I'm not even sure that "leaked" is the correct word to use. He was in Afghanistan. It's hard to hide Air Force One, the motorcade, etc. They were reporting the news, i.e. what they're expected to do.
Do you complain that you have to carry around and might lose your car keys or your house keys? At least if you car is stolen or your house is robbed, you can recover some of your losses with insurance. If your identity is stolen because your single-factor password is phished, you may never recover.
Some brands of tokens break. Some can be driven over or thrown in the laundry and they'll still work. Ask your bank to invest in quality.
The whole point of the tokens is that the code cannot be duped.
>Aren't we inocculated against measles when you're maybe six years old?
Others have danced around this, but your comment is naive. Not everyone was born and raised in a country where measles vaccination is routine. And Microsoft employees, contractors, and visitors are quite a diverse group of individuals from around the world.
>So this line of "attack" has nothing to do with underlying cryptographic weaknesses.
I agree. The problem in TFA appears that the government agency couldn't find an expert to explain why the MD5 hash on the photo made the photo authentic. The title should not be "in Doubt Because of MD5" since that leads people to believe that a SHA-256 hash would've stood up in court.
I think the mathematics in the article I read bear out that it isn't that the phrase needs to make sense but rather that they're all words in a dictionary - and that's why they're not an order of magnitude better than passwords.
I agree that the capitalization helps, but only marginally unless you start spelling "Brown" as "bRoWn" in your "easy to remember" passphrase.
I agree with you. One of the problems with nine-times analogies is that he thinks that tokens can be copied. Those that are well designed cannot be copied unlike a key or password. If you knew how to create a new, blank token, which is possible for someone with a lot of resources ($$$), then they'd still need to guess the 128-bit key used to generate the random number that appears on the front of one of these tokens. No current hardware or network of hardware can brute-force such a key within our lifetimes.
But he/she can repeat his assertions over and over again as he accused you of doing if he/she likes. They're just not true. Passwords are weaker than tokens. Not only that, tokens are "generally" used in concert with passwords anyway, creating two factors.
Actually, a pass phrase isn't necessarily more secure than a password. There's an in depth analysis on Microsoft's site (saw the articles on technet flash) but don't have the link handy. A brute force attack may or may not be harder to launch against a pass phrase based on the characters used, number of words in the phrase, word dictionary size, etc. Remember, phrases use real words put together generally in meaningful ways. That limits the entropy.
Well, that's the consensus on the guy's original blog. He misinterpreted the reason for the reduction in spam. Many (most?) spammers don't send e-mail to you directly, they send it to an MTA on the network belonging to the zombie or throwaway account they are using. Their software doesn't wait to find out if the MTA couldn't deliver it to the final MTA; they don't accept any mail at all anyway.
I hope the editors learned a little from this one - surprised that this article got accepted. Oh no, there goes my Karma.:-)
This coming from someone who spends 10+ hours a day in front of a computer and still looks skiny.[sic]
Ah, but are you physically fit, other than your hand-eye coordination?:-)
I do completely agree with your point. People in this world constantly complaining about the horrors of modern media turning our kids into zombies and them not getting out enough. But the responsibility lies with the parents to raise their children properly.
I think video games are great for kids - when there's nothing better to do or for a change of pace. When your kid is sick or it is raining outside, I'd rather they played a game or watched PBS instead of sit around being bored, playing with dust bunnies for fun. However, my kids have to go out and play because we make them. I would never let my children play my copy of Doom 3 until they're old enough to understand the difference between fantasy and reality, right and wrong. And that all comes gradually.
Now the creation of someone to coordinate the United States' efforts to enforce international copyright law would be a good thing; who here thinks that its a good thing that you can buy "Oceans 12" or "Half Life 2" on the streets of Hong Kong today for 50 cents? With the WTO making the rules these days and our jobs being outsourced, I'm all for leveling the playing field and making sure that US companies and artists get compensated for their work.
