- cypherpunks-legacy - lists.cpunks.org

Multi-part security solutions (Was: Re: Rijndael & Hitachi)
by Meyer Wolfsheim 12 Oct '00

12 Oct '00

-----BEGIN PGP SIGNED MESSAGE----- On Wed, 11 Oct 2000, Arnold G. Reinhold wrote: > Derek Atkins adds: > > > > >Why try to pick a Medeco when it's locking a glass door? :-) > > The fact that some people put Medeco's in glass doors, doesn't mean > Medeco should never develop a better lock. Sure, Medeco should keep working on developing the best locks that it can produce. However, if you are going to design your structure with a glass door, it really makes no technological sense to exceed the security provided by the glass door with the other components (locks, hinges, etc.). Put a Medeco or an ASSA in a door that can be jimmied or broken down, and you've gained nothing that you wouldn't have had with a high quality lock lacking a sidebar. Except a warm fuzzy feeling inside: "We have unpickable locks!" Most burglar aren't going to spend the time picking your locks, regardless of what you have installed. The James Bond approach of sticking a pick in a lock (sans tension wrench), wiggling it a half a second, and then opening the door is pure fantasy. Lock picking, even for a very seasoned locksmith, takes more time than can be afforded in most cases. The same principle applies for fancy biometric access measures. I've seen high profile Internet security companies that have hand geometry scanners and I-Button controlled locks on doors that have door hardware that can be opened with pen-knives, coat hangers, and credit cards in a matter of seconds. How about ISP collocation centers with private, locked compartments for security conscious customers? Check the raised floors and the drop ceilings. In many cases, I fear, you will find that the steel doors on the compartment stop 18 inches above the concrete floor below, and/or don't extend past the ceiling tiles. Is it likely someone is going to pop the floor tile, craw around the cables and then pop up in your private collo space? No. But you as the customer deserve to be aware of where the weaknesses are. The only reasons I see for having a security system (be it an encryption product, or a physical access device) with a large discrepancy in the level of security that the individual components provide is either: a) Incompetence on the part of the designer, when the weaker component is thought to be as or nearly as secure as the stronger component, or b) An intentional marketing design stunt, where the purpose of the stronger component is to make the consumer comfortable with using an inherently weaker solution, or c) "Future capacity planning" (see also: budget cutbacks). Perhaps most excusable is "c", where the hypothetical Medeco would be installed in the glass door, with the intention of implementing a steel door in the future, while retaining the Medeco lock. The chances of such improvements happening decrease drastically the longer the weaker (but working) solution is in place. ("It's been good enough so far...") As for the other two reasons, obviously, "a" is the better case here, as the problem will (in a lot, if not most cases) be corrected after being discovered. I am disgusted by the use of security devices purely for marketing reasons. The mentality that "It doesn't matter that we can't provide quality entropy in our encryption product as long as we can say we use 256 bit Twofish" is demonstrative of negligence. I want to be told the security of the *weakest* part of the system, as that is the measure of the entire system's security. Then I will decide if it is sufficient for me. Certain things we just take for granted. No one seems phased by using wooden or glass doors to secure sensitive locations. Some people religiously arm their car alarms, but when was the last time you paid attention to a blaring car alarm, other than to wish it would stop? Does anyone hear one of those, and call 911 to report theft? I don't think so. Who here actually verifies ssh key fingerprints before accepting them upon connecting to a host for the first time? Or when the host key changes? Very few people, I would bet. Security is a ritual, not a product. - -MW- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.3 Comment: No comment. iQEVAwUBOeT/dSsFU3q6vVI9AQFVdwf/YvVNrEnup42xIZh6xasSkGuvW1IIqLTL rUBLgI67Ip/Cpv7Q127nzv/1oQzVkfSSPzfRmN7UnjQMDQab+LQHqUv22eIDk5Ft 9Zoqef5JeKmz7NkUjt+6GX/B4WTHo3ZefrIVD0Hqg4dkTTsFC+ibiqEnC3xM4gT6 xHUpbnX/Vhfudw+j1bpkUwTFFlP0lPKVEK803bNOMoPUcubHj9TRoFq64f+got5s ieEqPMEc3/EZAq+/72kZgZHMN1YEBg3rZ+i2EaZhG5iIleEO69DqYau6kVUxX5lJ nEditzNjXox4jV0p+CwBCRU4r6WFX27480zh5iAo6M24FFfQlg/sng== =fjfM -----END PGP SIGNATURE-----

