November 2013 - cypherpunks - lists.cpunks.org

Fwd: Talk at Paypal on "The Grand Challenge to Kill Passwords for Good"
by Bill Stewart 13 Nov '13

13 Nov '13

This just arrived; seems germane to the discussion, for any of you who are local to Silicon Valley area. >From: "PayPal's TechXploration" <info(a)meetup.com> >Subject: Monday: Join 347 Xplorers at "The Grand Challenge to Kill Passwords > for Good" > >Monday >The Grand Challenge to Kill Passwords for Good >PayPal's TechXploration >Monday, November 18, 2013 >6:00 PM >PayPal Town Hall >2161 North 1st Street San Jose, CA 95131 >Will you attend? >Yes &… [View More]

1 0

re: passwords! (p4)
by brian carroll 13 Nov '13

13 Nov '13

completeness is its own thing... need to mention case of 'partial passwords' where user and site merge into a final password yet the user password cannot be cracked without the hidden variables blended into the final working password that is either static or changing... for instance, a previous example... [морд][3][માટે][.][for][-]...[جو][4][iconID][cibé] what if [iconID] was hidden as to its bit-set size, it could be 1 character space or twelve, and yet it would remain hidden at … [View More]password entry by the user yet required to gain access. [морд][#][3][###][માટે][.][for][##][-]...[جو][4][##][cibé][#] such that some algorithm processes the input in another framework and if somehow this is processes is not normal or it triggers a particular mechanism, a threshold condition could activate blocking access within the password itself vague, i do not know exactly how it could be engineered such that it would be needed and unseen by the user and yet be able to distinguish the actual user from imitator or hostile attacker, though in this way, the moat/drawbridge mechanism that would be 'missing information' within the structure of the password, such that the STRING in itself, input by the user, is not the password, until it is mixed in with the other piece via the site security. [#|#|x|ம்|7|#|#|#|ன்] in other words, a password could only be partially that of the user, and perhaps this is already how it exists today, though that each variable could be more than a character and this could be a bit-set computation, as an icon/other coordinates are blended together, some data of which is not in the user domain and would remain unknown and beyond the ordinary boundary, inside a further interior realm of protected data, a second security vestibule, in the above case, all the wildcards could be data that is in the password yet zoned for another level of access, such that the administrators must provide the data else that it could also be variable in size and 'timing', such that real-time or other permutive functioning could be rolling, 'living code' that is masked - "unknown", and potentially has a calculative or image-based input that is not visible on the outside, yet also entangled with it. perhaps it is not of classical physics, this, yet why must the password unit be assumed a single static character and not something in movement, existing beyond perception and operating by unknown rules that influences what the actual password is, at any given point or place in time. unique perspective as the basis for a universal security approach (UID) lime, tequila, [#], triple-sec [View Less]

1 0

[SOT] {FWD} [Dailydave] Don't use vowels in passwords! (fwd)
by J.A. Terranson 13 Nov '13

13 Nov '13

Mildly interesting, for those who have an interest ? //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another. ---------- Forwarded message ---------- Date: Thu, 7 Nov 2013 14:01:15 -0500 From: William Arbaugh <warbaugh(a)gmail.com> To: dailydave(a)lists.immunityinc.com Subject: [Dailydave] Don't use vowels in passwords! According to the Defense Finance and Accounting Service (DFAS), you shouldn't … [View More]

8 11

re: passwords! (p3)
by brian carroll 13 Nov '13

13 Nov '13

yet another approach, user registration involves time-based parameter, which is based on NIST shared clock set to a particular city or time-zone, minus a mystery variable, which then runs a 'tally' as the password as it has been transmuted via calculation: thus the password is rolling, every changing and cannot be computed as a string because it is never the same (if designed that way, to include rolling variables within a longer bit string)... in this way, example: [var1] = [Pacific Time … [View More]

