 |
|
|
|
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Fa3ien <fab### [at] yourshoes skynetbe> wrote:
> Changing a password is something you can do in a few seconds, and is barely
> noticeable.
Not if you have to boot into single-user mode to do it.
> Rebooting on a CD is a slightly more noticeable operation.
As well as rebooting into single-user mode.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> Well, if you can reinstall linux in the computer, then that's basically
> the same level of insecurity as being able to reset the root password.
Um, no. That's what I'm saying.
> How is the OS going to stop someone from booting from a specially created
> CD which allows you to read the contents of the HDs regardless of what
> the ownership flags of the files are?
Encryption techniques.
> The only way to reduce that risk is to encrypt the files, but in that
> case then even being able to reset the root password is not going to help
> in decrypting them.
Ding ding ding! Yes, that's what I'm saying.
> Accounts are of no use if the malicious person has direct access to
> the computer.
Depends what maliciousness they intend.
>> Again, you're making a boolean description of security. The fact that
>> you can destroy the computer doesn't mean it's "insecure".
>
> Then we disagree.
More specifically, there are levels of security above the level of being
able to destroy the computer.
> If your files are encrypted then the root password is of no use to
> decrypt them. You can only do the same thing as you could do with the
> boot CD: Destroy or modify the files.
Ding ding ding! Give that man a cigar.
> What does this have to do with you being able to reset the root password?
That there are systems more secure than those which can have their root
password reset without losing any data. That security isn't a boolean
property.
> Being able to reset the root password and being able to boot from a CD
> are basically the same thing.
I disagree. If I can reset the root password on the machine on my
desktop, then I can change the password on your account, log in as you,
and access the remote resources that are supposed to be protected by
that account.
--
Darren New / San Diego, CA, USA (PST)
Remember the good old days, when we
used to complain about cryptography
being export-restricted?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
> Unless your particular encryption system works transparently to the user
> for each account automatically (like it does in Win XP).
First, you can't force a reset of a password on XP without already
having the root password. I.e., an admin can reset someone else's
password, but you have to already be logged in as admin. You can't do it
from a regular boot CD.
Second, resetting the password loses the encryption key, so it doesn't
get you encrypted files either.
However, you might be able to change the password on someone's account
and then use that account to get remote access to drive shares. I'm
pretty sure they closed this hole in XP, but I think it was there in 2000.
Certainly on Linux, as root, you can do things with NFS mounts that get
you bypassing security there.
--
Darren New / San Diego, CA, USA (PST)
Remember the good old days, when we
used to complain about cryptography
being export-restricted?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> Warp wrote:
>> People who don't know how to use linux shouldn't use it, IMO.
>
> Well, *that* would lead to widespread adoption, wouldn't it?
Yes, if that statement were taken literally there'd be nobody using
Linux anywhere within about 40 years. I've recently installed a linux
flavour on one of my computers because I'd quite like to learn more
about it. Are you recommending that I give up? ;-)
>> Just a couple of days ago someone in irc commented that he needed
>> to reinstall linux because he had forgotten the root password. Well,
>> someone who knew better saved him some hours of useless work.
>
> People who don't know the security holes in Linux shouldn't forget their
> root password? >8)
I quite agree. Somebody absent-minded enough to forget their root
password would probably have even more difficulty with the solution. I
myself wouldn't know what to do, but I can't imagine how I'd forget my
password. Unless a piano fell on me or something.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New <dne### [at] sanrrcom> wrote:
> > The only way to reduce that risk is to encrypt the files, but in that
> > case then even being able to reset the root password is not going to help
> > in decrypting them.
> Ding ding ding! Yes, that's what I'm saying.
No, it isn't. You hinted in your first post that being able to reset
the root password is a security hole.
What I'm saying is that it's no more of a security hole than being able
to boot from a CD. The only protection against these two things is to
encrypt the files (or not to let anyone access your computer directly,
only remotely).
Besides, linux can probably be configured to disallow booting in
single-user mode (which is the only way to reset the root password
without having to resort to more drastical measures), if you really
want that.
> > Being able to reset the root password and being able to boot from a CD
> > are basically the same thing.
> I disagree. If I can reset the root password on the machine on my
> desktop, then I can change the password on your account, log in as you,
> and access the remote resources that are supposed to be protected by
> that account.
You can do that with a proper boot CD too. So there's no difference.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New <dne### [at] sanrrcom> wrote:
> First, you can't force a reset of a password on XP without already
> having the root password.
Of course you can. You just need the proper boot CD.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> First, you can't force a reset of a password on XP without already
>> having the root password.
>
> Of course you can. You just need the proper boot CD.
