Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
×

Comment though... (Score 1) 180

Nobody's saying "Man, I wish my CAN bus had more bandwidth so I could stream!

Yup, in *theory* you know that a CAN bus is used for critical automotive functionality (say engine, ABS, power steering, or even drive-by-wire, autonomous steering, etc.)
Whereas the streaming should stay confined within the media subsystem, and both should be kept completely isolated from each other.
So it doesn't make sense to speak about successor of CAN bus technologies and media consumption in the infoteinment system of the car.
They are completely separate networks.
In theory.

In practice, you know pretty much that we leave in a world of product rushed into production due to marketing constrain. A world where, due to extremely flacky design, it's possible to hack a vehicle by abusing the wireless transmission used to report tire pressure.
So you know that lack of proper separation is bound to happens and you will end-up being able to hack a vehice by streaming a specially crafted video file, simply because the various ethernet networks aren't properly isolated from each other.

Comment Practical problem (Score 1) 109

The most obvious attack is control of a majority of the network, and of course correlations attacks which require access to many ISPs.

The *owning* itself might be achievable (and even that is going to be complicated because you need to own significantly more than other governments trying to achieve the same and non-governmental legitimate users)

  *BUT* even then extracting any meanfingful data is complicated. The more people use tor for anything else beside what you're targetting, the higher the noise level among which you're searching for signal, and thus the lower significance of anything you might try to analyse.
Beyond some point, your better of using a random generator, that is going to give results as statistically significant as what analysis method give out.

Remember, whenever you use Tor to surf for porn, not only are you protecting a bit your privacy, but even more: you're helping intelligence service drown under too much to be able to analyse Tor.

Comment That's the plan (Score 1) 109

That's actually their plan:
- Use Tor for network anonymity
- Use OTR for content protection.

And they also have a 3rd step:
- Use the open source InstantBird. It's opensource so it's possible to make it secure.
(basically, yet another chat system that relies on Pidgin's libPurple. Like Adium and co)
(except that one runs on mozilla's xul, so there some code share with firefox, the other software that is bundled next to tor in their bundle)

And probably (not mentioned yet but likely to happen):
- Deploy some Jabber/XMPP server running as a ".onion" tor-only darknet server.
So people have additional choices next to the classic XMPP (for Google or Facebook) etc.
(Note: as long as you use Tor and OTR, and that you use a separate Google or Facebook identity when chatting, they are perfectly secure enough too. Meaning that they are probably not absolutely secure, but on the other hand, thanks to Tor+OTR, there is no compromising information leaking through them).

Comment Academics (Score 1) 109

Where is a more recent credible assessment of adversary capabilities specifically to the TOR network?

The fact that NSA dosn't have a monopoly on brains. The fact that research is done by advancing previous research (and rarely appearing out of the blue), and universities have access to the same historical previous research that secret researcher hidden in the NSA do.

And despite this, none of the academics working on it has been able to demonstrate any actual failure of principles behind Tor.
There *is* a prestige incentive to be the first research group to demonstrate an actual good failure. But until now, such papers have been limited to though experiment (if you could monitor nearly every entry and exit node on the network, and suddenly the traffic was very low [all the porn, all the chinese simply using it to communicate outside the great firewall, etc. all suddenly disapeared], then maybe it would be feasible to find some suspects by using traffic analysis. But that's not actually the case in real life. You can thank PORN for that)

Comment Not "Illegal". (Score 1) 109

It's also possible that those pieces of evidence were discovered _after_ some other, illegal methods were used.

Except that, in this case it wouldn't have required any *illegal* method (1) (2).
It would have required method which go against anything that is currently known in cryptography.

The cryptographic methods which form the basis of Tor are sound and unbroken as of yet.
Tor is sufficiently well designed to avoid bugs and exploits that might lead to leaks (Side-channels, etc.)
To actual crack Tor open, you need to beat modern cryptography.
And the NSA doesn't have a monopoly on brains, and modern research is (as always) standing on the shoulder of giant.
Public academic research has brains involved, and has access to previous research, just like the NSA.
Chance are, if researcher at the NSA find a way to break open modern cryptography, research in universities will end up discovering the same findings on their own too. If nobody in the academic field is suspecting any danger on modern cryptography, chance are that the NSA can't find way around it neither.

(That's why the Snowden revelations, although suprising for the general population, wheren't that much a surprise for the specialist in that fields: it's merely a confirmation for methods which were suspected for a while).

