock on a weapon system? If I was out in a war zone and I was getting shot at, the last thing I'd want to do is have to enter a password, on tiny buttons, while wearing thick gloves, to unlock my rifle.

  14. Re:Switch distros? on Keeping Up With DoD Security Requirements In Linux? · · Score: 1

    I'd love to run Gentoo on my box, but the IT department requires Red Hat or Windows XP/Vista. :(

  15. Re:Dict' attack is sooooo 2000 on Strong Passwords Not As Good As You Think · · Score: 1

    Because they invariably also feature some braindead password recovery feature (ya know, the supersecret questions like "what was the name of your pet dog", again with infinite tries) that is usually even easier to defeat than the password guessing game.

    Well my dog's name is 7/16/1964. My mother's maiden name is Houston, TX. My first girlfriend's last name is 4019-2881-2840-9293. My childhood hero is 123-45-9874.

  16. Re:News at 11 on Strong Passwords Not As Good As You Think · · Score: 1

    I imagine if the helpless desk gets 100 requests a day to reset account passwords then after a while they become less careful to ensure that the person requesting a password reset is actually the person that owns the account.

    Help desks definitely can become lazy. One time at this one job, I forgot my password. I called the help desk to ask for a password reset, but didn't give them my name. The help desk person said my name, asking if it was me, and I said yes. Then they told me that I should probably "write this down" and proceeded to spell out my new password to me over the phone. I thanked them and hung up. They never actually verified that I was the owner of the account. Later when I received one of their "customer satisfaction surveys" I left a comment about the poor quality of service regarding their password reset policies. One of their admins called me back to ask about this. He said it is their policy because it's "what the customer wants," the customer being the employer since the help desk is outsourced.

  17. Re:News at 11 on Strong Passwords Not As Good As You Think · · Score: 1

    Yeah, rules like requiring 10 characters, 2 upper, 2 lower, 2 numbers, 2 special characters, change every 40 days, can't reuse last 25 passwords.

    Security training could include tips on good password techniques. _Sk1M4n1979_ shouldn't be that hard to remember. It meets or exceeds some of the strong password rules and matches my Slashdot username. Of course users should be told not to make their passwords resemble their usernames. No, it's not my Slashdot password ;-)

    In the past, I've seen suggestions like using the initial letters of an easy to remember phrase as your password. I always have trouble coming up with a phrase, and then remembering which phrase to use for said password. However, if you like using trustno1 as your password, maybe _Tru5tNo1!_ would work.

  18. Re:What an ass... on Researcher Trolls MMO, Surprised When Players Hate Him · · Score: 1

    I think the professor's study would have been better if he actually PVPed with his opponents instead of just teleporting them to their insta-deaths all the time. Also, I do agree with whoever it was above that said heroes won't just run around killing villians just "because, hey, he's a villian". Heroes prevent villians from doing evil. Villians should be attempting evil deeds, not just standing around in a combat arena chatting with heros.

    I used to play Silkroad Online (http://www.joymax.com/silkroad) and in that game, you can start PVPing at a pretty low level. I can't remember if it's level 10 or 20. Cap is 100 right now. At one point, the game offered scrolls that you could use to spawn monsters about your level so you could kill them for large amounts of experience. Instead, some high level players would spawn those monsters, hundreds at a time, in low level areas and teleport away, causing the monsters to start 1-hitting everyone in sight. The game mechanics allow it, but it's frowned upon. The GMs I believe actually started banning some people for it, or at least said they would.

  19. Re:Nice thought, bad planning on Bike Projector Makes Lane For Rider · · Score: 1

    Just saying you probably should wait until you are out of the blind curve before passing a bicyclist. The same could be said for a street sweeper, or a car, or a deer that won't get out of the way.

  20. Re:Nice thought, bad planning on Bike Projector Makes Lane For Rider · · Score: 1

    Who cares about what the drivers behind you are doing? If they want to swerve back and forth, flash their headlights at you, tailgate you, that's their problem. Consider what would be worse (for you): passing that bike around a blind corner, which involves you accelerating and possibly getting hit head on by oncoming traffic at faster-than-bike speed, or staying at bike speed and possibly getting rear ended by an impatient driver, or getting your front fender clipped by the same impatient driver who passes you?

    If you're staying at or below bike speed and get hit by someone trying to pass you, it surely wouldn't be as bad as getting hit head on because you were too impatient to wait for a safe time to pass that bike. Besides, if you stay patient and abide the "safety rules" and someone hits you, you could sue.

  21. Re:Anti-trust? on AV-Test Deems Windows Security Essentials "Very Good" · · Score: 1

    Wouldn't it be more like tow truck companies suing GM for integrating an automated self-towing system into all new GM vehicles starting in 2011? If your car breaks down, a third axle with attached tires would lower to the ground and raise the front end of the vehicle. The system would be programmed to take the car to the nearest auto repair shop via GPS.

  22. Re:Let's first agree on one thing on John Hodgman Asks Obama, "Are You a Nerd?" · · Score: 1

    I suggest we first define who a nerd is. Otherwise this being slashdot, we'll end up submitting comments about something that is entirely different depending on who is posting.

    My submission: I agree with this definition and hope that all of you use it as a bench mark as you post your comments.

    In part: "...derogatory connotation or stereotype, that refers to a person who passionately pursues intellectual activities, esoteric knowledge, or other obscure interests..."

    Thank you.

    As opposed to a geek which, according to Wikipedia is (in a more recent school of thought)...

    ...simply a description. It is taken to be someone who is an enthusiast, often in things outside of the mainstream spectrum, of note is that in this definition, there is no reference to being socially inept in the slightest.

    Geeks can socialize. Nerds can't... usually. I was a bit of a nerd in high school, but I've transformed into a geek in more recent years. I wear my Geek Badge proudly! :-)

  23. Re:You miss-quoted the article... on John Hodgman Asks Obama, "Are You a Nerd?" · · Score: 1

    ... Sorry to split definitions but we have to agree on the definition of nerd and geek. I don't consider them quite the same.

    Agreed. Geek != Nerd. I basically consider a geek to be a nerd with social skills. Nerds aren't very good at socializing, but are just very good at their technical expertise. Geeks are similar, but know how to socialize as well. I consider myself a geek, but a somewhat shy geek. ;)

  24. So I can't sing to my kids anymore? on ASCAP Wants To Be Paid When Your Phone Rings · · Score: 1

    I guess I should be careful about singing songs to my kids in the car when we're traveling? My wife and I often sing songs from the Wiggles, or various Disney songs, Hannah Montana (my 3-year old daughter LOVES her), and the like to the kids to entertain them on long trips. If we sing too loudly, someone outside the car might hear us and report us!!

  25. Sound systems in cars on ASCAP Wants To Be Paid When Your Phone Rings · · Score: 1

    What about all those people with HUGE sound systems in their cars? The type that pump out so much bass that the entire frame of the car rattles as the car moves down the road, and the music can be heard hundreds of meters away. I guess the RIAA will be going after them too, if they haven't already, assuming the driver is playing CDs rather than public radio broadcasts which would be covered by royalties paid by the radio station.