Where do you get this "proper boot CD" form btw? Or do you mean write one
yourself to modify certain bytes on the harddrive so that the password is
reset to something you know? Is that even possible in practise?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott <sco### [at] laptopcom> wrote:
> Where do you get this "proper boot CD" form btw?
Almost any linux installer CD will do.
> Or do you mean write one
> yourself to modify certain bytes on the harddrive so that the password is
> reset to something you know? Is that even possible in practise?
What do you think Windows does if there's no root password (because it
has been removed using the boot CD)?
Speaking of disk encryption, I just saw this:
http://www.phoronix.com/scan.php?page=article&item=873&num=1
Not that it's really relevant to the discussion, but I found it fitting. :)
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Where do you get this "proper boot CD" form btw?
>
> Almost any linux installer CD will do.
What, to remove the admin password of a WinXP installation? Would be useful
to know how to do that occasionally.
> Speaking of disk encryption, I just saw this:
> http://www.phoronix.com/scan.php?page=article&item=873&num=1
>
> Not that it's really relevant to the discussion, but I found it fitting.
> :)
Interesting. I also always wondered what would happen if you were involved
with some illegal activity (even just piracy) and got your PC taken away by
the police. If it was encrypted then presumably they would try to force you
to tell them how to decrypt it - what if you refused? I guess it depends on
the country.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
>>> Where do you get this "proper boot CD" form btw?
>>
>> Almost any linux installer CD will do.
>
> What, to remove the admin password of a WinXP installation? Would be
> useful to know how to do that occasionally.
>
Something like BartPE would let you do the same with a Windows Live CD.
If you like Linux, Knoppix STD comes with password tools.
>> Speaking of disk encryption, I just saw this:
>> http://www.phoronix.com/scan.php?page=article&item=873&num=1
>>
>> Not that it's really relevant to the discussion, but I found it
>> fitting. :)
>
> Interesting. I also always wondered what would happen if you were
> involved with some illegal activity (even just piracy) and got your PC
> taken away by the police. If it was encrypted then presumably they
> would try to force you to tell them how to decrypt it - what if you
> refused? I guess it depends on the country.
>
>
Law enforcement can get a subpoena or warrant for keys to a safe. I
suspect that in many countries they would treat a password the same.
Failing to turn over the password might have worse consequences, since a
contempt of court charge would just leave someone sitting in jail until
they turned over the password.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Sabrina Kilian <"ykgp at vtSPAM.edu"> wrote:
> Law enforcement can get a subpoena or warrant for keys to a safe. I
> suspect that in many countries they would treat a password the same.
> Failing to turn over the password might have worse consequences, since a
> contempt of court charge would just leave someone sitting in jail until
> they turned over the password.
If the suspect simply claims that he forgot it, how can they prove he
didn't?
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
>>> Where do you get this "proper boot CD" form btw?
>>
>> Almost any linux installer CD will do.
>
> What, to remove the admin password of a WinXP installation? Would be
> useful to know how to do that occasionally.
http://home.eunet.no/~pnordahl/ntpasswd/index.html
(You can use his ready made boot CD/FD or you can
use his chntpw with Knopix.)
--
Tor Olav
http://subcube.com
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Sabrina Kilian wrote:
> Something like BartPE would let you do the same with a Windows Live CD.
Except you'd wind up changing the password on the hive that came from
the CD, not the hive on the hard drive.
--
Darren New / San Diego, CA, USA (PST)
Remember the good old days, when we
used to complain about cryptography
being export-restricted?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Wed, 10 Oct 2007 05:35:20 -0400, Warp wrote:
> Jim Henderson <nos### [at] nospamcom> wrote:
>> (fdisk /mbr should get rid of Grub from the MBR, BTW)
>
> People who don't know how to use linux shouldn't use it, IMO.
That doesn't really help the userbase grow, though.
> Just a couple of days ago someone in irc commented that he needed
> to reinstall linux because he had forgotten the root password. Well,
> someone who knew better saved him some hours of useless work.
And you can bet that he won't forget the solution next time around. At
least he had the sense to ask for help before wiping the system and
starting over.
That's how a lot of people learn - by making mistakes. Nothing wrong
with that - it's not the most efficient way to learn, but it tends to be
retained better than trying to learn from other people's experiences,
books, etc.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Wed, 10 Oct 2007 14:43:55 -0400, Warp wrote:
> Linux developers and advocates couldn't care less if someone else uses
> linux. They are making linux for *themselves*, not for everybody.
Um, that's something Linus has *personally* stated in several interviews.
But that doesn't extend to even a majority of the developers - of course,
if you have some numbers to back up the statement that the majority do
feel that way, I'd love to see those numbers.
