One of Brinworld's uglier moments, no rights for immies

2002-10-22 Thread Major Variola (ret)
So two illegals are going back because they were in a white van near a pay phone. They're fortunate, they only got the 12gauge in the face and the asphalt facial; in a month it'll be a cruise missile first, forensics later. Mr. Godsniper, call us back. We couldn't trace^H^H^H^H^H hear you. The

Re: Auditing Source Code for Backdoors

2002-10-22 Thread Mike Rosing
On Wed, 31 Dec 1969, Bill Frantz wrote: I have been asked to audit some source code to see if the programmer inserted a backdoor. (The code processes input from general users, and has access to the bits that control the privilege levels of those users, so backdoors are quite possible.) The

Re: Intel Security processor + a question

2002-10-22 Thread Major Variola (ret)
At 05:13 PM 10/21/02 -0400, Tyler Durden wrote: So I guess the follow on question is: Even if you can look at the code of a RNG...how easy is it to determine if its output is usefully random, or are there certain Diffie-approved RNGs that should always be there, and if not something's up? Start

anonymous remailers

2002-10-22 Thread Shawn K. Quinn
If one has set up a new anonymous remailer, where is the best place to get the word out? Here or somewhere else? -- Shawn K. Quinn

Re: Palladium -- trivially weak in hw but secure in software?? (Re: palladium presentation - anyone going?)

2002-10-22 Thread Tal Garfinkel
Software-based attacks are redistributable. Once I write a program that hacks a computer, I can give that program to anyone to use. I can even give it to everyone, and then anyone could use it. The expertise necessary can be abstracted away into a program even my mother could use.

Palladium

2002-10-22 Thread Peter Clay
I've been trying to figure out whether the following attack will be feasible in a Pd system, and what would have to be incorporated to prevent against it. Alice runs trusted application T on her computer. This is some sort of media application, which acts on encoded data streamed over the

Re: palladium presentation - anyone going?

2002-10-22 Thread Adam Back
On Sun, Oct 20, 2002 at 10:38:35PM -0400, Arnold G. Reinhold wrote: There may be a hole somewhere, but Microsoft is trying hard to get it right and Brian seemed quite competent. It doesn't sound breakable in pure software for the user, so this forces the user to use some hardware hacking. They

Re: palladium presentation - anyone going?

2002-10-22 Thread Arnold G. Reinhold
At 10:52 PM +0100 10/21/02, Adam Back wrote: On Sun, Oct 20, 2002 at 10:38:35PM -0400, Arnold G. Reinhold wrote: There may be a hole somewhere, but Microsoft is trying hard to get it right and Brian seemed quite competent. It doesn't sound breakable in pure software for the user, so this

Palladium -- trivially weak in hw but secure in software?? (Re: palladium presentation - anyone going?)

2002-10-22 Thread Adam Back
Remote attestation does indeed require Palladium to be secure against the local user. However my point is while they seem to have done a good job of providing software security for the remote attestation function, it seems at this point that hardware security is laughable. So they disclaim in

Re: Palladium -- trivially weak in hw but secure in software?? (Re: palladium presentation - anyone going?)

2002-10-22 Thread Rick Wash
On Tue, Oct 22, 2002 at 04:52:16PM +0100, Adam Back wrote: So they disclaim in the talk announce that Palladium is not intended to be secure against hardware attacks: | Palladium is not designed to provide defenses against | hardware-based attacks that originate from someone in control of