Comment: Re:Time to create a truely secure chat client (Score 1) 273
SSH is not a chat client, its a secure remote shell for logging into other computers.
|
|
SSH is not a chat client, its a secure remote shell for logging into other computers.
I have an idea for a really secure chat client. It would support all the things Skype does that don't cost money (including voice chat, video chat and file transfers). How I envisage it working is this:
1.When a user installs the program and registers for the service on a given host (there could be multiple separate instances of the server which may or may not communicate for the purposes of allowing users on one to talk to users on another), a public and private key-pair is generated on the local device. The public half is submitted alongside the registration details and the private half never leaves the users device (unless the user e.g. copies it to another device so they can use the program there).
2.When the user logs onto the service, they use their private key to digitally sign a login packet which is verified by the central host (to verify that the user is who they claim to be and making phishing and password-theft much harder).
3.To talk to someone (voice, video, text, file transfer, whatever) the client that wants to initiate the conversation asks the central server for the public key of the other guy. Then that public key is used as part of some sort of key exchange to share an encrypted session key in a way that even someone with a complete packet dump of the network traffic AND the private keys of both people couldn't recover the session key (something like Diffie-Helman would probably work here)
4.All communications between users would be peer-to-peer direct conversations. In cases where direct links are not fesable (such as mobile devices where direct p2p links are not an option) all any relay servers ever see is encrypted data packets.
5.Unless specifically asked by the user to do so, none of the communications are ever stored on any persistent storage medium by the client.
6.At the end of the conversation, the session key is destroyed. (how you define "end of the conversation" in an IM client I dont know but certainly ending a video or voice session would count, as would closing the client)
7.The client would cache public keys from users and warn if the cached key and the one the server has are different (thus helping detect if the central server has been compromised by someone)
Assuming the client is implemented properly and the crypto is good (and hasn't been cracked) then this should be highly resistant to eavesdropping.
The protocol would be 100% documented and open.
The client (and there would ideally be multiple implementations to ensure against someone inserting a back-door) would be open source.
If the session keys and key exchange are done properly (and there are no weaknesses in the key exchange or crypto) then even with the private keys of both parties in the conversation AND a full packet dump of the entire conversation, it would be impossible to recover what was transmitted.
In some cases they want to lock games out of FTA in an area because there is a different game on a subscription channel in some form that they want people to watch (and pay for)
The ITAR rules place restrictions on exporting certain things without an export license. One of the things that is restricted are handguns. ITAR also says that exporting blueprints and technical data related to an item requires an export permit in the same way that exporting the item does.
So by publishing blueprints to a handgun on a US-hosted web server without an export license, an ITAR violation has taken place.
The law says that its not illegal to produce a gun at home. People have been making guns at home for years.
Why is it suddenly a problem that someone can 3D print a gun instead of making one out of a block of metal with machine tools?
Is to teach the top management not to believe all the stuff in the shiny brochures from the ERM vendors and to consult with the in-house experts (i.e. the IT team) to make sure they get the best solution for the company's needs rather than just the one from the company with the best marketing department.
Is that it is simply replacing one set of binary blobs (Flash, Silverlight and a host of dedicated non-web apps on mobile devices, smart TVs, games console etc) with another set of binary blobs (the content decryption plugins).
It does nothing to make the content work on more browsers (the content decryption plugins still have to be ported to a given OS/browser combination). In fact, if those who create content decryption plugins do browser sniffing to block browsers they dont like (or browsers that contain bugs, vulnerabilities or features that could allow access to the decrypted content) it may reduce the number of choices to view specific content.
It will likely increase the number of DRM solutions out there as different content providers will want their own DRM solutions. (e.g. what Netflix uses may be different to what Google or Microsoft or Hulu or Amazon uses).
I agree with others posting here that the correct response (given that no-one was hurt, no damage was done and there was no intent to hurt anyone or cause any damage and given that this kid was otherwise a model student and had never done anything wrong before) was NOT to call the cops but to give the kid a week of detentions or maybe a weeks suspension, maybe combined with a stern warning to the kid (and the school as a whole at the next school assembly or something) not to do such things again because people might get hurt.
I suspect a lot of the problem there has to do with Imagination Technologies (creator of the PowerVR GPU core in the Poulsbo parts) and how much Imagination Technologies were willing to let Intel release (either as binary drivers or as source code)
I think (based on what I read) MAME wont support gambling games that are still being produced or that are new enough to still be in casinos.
One big reason for Google to be interested in Motorola is that, at the time Google bought them, Motorola was making a LOT of noise about using its patent portfolio to go against not just Microsoft and Apple but other Android vendors as well. Which would have hurt Android and hurt Google.
Buying Motorola allowed Google to end that threat.
The current market capitalization of Disney is over $100 billion. I cant find any specific information on Disney but I would expect that the shareholding of Disney is the same as for many large blue-chip companies where significant chunks are owned by entities (index funds, hedge funds, pension funds and others) who are only interested in the short term share price or the next set of quarterly financial numbers.
Personally I think Google could do well to buy one of the big movie studios. (Warner might make a good target) then use that ownership (and seat on the MPAA and etc) to push for a saner copyright system (e.g. one that doesn't place as many requirements on Google and YouTube to look for, censor or remove illegal content themselves and placing greater burden on the owners of the copyright to carry out the policing)
DRM in HTML5 replaces proprietary, often browser-specific and platform-specific plugins like Flash and Silverlight with proprietary browser-specific and platform-specific content decryption modules (which will likely be even MORE tied to specific browsers and platforms)
At least with Flash, you have a reasonable chance of it working in any web browser that supports whatever plugin API the Flash plugin you have actually needs. With the CDMs, expect to see the people who create them specifically tying the CDMs to browsers (and browser versions) they have verified as "safe" (i.e. unable to be used to steal their precious content). It will likely be HARDER to use the CDM plugins with open-source web browsers than it is now with Flash.
None of which will be an option in the USA because US laws are backwards-thinking and ban any headlight tech that's in any way modern.
A better idea would be a 0.001% tax on all financial transactions (share trades, commodities etc). Small enough that anyone doing it to invest and hold wont be affected but large enough that those doing HFT will find its unprofitable thanks to the tax.
Actually I dont know the exact number that makes sense for this, maybe its not 0.001% (I am not an economist, a tax expert or an investment guy)
If you are going to walk on thin ice, you may as well dance.