November 2003 - cypherpunks-legacy

Lucrative update
by R. A. Hettinga 26 Nov '03

26 Nov '03

--- begin forwarded text

1 0

Lucrative update
by R. A. Hettinga 26 Nov '03

26 Nov '03

--- begin forwarded text

1 0

Lucrative update
by R. A. Hettinga 26 Nov '03

26 Nov '03

--- begin forwarded text

1 0

Lucrative update
by R. A. Hettinga 26 Nov '03

26 Nov '03

--- begin forwarded text

1 0

Lucrative update
by R. A. Hettinga 26 Nov '03

26 Nov '03

--- begin forwarded text

1 0

Lucrative update
by R. A. Hettinga 26 Nov '03

26 Nov '03

--- begin forwarded text

1 0

Lucrative update
by R. A. Hettinga 26 Nov '03

26 Nov '03

--- begin forwarded text

1 0

Patriot II provisions snuck through in spending bill.
by Neil Johnson 26 Nov '03

26 Nov '03

Sigh.. http://www.wired.com/news/politics/0,1283,61341,00.html?tw=wn_tophead_1

1 0

Fwd: "Bedazzled" Log-in Method Whitepaper
by Steve Schear 25 Nov '03

25 Nov '03

>"Bedazzled" Log-in Method Whitepaper > >Author: George Hara >(http://www.filematrix.xnet.ro/ideas/whitepapers/login.htm) > > >Introduction >------------ > >Using strings of characters as passwords has always been a security issue >because they are hard to remember and can be stolen by key-loggers or >screen-text harvesters. It will still be an issue for personal computers, >but there is another method available for authentication over the Internet >(where are the highest security concerns). This method involves no special >technologies, but simply a new vision on how to bring existing technologies >together. The method is easier to use than text passwords, but it requires, >from the users, the protection of their personal computers (where they need >text-password log-in and encryption), just as they do now. > >The "Bedazzled" log-in method uses a (public) user name / ID (for example, >the user's email address) and a number of images, called password images, >for authentication. The images have to be generated (by the authentication >service) during the creation of the account for which the authentication >will be later required. Each image is a small, PNG compressed, bulk of >pixels with random colors. The PNG compression is used because a true-color >image is compressed without losses, with a very high rate. In the case of >random images this doesn't help, but, as you'll read below, in the User >images section, this is the best format. > >Each image should contain something like 50 * 50 true-color pixels (24 >bits). This means that the total number of combinations of such a random >image is 24 ^ (50 * 50), that is over 10 ^ 3450. Basically, a particular >case is unbreakable through brute force search. > > >Authentication >-------------- > >The authentication is the classic method: the user is identified by his user >name, and then he is authenticated by comparing all images specified in the >log-in form, with the images stored on the computer which makes the >authentication. If all images are *identical*, and put in the same order (im >age 1 as password 1, image 2 as password 2...), the user is authenticated. >If they are not identical, the user is rejected. > > >Implementation >--------------- > >To make the "Bedazzled" log-in method easy to use, the password images must >be saved on the user's computer, preferably in encrypted files (see file >encryption under WindowsXP, or PGP encrypted drives). > >Since the "Bedazzled" log-in method is supposed to be used over Internet, it >is necessary for the user to be able to drag-and-drop each image onto the >browser, in the log-in form. This way, the log-in form has access to the >password images, and can download them to the authentication server when the >user clicks the "Log-in" button. > >As you can see, the method is very eay to use, but in order to make it even >easier, the log-in form should display a small file browser which should be >used to navigate to the password images (they should all be in the same >directory, for easy user access). The log-in form should save a cookie on >the user's computer in order to automatically open the file browser at the >same location, the next time the user attempts to authenticate himslef. > > >User images >------------ > >There is no need for the images to be random. The user could choose his own >images when he creates an authentication account, being only limited to a >specific file size (like 20 KB / image). He could simply take some images >from his computer and resize them to fit the size limit; the images should >be compressed without loss (preferably in a PNG format), just in case they >are lost but the original bigger images still exist and can be resized again >with the same algorithm (to generate the same password image). > >Another method requires a small program which takes a string of characters >typed by the user, and converts them through a hash algorithm into an >apparently random image. This method makes it possible to recreate the >password images if the user remembers the string of characters, without the >need of storing any information. > > >TEMPEST protection >---------------------- > >First of all, since the user doesn't need to type anything and the password >images don't need to be displayed, the passwords are protected from TEMPEST >atacks. However, the user may need to navigate through his pictures and >choose the correct password images for each log-in form. This would create a >potential security breach. > >The "Bedazzled" log-in method has intrinsic TEMPEST protection to this kind >of breach because when a monitor displays an image, the colors of each pixel >is not displayed exactly as indicated by the bits that make the picture. > >Each monitor has its own way of displaying the image. Besides, users always >alter the image by chaging various parameters of the monitor's image: >brightness, contrast, color balance, color temperature, gamma. > >On the other end of the TEMPEST technology, the "reader" takes a snapshot of >the image displayed by the monitor. This is like making a scan of a print of >a digital image. Though the resulting image looks similar with the original >for the human eye, the binary picture will be quite different. Actually, the >whole "reading" process makes it impossible to detect those minute details >(= changes in colors) of the original image, details that give to the owner >of the original picture a unique way to authenticate himself. > >Another help comes from the fact that when the user navigates through the >images, these are displayed as thumbnails, and thus altered (if the size of >the thumbnail is smaller than the size of the original image). > > >Last Word >----------- > >The "Bedazzled" log-in method makes key-loggers and screen-text harvesters >useless. However, there is still the danger of specially designed viruses >that would look for the password images. The only protection from such >malware I can think of, is for the log-in form to require quite a few >password images, and ask for them (using pictures of the picture order >index) in random order each time the user logs-in. > > >George Hara --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: [Mac_crypto] MacOS X (Panther) FileVault
by R. A. Hettinga 25 Nov '03

25 Nov '03

--- begin forwarded text

2 1