Traffic analysis can't help you to beat Tor, simply due to the latency of the network and the wide usage:
So okay, you want to monitor entry and exit nodes to match them. You got a positive hit on an exit node connecting to a known "enemy location" (an anti-government website), what next? Well, any of the entry node (not only those you're watching, but the other too) could have initiated the request, and that request hasn't been issued right now, but somewhen in the past, over a period corresponding of the typical latencies you see on Tor network.
So you need to be lucky that the entry node was one you're watching.
And you have to correlate your hit with *ALL THE TRAFFIC* from *ALL THE NODES YOU'RE WATCHING* over a *LONG DELAY IN THE PAST* (instead of exactly the same time). That's a metric fuck ton of data. Your important match is lost in a sea of noise. The 1 single contact to a subversive site is just lost under a sea of avarage users surfing porn and simply using Tor for the added anonymity and to circumvent restrictions.
You can't make a correlation, because there are simply too many orders of magnitude difference between the signal and all the noise to be able to make any significant and relevant statistics. Traffic Analysis can't help you get Tor down.

Until now, all attacks against Tor haven't been against its cryptographic basis, nor have been against its complex network. The attacks have been against stupid mistakes and blunders, like vulnerabilities inside the browser used to surf on tor (for exemple, an older unpatched firefox was used by some)

So intelligence services are able sometime to get some info out. But this isn't because of Tor itself (Tor didn't bring down Silk Road). It isn't because of Traffic Analysis either. It's because some users used an unpatched browser and got hacked, just like any other common driver-by attack.

Tor network can be trusted to keep secrets. Buggy software can't.

----

(1): Well except under weird legislation, where DCMA do apply and where breaking any form of encryption is illegal. So in the case of Silk Raod and USA, such methods might indeed have been illegal.

(2): "Illegal". Well mostly because you want to keep the first lead *secret* (either because it's illegal, or because it's a state secret). You know X is guilty, but you can't build a case because the method is illegal. So you keep watching the known guilty X, until he does other mistakes that reveal him and use these to build the legal case.

Comment "Not traceable" (Score 1) 109

It would be better to call it "not traceable".
Here the meaning of "anonymous" being that NSA can't tie an actual identity to the peers of a chat (by using the already well tested Tor network), and that they can't eavesdrop into the conversation (by using the already well tested OTR standard).

i.e.: Bob1983 and Alice_696969 happily chat to each other about how much they dislike the current political situation in Kiev or brainstrom about better methods to circumvent the Chinese Great Firewall.

They might know each other on-line since a while, enough to trust each other to talk about such objects freely (they might or might not have already met in real life but at least they are not completely anonymous to each other. At minimum they are pseudonymous. That's important because the "socialist millionaire" protocol to weed out man in the middle attacks requires them to know each other at least a bit)

Thanks to Tor, none of the concerned government (or any of they allies) will be able to know if one of those holding these subversive discussion is actually a citizen inside the country.
Thanks to OTR, nobody beside the two chatter will be able to actually know the content of the chat.

Comment filtering (Score 1) 526

A high quality sound system should be able to filter out such harmonics.
A very well designed sound system should be able to take any possible wave form, and play it without destroying anything in the process.
It's possible to filter out unwanted harmonics, etc.

The problem? Such a system would cost a few more bucks and laptop manufacturers are racing to the bottom for prices.

Comment Move to another crypto-coin (Score 1) 250

Exponentially wasting electricity and semiconducts to generate a unique numeric key. Great!

Then move to another crypto-coin.

- Litecoin use a different hashing algorithme which is *NOT* scaling exponentially with generation. (Good CPUs can still pose a challenge to mid-range GPUs, FPGA and ASIC deliver the same performance range as graphic cards, only at a lower power consumption. Even when companies start selling Scrypt ASICs, your graphic card won't be worthless).

- Quarkcoins are a good test-case for newer generation SHA-3 family of algortihms (the current winner and other contender).

- Primecoin is even an entirely different beast.
Instead of simply generating hashes, primecoin generate actually useful research data in the field of mathematics.
(my personnal current favorite)

- Not happy with any of these? Then try imagining a way to generate even more useful result during mining (Hey, can someone invent a valid way to turn BOINC or Folding@HOME into an actually useful crypto-currency?) The code to the bitcoin protocol is free, launching a new coin nowaday is mostly trivial. (as you can see with all the multiple alt-coins emerging everyday. Even joke coins like Dogecoin).

Comment bitcoin is an exchange mecanism (Score 3, Informative) 207

Indeed, bitcoin is a protocol used to push around numerical value (which are counted is bitcoins, BTC).
Your IRS or any other tax service shouldn't tax bitcoin, just the same way that they don't tax your paypal account (as is litteraly putting a tax on the e-mail address itself) nor (for a more extreme metaphore) put a tax on your credit cards (litteraly taxing the actual bit of plastic with a "Visa" or "Master card" logo on them).

Bitcoin protocol is a mean to exchange value (except that you don't directly push around any official currency, but instead you push BTC around and convert to/from BTC using exchanges, payment processors, etc.)
This is exactly the same as paypal is a service used to do online payment, and as a credit card is a mean to do payment.

