November 2013 - cypherpunks@lists.ogf.org

Fwd: Talk at Paypal on "The Grand Challenge to Kill Passwords for Good"
by Bill Stewart 13 Nov '13

13 Nov '13

This just arrived; seems germane to the discussion, for any of you who are local to Silicon Valley area. >From: "PayPal's TechXploration" <info(a)meetup.com> >Subject: Monday: Join 347 Xplorers at "The Grand Challenge to Kill Passwords > for Good" > >Monday >The Grand Challenge to Kill Passwords for Good >PayPal's TechXploration >Monday, November 18, 2013 >6:00 PM >PayPal Town Hall >2161 North 1st Street San Jose, CA 95131 >Will you attend? >Yes >No >347 Xplorers attending, including: >Max Gorbunov >"Physicist, software developer" >Van Riper >"I work in Google Developer Relations as the >Global Program Manager for Google Developer >Groups: http://developers.google.com/groups/" >Sanjay Shroff >"Sanjay Shroff >http://www.linkedin.com/in/shroffsanjay >http://www.shroff.ca http://www.facebook.com/sanjays..." >Lourdes >"Hi" >Alvin Wang >"hi" >Suyash Joshi >"devloper" >"Our intention is to really obliterate, within a >certain number of years, both passwords and PINs >and see the whole Internetincluding internally >in enterprisessobliterate user IDs and >passwords and PINs from the faace of the planet.â > >Michael Bar... >Learn more >Sponsored by NextSpace San Jose, PayPal and Content Magazine >Follow us! > >Meetup HQ in NYC is hiring! meetup.com/jobs

1 0

re: passwords! (p4)
by brian carroll 13 Nov '13

13 Nov '13

completeness is its own thing... need to mention case of 'partial passwords' where user and site merge into a final password yet the user password cannot be cracked without the hidden variables blended into the final working password that is either static or changing... for instance, a previous example... [морд][3][માટે][.][for][-]...[جو][4][iconID][cibé] what if [iconID] was hidden as to its bit-set size, it could be 1 character space or twelve, and yet it would remain hidden at password entry by the user yet required to gain access. [морд][#][3][###][માટે][.][for][##][-]...[جو][4][##][cibé][#] such that some algorithm processes the input in another framework and if somehow this is processes is not normal or it triggers a particular mechanism, a threshold condition could activate blocking access within the password itself vague, i do not know exactly how it could be engineered such that it would be needed and unseen by the user and yet be able to distinguish the actual user from imitator or hostile attacker, though in this way, the moat/drawbridge mechanism that would be 'missing information' within the structure of the password, such that the STRING in itself, input by the user, is not the password, until it is mixed in with the other piece via the site security. [#|#|x|ம்|7|#|#|#|ன்] in other words, a password could only be partially that of the user, and perhaps this is already how it exists today, though that each variable could be more than a character and this could be a bit-set computation, as an icon/other coordinates are blended together, some data of which is not in the user domain and would remain unknown and beyond the ordinary boundary, inside a further interior realm of protected data, a second security vestibule, in the above case, all the wildcards could be data that is in the password yet zoned for another level of access, such that the administrators must provide the data else that it could also be variable in size and 'timing', such that real-time or other permutive functioning could be rolling, 'living code' that is masked - "unknown", and potentially has a calculative or image-based input that is not visible on the outside, yet also entangled with it. perhaps it is not of classical physics, this, yet why must the password unit be assumed a single static character and not something in movement, existing beyond perception and operating by unknown rules that influences what the actual password is, at any given point or place in time. unique perspective as the basis for a universal security approach (UID) lime, tequila, [#], triple-sec

1 0

[SOT] {FWD} [Dailydave] Don't use vowels in passwords! (fwd)
by J.A. Terranson 13 Nov '13

