Re: New Protection for 802.11

2002-11-07 Thread Nelson Minar
Reading the Wifi report, it seems their customers stampeded them and demanded that the security hole be fixed, fixed a damned lot sooner than they intended to fix it. Which is sort of a shame, in a way. 802.11b has no pretense of media layer security. I've been thinking of that as an opportunity

Re: Palladium -- trivially weak in hw but secure in software?? (Re: palladium presentation - anyone going?)

2002-10-22 Thread Nelson Minar
Adam Back says: Providing almost no hardware defenses while going to extra-ordinary efforts to provide top notch software defenses doesn't make sense if the machine owner is a threat. So maybe the Palladium folks really mean it when they say the purpose of Palladium is not to enable DRM? I doubt

Re: unforgeable optical tokens?

2002-09-20 Thread Nelson Minar
I see several applications where these tokens could be really useful where biometric methods are completely useless. Main advantage seems to be that these tokens are extremely cheap. There are heaps of applications where these tokens seem to be just perfect. For a bit of perspective, this work

Re: Thanks, Lucky, for helping to kill gnutella

2002-08-10 Thread Nelson Minar
Wow, this conversation has been fun. Thanks, Anonymous Aarg, for taking up the unpopular side of the debate. I'll spare any question about motives. I think most of us would agree that having a trusted computing environment makes some interesting things possible. Smartcards, afterall, are more or

Re: crypto question

2002-03-21 Thread Nelson Minar
Question. Is it possible to have code that contains a private encryption key safely? As a practical matter, yes and no. Practically no, because any way you hide the encryption key could be reverse engineered. Practically yes, because if you work at it you can make the key hard enough to reverse

Re: CFP: PKI research workshop

2001-12-26 Thread Nelson Minar
HTTPS SSL does not use PKI. SSL at best has this weird system in which Verisign has somehow managed to charge web sites a toll for the use of SSL even though for the most part the certificates assure the users of nothing whatsoever. To be fair, Verisign *is* a PKI. It's not the one a lot of us

Yet more stego scare in the New York Times

2001-10-30 Thread Nelson Minar
Another sensationalist article in the NYT about the pervasiveness of steganography, with yet another lack of any evaluatable information. http://www.nytimes.com/2001/10/30/science/physical/30STEG.html?pagewanted=print In summary, evidence for stego in this article is: Some unnamed French