The bad news is that the other posters are right - this czar will probably focus more on coordinating the RIAA/MPAA legal fights and forcing computer makers to build in DRM so that I can't even legally backup copies of my own CDs/DVDs/etc.
It frustrates me to see people who *share* content getting more persecuted/prosecuted than those who try to profit from stolen content - the real pirates.
The original post said "So how long until the mass market will be saying goodbye to the DVD player?"
You can't even start to predict that date until there's actually an agreed upon replacement for the DVD player.
Is it my PVR hooked up to a cable/satellite provider? No - the disk space problem limits its utility for building a useful library.
Is it video on demand? Maybe, but the technology has a ways to go in order to support the portability, sharability and scalability of a DVD library.
...now I'll wait 5 seconds for those more knowledgeable than I to clear this up.:-)
1) I agree that it would be nice if you didn't need the CD anymore, but it isn't a deal breaker. If you have the CD, stick it in. I think you could probably hack up a CD emulator as opposed to hacking a binary - hacked binaries may have trouble with authentication, depending on the protocol. Note that I'm not saying that's how HL2 implemented it. Just noting that a signed EXE/DLL is one way to verify it hasn't been modified.
2) I don't see how asking an anonymous person for proof that they've purchased the game is treating you like a potential criminal. Do you complain when you have to show a ticket before getting into your local sports stadium?
Already in this thread people are claiming that there are cracked versions of HL2 that do not require you to be online to authenticate to Steam in order to play (ever). But your reverse engineering online service idea brings up an interesting point.
While I'm perfectly in favor of Valve's actions here, I know that the ability to run software on your PC will never be stopped by activation or other such features. Even if they encrypt the binaries separately for every user and digitally sign them and send each purchaser a dongle to decrypt the data on the fly, eventually the data is going to be in memory and executed by a general purpose CPU and GPU. If you were enterprising enough, you could capture the data and recreate the unencrypted binary and hexedit to your heart's content. Even a trusted computer will have untrusted parts like memory and a CPU running the OS of your choice.
Activation and other security schemes will slow down hackers, but not stop them. And once one person solves the problem, its out there for the world to copy.
A more interesting hack is to figure out how to fool the authentication servers of an online service, whether it be EQII or something less massively multiplayer. If their protocol is good or they implement two-factor authentication, this might be really hard.
The New York times has free registration (and non-registration versions of the URLs) for current articles, but their archives require paying money.
The Boston Globe actually has free access to all their archives for their weekly subscribers. Which is great for me but isn't very useful for the 99.9% of the world that doesn't subscribe. So another reason why I agree that copyrights shouldn't last so long.
So when my retina scan or fingerprint is compromised, I can no longer lock a smartcard with it?
Ugh! I guess I needed to be clearer. While the technology on the smart cards is still maturing, generally you're depending on a trusted path between the biometric reader to the smart card. Implemented correctly with appropriately sensitive hardware, there's nothing to "compromise". For example, the better fingerprint readers are not susceptible to the gelatin mold trick, etc. So with a tamper resistant device that combines the reader with the smart card, you can be assured that only "something you are" unlocks the "something you have" smart card.
That said, the Axalto solution at Microsoft is not protected with biometrics but rather with a PIN. But that's not the tangent we're on here, is it.:-)
To add to the correction of the previous post - which is NOT insightful in the least:
Even worse, its a very poor idea to base your systems on a completely centralised system like passport authentication
This is not based on Passport authentication. It is based on Kerberos. It, using smart card based certificates, is the built-in and not-new strong authentication method for Windows.
It only takes 1 person at microsoft to trip on a cable then for all of your logins to fail.
Even for employees at Microsoft that will use this solution, cable cuts and DNS outages will not affect this since you can do smart card based logon without the domain controller using cached credentials.