13 Nov '13

Mildly interesting, for those who have an interest ? //Alif -- Those who make peaceful change impossible, make violent revolution inevitable. An American Spring is coming: one way or another. ---------- Forwarded message ---------- Date: Thu, 7 Nov 2013 14:01:15 -0500 From: William Arbaugh <warbaugh(a)gmail.com> To: dailydave(a)lists.immunityinc.com Subject: [Dailydave] Don't use vowels in passwords! According to the Defense Finance and Accounting Service (DFAS), you shouldn't use vowels in your password! The DFAS web site myinvoice.csd.disa.mil is instituting new password requirements starting tomorrow. The details can be found at the site (if you're willing to read a PDF hosted by DOD that is). DFAS brings us two significant improvements to password/PIN security by forbidding the use of vowels, and requiring that password/PINs be EXACTLY 15 characters long (no more, no less). I'd guess that the first requirement is to prevent people from using dictionary words. The second requirement is probably due to some obscure issue with their use of an Oracle Java front-end. This is from a web site that until recently ( and I believe still does) required the use of IE and Java 6. Logging in use to require clicking through no less than 3-4 security warning pop-ups. _______________________________________________ Dailydave mailing list Dailydave(a)lists.immunityinc.com https://lists.immunityinc.com/mailman/listinfo/dailydave

8 11

re: passwords! (p3)
by brian carroll 13 Nov '13

13 Nov '13

yet another approach, user registration involves time-based parameter, which is based on NIST shared clock set to a particular city or time-zone, minus a mystery variable, which then runs a 'tally' as the password as it has been transmuted via calculation: thus the password is rolling, every changing and cannot be computed as a string because it is never the same (if designed that way, to include rolling variables within a longer bit string)... in this way, example: [var1] = [Pacific Time Zone] minus (skew variable) - "3.14" [var2] = [DAYDATE spelled out] plus (translation) such that ==> [var1]*[var2] (list fool's magic xor goes here) ==> [var1a][var2c][var1b.var2d]...[var1w][var2i] whereby, the entire variable of [var1] and [var2] when combined is *changing* and transforming in real-time, via hidden, unknown clock and date correspondence, though could involve GPS, weather, other variability that is essentially entangled into a living password. in the realm of impossible to crack, in my estimation. any computation that cannot stop time itself in order to run the brute force would be losing time and then it would be purely chance, never less than the odds of trillion to one, or whatever it could be, every attempt no matter how many dictionaries parsed in parallel... this is not a password: [password]