1 0

Re: passwords!
by brian carroll 13 Nov '13

13 Nov '13

the list fool here chiming in... i just wonder if there is a boundary condition that exists that is making passwords insecure by protocols that could themselves be modified, and alter the probabilities of easy dictionary attacks. for instance, if A-Z and a few special characters are allowed in a US keyboard alphabet, if that is the majority of what is being automatically cracked, perhaps it is not surprising. yet what if the passwords 'length' were not the issue, such that a 20 character … [View More]string (of several number.words with several intermixed special characters) could still be successfully attacked, given those limited parameters. and such a view may be: moar characters, longer string, etc. perhaps mistaken though i wonder what 'dictionaries' are referenced because if they are mapped to normal words of a given language, and special symbols, and yet held within the walls or boundaries of a particular alphabet or sign-system, then perhaps language-to-language the password cracking situation remains basically the same. yet, what if the Unicode barrier (if that is what it is) is dissolved, such that many languages could co-exist, such as 12 different N's and ligatures and other special characters... ex. normal bounded password in a given Unicode character set / alphabet, with special characters: th3r0uT33Nw4!z+3sezU3 compare this with a multi-alphabet approach: п世לកóવિz what are the computational probabilities of searching across all ascii/unicode alphabet characters and getting that pattern matched, versus let's say [35] options per password character in a constrained alphabet. the calculation would be something like this (to 21 spaces in ex.) [35][35][35][35][35][35][35][35][35][35][35][35][35][35][35]...[35] versus, if wildly approximating: [1,000] options for the 'multiple language Unicode characters and special symbols' password approach. the following estimate may be inaccurate though for 35 times itself over and over twenty one times, the number i arrived at was: 9.321739789445372e+33 again, calculation may be inaccurate, though for the multiple character approach, only 11 characters @ [1000] needed for: 1.e+36 though imagining it could be many fewer characters in comparison, say if accessing Chinese and Arabic other characters. in other words, perhaps a hypothetical [10,000] symbols could be made available per password unit than [35] in the highly restricted approach that is easy to crack, and that would change how computation occurs with regard to how such passwords are created, stored, and exist, especially in a highly constrained OS and peripheral environment that constrains cross-pollination of such key typographic information that would change the basic dynamics, data behavior. this is the slot-machine approach to [p|a|s|s|w|o|r|d|s] because at a certain point, anything could tally... [*|*|x|ம்|7|*|*|#|ன்] though what is more... for each _space_ there could be any sign.symbol, as with icons or special characters, potentially, that could be potential keyspace or what today may appear as "junk" information that is infrastructural for multilanguage computing, and be utilized beyond the language boundary for its signage, for passwords & security. in this way, the three unit password (icon=ascii symbol) ['icon'][પ્રે][ю] could be stronger than a much longer, restricted alphabet, if going towards 10,000+ options per character. yet the model itself could example such that a password is constructed by a bit-set string, where like a slot machine, could instead have 'words' as the units (as with the existing password approach, word1&word2, etc.)... ['word1'][[પ્રે][ю]['gps-coords'] if only viewed in bounded terms and of serial computation, a long *predictable* string may be easier to attack than a shorter unpredictable string that takes massive resources to churn through the possibilities - and who knows, maybe the password has a time-cycle that automatically changes its nature during that time period of calculation. surface tension, iridescence, spinner [View Less]

1 0

philosophy & psychology (urls)
by brian carroll 12 Nov '13

12 Nov '13

// infospace, system earth, being and communication TEDx: Prof. Dr. Elisabeth von SamsonowCordless Mega Confusion http://www.youtube.com/watch?v=qLVls6ZX3dk "it is not that the body is inhabited by the soul, it's just the other way around, it's that the body inhabits the soul, the soul is inhabited by bodies- by many bodies. the soul is the sphere in which we communicate, and our bodies are in this sphere, where we shared this... cordless communication, by directing our information packages … [View More]

1 0

Re: [SOT] {FWD} [Dailydave] Don't use vowels in passwords! (fwd)
by Guido Witmond 12 Nov '13

12 Nov '13

On 11/14/13 00:09, sharon wrote: > below :) > On 11/12/2013 11:48 PM, Guido Witmond wrote: >> The world needs to forget passwords as remote identification and move on >> to client certificates. Preferably, a separate client certificate for >> each site. It takes only a small browser plug in to make it easy. >> >> Regards, Guido. > hi, off-list. > ive read a bit about your ideas for auth. its interesting. > but im not clear on one thing - > if … [View More]

1 0

Senate to investigate Intelligence Community
by Gregory Foster 12 Nov '13

12 Nov '13

Foreign Policy (Nov 12) - "Senate to Start Sweeping Intel Review This Month" by @shanewharris: http://thecable.foreignpolicy.com/posts/2013/11/12/senate_to_start_sweeping… Harris, author of _The Watchers_ and not one prone to hyperbole, draws comparison with the Church-Pike hearings. > Not everyone had been convinced that Feinstein's promise to investigate the intelligence agencies was more bark than bite. A former senior intelligence official recently told The Cable that he believed the … [View More]

1 0

Re: patents in a free society (Re: Brother can you help a fiber?)
by Bill Stewart 12 Nov '13

12 Nov '13

The standard Libertarian position on patents is "rabid". Whether "rabidly for" or "rabidly against" or "rabidly endorsing some highly nuanced conditional niche position in between", we're in pretty solid agreement on the "rabid" part. Some of us strongly believe in intellectual property. Some of us believe that initiating force to defend "imaginary property" that's really a euphemism for a government-granted monopoly is both dishonest and anathema. So take your pick.

7 7

NIST Randomness Beacon
by d.nix 12 Nov '13

12 Nov '13

surely someone here has an opinion... http://www.nist.gov/itl/csd/ct/nist_beacon.cfm :-)

6 5