It is in fact even easier with.net because unlike a keylogger, the answer wont be obfuscated, you can just monitor the smartcard port, capture all the details sent, and you dont even need the smartcard
As another poster corrected, the private key never leaves the smart card. There's nothing to monitor - the only thing you could get with a keyboard or memory monitor is the PIN for the smart card. But it is the smart card that creates the encrypted kerberos messages based on your private key. This is much better than a password-only system because the attacker will still need to steal your card. You can't emulate it because you don't know the private key.
Again, this is not ".NET authentication". It is the.NET framework running on the smart card. Microsoft is happy because their tech is being used by non-Windows vendors like Axalto. Axalto is happy because they just sold tens of thousands of smart cards to Micrsoft.
If you RTFA, this is for access to the Microsoft corporate network. It has (almost) nothing to do with their products' development. They need to fix their software, but they also need a strong authentication mechanism for their employees. There's nothing wrong with this "article" (aka Axalto press release).
The real benefit from Biometrics come not from storing your retina template on some authentication server but rather from using them to protect the secrets on your smart card. Now I don't think the Axalto system has it, but you could probably cobble one together that uses your fingerprint or retina scan or something else to unlock your smart card and give you access to your private key and certificate that's used for secure authentication (Kerberos or SSL style) onto the network.
So you can use a fingerprint in a secure manner to enhance the security of a smart card. It's better than a PIN.
as long as consumers keep looking for and buying strictly based upon price, the situation is going to continue
While what you say sounds correct at first, my experience has been that this happens even when you buy not-so-cheap RAM. Crucial is known as a pretty good brand (not the best, but good), but in 2002 my company bought a bunch of Thinkpads and upgraded the memory with sticks bought from Crucial. Bad news - most of the memory was bad and Crucial had to replace it for free. Yes - it was cheaper than IBM's memory, but then again, what isn't?
I too am going to wait. While I think it is nice to have the big fix release out there, I'm too busy to be updating browsers on my 3 machines at two locations every other week, especially since another poster indicated that the extensions from PR1 aren't recognized by RC1.
Also, this isn't a "Release Candidate" in the purest sense since they know they've got to fix more bugs before release. So this "candidate" will definitely not be elected.
Although if I am posting to/., then I probably do have time to update my browser.:-)
not caring what the rest of the world thinks, and siding with the interests of business.
I really don't see it that way, and I don't know why you do. Not caring what the rest of the world thinks? Certainly, the World's opinion would be lower if traffic crashed the site. Perhaps the campaign was also worried about being subjected to DDoS attacks. We don't know because there's no comment from the Bush campaign, but I think your negative assumptions about the intent is a little much.
...or was that some sort of IT joke? Maybe we've gone from a (fill in the) bubble sort for optical ballots and a heap sort for absentee ballots to an insertion (of Diebold's candidate) sort?
My apologies and mistake. My comment was limited to those foreign-educated and cultured individuals working here on H1-B visas or remotely in an offshored environment. I bring up culture only because I've found that cultural differences make it hard for the two different teams to work well together. It isn't the fault of any one culture, only that a culture clash is a negative for outsourcing.
Slashdot Mirror
I'm not even sure that "leaked" is the correct word to use. He was in Afghanistan. It's hard to hide Air Force One, the motorcade, etc. They were reporting the news, i.e. what they're expected to do.
Real time attacks are not currently a problem. So as another poster has already said, this effort raises the bar for attackers.
Some brands of tokens break. Some can be driven over or thrown in the laundry and they'll still work. Ask your bank to invest in quality.
The whole point of the tokens is that the code cannot be duped.
>Aren't we inocculated against measles when you're maybe six years old?
Others have danced around this, but your comment is naive. Not everyone was born and raised in a country where measles vaccination is routine. And Microsoft employees, contractors, and visitors are quite a diverse group of individuals from around the world.
I agree. The problem in TFA appears that the government agency couldn't find an expert to explain why the MD5 hash on the photo made the photo authentic. The title should not be "in Doubt Because of MD5" since that leads people to believe that a SHA-256 hash would've stood up in court.
Here are the links...