1 0

Re: passwords!
by brian carroll 13 Nov '13

13 Nov '13

the list fool here chiming in... i just wonder if there is a boundary condition that exists that is making passwords insecure by protocols that could themselves be modified, and alter the probabilities of easy dictionary attacks. for instance, if A-Z and a few special characters are allowed in a US keyboard alphabet, if that is the majority of what is being automatically cracked, perhaps it is not surprising. yet what if the passwords 'length' were not the issue, such that a 20 character string (of several number.words with several intermixed special characters) could still be successfully attacked, given those limited parameters. and such a view may be: moar characters, longer string, etc. perhaps mistaken though i wonder what 'dictionaries' are referenced because if they are mapped to normal words of a given language, and special symbols, and yet held within the walls or boundaries of a particular alphabet or sign-system, then perhaps language-to-language the password cracking situation remains basically the same. yet, what if the Unicode barrier (if that is what it is) is dissolved, such that many languages could co-exist, such as 12 different N's and ligatures and other special characters... ex. normal bounded password in a given Unicode character set / alphabet, with special characters: th3r0uT33Nw4!z+3sezU3 compare this with a multi-alphabet approach: п世לកóવિz what are the computational probabilities of searching across all ascii/unicode alphabet characters and getting that pattern matched, versus let's say [35] options per password character in a constrained alphabet. the calculation would be something like this (to 21 spaces in ex.) [35][35][35][35][35][35][35][35][35][35][35][35][35][35][35]...[35] versus, if wildly approximating: [1,000] options for the 'multiple language Unicode characters and special symbols' password approach. the following estimate may be inaccurate though for 35 times itself over and over twenty one times, the number i arrived at was: 9.321739789445372e+33 again, calculation may be inaccurate, though for the multiple character approach, only 11 characters @ [1000] needed for: 1.e+36 though imagining it could be many fewer characters in comparison, say if accessing Chinese and Arabic other characters. in other words, perhaps a hypothetical [10,000] symbols could be made available per password unit than [35] in the highly restricted approach that is easy to crack, and that would change how computation occurs with regard to how such passwords are created, stored, and exist, especially in a highly constrained OS and peripheral environment that constrains cross-pollination of such key typographic information that would change the basic dynamics, data behavior. this is the slot-machine approach to [p|a|s|s|w|o|r|d|s] because at a certain point, anything could tally... [*|*|x|ம்|7|*|*|#|ன்] though what is more... for each _space_ there could be any sign.symbol, as with icons or special characters, potentially, that could be potential keyspace or what today may appear as "junk" information that is infrastructural for multilanguage computing, and be utilized beyond the language boundary for its signage, for passwords & security. in this way, the three unit password (icon=ascii symbol) ['icon'][પ્રે][ю] could be stronger than a much longer, restricted alphabet, if going towards 10,000+ options per character. yet the model itself could example such that a password is constructed by a bit-set string, where like a slot machine, could instead have 'words' as the units (as with the existing password approach, word1&word2, etc.)... ['word1'][[પ્રે][ю]['gps-coords'] if only viewed in bounded terms and of serial computation, a long *predictable* string may be easier to attack than a shorter unpredictable string that takes massive resources to churn through the possibilities - and who knows, maybe the password has a time-cycle that automatically changes its nature during that time period of calculation. surface tension, iridescence, spinner

