Hacker Jeff Moss Sworn Into Homeland Security Advisory Council 139
Wolfgang Kandek writes "Hacker Jeff Moss, founder of computer security conferences DEFCON and Black Hat, has been sworn in as one of the new members of the Homeland Security Advisory Council (HSAC) of the DHS. Moss, who goes by the handle 'the Dark Tangent' says he was surprised to be asked to join the council and that he was nominated to bring an 'outside perspective' to its meetings. He said, 'I know there is a new-found emphasis on cybersecurity, and they're looking to diversify the members and to have alternative viewpoints. I think they needed a skeptical outsider's view because that has been missing.'"
DC = suits = Borg (Score:5, Insightful)
Re:DC = suits = Borg (Score:5, Interesting)
Re: (Score:3, Insightful)
Re:DC = suits = Borg (Score:4, Interesting)
Nah. He can still "leak" stuff. (Hey, they asked him to be their expert. If he can't circumvent their "leak protection" [whatever that might be], then nobody can. ^^)
He can also destroy them from within, in case they become/are too evil to bear.
It's nearly impossible for this to be bad for us. :)
Re: (Score:3, Interesting)
Yeah, but would he be able to avoid canary traps [wikipedia.org]?
Re: (Score:2)
Easy. He just would have to spread his version to all other people that he is allowed to discuss this with. A canary trap does not work when people can share the information anyway.
A good social engineer (or spy/agent) should know such stuff. ^^
Re: (Score:3, Insightful)
Give me a break. It's another talented, unethical scumbag joining up with the even bigger scumbags in government so that they can fuck us over more efficiently. Immunity and privilege for him, surveillance for the rest of us.
Re: (Score:2, Funny)
At least you partly benefit. Less of your tax dollars needed to fuck you over ;D
Re: (Score:1)
Didn't you mean to say, "more surveillance for the same amount of money"?
Re: (Score:1)
No, I meant to say "same amount of surveillance and a nice cash-in-hand bonus for [y]our keepers."
Re: (Score:1, Flamebait)
It's another talented, unethical scumbag joining up with the even bigger scumbags in government
Why the hell do you say that? Do you even know Jeff? As someone who does I can tell you your statements are ridiculous, why don't you shut the fuck up before you end up looking even stupider than you already do?
Re: (Score:1)
given the amount of money DEFCON and Black Hat make from the government and its contractors, i question the notion that he's been a rebel since the commercialization of those conferences.
Re: (Score:2)
Re: (Score:2)
I doubt Obama can replace the entire council. So hope it works out well. Or it's back to "same old same old".
Re: (Score:2)
He's a poacher turned gamekeeper?
Not quite (Score:5, Insightful)
Re: (Score:3, Funny)
Re:Not quite (Score:5, Interesting)
Where have you been? The federal government frowns on talking about obvious security holes because doing so makes them exploitable. As long as we pretend that the DoD and other government agencies are properly securing their networks the crackers can't get in.
And where have you been? I've been inside the federal government. I've seen them (us) use all that public knowledge and tools to deal with the security issues we've had. I've attended security conferences on the Fed's dime where information from open discussions were brought back to help deal with our vulnerabilities. The Feds have benefited greatly from open security discourse. That's not to say the Fed is effective with infosec. In recent years they've woken up to the fact that they're sorely lacking. Unfortunately, their response has been to turn the issue in to an exercise in red tape that generates a lot of effort - only a fraction of which goes to actually securing the systems involved. And that's why we get agencies that think they've secured their networks when they haven't (the more redtape exists, the more loopholes there are). It's not all a case of the Emperor's New Clothes.
Re: (Score:3, Informative)
And that's why we get agencies that think they've secured their networks when they haven't (the more redtape exists, the more loopholes there are).
The name of the House Committee escapes me, but they do yearly reports on computer security and gov't agencies regularly get Ds (up from their previous Fs).
http://csrc.nist.gov/groups/SMA/fisma/index.html [nist.gov] demonstrate its compliance with the security requirements as opposed to how well the requirements are actually implemented.
Re: (Score:3, Insightful)
The name of the House Committee escapes me, but they do yearly reports on computer security and gov't agencies regularly get Ds (up from their previous Fs).