2 1

CDR: RE: Think cash
by Trei, Peter 12 Oct '00

12 Oct '00

> ---------- > Marcel Popescu[SMTP:mdpopescu@geocities.com] wrote: > An interesting idea has surfaced on the freenet-chat list: is it possible > to > build a program that creates some sort of a puzzle, whose answer the > generating computer knows (and can verify), but which can only be answered > by a human being, not by a computer? [Additional requirement: it should be > easy for the human to answer the puzzle.] > > My proposal was to randomly create an image, which should be 1) easily > recognizable by a human (say the image of a pet), but 2) complex enough so > that no known algorithm could "reverse-engineer" this. [You need a > randomly-generated image because otherwise one could build a large > database > of all the possible images and the correct answers.] Background > information > would also be very useful - see > http://www.digitalblasphemy.com/userg/images/969403123.shtml - it's easy > for > a human being to identify the animal in the picture, but (AFAIK) > impossible > to write a program to do the same thing. > > Ideas? > > Mark > That's a really interesting question. My off-the-cuff answer would be 'no'. The constraints which say that the problem is randomly generated by a computer and the answer also evaluated by a computer are the killers. Any problem which one computer can create, and solve, can also be solved by another. Perhaps one could generate the solution, and find a problem which is solved by that solution, but finding a type of problem which humans will always solve one way, and computers another is the rub. You refer the the problem of recognizing a photo of an animal. It used to be said that no computer program could reliably distinguish between a dog and a cat, but I'm not sure that's the case since the development of neural networks. Almost any question which has a solution which is clear, unambiguous, and easy determined by a human can probably also be solved by either a regular program or a neural net. What you are really attempting to find is a reliable, fast, single-question Turing test. I'm far from sure this is possible. Peter Trei

2 1

Re: CDR:Multi-part security solutions (Was: Re: Rijndael & Hitachi)
by drt＠un.bewaff.net 12 Oct '00

12 Oct '00

Meyer Wolfsheim <wolf(a)priori.net> writes: > Most burglar aren't going to spend the time picking your locks, > regardless of what you have installed. The James Bond approach of sticking > a pick in a lock (sans tension wrench), wiggling it a half a second, and > then opening the door is pure fantasy. Lock picking, even for a very > seasoned locksmith, takes more time than can be afforded in most cases. In Germany there is a Group calling themselvs "Sportenthusiasts of Lockpicking" - http://www.ssdev.de/ They have a tournament every year at the CCC Congress and be assured they open nearly every Lock in James Bond Time. drt -- Aber laß mich dich gleich mal vor der Zeitverschwendung deines Lebens bewahren: wenn du mit diesem Problem schon überfordert bist, ist Assembler nichts für dich. Denn da muß man logisch denken und Probleme selbständig lösen, die sonst ein Compiler für einen löst. ---Felix von Leitner http://koeln.ccc.de/~drt/

1 0

CDR: RE: Think cash
by Bill Stewart 12 Oct '00

12 Oct '00

>> Marcel Popescu[SMTP:mdpopescu@geocities.com] wrote: >> My proposal was to randomly create an image, which should be 1) easily >> recognizable by a human (say the image of a pet), but 2) complex enough so >> that no known algorithm could "reverse-engineer" this. [You need a >> randomly-generated image because otherwise one could build a large >> database of all the possible images and the correct answers.] >> Background information would also be very useful - see >> http://www.digitalblasphemy.com/userg/images/969403123.shtml - it's easy >> for a human being to identify the animal in the picture, but (AFAIK) >> impossible to write a program to do the same thing. Ideas? At 01:53 PM 10/11/00 -0400, Trei, Peter wrote: >You refer the the problem of recognizing a photo of an animal. >It used to be said that no computer program could reliably >distinguish between a dog and a cat, but I'm not sure that's >the case since the development of neural networks. Blind humans aren't always good at recognizing screen images. Neural networks are good at recognizing things. Sometimes more precisely defined algorithms are good too. Some examples of recognition systems - you can look in the archives for pointers to the UCBerkeley "Naked People Finder", which does a reasonably accurate job of distinguishing whether pictures on the internet contain naked people. The people who did the research on that also designed the "Incredible Horse Finder", which identifies horse pictures on the net. I remember that those systems did a lot of modelling; I don't remember if they also did neural nets or not. If they wanted to describe shapes of dogs and cats and differentiate between them, it would be relatively doable. There's also a company out there that does "passfaces" - they pop up 9 pictures of people's faces, and you identify which one is in the set that's you password-equivalent. They do about 4 rounds of this, with random sets of faces; it's closer to a PIN than a real passphrase in strength, because they thought that was enough for their problem space. An interesting aspect of it is that humans are very good at recognizing faces, but not usually that good at describing them, so it's hard to give somebody else your passface set. Thanks! Bill Bill Stewart, bill.stewart(a)pobox.com PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639