1 0

philosophy & psychology (urls)
by brian carroll 12 Nov '13

12 Nov '13

// infospace, system earth, being and communication TEDx: Prof. Dr. Elisabeth von SamsonowCordless Mega Confusion http://www.youtube.com/watch?v=qLVls6ZX3dk "it is not that the body is inhabited by the soul, it's just the other way around, it's that the body inhabits the soul, the soul is inhabited by bodies- by many bodies. the soul is the sphere in which we communicate, and our bodies are in this sphere, where we shared this... cordless communication, by directing our information packages on different wavelengths." // leading model of orientation: architecture --> text, (since 15th c.) // 1. geology, 2. parasites and real-estate, 3. electra complex, 4. circus [highly recommended. profound understanding & observations, conceptualization and awareness. philosophy of architecture...] Keynote lecture by Elisabeth von Samsonow: The Plasticity of the Real http://www.youtube.com/watch?v=GGBzbHMf7iI "architecture as cybernetic loop through geology; architecture is parageology" "people take the role of [the] Electra... who confronts a big problem when her mother loses power. truly nothing is more disagreeable than a weak person to depend on. one would get furious with that person. and the {unknown} is more and more turned against the earth directly, which makes it finally difficult to enjoy (architecture in the form of) parageology. ...all the building, all the digging, and hollowing out get more and more performed by rage and despair against the earth and by complicity. ...this is the age of archi-heresy that marks a period where the ontological tie between architecture and geology is broken and dissimulated. archi-heresy is not operated against a monotheistic god but against the earth. it is the dismissal of geology as the principle of architecture when an open heresy - another earth - is simulated, a pseudo-earth- offering space and arranging material." (cartography replaces geology, gps orientation)" "architecture... more of a gardening practice (and biology), than parageology." "a large part of the built world, the environment of today, could have been {mould} to the thick surface of the earth. the fetishizing of the eye and the look made architecture an issue of vision but in fact it is not. it is an issue of the whole body that is equipped by a proper sense of space and matter." ... "instead of impressing the public with pornographic forms and fancy structures, architecture must concentrate on its geological mission. where else? now the strata of the earth are completely irrelevant compared to the price per square meter of the {superficials}, all future architecture will include mining and geologic expedition as well as metallurgic and ecologic research- such as finding out where the veins of water go as well as those of petrol, and any other liquids and tissues and minerals and stones and soft {earths}. this will be the {infernal-jective} operations of an architecture that reconquers and finally integrates its proper foundations." (being-unborn, electra complex to electro complex) A Network Spanning The Forest (Underground) -- of Mother Trees http://www.treehugger.com/natural-sciences/trees-communicate-one-another-co… A Ballet Performed by Birds: Starling Murmurations (see first vid) http://www.visualnews.com/2013/11/06/ballet-performed-birds-starling-murmur… // if not entirely clear.... Murmurations - Ephemeral Plastic Sculptures http://www.alaindelorme.com/works-murmurations & Geometric Order Amidst Starling Chaos http://www.visualnews.com/2012/05/09/geometric-order-amidst-starling-chaos/ Self-steering particles go with the flow // tuning via asymmetry http://phys.org/news/2013-11-self-steering-particles.html "The new MIT approach, described in Nature Communications, requires no external forces and takes advantage of hydrodynamic principles that can be exploited simply by altering the shapes of the particles." E. B. White declining an invitation (via the inimitable @AndreaKuszewski) https://twitter.com/LettersOfNote/status/397354825915985921/photo/1 // autism, x-altruism, ~sociopath reduction strategy... Podcast #74 - Andrea Kuszewski - Bulletproof Executive Radio http://www.youtube.com/watch?v=3siooeUd1nw&feature=youtu.be&a GSummit SF 2012: Andrea Kuszewski How to Design Your Life for Continuous Cognitive Enhancement http://www.youtube.com/watch?v=ayihfOsVwiQ Andrea Kuszewski - The Science of Motivation: Neurology, Psychology, Gamification (GSummit SF 2013) http://www.youtube.com/watch?v=s40QcA7NJUk [saw this underwater ROV and downrigger attachment and it immediately conjured the future of musky fishing (may require stealth though, a sealed container before deploying baited lure or hook). this for the trophy-winning no technology barred Boba Fett fisherman. all it needs is a floating wireless transmitter buoy to allow extended range, cut the cord. though perhaps murky water, seawood, underwater hazards combined could shipwreck.] Deep Trekker ROV http://www.deeptrekker.com/collections/all http://www.deeptrekker.com/pages/compare-deep-trekker-models http://www.deeptrekker.com/collections/all/products/downrigger http://www.deeptrekker.com/pages/videos Nothing to see here // rel. 