The big question is what do these grades really mean? Do they really provide any true indication as to how effective the Government is at securing their systems? Is a 'D' all that much better than a 'F'? And what does it mean if an organization manages a 'B' (mine did)?
But at the same time, I get a feeling that it sort of does give an impression as to where things are. A 'D' just isn't all that great. But it is better than a 'F'.
My little nook of the Fed world improved over the years. Infosec took
Re: (Score:2)
The first image I got was Neo being taken over by Agent Smith. You'll like being me, Missster Anderson!
Re:DC = suits = Borg (Score:5, Funny)
Oh, I think he'll be fine.
Just don't be surprised when all of a sudden "Hail to the Chief" gets replaced with "All your base are belong to us."
His recent keynote (Score:2)
Re: (Score:2)
That's only because the dominatrix went a little too far with the riding crop.
More change for the US (Score:4, Interesting)
That Obama chap keeps making some inspired decisions - we could do with someone like him over here (UK) to bring a bit of change.
Re:More change for the US (Score:4, Funny)
Quite a few of us back here would like him to be over there as well.
Re: (Score:1)
AMEN to THAT, Brother.....
Re:More change for the US (Score:4, Insightful)
Well, if you stop looking at it as a insult to your team, and more as nothing more than a joke, it was pretty funny. I voted for Obama, and I still thought it was funny as shit.
But ... lets be realistic here, the jury is still out on intelligent and competent, I've seen nothing in particular so far to make me believe he is truly any different. Its practically impossible to tell this early on how its going to play out, you really don't know his agenda yet, just what you're supposed to think it is.
Re:More change for the US (Score:5, Insightful)
Re: (Score:2)
But there's more than just intelligence and competence needed to be a good president.
You might have missed the very first sentance of the post you replied to. It read:
I don't think the jury is still out on intelligent, at least.
I don't see why you're trying to turn that in to a debate on being a "good President."
Re: (Score:1)
Did you actually read my post or just use find/copy/paste ?
The GP is saying that obama is intelligent. I'm accepting that ok, maybe he's intelligent and competent but that those two facets of his personality are not enough to ensure that the country's people get a fair deal from his period of office.
I'm 'trying to turn that into a debate on being a good president' because the thread is focusing too closely on intelligence and comptence. What about ethics? Desire to do the right thing? Huh?
Re: (Score:2)
Did you actually read my post or just use find/copy/paste ?
I used this thing called "reading comprehension" where you pay attention to what the person wrote and you understand it. It's amazing stuff.
I'm 'trying to turn that into a debate on being a good president' because the thread is focusing too closely on intelligence and comptence. What about ethics? Desire to do the right thing? Huh?
Oh. I see. You meant to reply to BitZtream where those points were put to question. (And good points they are, IMHO).
Re: (Score:1)
No. I replied to the AC, as intended.
Feel free to correct me :D
Re: (Score:2)
Yeah, because god forbid you have someone intelligent and competent running your country.
I think it's the fact that he's not been walking on water yet that has upset some people.
Re: (Score:2)
I think it's the fact that he's not been walking on water yet that has upset some people.
It's true we're pretty tight over here in the UK but even we can stretch to a plane ticket . . .
Re: (Score:1)
Godwin'd quiiiiiick
Re: (Score:2)
The czars were killed by communists, Hitler was a fascist, fascists are the mortal enemies of socialists and most of the economic problems have been caused by fascists running the economy.
Which is why fascists are so opposed to proper education, it puts all kinds of holes in their arguments.
Re: (Score:1, Offtopic)
Fascists were mortal enemies of communists.
They were both socialists.
Get over it. It's simply a historical fact.
In fascist systems the government takes over the corporations (This happened in Nazi Germany, Mussolini's Italy and Franco's Spain) not the other way around.
You are however correct about most of the economic problems being caused by Fascists...Fascists like Barny Frank.
Re: (Score:1, Informative)
Another misguided person who thinks state control is socialism. If I redefine a fire in my house as a "house warming party" it still won't save my house. By the same token, defining everything you don't like as "socialism" won't help you understand either what socialism is, or what the defining features of fascism are. And if you cannot recognize it, you are powerless to do anything about it.