At the end of the day, a merchant using BTC as mean of payment, will exchange them to a local currencies (USD, EUR, whatever is here around) usually in a completely automatic manner (using a payment processor such as coinbase, bitpay, etc.)
  So at the end of the day, a merchant will make revenue in local currency (USD, EUR) and that what the merchant has to declare as a revenue:
the flow of USD/EUR/etc. going to the merchant's bank account. The tax service shouldn't give a fuck is that money was conveyed using paper money at a cash register, or using commercial centralised payment methods like PayPal or MasterCard, or a distributed crypto-currency as bitcoin.
What matter is at the end of the day, a merchant made XXXX USD/EUR and has to pay taxes, social charges, inssurances, etc. from this amount.

Also, to the poster above: please stop spreading the disinformation that bitcoin can't be tracked. In fact, the whole security principle of bitcoin lies on the exact opposite: every single transaction is broadcasted to the whole network, so every single node is able to verify it.

The closest thing the bitcoin protocol has is "pseudonymity". Identity of parties in a transaction aren't directly disclosed in the clear:
- it's not 'Mr XXX, living at adress AAA' has sent bitcoins to 'Ms. YYYY living at BBBB'"
- it's more like 'account [public key 1]' has sent bitcoins to 'account [public key 2]'
On the other hand, if Ms. YYYY happens to be a merchant, she has the name and address of Mr. XXX and can map it to a public address. Government have enough ressouces to do such mapping on a large scale and completely remove any anonymity.
But you're shielded from your neighbours accidentally discovering that you spent money at a sex-shop.

Comment Didn't work for DRM. (Score 1) 364

Why? This is essentially a signed kill message and message signing has generally been very secure, good luck getting anyone's root key.

Yeah, just like Sony Playstation's, or the Blu-ray's, or Debian's root key have never been compromised neither...
Oh, wait...

In a perfect world, were everything is perfectly implemented, such a "remote-kill-switch" could probably work only as intended, and the only reason to be afraid would be potential abuses (Government authorising warant-less remote shutdown because of newer laws against cyber pedo-terrorist pirates, Cops abusing the system for their own gain, etc.)

In practice, you know that the implementation is going to be imperfect and flawed. Probably 6 years after its release someone at a hackers' conference will demo an exploit that involves sending a malformed data packed on the same frequency as the tire-pressure detector talks to the car, because the car's subsystems weren't correctly isolated.

Beaten 6 months later by another team which discovers that the "oh-so-easy-to-hack" on-board entertainment system [complete with wifi/bluetooth/4G online access], actually *DOES* talk on the same vehicle-wide network as the car's subsystem even if nobody in his right mind would ever design such a system.

And it doesn't matter, because your local car-jackers had the root key anyway from day zero, because they bought it from some foreign thief, who bought it from the russian mafia, who got it "leaked" from the FSB, who got it because one of the engineer designing the whole system was actually one mole agent planted by them. (And then Snowden will reveal that the NSA unsuccessfully attempted the same. But as their mole got caught, the NSA resorted instead to getting one of the real legit engineer drunk).

Cue-in tabloid story of a cop who blocks the car of a love intesress' current boy friend and courting competitor....

Probably a bit of tin foil around the antenna would do the trick, maybe it won't work on getaway cars but police stop runners, DUIs, people driving the wrong direction and a lot of other loose cannons probably wouldn't have done that.

You probably will get a whole range of solution, between simple tinfoil to jam the antenna, to simply using older cars dating before this system, to complex hacks that look completely legit on the radio wave (like correctly answer to pings and will acknowledge a remote kill order), but do not actually enact the kill.

Probably privacy and security savvy everyday users will try the former, and probably get busted and heavily fined for it.
While criminal will try the later solution (car predating the system, or hack that quacks like the duck, walk like the duck, but aren't actually the duck) with great success.

Oh and all military aircraft have kill codes today I think, want to do a runner with a US jet to Russia? Methinks you'd never arrive, even if you could avoid being shot down. Missiles definitively have self-destruct codes, now if it was this totally insecure why would we build systems to totally cripple ourselves in case of war?

There is a small difference between the military (who have plenty of budget and won't mind spending it on the top of the line. Their things might be completely overpriced, but they can afford proper audit) and mass produced goods like car which have to be as dead cheap as possible (be ready for the kill-switch's firmware to be outsourced to the cheapest asian contractor).

And I'm ready to bet that, deep at the MSS and at the FSB, someone DOES know the root key to US missile remote deactivation.

Comment Jolla... (Score 1) 303

that the developers are still almost as closed off and unresponsive as the maemo and meego team at Nokia.