'man caves' http://phys.org/news/2013-11-nothing-to-here.html [quote] "Blending in makes sense when you're trying to avoid being eaten," Martin says. "Less is certainly more when predators are around." [unquote] Changing the conversation: Polymers disrupt bacterial communication http://phys.org/news/2013-11-conversation-polymers-disrupt-bacterial.html "As part of their research into the development of artificial cells and programmable bacterial coatings, the team found that polymers—long-chain molecules—that were able to arrange bacteria into clustered communities were, surprisingly, encouraging these bacteria to actively 'talk' to each other. This communication occurred by quorum sensing (QS), a way in which bacteria signal to each other, and coordinate response to environment. Quorum sensing also controls the way in which bacteria release certain types of molecules—for example as a defence mechanism or as tools for infection." Better police surveillance technologies come with a cost, scholar says http://phys.org/news/2013-11-police-surveillance-technologies-scholar.html [quote] "Much of the Supreme Court's previous treatment of police surveillance has rested on the belief that individuals have no expectation of privacy in public places, and that surveillance technologies that merely improve the efficiency of police investigations comport with the Fourth Amendment," he said. "While officers must obtain a warrant before using some technologies, the courts generally do not regulate efficiency-enhancing technologies." Those assumptions have been workable in the past because of the limited use and capability of efficiency-enhancing technologies. But with the advent of automatic license plate readers and surveillance cameras with biometric recognition, the efficiency of the surveillance itself is becoming a constitutional issue, Rushin said. "Since no one has a reasonable expectation of privacy when they're in public, that means that a police officer can do whatever a normal person can do without any kind of special approval," he said. "They can observe your license plate and write it down on a piece of paper and run it through a database. But now they could also use an automatic reader to scan license plates in bulk – up to 1,800 license plates per minute, in fact. That will invariably vacuum up enormous amounts of data on innocent people, too. "So you have technology that might replace the efforts of dozens, even hundreds, of individual law enforcement officers." [endquote] Physicists 'uncollapse' a partially collapsed qubit // reversible peek http://phys.org/news/2013-11-physicists-uncollapse-partially-collapsed-qubi… "... the recovery method is not perfect. The probability of recovering the qubit's state depends on how much it has collapsed, so that the more collapsed the qubit is, the less likely it is to recover. A fully collapsed qubit has zero probability of recovery. Still, the recovery method could be very useful for overcoming one of the biggest challenges in developing quantum systems: decoherence, which results in the loss of a system's quantum properties." // quasi-crypto tools, proposed correlatory... ek tools Nesting Punch Kit http://www.amazon.com/gp/product/B00EVJK3JY/ // the amazing talent of Eric Gjerde: Paper Artist... Money Folds, US Currency http://www.ericgjerde.com/2013/money-folds/ Gnosis Hand-made bio-paper, created by the artist http://www.ericgjerde.com/2012/gnosis/ Under the Sea http://www.ericgjerde.com/2012/under-the-sea/ Rhombic Flagstone, Elephant Hide Paper http://www.ericgjerde.com/2012/rhombic-flagstone/ // Sensitive Compartmented Information Facilities (SCIFs) A Layman's Guide to the High-Tech Tents That Keep Secrets Secret http://gizmodo.com/a-laymans-guide-to-the-high-tech-tents-that-keep-secre-1… --- crypto experiment corner --- a potential realm of non-computer crypto could be realized in an arts & crafts context and or writing and typography and signage. recently saw a new style of LED sign for restaurants while random searching for a standard LED scrolling display, seeing what is available today. and a "LED lighted writing board" appeared, perhaps they are all over the place and i've yet to encounter the ubiquity yet, though it has potential for transformable writing via LED light. the Amazon links here are to show a basic kit: 28"x20" Flashing Illuminated Erasable Neon LED Writing Board Menu Sign with Control Button http://www.amazon.com/Flashing-Illuminated-Erasable-Complete-Fluorescent/dp… note: the different color markers are related to the colors of the LED light, and via this property, some colored text could fade out while other text remains, due to the color of the projected light. in other words, an invisible ink or reverse-invisible ink effect could exist, especially if typography were to have superposition of letters or symbols that could retain coherence in partial states, or transform their meaning given what colors are activated. (notice on this example, the remote control is similar to the LED lightbulbs that change colors, thus the concept need not be limited to the writing board...) Image® Flashing Illuminated LED Lighted Writing Board 7 Color Lights 28 Modes up to 28 Feet Remote Control Restaurant http://www.amazon.com/Flashing-Illuminated-Restaurant-Specials-Promotions/d… so it would be an issue of what fluorescent marker colors are available and what light colors are available, as to what the range or number of phase changes could occur via this method. certainly lighting engineers (forget their actual title) have used such effects for animation and movement, though it could also be used for hiding and revealed patterns, etc. and this following url has examples of signage with this changing-color effect that influences the appearance of what is written. (see right column animated signs) LED Writing Boards With Various Lighting Effects http://www.displays2go.com/C-4747/LED-Writing-Boards-With-Various-Lighting-… now perhaps UV and IR wavelengths and blacklight would be needed though if distance is taken into account, scale of glyphs or type, the existing color range could also potentially have enough difference to make some signs more predominant than others, this within a context of intra-sign and infra-sign structuring. like having: \/\ appear in a given color, and then \ \ when the color changes to a particular phase, if not also /\ and / using other hues. /// just in case someone has not seen this yet... True Facts About The Angler Fish http://www.youtube.com/watch?v=Z-BbpaNXbxg truncated polyhedra, vertex, cosine