Good for the council (Score:3, Insightful)
Re: (Score:2)
We already do. They're called the NSA.
Re:Good for the council (Score:5, Interesting)
Technically, you are certainly right. The NSA are brilliant in practical cryptography etc.. However, the current security disaster we call the internet is directly linked to the NSA. If they hadn't been so determined to block strong crypto for so many years; if they had actually understood the importance of computing security to the future of their nation; if they had done their job right, many things could be better. Some sensible mechanism like IPSEC could easily be standard everywhere. A civilian standard for basic secure systems could be widely recognised. Many consumer standard systems could have much better security. Having them decide cyber security policy has been a disaster which has left the commercial infrastructure of the USA and the rest of the world needlessly insecure. Having people from the outside who actually see this has to be better.
Re: (Score:3, Funny)
I think he meant white hat hackers. ^^
Good luck with that, Jeff (Score:5, Insightful)
Re:Good luck with that, Jeff (Score:5, Interesting)
perhaps... just perhaps his background (read: _not a stuffed shirt_ ) will allow him to say "look, this is a problem and if you dont realise it you're an idiot and these are the very real consequences" hes not beholden to any voter or company and has no political baggage. if the sky is falling he can definily say it is without worrying about constituents or political parties
Re: (Score:1)
But if they don't believe him, what good does it do?
Re:Good luck with that, Jeff (Score:5, Interesting)
He may employ a similar tactic to the one I use when I have to deal with people above me in political clout on issues of a technical nature
Rather than play their game, I simply produce a highly condensed set of the major risks that would be caused if the activity I recommend does not take place, then wander round to whoever it is that's trying to hold it all up/derail it, and get them to sign at the bottom of the page (has to fit on one side of paper) saying they agree that the risk is all on their own head and that they accept it entirely be not performing the activity.
You then leave with a signature, or the support for the activity. You'd be surprised by how many people don't even try to understand the matter until their head is on the block for it. The pen is truly mightier than the sword sometimes.
If they don't sign, they lose a lot of respect for trying to dodge the matter.
Re:Good luck with that, Jeff (Score:5, Informative)
Re: (Score:1)
Now, how would know for sure this is the "Real" Dark Tangent?
Re: (Score:1)
IF what you say is true, his eyes likely glazed over because he already knew the information and warned the Bush administration multiple times with no equivocation, and even included several action plans, as this 2001 memo clearly documents: http://www.gwu.edu/~nsarchiv/NSAEBB/NSAEBB147/clarke%20memo.pdf [gwu.edu]
That very memo (one of many) may possibly even include some of what those 'smart security folks' said.
Funny how despite numerous warnings and plans of action from various intelligence organizations, the Exec
PR ploy maybe? (Score:1)
I think she just watched the 1993 SciFi movie "Demolition Man" with Sylvester Stallone and Wesley Snipes:
"Send a maniac to capture a maniac".
While I understand the gut PR logic, I fail to understand how it translates into anything but "We're thinking outside the box" political cover. I think Janet Napolitano is anxious to be seen looking open minded after the "Veterans are possible terrorists" memorandum that leaked out.
Re: (Score:3, Interesting)
Jeff is hardly a maniac, he's an expert in computer security. Far from a PR stunt, this is an effort to get somebody who knows how to secure computer systems involved in *gasp* security.
Re: (Score:1)
You are taking me far too literally.
Please enhance your calm.
Narc Tangent sells out (Score:4, Interesting)
I guess I'll give the perspective here of a very small (yet dedicated) section of the hacker community. I have retired from hacking, but the hacker community still interests me, and I feel a responsibility with some others in guiding it.
As far as myself, I was on H/P sub-boards of BBSs in the early/mid 1980s, and did use the Feature Group B (950-XXXX) codes they posted to phreak, but I put that aside because I did not begin to seriously hack (and phreak) until 1989, and I retired in 1996, the day I began working for an ISP. I personally have met many members of LoD, MoD, BoW, l0ck and so forth, have gone to many cons and 2600 meetings, have gone on trashing runs, talked to them on "confs" (conference calls), on BBSs, IRC etc.