Technically, the developers *are* the maemo/meego team at Nokia. Or were formelly, before splitting away.

but I still have hope that the Jolla will actually develop into something even nicer, eventually, maybe.

Unlike most other open project (like openmoko, for exemple), Jolla, because of this background, have probably much more know how and experience putting actual phone on the market. So I'm also expecting that in the long run they are going to do quite well.

They already managed to sell a phone which after all is more or less decent.

Comment Resurect page (Score 1) 79

There's a FireFox extension called "Resurrect Pages" which already does this tastefully:

In case of error, it does display the error page, but the extension gives you the choice to look for the missing link in a few place (archive, google cache, etc.)

As long as they don't simply replace 404 errors, but give a choice to the end user, I'm for it.

Comment Some of the attraction of Bitcoin (Score 2) 157

The fact that nobody does this tells you a lot about the majority of the population's attitude towards corporate controlled private currencies.

Bitcoin is attractive in that it's not a corporate private currency. It's not even controlled by anybody (which has some advantage in the eyes of some anarchist or people living with corrupt government, but which also means that currently BTC exchange rates are prone to much more fluctuation).

I still remain deeply sceptical that BitCoin is anything other than an enthusiast's curiosity and/or "get rich quick" scheme, and can't imagine it going the distance.

Well it has a value (at least the bitcoin protocol, not the BTCs themselves) as a system to send money abroad.
More or less the advantages that SEPA has brought to easily push money between european banks, bitcoin brings the same advantage to push around money between any 2 individuals on the internet:
- you're not bound a a peculiar bank (in case of SEPA) or to a peculier service (in case of bitcoin). Whereas if a merchant uses Paypal, the customer are forced to use Paypal too.
- no chargeback fraud
- no need to leave leakable/exploitable data at the merchant, you just have an account number/public key.
etc.

The value fluctuation of BTC is only problematic for people holding BTC to speculate on them.

Merchants aren't affected if they use a payment processor to convert BTC back into the currency they work with.
Same for customers (and they don't need to use the same service to convert currency into BTC, as mentionned above).

Comment ...and then they get shutdown (Score 1) 157

Imagine if they just started by basing Amazon Gift Certificates off the technology. Suddenly next Christmas, several hundred million teens and twenty-somethings would have wallets and be spending Amazoncoins. Amazon trumpets the numbers, using them as proof that Amazoncoins are popular, thus setting the stage for further acceptance by people who know nothing about Bitcoin but sure as hell know Amazon.

...and a few months later, the whole operation will get shut down on various grounds.
(Accusation of tax evasion or money laundering or whatever, or simply because they are not legally authorised to create their own money)

That's one of the main strong points of bitcoin: its distributed nature. You can't "shutdown bitcoin", because there's no single entity to go to in order to shut it down.
Whereas, in case of Amazon, obviously you just shut down AZC by going at Amazon and asking them.

Comment Urban legends die hard (Score 1) 69

Is your government still denying benefits to young women that refuse to work in brothels?

Hey, and I heard that circus performer is a legit job in your country, does *your* government still deny benefits to young boy that refuse to work as Circus Lion Tamer and/or Human Cannon Ball ?

Can you please stop perpetrating this stupid urban legend ?

Yes, indeed, Germany, as well as Switzerland here, and Netherlands recognize prostitution as a regular profession.
But no, the state CANNOT force a job-seeker to work as a prostitute in a brothel.

You see, the State recognize the notion of "suitable job". And just like not every single random young man is ready to put his head in jaws of a Lion or jump into a cannon for the entertainment of the audience, the same way not every single random young woman might want to work as a prostitute.
It takes more than simply having a vagina or a penis to work in a brothel.

When you get the status of job-seeker, you define professionnal fields in which you are seeking for jobs. The state might try to give you jobs in your field. And you can get penalize if you refuse to apply for such a job which is in your stated professional field of work.

If you state that you're a teacher, that you're seeking another job in this domain, the state gives you a job offer as a teacher, and you turn it down without reasons, you'll get penalized.
But nobody is going to penalize you for skipping an opportunity to work as a prostitute if you're a teacher.

The only situation would be if you're actually a prostitute (and say, your former brothel went bankrupt, or you had to quit because you moved to a different part of the country), and registered as a job-seeker seeking a new position as prostitute in a new brothel, and you turned down an offer to work as a prostitute in borthel A (for example because you are holding because you would prefer getting an offer from brothel B which is more prestigious), that might be the single situation when the state might penalize you.
(But that isn't likely to happen in real life because the job market for sex workers isn't saturated and thus brothel B would probably hire you as soon as they've recieved your CV/references and interviewed you).

Now, brothel operator still publish job offers, hoping for the rare occasion when a girl might think "Well, why not... it's a job like another", and decide to accept the offer anyway.

Slashdot Top Deals

To do nothing is to be nothing.

Working...