Part 1
Part 2
Part 3
I agree that the capitalization helps, but only marginally unless you start spelling "Brown" as "bRoWn" in your "easy to remember" passphrase.
Does your hardware and OS give you nanoseconds?
I agree with you. One of the problems with nine-times analogies is that he thinks that tokens can be copied. Those that are well designed cannot be copied unlike a key or password. If you knew how to create a new, blank token, which is possible for someone with a lot of resources ($$$), then they'd still need to guess the 128-bit key used to generate the random number that appears on the front of one of these tokens. No current hardware or network of hardware can brute-force such a key within our lifetimes.
But he/she can repeat his assertions over and over again as he accused you of doing if he/she likes. They're just not true. Passwords are weaker than tokens. Not only that, tokens are "generally" used in concert with passwords anyway, creating two factors.
Actually, a pass phrase isn't necessarily more secure than a password. There's an in depth analysis on Microsoft's site (saw the articles on technet flash) but don't have the link handy. A brute force attack may or may not be harder to launch against a pass phrase based on the characters used, number of words in the phrase, word dictionary size, etc. Remember, phrases use real words put together generally in meaningful ways. That limits the entropy.
I hope the editors learned a little from this one - surprised that this article got accepted. Oh no, there goes my Karma. :-)
Ah, but are you physically fit, other than your hand-eye coordination? :-)
I do completely agree with your point. People in this world constantly complaining about the horrors of modern media turning our kids into zombies and them not getting out enough. But the responsibility lies with the parents to raise their children properly.
I think video games are great for kids - when there's nothing better to do or for a change of pace. When your kid is sick or it is raining outside, I'd rather they played a game or watched PBS instead of sit around being bored, playing with dust bunnies for fun. However, my kids have to go out and play because we make them. I would never let my children play my copy of Doom 3 until they're old enough to understand the difference between fantasy and reality, right and wrong. And that all comes gradually.
The bad news is that the other posters are right - this czar will probably focus more on coordinating the RIAA/MPAA legal fights and forcing computer makers to build in DRM so that I can't even legally backup copies of my own CDs/DVDs/etc.
It frustrates me to see people who *share* content getting more persecuted/prosecuted than those who try to profit from stolen content - the real pirates.
You can't even start to predict that date until there's actually an agreed upon replacement for the DVD player.
Is it my PVR hooked up to a cable/satellite provider? No - the disk space problem limits its utility for building a useful library.
Is it video on demand? Maybe, but the technology has a ways to go in order to support the portability, sharability and scalability of a DVD library.
1) I agree that it would be nice if you didn't need the CD anymore, but it isn't a deal breaker. If you have the CD, stick it in. I think you could probably hack up a CD emulator as opposed to hacking a binary - hacked binaries may have trouble with authentication, depending on the protocol. Note that I'm not saying that's how HL2 implemented it. Just noting that a signed EXE/DLL is one way to verify it hasn't been modified.
2) I don't see how asking an anonymous person for proof that they've purchased the game is treating you like a potential criminal. Do you complain when you have to show a ticket before getting into your local sports stadium?
While I'm perfectly in favor of Valve's actions here, I know that the ability to run software on your PC will never be stopped by activation or other such features. Even if they encrypt the binaries separately for every user and digitally sign them and send each purchaser a dongle to decrypt the data on the fly, eventually the data is going to be in memory and executed by a general purpose CPU and GPU. If you were enterprising enough, you could capture the data and recreate the unencrypted binary and hexedit to your heart's content. Even a trusted computer will have untrusted parts like memory and a CPU running the OS of your choice.
Activation and other security schemes will slow down hackers, but not stop them. And once one person solves the problem, its out there for the world to copy.
A more interesting hack is to figure out how to fool the authentication servers of an online service, whether it be EQII or something less massively multiplayer. If their protocol is good or they implement two-factor authentication, this might be really hard.
The Boston Globe actually has free access to all their archives for their weekly subscribers. Which is great for me but isn't very useful for the 99.9% of the world that doesn't subscribe. So another reason why I agree that copyrights shouldn't last so long.