Perhaps I'll search for more original links later, but Gweeds speech [theregister.co.uk] at H2K2 in July 2002 is what was really the clarion call of the white hat backlash. That speech was great, and expressed what I felt for a long time but hadn't heard anyone else say.
This [phiral.net] web page is dedicated to the white hat backlash as well.
Actually, the anti-whitehat movement in my mind has itself already split. There are the older people like me, Gweeds and some others who primarily want to delineate this line between hacking and the security industry. They are two separate things, in fact, they are against each other - the security community arrests and jails hackers. The idea that there can be a grey hat who is between white hat and black hat is ridiculous, you are either a hacker, or you are working for the security industry and law enforcement. I think even a lot of anti-hacker people would agree with us on that one.
Most of us are older, most of us don't hack any more, and the people in this movement or tendency that Gweeds became a spokesman for I have noticed are also in the anarchist movement. After all, Gweeds talked about anarchism a lot, I have been involved in the anarchist movement, and I know others of our mindset (some who I feel have expressed sympathetic sentiments are in the cDc).
I myself more than most of this group are in a political plain at the cross-section of anarchism and Marxism. So being one more of a dialectic bent, I think the progression of what has happened - people hacked until the mid 1990s, in the mid 1990s many hackers entered the security industry and the hacking movement died out to a large degree, then Gweeds made his speech in 2002 and the hacking movement is still moribund, but has some more self-awareness now anyhow. The rise and fall of IT with the dot-coms caused a chain of reactions. Perhaps the rise and fall of IT within FIRE (Finance, Insurance and Real Estate) will have some reaction as well.
I think what is more important is I think the expression of the "hacker ethic" has always been bullshit. Whether it was what the Mentor said, or that Phrack or 2600 talked about. 2600 has said things like "Companies should be glad we're hacking as we're showing them holes before the bad guys do" which sounds ridiculous to me from a hacker perspective, and I'm sure sounds ridiculous to law enforcement and companies being hacked. Gweeds, and some of the people who picked up the torch of what he said have refined that.
I myself think another criticism has to be made, not just of the white hats, but of the crowd which I'll call the 4chan/Anonymous crowd. I think what they're doing is a new development, is sort of in the spirit of hacking, but misses the boat in a few ways.
I remember him (Score:2)
Many moons ago, after a 2600 meeting, a bunch of us converged at a coffee shop. Dark Tangent & his friends were there. He had a laptop with a webcam attached to it(supposedly recording). Yet he raised a stink when someone else tried to take a picture of him. Do as I say, not as I do?
Re: (Score:3, Interesting)
Re: (Score:1)
Holy Crap! (Score:5, Funny)
This almost makes me believe that the government is serious about cyber-security.
Now, next, add a Constitutional Rights specialist from the EFF or ACLU and I might have an honest-to-goodness heart attack.
Re: (Score:2)
This almost makes me believe that the government is serious about cyber-security.
I'm sure they're serious about not looking like total incompetents. But a token expert probably won't have an impact on actual policy, especially when the expert tells the government it ought to butt out of an issue.
I'll be thrilled to be proven wrong on that.
Mitnick and Lamo think otherwise (Score:5, Interesting)
I wonder what the reaction in the tech community would have been had the 2 above gotten the call instead.
Listen to (h)Ackbar (Score:2)
Re: (Score:2, Funny)
He's an FBI Informant (Score:2, Interesting)
Jeff Moss' FBI Handler (Score:2, Interesting)
Re: (Score:1)
Re: (Score:1)
An oxymoron (Score:1)
OutputLogic [outputlogic.com]
Mystery Anoucement: Hacker Militia... (Score:1)
In the original 2nd amendment way, Every able-minded hacker is now in the hacker militia, it is now okay to hack computers in foreign countries... ;)
Grats DT (Score:4, Informative)
Re: (Score:2)
The question is, when they say he is working for the Feds does it mean that he is working for "the people" by helping the Feds improve security, or is he working for the Feds to push their own agenda.
I, would like to believe that DT's contributions will be in the interest of the users of technology, balancing security and openness, and showing the government how being more open about technology can actually improve security.