1 0

Re: [SOT] {FWD} [Dailydave] Don't use vowels in passwords! (fwd)
by Guido Witmond 12 Nov '13

12 Nov '13

On 11/14/13 00:09, sharon wrote: > below :) > On 11/12/2013 11:48 PM, Guido Witmond wrote: >> The world needs to forget passwords as remote identification and move on >> to client certificates. Preferably, a separate client certificate for >> each site. It takes only a small browser plug in to make it easy. >> >> Regards, Guido. > hi, off-list. > ive read a bit about your ideas for auth. its interesting. > but im not clear on one thing - > if were happy with keeping secrets locally, and even letting a browser > plug-in read/write them, > why not just generate a pgp key pair, with one good password, > and use that to keep an encrypted file with lots of randomly generated, > strong passwords? > that encrypted file can be easily synced across devices, with any > regular service, a its encrypted. > (or synced manually, privately) > and the key pair, should be better protected, manually synced, or for > non-paranoid people, with the same service, since thats protected with a > good password too. > of course, echo "good password"| gpg -d "password file"|grep "service > name" could be done with a browser plugin as well. > how is that inferior to client certificates? or the the code you wrote > to make it happen? > thanks. > feel free to reply publicly if you think someone else might also benefit > from it. What you've designed is a classic password manager application, like Lastpass, Keepas. It's a good design for when the site requires a password. However, as every website has their own rules for password, lengths, allowed characters, it makes it a bit of hit and miss whether a certain generated password will be accepted. It would lead to having a list of sites and recipes of what is allowed. It doens't scale. Besides, most sites also require an email address, so anonymity is lost. Client certificates are already implemented in most web servers. It's a one-line setting to accept a certain certificate authority for a site. If that is the Ca of the site owner themselves, it's even easier. The price to pay (for end users) is to have a computer that cannot easily be subverted by malware. Notice that's the same requirement for password managers. I've written about my ideas on client certificates on my site: http://eccentric-authentication.org/ Feel free to ask if anything is not clear Regards, Guido.

1 0

Senate to investigate Intelligence Community
by Gregory Foster 12 Nov '13

12 Nov '13

Foreign Policy (Nov 12) - "Senate to Start Sweeping Intel Review This Month" by @shanewharris: http://thecable.foreignpolicy.com/posts/2013/11/12/senate_to_start_sweeping… Harris, author of _The Watchers_ and not one prone to hyperbole, draws comparison with the Church-Pike hearings. > Not everyone had been convinced that Feinstein's promise to investigate the intelligence agencies was more bark than bite. A former senior intelligence official recently told The Cable that he believed the inquiry would be wide-ranging and would uncover more controversial programs that will embarrass the intelligence agencies. HT @shanewharris: https://twitter.com/shanewharris/status/400340087894204416 gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/

1 0

Re: patents in a free society (Re: Brother can you help a fiber?)
by Bill Stewart 12 Nov '13

12 Nov '13

The standard Libertarian position on patents is "rabid". Whether "rabidly for" or "rabidly against" or "rabidly endorsing some highly nuanced conditional niche position in between", we're in pretty solid agreement on the "rabid" part. Some of us strongly believe in intellectual property. Some of us believe that initiating force to defend "imaginary property" that's really a euphemism for a government-granted monopoly is both dishonest and anathema. So take your pick.

7 7

NIST Randomness Beacon
by d.nix 12 Nov '13

12 Nov '13

surely someone here has an opinion... http://www.nist.gov/itl/csd/ct/nist_beacon.cfm :-)

6 5