1 0

CDR: Keyboard & Mouse Recorder
by fran ndi ndi 12 Oct '00

12 Oct '00

Does anyone know where I can get a keyboard recorder for WIN95 and OS/2 and free (no paY) I would like to record the mouse and keyboard strokes. Then re-run the host program at a pre-determined time. Join 18 million Eudora users by signing up for a free Eudora Web-Mail account at http://www.eudoramail.com

1 0

CDR: FREE vacation getaway!
by tgardner23＠melrun.org 12 Oct '00

12 Oct '00

1 0

CDR: FREE VACATION!!!!!
by kawen123＠aol.com 12 Oct '00

12 Oct '00

NEED TO GETAWAY??? I would like to take a minute to offer you a FREE VACATION!!!!! Just take a moment and click the link below (or copy to your browser) http://reports.emarketplacedirect.com/pages/1095814.html and visit my website. I would like to give you details on your FREE VACATION and I would like to share with you my excitement for signing up with E-Marketplace Direct. I am finding that the FREE information has proven to me to have astounding results. I am getting more hits on my website than I ever imagined since I started using these tools. If you are a web beginner, or home office hero I hope you find the FREE information a great asset to your desire to achieve your dreams. Let nothing stand in your way. The WORLD is literally at your fingertips. PLEASE take advantage of the FREE VACATION offer. You Are Just a Click Away From Some Serious Cash! http://reports.emarketplacedirect.com/pages/1095814.html

1 0

CDR: And you thought Nazi agitprop was controversial?
by Declan McCullagh 12 Oct '00

12 Oct '00

[A veteran free speech activist in Cambridge, Mass. sent me this. Any offers of mirroring should go to the list, where I assume they'll be duly forwarded. I wonder how long the HTML files in question here would last on a Geocities/etc account. --Declan] --- Hi Declan, I know you're aware of the case of Curley v. NAMBLA, which has very serious First Amendment implications. Jeffrey Curley was a 10-year-old who was murdered in Cambridge, Massachusetts, in October of 1997. The parents are alleging that the murderers were driven by NAMBLA literature in general and specifically by the contents of NAMBLA's web site. After the suit was filed in May of this year, the current NAMBLA web site was taken down. Frisoli, the Curley lawyer, has been making very outrageous and false statements about what was on the web site. Because the media has no access to the site, no one can contradict him. A vicious media war is now being waged against the ACLU and other free-expression advocates for defending freedom of expression in this case. Few reporters seem even interested in finding out the contents of NAMBLA literature or the contents of the web site as of 10/97. But even if a fair-minded reporter did have this interest, he or she would be out of luck. Printed material from NAMBLA is difficult to find. Members of NAMBLA will speak to the press only under conditions of strict anonymity because they fear for their lives. And the web site is not accessible. I am not a NAMBLA member, but I believe that the First Amendment applies to them. I have obtained the web files as of 10/97. I don't wish to put them up myself for a variety of reasons. First of all, my ISP might make me take them down. Also, I am involved in another case which I don't want tarred with the NAMBLA brush. There is no court injunction against the publication of the materials. But a site outside the US might be best in any case. Anyway, if you can help me find someone to take the files and put them up, please let me know.

26 85

CDR: Looking for a new car!!!!!
by thannon19＠melrun.org 12 Oct '00

12 Oct '00

1 0

Re: Rijndael & Hitachi
by Derek Atkins 11 Oct '00

11 Oct '00

No, you're right. Medeco should certainly work on a better lock. Except there comes a point at which, relatively speaking, ALL doors are "glass" doors compared to the security of this new medeco++ lock. At which point no, it doesn't make sense to develop an even better lock until you come up with better doors. :) -derek "Arnold G. Reinhold" <reinhold(a)world.std.com> writes: > Derek Atkins adds: > > > > >Why try to pick a Medeco when it's locking a glass door? :-) > > The fact that some people put Medeco's in glass doors, doesn't mean > Medeco should never develop a better lock. > > > Arnold Reinhold -- Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory Member, MIT Student Information Processing Board (SIPB) URL: http://web.mit.edu/warlord/ PP-ASEL-IA N1NWH warlord(a)MIT.EDU PGP key available

1 0