Only time will tell if DT can maintain the respect of the pro-hacker community and t
Set a Thief to catch a Thief (Score:1)
'nuff said.
Obama is on the road to success (Score:2)
I applaud Obama, he has the right mind frame for getting cyber threats under wraps.
Fight fire with fire....so get a hacker on board, to level the playing field.
(Just make sure to always keep him either so terrified of not cooperating by suggesting his family might be on grave danger because he is now consorting with the gov. that they need supervision, and they will provide it just as long as he keeps on the up and up...
which to me is not always the best, or keep him always interested in doing more and givi
Re: (Score:3, Informative)
Look up one-way hashing algorithm. The hash (encrypted password) does not contain all the info of the clear password, so you can't get the password out of the hash. It's a feature.
Or maybe that's not your question?
Re: (Score:1, Funny)
do we have to re-hash this again?!
Re: (Score:1, Informative)
Re: (Score:2)
Some mathematical instructions are easy to execute, but are very hard or non-deterministic to reverse. A simple example: take two (large) numbers x and y, and keep them secret. Multiply them and call the result z. Easy, right? And it is also easy to check if any two numbers are equal to the secret x and y, by c
Re:Maybe Jeff can explain this (Score:5, Funny)
Could a slashdotter post some "simple to understand code" that produces output I cannot reverse engineer?
function f(int x) { return x/x; }
Find the original value of x, when given f(x) == 1. To get you started, x is not 3853, 178470 or -8956583566.
Re: (Score:1)
Could a slashdotter post some "simple to understand code" that produces output I cannot reverse engineer?
function f(int x) { return x/x; } Find the original value of x, when given f(x) == 1. To get you started, x is not 3853, 178470 or -8956583566.
OOhhhh!!! ohhh!!! I know, I know!
It is zero!!!
hmmm.... maybe not!
Maybe it is 42!
YES! That is it! 42!
My God! You have done it!! You have discovered the Question.
Isn't reality supposed to be replaced by something far more complex now.
Hmm... mayb#@
this is a sig... Emmanuel
refinancing [erefinancing.org]
Re: (Score:2)
Trivial Case is a good teaching example... (Score:2)
function f(int x) { return x/x; }
Find the original value of x, when given f(x) == 1. To get you started, x is not 3853, 178470 or -8956583566.
This is actually, in a funny kind of way, a good illustration of an aspect of hash functions. In a non-reversible hash function, a certain amount of information gets destroyed. The above algorithm is a trivial example in which all information gets destroyed, and thus every single number is a collision.
Part of what makes a good hash function is throwing away just enough information to make it irreversible, but preserving enough to make it meaningful.
Re: (Score:2)
Exactly. You could have F(x) defined such that it returns every other bit of x (or even just the lower 1 bit of x) -- a crappy hash, to be sure, but you sure couldn't derive x from F(x). A has function is by definition a function you cannot reverse.
Re: (Score:1)
Meaning that even if you could reverse it, there are infinite possibilities for the answer.
Re: (Score:2)
Here are the rules for hashing:
Given M, easy to compute h=H(M)
Given h, hard to compute M such
Re:Maybe Jeff can explain this (Score:4, Informative)
Why? Discrete mathematics, my friend, and in particular, modular arithmetic. (You know, from fourth grade, when you'd do 11 / 3 and get "3 remainder 2" - the 'modulo' operation just gives you the 2.) Now suppose you have an algorithm:
a = x % 731
b = x % 129
Now take a number: say, x = 10,000. Easy to compute: a = 497. b = 67. Very easy to calculate. But, working backwards from a and b alone, can you determine x? Suppose a = 616 and b = 100; can you tell me what my number is? It's not quite that easy! You'll need to do a lot more math. Not too much, in this case, as this is a ridiculously simple code and the numbers are small, but a lot more than a simple integer-division-and-remainder operation.
That's not an encrypted message. (Public-key cryptography is related but different.) That's a simple one-way cryptographic hash: a secret number (your password) goes in, and a mysterious hash-value (a and b) comes out, and there's no easy way to map it back. But if you give me the password, it's easy to check that it's right. That hash value is what's in your shadow password file. Except it uses MD5 or SHA or whatever-the-latest-hotness-is.