When I see major kernel developers like Greg Kroah-Hartmann offering to
write drivers for hardware for free, that tells me that he's looking to
increase adoption, and he's certainly not alone. Look at the folks over
at freedesktop.org who have been doing studies on interface development
and whatnot. You don't do that type of research because it's a hobby.
That particular statement that you're quoting may have been true 5 years
ago, but I doubt it's true today.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Wed, 10 Oct 2007 20:19:23 -0400, Warp wrote:
> It would, quite naturally, not make too much sense that if you forgot
> the root password, you would be completely stuck and the computer would
> become completely unmaintainable. There must, of course, be some way of
> resetting the root password (given that you have direct physical access
> to the computer). It's just common sense.
At least the initial release of Windows Server 2003, if you lost the
admin password for the system and b0rked the domain, you couldn't get
in. You *had* to reformat and start over - had it happen to me, with
Microsoft consultants on-site helping me.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Wed, 10 Oct 2007 20:19:23 -0400, Warp wrote:
>> > It doesn't matter which OS you are using.
>
>> This would be factually incorrect also, unless you believe ...
>
> You mean some OS can stop someone from booting from a CD and wiping
> the HDs, for example?
My brand-new HP Pavillion has settings in the hardware that do just that,
in fact. Password protect the bios and disallow booting from any device
other than the hard drive.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Thu, 11 Oct 2007 18:01:11 -0700, Darren New wrote:
> If I can reset the root password on the machine on my desktop, then I
> can change the password on your account, log in as you,
Arguably, if you're talking specifically "root", you're talking POSIX
(right? *nix at least), in which case it's unnecessary to change the
password on the user's account, just su user....
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sat, 13 Oct 2007 05:56:07 +0200, Darren New <dne### [at] sanrrcom> wrote:
> Sabrina Kilian wrote:
>> Something like BartPE would let you do the same with a Windows Live CD.
>
> Except you'd wind up changing the password on the hive that came from
> the CD, not the hive on the hard drive.
Any half-decent registry tool lets you load a different registry hive.
Trust me, a Windows XP password can easily be reset from a boot-CD; I have
done it many times.
--
FE
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Jim Henderson <nos### [at] nospamcom> wrote:
> > You mean some OS can stop someone from booting from a CD and wiping
> > the HDs, for example?
> My brand-new HP Pavillion has settings in the hardware that do just that,
The hardware is not the OS.
> in fact. Password protect the bios and disallow booting from any device
> other than the hard drive.
Bios settings can be reset, and hard drives can be physically transferred
to other computers.
Bios passwords are only a deterrent. They are not secure.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> Bios settings can be reset, and hard drives can be physically transferred
> to other computers.
Supposedly, the new Vista full-drive encryption prevents this, storing
the password somewhere on the motherboard or some such, even if you
chose not to have a USB key.
--
Darren New / San Diego, CA, USA (PST)
Remember the good old days, when we
used to complain about cryptography
being export-restricted?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sat, 13 Oct 2007 06:50:16 -0400, Warp wrote:
> Jim Henderson <nos### [at] nospamcom> wrote:
>> > You mean some OS can stop someone from booting from a CD and wiping
>> > the HDs, for example?
>
>> My brand-new HP Pavillion has settings in the hardware that do just
>> that,
>
> The hardware is not the OS.
No, really? In the end, I don't care if it's the OS or the hardware, if
I can restrict the usage in a corporate environment in that way, I don't
particularly care which it is.
The end result is what *I'm* looking at.
>> in fact. Password protect the bios and disallow booting from any
>> device other than the hard drive.
>
> Bios settings can be reset, and hard drives can be physically
> transferred
> to other computers.
Sure, so what you do is lock it in a room where only authorized users can
access it, bolt it to the desk, and lock the case. Sure, they *could*
come in with a sawzall and cut the lock, bolts, or case open, but they're
likely to be seen.
Computer security ain't just about the OS, it's about the entire system.
If you try to practice security using *only* the OS, you *will* fail.
> Bios passwords are only a deterrent. They are not secure.
Again, depends on the level of physical access to the system.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sat, 13 Oct 2007 09:09:35 -0700, Darren New wrote:
> Supposedly, the new Vista full-drive encryption prevents this, storing
> the password somewhere on the motherboard or some such, even if you
> chose not to have a USB key.
I'd heard that - there are some systems that implement this at the
hardware level as well - I think my Thinkpad has an option like that that
keys the drive to the hardware.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Jim Henderson <nos### [at] nospamcom> wrote:
> Sure, so what you do is lock it in a room where only authorized users can
> access it,
Optimally only the person who knows the root password has direct access
to the computer.