Ugh! I guess I needed to be clearer. While the technology on the smart cards is still maturing, generally you're depending on a trusted path between the biometric reader to the smart card. Implemented correctly with appropriately sensitive hardware, there's nothing to "compromise". For example, the better fingerprint readers are not susceptible to the gelatin mold trick, etc. So with a tamper resistant device that combines the reader with the smart card, you can be assured that only "something you are" unlocks the "something you have" smart card.
That said, the Axalto solution at Microsoft is not protected with biometrics but rather with a PIN. But that's not the tangent we're on here, is it. :-)
Even worse, its a very poor idea to base your systems on a completely centralised system like passport authentication
This is not based on Passport authentication. It is based on Kerberos. It, using smart card based certificates, is the built-in and not-new strong authentication method for Windows.
It only takes 1 person at microsoft to trip on a cable then for all of your logins to fail.
Even for employees at Microsoft that will use this solution, cable cuts and DNS outages will not affect this since you can do smart card based logon without the domain controller using cached credentials.
It is in fact even easier with .net because unlike a keylogger, the answer wont be obfuscated, you can just monitor the smartcard port, capture all the details sent, and you dont even need the smartcard
As another poster corrected, the private key never leaves the smart card. There's nothing to monitor - the only thing you could get with a keyboard or memory monitor is the PIN for the smart card. But it is the smart card that creates the encrypted kerberos messages based on your private key. This is much better than a password-only system because the attacker will still need to steal your card. You can't emulate it because you don't know the private key.
Again, this is not ".NET authentication". It is the .NET framework running on the smart card. Microsoft is happy because their tech is being used by non-Windows vendors like Axalto. Axalto is happy because they just sold tens of thousands of smart cards to Micrsoft.
If you RTFA, this is for access to the Microsoft corporate network. It has (almost) nothing to do with their products' development. They need to fix their software, but they also need a strong authentication mechanism for their employees. There's nothing wrong with this "article" (aka Axalto press release).
The real benefit from Biometrics come not from storing your retina template on some authentication server but rather from using them to protect the secrets on your smart card. Now I don't think the Axalto system has it, but you could probably cobble one together that uses your fingerprint or retina scan or something else to unlock your smart card and give you access to your private key and certificate that's used for secure authentication (Kerberos or SSL style) onto the network. So you can use a fingerprint in a secure manner to enhance the security of a smart card. It's better than a PIN.
While what you say sounds correct at first, my experience has been that this happens even when you buy not-so-cheap RAM. Crucial is known as a pretty good brand (not the best, but good), but in 2002 my company bought a bunch of Thinkpads and upgraded the memory with sticks bought from Crucial. Bad news - most of the memory was bad and Crucial had to replace it for free. Yes - it was cheaper than IBM's memory, but then again, what isn't?
Also, this isn't a "Release Candidate" in the purest sense since they know they've got to fix more bugs before release. So this "candidate" will definitely not be elected.
Although if I am posting to /., then I probably do have time to update my browser. :-)
not caring what the rest of the world thinks, and siding with the interests of business. I really don't see it that way, and I don't know why you do. Not caring what the rest of the world thinks? Certainly, the World's opinion would be lower if traffic crashed the site. Perhaps the campaign was also worried about being subjected to DDoS attacks. We don't know because there's no comment from the Bush campaign, but I think your negative assumptions about the intent is a little much.
...or was that some sort of IT joke? Maybe we've gone from a (fill in the) bubble sort for optical ballots and a heap sort for absentee ballots to an insertion (of Diebold's candidate) sort?
My apologies and mistake. My comment was limited to those foreign-educated and cultured individuals working here on H1-B visas or remotely in an offshored environment. I bring up culture only because I've found that cultural differences make it hard for the two different teams to work well together. It isn't the fault of any one culture, only that a culture clash is a negative for outsourcing.