Now, granted, there's few enough passwords that you can check them all, given enough time. (You might even precompute them all, which is why you add a little random 'salt' to each password that makes them all different. In the example above, the 'salt' could be 'add 12345 to X before hashing it'. You can store the salt next to the encrypted password - you'll need it to check the password. It only protects you from the guy who calculated all the passwords adding +12344 each time - his "rainbow table" of passwords and hashes is now useless.). That's why the shadow-password file isn't usually broadcasted to the world. You try to keep it reasonably secret: not world-readable, certainly not exposed to the Internet. But it's a whole lot better than nothing.
Re:Maybe Jeff can explain this (Score:5, Informative)
I see a number of people have answered, but none have giving a simple and straightforward explanation to what's wrong with your question.
Simply put: Unix does not store your password. If you've been told Unix stores your password encrypted somewhere, someone was glossing over the details to the point of making false statements. People can't reverse the process of decrypting your password because your password isn't stored there to begin with.
If you want to know what is actually stored, follow the previous advice about looking up hashing algorithms. Quick a dirty answer: when you first type in your password, a hashing algorithm is run over it and a hash code is produced, which is stored. When it prompts anyone for your password, it doesn't know the correct answer, but whatever answer anyone gives, it runs through the same hashing algorithm and sees if it produces the same result. The odds of two different strings producing the same hash result vary with the algorithm but it can be something like 1 in 2^160.
But the short answer is, your password cannot be decrypted because it wasn't encrypted and stored to begin with. There's nothing to decrypt.
Re: (Score:1)
Re: (Score:1)
If you've been told Unix stores your password encrypted somewhere, someone was glossing over the details to the point of making false statements. People can't reverse the process of decrypting your password because your password isn't stored there to begin with.
So you're saying that if your password was loosely related to a dictionary word, and if a hacker gained root access to that server, then you would be completely unconcerned about having used the same password on other servers? You would sleep well at night, with complete confidence that the text spit out by "John the Ripper" is going to be some totally unrelated text string?
In your reply, please include the IP address of your server. ;-)
-Gonz
Re: (Score:2)
No, he's not saying that at all. Go read it again.
Basically John the Ripper guesses the password and then you're free to try that password against other machines. Obviously if someone's used that password on the other machines you will get in using that password. That has nothing to do with whether the original password can be retrieved from the hash by reversing the hashing algorithm or "decrypting" the hash to get the original password.
Also, the text that John the Ripper spits out could actually be dif
Re: (Score:2)
Very good explanation of how one way hash passwords work... I always emphasize that the passwords are NOT STORED ANYWHERE!
What I find much more distressing is how many systems use more complex systems to store passwords. I could implement a reasonably good one-way hash password system in nearly any programming language in very few lines of code and have a very low risk of the user's passwords being compromised. But many systems still insist on keeping that password stored in a reversible format, even thou
Re: (Score:3, Insightful)
The password is not encrypted, it is cryptographically hashed (encrpytion is two-way, hashing is one-way). A hash function transforms an arbitrary length input into a fixed length output, so there is no inverse function in the mathematical sense: a single hash value has an infinite number of inputs corresponding to it. Finding a value that produces a given hash is extremely hard: a good hash function will not have any way of computing such a value more effective than brute force (e.g. you try all possible i
Re: (Score:2)
Re: (Score:3, Informative)
http://en.wikipedia.org/wiki/One-way_function [wikipedia.org]
Re:Maybe Jeff can explain this (Score:5, Informative)
If a known algorithm produces the encrypted password, why can't that algorithm be "reversed" to produce the original password in the first place?
It has been. But it doesn't really do you any good. The actual password is lost. The reverse of a hash produces infinite solutions. (In the same way the reverse of modulus division produces infinite solutions).
But those solutions are all 'collisions' and they could all be used interchangeably with the original password. So getting any solution is almost as good as getting the original.
Even in open source systems, encrypted passwords are not easy to crack. Why?
Because pretty much all modern encryption is based on the idea that its VERY easy to multiply two stupidly large prime numbers to find an even stupidly larger number. Multiple two 1000 bit prime number numbers and get a 2000 bit non-prime as a result.
