Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Encryption

Generate Memorizable Passphrases That Even the NSA Can't Guess 267

HughPickens.com writes Micah Lee writes at The Intercept that coming up with a good passphrase by just thinking of one is incredibly hard, and if your adversary really is capable of one trillion guesses per second, you'll probably do a bad job of it. It turns out humans are a species of patterns, and they are incapable of doing anything in a truly random fashion. But there is a method for generating passphrases that are both impossible for even the most powerful attackers to guess, yet very possible for humans to memorize. First, grab a copy of the Diceware word list, which contains 7,776 English words — 37 pages for those of you printing at home. You'll notice that next to each word is a five-digit number, with each digit being between 1 and 6. Now grab some six-sided dice (yes, actual real physical dice), and roll them several times, writing down the numbers that you get. You'll need a total of five dice rolls to come up with each word in your passphrase. Using Diceware, you end up with passphrases that look like "cap liz donna demon self", "bang vivo thread duct knob train", and "brig alert rope welsh foss rang orb". If you want a stronger passphrase you can use more words; if a weaker passphrase is ok for your purpose you can use less words. If you choose two words for your passphrase, there are 60,466,176 different potential passphrases. A five-word passphrase would be cracked in just under six months and a six-word passphrase would take 3,505 years, on average, at a trillion guesses a second.

After you've generated your passphrase, the next step is to commit it to memory.You should write your new passphrase down on a piece of paper and carry it with you for as long as you need. Each time you need to type it, try typing it from memory first, but look at the paper if you need to. Assuming you type it a couple times a day, it shouldn't take more than two or three days before you no longer need the paper, at which point you should destroy it. "Simple, random passphrases, in other words, are just as good at protecting the next whistleblowing spy as they are at securing your laptop," concludes Lee. "It's a shame that we live in a world where ordinary citizens need that level of protection, but as long as we do, the Diceware system makes it possible to get CIA-level protection without going through black ops training."

Comment Re:One-sided relationship (Score 1) 139

We don't want American spy agencies listening to our https traffic either. Just because Alice is shooting at me, it doesn't suddenly make it OK for Bob to stab me too.

This is an attack against the SSL trust model. A CA knowingly created a rogue certificate for malicious purposes. This wasn't an accident. A Diginotar type response would not be inappropriate.

Comment Browsers getting too complex (Score 3, Insightful) 237

Is it reasonable to expect browser makers to hold their own in an arms race against exploits?

The problem is that browsers are trying to become an OS - with all the complexities associated with one.

If we want back to a world where HTML was mostly about content -- that could be displayed in everything down to things like the Lynx browser -- they coudl be made secure.

People wanted more, though -- so they decided to allow extensions like Java Applets, Flash Plugins, and ActiveX controls. Obviously more complex, those were not surprisingly insecure.

So now people decide to take all the complexity and insecurity and build it directly into the browser itself?!? WTF.

Makes me miss gopher clients. Maybe we should go back.

TL/DR: Javascript+HTML5 is the new Java applet + Flash Player + ActiveX control.

Comment Re:Waring against AI.... (Score 1) 341

He, like most rich and powerful people are, is afraid of that which he cannot or could not control. Bostrom, the philosopher drumming-up all the fear, is afraid of that which he cannot or could not understand.

Look how the powerful record and media companies reacted (and continue to react) to file sharing. Look how a chess champion reacts to being beaten by a computer.

I think that the powerful don't want something more powerful than them and the smart don't want something smarter than them.

But I believe the wise will always seek that which is wiser than them.

What was this thread about again? Cars?
Privacy

Uber Sued Over Driver Data Breach, Adding To Legal Woes 32

wabrandsma writes with news about the latest trouble facing Uber. "Uber Technologies Inc has been hit with a proposed class action lawsuit over a recently disclosed data breach involving the personal information of about 50,000 drivers, the latest in a series of legal woes to hit the Internet car service. The suit, filed Thursday in federal court in San Francisco by Sasha Antman, an Uber driver in Portland, Oregon, says the company did not do enough to prevent the 2014 breach and waited too long — about five months — to disclose it. Antman says Uber violated a California law requiring companies to safeguard employee's personal information."

Comment Not yet, let them decide. (Score 1) 734

If you don't sign before the child reaches 18, the child is not considered an American citizen.

So I read this as meaning you have 18 years for such a decision to be made? In that case, don't do it now, but let them make their own minds up when they're (hopefully) intelligent teenagers who can understand the implications and how they might want to live their adult lives (such as if this might include moving to the US). Unless you plan on returning to the US or splitting up with the mother and want custody, there are zero benefits for them to be US citizens now so either let them decide or make the decision at a time when it makes sense.

Comment Re:Who's Afraid of Android Fragmentation? (Score 1, Interesting) 136

Who's Afraid of Android Fragmentation?

I'm afraid of the ***lack*** of fragmentation in Android.

I believe that Linux's success is directly tied to it's fragmentation.

When a early Linux distro is hard to use (mailing lists), a much easer one comes out (Slackware). When a different Linux vendor goes insane (SCO Linux), other vendors can remane sane. When a different linux goes expensive (RHEL), affordable forks spring up (CentOS).

Fragmentation is what keeps Linux safe both-from-and-for things like systemd. If systemd turns out great - fragmentation is what allowed early adopters to use it so it gained traction. If systemd turns out to be horrible, fragmentation is why other linux distros will survive that experiment.

TL/DR: We need more fragmentation. The mobile world would better if I could choose to run Ubuntu-Android, Fedora-Android, Samsung-Android or Google-Android on my phone.

Comment Re:If you hate Change so much...... (Score 1) 516

attempt to get rid of the penny was a conspiracy to drive up prices.

Well - it kinda is!

Often people rant about wanting a "gold standard" for currency -- though that's a bit foolish because gold is rare enough that it's pretty easy for the richest banks to manipulate prices.

What the penny could give us instead (if they allow people to melt them) is a *zinc standard* for our currency! Where the value of a dollar is tied to an amount of real-work (the amount of work to mine and refine zinc) -- a mineral common enough that it'd be harder to manipulate than gold.

Slashdot Top Deals

I've noticed several design suggestions in your code.

Working...