Friam

Forum hacked

Classic

List

Threaded

48 messages Options

123

cody dooderson

Re: Peacocks, Clowns and now Squirrels

How can you be sure that it's the same peacock in Nambe?

Cody Smith

On Tue, Nov 19, 2013 at 1:04 PM, Steve Smith <[hidden email]> wrote:

Ray -

A similar flock has been free-ranging the Albuquerque valley area near Broadway and Montano.

I don't think I ever make it down that way. I'm always heartened to see a little "wild" in the city.

Some friends of mine whose property is roamed got married some years ago and they had a wedding dinner featuring roast peacock. It's a little greasy, like duck, and tastes somewhere between duck and goose.

And free-range, if not (almost surely) organic to boot! I've always wondered what the rules about "harvesting" feral animals might be... especially in a city. Is that NM Fish&Game rules or Bernalillo country Animal Control purview? My Appalachy ancestors loved their squirrel and possum (not feral but verminish). I assume that the last generation's homeless (aka Hobos) fed off of anything they could catch (pigeons, rats, ???) with gusto while today I suspect most of us would starve to death while pigeons shat upon us and rats tugged at our leather shoes/belts while we slept.

When I first moved into Corrales, there were several flocks of guinea hens that migrated north-south twice-daily across the generally east-west properties. Those were the remnant of a flock released when a local farmer failed to make any money raising them.

We had 3 (remaining of 4 after an Owl snagged one) Geese and 8 chickens when we gave them up to move to Berkeley in 2005. I was amazed that both, raised from chicks/goslings were happy to remain within our property boundaries (how do they recognize a barbed wire fence as a boundary?) as a matter of course. Maybe they recognized the territory of our dog (who also for the most part respected the same boundaries) as being (mostly) coyote free? I suppose that Pea and Guinea fowl are probably much closer to "wild" and of course water birds are going to stay close/return to their water.

I would expect that there has not been sufficient time for real genetic variations to develop in any of these isolated communities.

If I'm right about the timeline of the Nambe Peacocks, it seems like an isolated and relatively small community of order 100 generations with no (or few?) introductions and no (or little) human intervention (except as patrons)?

- Steve

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

Steve Smith

Re: Peacocks, Clowns and now Squirrels

On 11/19/13 5:23 PM, cody dooderson wrote:
> How can you be sure that it's the same peacock in Nambe?
The same way I can be sure that Clowns and Squirrels are Evil... I just
know!

Look closely next time and you will see that he's giving you the evil eye.

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

Arlo Barnes

Re: [EXTERNAL] Forum hacked

In reply to this post by Steve Smith

CryptoCards

Anything like a SecurID?

From Kevin Mitnick's autobiography excerpted on Google Books:

-Arlo James Barnes

Marcus G. Daniels

Re: [EXTERNAL] Forum hacked

On 12/18/13, 11:13 AM, Arlo Barnes wrote:

CryptoCards

Anything like a SecurID?

Organizations that use SecurID may prepend or append a password to a token provided by a device. The token changes every few seconds.

CryptoCards (the brand) are different in that the password is set when the device is issued.
That way there is less opportunity to intercept the password part. One plus of SecurID is that they are small enough to carry on a keyring. CryptoCards are like thick credit cards -- too thick to put in a wallet, really.

Marcus

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

Owen Densmore

Re: [EXTERNAL] Forum hacked

Administrator

In reply to this post by Parks, Raymond

[a bit late, but...] These are *great* sites, thanks! Fascinating read about becoming a cracker-for-a-day! It might be worth trying that for ourselves just to understand what we're up against. I just had my twitter account apparently hacked so got pretty interested in this.

Bruce Schneier's advice:

https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html

So if you want your password to be hard to guess, you should choose something that this process will miss. My advice is to take a sentence and turn it into a password. Something like "This little piggy went to market" might become "tlpWENT2m". That nine-character password won't be in anyone's dictionary. Of course, don't use this one, because I've written about it. Choose your own sentence -- something personal.

I thought about this independently (or remembered it!) and started thinking about sentences and taking the first letter of each word: Star Spangled Banner: oskysbtdel .. then adding other stuff that is unique per site and fulfills n-Caps, n-Specials, etc silly rules. Since many hacks are dictionary based (this means you XKCD), this avoids words completely. Pub tunes and chanties are great for this! Or favorite poems.

This is still somewhat low on the PW Hygiene scale, I bet, but still .. I'd like to not have a PW mgr be the only one knowing the unique passwords, so wanted a formula of my own, one I can remember for every site.

So questions:

- How many of us are now using completely random pw's generated by one of the pw managers?

- Is sentence based stunts close to "random"?

- Wouldn't unicode help here? 16 bit characters would definitely bother the crackers, right?

And we should remember, the massive hacks are only for sites that have gotten an encrypted pw file and know a lot about it like what crypto it uses etc. The high order bit here is quick notification by compromised sites.

-- Owen

On Mon, Nov 18, 2013 at 11:28 AM, Parks, Raymond <[hidden email]> wrote:

WRT password cracking - Dan Goodin has a good series of articles on password cracking at Ars Technica.

http://arstechnica.com/security/2013/03/how-i-became-a-password-cracker/
http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/
http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/

TL;DR - Current GPU-based password cracking using 20-million word dictionaries make truly random passwords below 14 characters and nearl all pass-phrases susceptible to cracking in a relatively short time.

On a related subject, roughly 75% of websites store passwords as nothing more complicated than simple, unsalted MD5 hashes. This is almost as easy to break as as NTLM.

Salt makes the initial crack more difficult, but if the same salt is used for all hashes, then subsequent cracks ignore it.