But it takes years upon years of processor time to take that stupidly larger number, and factor it back into the original stupidly large primes.
Could a slashdotter post some "simple to understand code" that produces output I cannot reverse engineer?
z = primex * primey;
suppose z = 377, how do you find the factors: 13 and 29?
Now, for encryption, z is thousands of digits instead of 3.
Algorithms that solve this exist, they just won't finish running until after you've died of old age.
Re: (Score:2)
Re: (Score:2)
Anybody willing to make such a database? :-D
We're talking stupidly big numbers, not your garden variety big numbers. To paraphrase the Hitchhiker's Guide to the Galaxy:
"Its big. Really big. You just won't believe how vastly hugely mindbogglingly big it is. I mean you may think it's a long way down the road to the chemist, but that's just peanuts to these."
Using very rough numbers, at around 500 digits, around 99.9% of integers are composite, meaning around 0.1% are prime. (I'll leave proof of this as an exe
Re: (Score:2)
I can't attest to the accuracy here... but mod this parent up for putting really large numbers into perspective quite well.
People throw large numbers, or very small numbers, around so often these days with no understanding how large or how small they really are. Like that recent discussion of the laser based technique used to improve incandescent bulb efficiency using the equivalent of the entire countries power production for a crazy small amount of time. The numbers seem pretty impressive until you real
Re:Maybe Jeff can explain this (Score:5, Informative)
Could a slashdotter post some "simple to understand code" that produces output I cannot reverse engineer?
While I *love* the first respondent's answer, and giggled like an idiot when I read it, perhaps this will be more a more useful example for understanding how it works.
The modulus operator in arithmetic returns the remainder after integer division. It is commonly noted "x % y", "x mod y", "mod( x, y )", or similar.
So: ...
3 mod 2 = 1
4 mod 3 = 1
4 mod 2 = 0
5 mod 2 = 1
5 mod 3 = 2
5 mod 4 = 1
Now, suppose a password structure "x:y" -- you are required to enter your password as two digits, separated by a colon (not normal, but just suppose).
You could enter, as your password, "4:3", and the system could store as your password hash "1" -- the result of "4 mod 3". Then, when you attempt to log in next time, if you submit "4:3", the system would take the modulus and check the result, "1", against its internal table of password hashes and allow you in.
Now, suppose you get the table of hashes, and see:
joeSmith: 1
joeSmith has the password hash "1". Is his actual password "3:2", "4:3", "5:2", or "5:4"? Since the modulus of all those pairs is "1", the correct answer cannot be determined from the output alone. Modulus is what is called a "non-reversible function." The output of the modulus function contains less information than the input, so it cannot be reversed.
In this example it is trivial, however, to generate another password combination that results in the same hash. For example, "6:5" also equates to the hash "1". This is called a collision between "6:5" and "4:3". The attacker does not have to know joeSmith's actual password, as long as he can supply input that results in the correct hash. That leads to the next step in identity verification systems: ensuring that it is not possible for a reasonably funded attacker to forge a document which collides with the actual document (or password in this case, which is a special kind of document).
That is a much harder topic.
Re: (Score:2)
well lets see
1 salting: a number is added into the mix to jig the results (and this may not be a known number for a particular setup)
2 the password function itself is designed to be slow and the encoder works one way (no decode)
3 anybody that is running with passwords in the /etc/security/passwd is a complete moron (hint shadow is the correct name of the file) http://www.cyberciti.biz/faq/understanding-etcshadow-file/ [cyberciti.biz]
Re: (Score:2)
The encryption is a one-way street. One (simple, understandable and entirely useless for security) example of such an "encryption" function would be to simply count the letters typed.
If somebody's password is "foo", it would be stored as "3". Given "3", it's impossible to tell that the password was "foo".
When I want to log in, I type "foo", the login program converts what I typed into "3", and compares that value to what it has stored. Also "3". Access granted.
If I had typed "fluff", that would have bee
And "Spot the Fed" just got a lot more interesting (Score:3, Funny)
I wonder how the rules of "Spot The Fed" will change now that DEFCON is somewhat run by a fed????