WRT the use of PII - it's sold on various markets, correlated in a "big data" manner with other exposures, and, if enough information is available and the person's credit score is high enough, is used for credit attacks. In some cases, if banking information is correlated, the collection is used for banking attacks. If there is poor correlation but an email or FQDN is in the information, then the data may be used as a target list.

Ray Parks
Consilient Heuristician/IDART Program Manager
V: <a href="tel:505-844-4024" value="+15058444024" target="_blank">505-844-4024 M: <a href="tel:505-238-9359" value="+15052389359" target="_blank">505-238-9359 P: <a href="tel:505-951-6084" value="+15059516084" target="_blank">505-951-6084
NIPR: [hidden email]
SIPR: [hidden email] (send NIPR reminder)
JWICS: [hidden email] (send NIPR reminder)

On Nov 18, 2013, at 10:12 AM, Owen Densmore wrote:

A forum I belong to has been hacked, including personal info as well as passwords.

How do they use this information?

I presume they try the hash function on all combinations of possible passwords. (Naturally optimized for faster convergence). They see a match, i.e. a letter combination resulting in the given hash of the password.

If they crack one password, does that make cracking the rest any easier?

And does "salt" simply increase the difficulty, and indeed can it be deduced, as above, by cracking a single password?

.. or is it all quite different from this!

-- Owen

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

Marcus G. Daniels

Re: [EXTERNAL] Forum hacked

TL;DR - Current GPU-based password cracking using 20-million word dictionaries make truly random passwords below 14 characters and nearl all pass-phrases susceptible to cracking in a relatively short time.

There are an increasing variety of cryptographic algorithms being developed under the auspices of altcoin cryptocurrency mining. Hardware that can do 1 trillion hashes a second for just a few hundred watts and less than $1000. There’s hardware SSL capabilities on systems like Sparc T4s (for secure webservers). And then there’s OpenCL to FPGAs for special cases. Pretty much hopeless I think.

Marcus

Owen Densmore

Re: [EXTERNAL] Forum hacked

Administrator

In reply to this post by Owen Densmore

Great info, thanks! Do you recall how many logins you have? And how did you use 1P to retroactively change/evolve to their system? And for "apps" I presume you use copy/paste?

Boy wouldn't it be great if they invented a way to *change* the passwords that they manage easily?

-- Owen

On Thu, Jan 29, 2015 at 9:40 AM, Barry MacKichan <[hidden email]> wrote:

For what it's worth, here are my answers:
1. I use 1Password on the Mac, Windows, and IOS, which is currently all the computers I use. The passwords it generates for me are currently 20 characters including upper and lower case, digits, punctuation, and symbols. I never (well, hardly ever) have to enter one by hand, so I don't mind using ambiguous characters (1, l, I, 0, O). They are not limited to 20 characters, but that seemed enough to me. The only problem is sites that put a low limit on the number of characters in a password (!!!)
2. The character distribution in the 'sentence-based stunts' is probably like the character distribution in English -- the etaoinshrdlu distribution. Since some characters may be more or less likely as word starters, the entropy might be even less than in English, so I don't consider it random.
3. I've considered putting some unicode characters in my 1Password master password, but I haven't checked to see that I can enter them in a password field on all the platforms I use. I would expect that unicode in a password field is represented as UTF8, so that making a single character unicode would add only one, maybe two, bytes to the password, rather than doubling the length. Making some of the characters ≥ 128 and < 256 would change the number of combinations that need to be checked from 128^n to 256^n; i.e., it would multiply it by 2^n, but this could also be done by adding a few more characters. Using UTF8 unicode would also put in high bytes.

The XKCD method is not bad. The fact that the component parts are words is not fatal. With the DICE method, you pick words at random from a dictionary of about 7000 words. Brute force cracking a five-word password requires 7000^5 tries, and then you can change the capitalization, use a variety of symbols between the words, etc. to increase the number. If someone tries to crack my 1Password vault, they don't have a hashed password, so they need to feed each password to 1Password, which uses PBKDF to slow down the process. With current hardware the time to crack my vault is over 100,000 years; I forget the exact number. When hardware improves, I'll add another word to the password.

For passwords I must remember (logon, Apple ID, dropbox) I use a program written by a friend which produces 11-character pronounceable pseudo-words. Dropbox has a shorter password so I can get to the 1Password vault it contains in the case of disaster.

—Barry

On 28 Jan 2015, at 21:25, Owen Densmore wrote:

So questions:
- How many of us are now using completely random pw's generated by one of the pw managers?
- Is sentence based stunts close to "random"?
- Wouldn't unicode help here? 16 bit characters would definitely bother the crackers, right?

============================================================
FRIAM Applied Complexity Group listserv
Meets Fridays 9a-11:30 at cafe at St. John's College
to unsubscribe http://redfish.com/mailman/listinfo/friam_redfish.com

Arlo Barnes

Re: [EXTERNAL] Forum hacked

What would really help is websites publishing a file that can be found in an automated way (perhaps, like robots.txt, it is standardly named at the root) that defines what areas of the site require what type of login (for example, it could say that forums.foobricks.ninja requires an OpenID, and then a browser can, if the user wants it that way, automatically log in using a preferred OpenID registered with the browser; and if the file says that demos.foobricks.ninja needs a SceneID, then the browser can log in with that). This would aid multiple-login schemes, since the user would not have to deal with the confounding detail of treating each site like an unrelated login system. As usual, there are attacks based on this that would have to be defended against.
Part of this file could give the restrictions on the password (of course, the less the better, for the most part) - perhaps as a regex. But it is important that it be machine-readable, this will help a password keeper application to generate better random passwords, and be able to check whether a user-saved password would be valid as often as it wants, offline.
I think XML would be ideal for such a file, but it could be in any standard format.

Of course, for sites with poor security, this will help rather than ultimately hinder the attackers, but only because of security through obscurity.

-Arlo James Barnes

123