In which case it doesn't really matter if the root password can be
reset locally or not.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sat, 13 Oct 2007 17:23:37 -0400, Warp wrote:
> Jim Henderson <nos### [at] nospamcom> wrote:
>> Sure, so what you do is lock it in a room where only authorized users
>> can access it,
>
> Optimally only the person who knows the root password has direct
> access
> to the computer.
This is certainly true for servers. Unfortunately, we also have these
things called "users" who use computers. ;-)
> In which case it doesn't really matter if the root password can be
> reset locally or not.
Yes.
BTW, this was considered very standard practice for NetWare (still is,
for that matter) - physical console access = access to everything. It
amazed me that some systems admins never understood that concept - and
put their servers in, say, the middle of their office space.
Similarly with Windows, in a retail environment I used to work in a few
years ago, the servers were put in the store managers office. Guess
where many store managers put shoplifters they catch while waiting for
the police, frequently unsupervised....
Now make each of those servers a domain controller. Yep, we had to plan
our designs around the idea that someone could walk off with the hard
drives from the system, compromising a domain of 500-1500 DCs.
"Not pretty" doesn't even begin to describe the amount of traffic
generated by a global password change with that many DCs. With the WAN
in place, I estimated 4 months worth of traffic at 100% network
utilization.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Jim Henderson <nos### [at] nospamcom> wrote:
> > Optimally only the person who knows the root password has direct
> > access
> > to the computer.
> This is certainly true for servers. Unfortunately, we also have these
> things called "users" who use computers. ;-)
Users should only use the computer remotely. Just give the users a
dummy "multimedia" PC with no valuable information stored in it and
which HD can be reset to default each night. (That's what they do at the
university here.)
Networked file systems exist for a reason.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Law enforcement can get a subpoena or warrant for keys to a safe. I
>> suspect that in many countries they would treat a password the same.
>> Failing to turn over the password might have worse consequences, since a
>> contempt of court charge would just leave someone sitting in jail until
>> they turned over the password.
>
> If the suspect simply claims that he forgot it, how can they prove he
> didn't?
Well I guess if they showed he had used it every day for the last 5 years
then the jury wouldn't find it too hard to come to a decision...
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott <sco### [at] laptopcom> wrote:
> Well I guess if they showed he had used it every day for the last 5 years
Big Brother is watching? I'm not comfortable with where this is going...
I see where this is going. Let's see which country is the first to make
all kinds of encryption illegal.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> Well I guess if they showed he had used it every day for the last 5 years
>
> Big Brother is watching? I'm not comfortable with where this is going...
If you've just been arrested (and had your PC taken away) on suspicion of
downloading child porn (or whatever), then I think the police could quite
easily get records of your activity online, they may have even been spying
on you already.
It's then up to the jury what they think after all the facts have been
presented. It's not going to look good if you conveniently "forgot" the
password to work your computer the day it was confiscated, but you managed
to work it fine for the last few years.
Besides, the ISP will probably have records of what you did online, and I
suspect some expert lab would be able to look at the PC and say how recently
a lot of the data on the disc had changed (ie was the drive re-encrypted
with a different key recently).
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott <sco### [at] laptopcom> wrote:
> they may have even been spying on you already.
Regardless of the suspected crime type, I'm still not very comfortable
if the police could legally spy on anyone they want.
I suppose that's where the world is going. Hundreds of millions of people
will have to reduce their rights to privacy so that the few dozens of bad
criminals can be spied upon.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> they may have even been spying on you already.
>
> Regardless of the suspected crime type, I'm still not very comfortable
> if the police could legally spy on anyone they want.
How are they meant to catch people downloading illegal material without
spying on you? Don't ISPs already report suspected illegal activity to the
police?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
>>> Well I guess if they showed he had used it every day for the last 5
>>> years
>>
>> Big Brother is watching? I'm not comfortable with where this is going...
>
> If you've just been arrested (and had your PC taken away) on suspicion
> of downloading child porn (or whatever), then I think the police could
> quite easily get records of your activity online, they may have even
> been spying on you already.
>
> It's then up to the jury what they think after all the facts have been
> presented. It's not going to look good if you conveniently "forgot" the
> password to work your computer the day it was confiscated, but you
> managed to work it fine for the last few years.
>
I don't think a jury would ever hear about it, in the USA. Quoting
lectlaw.com :
Civil contempt occurs when the contemnor willfully disobeys a court
order. This is also called indirect contempt because it occurs outside
the judge's immediate realm and evidence must be presented to the judge
to prove the contempt. A civil contemnor, too, may be fined, jailed or
both. The fine or jailing is meant to coerce the contemnor into obeying
the court, not to punish him, and the contemnor will be released from
jail just as soon as he complies with the court order.
http://www.lectlaw.com/def/c118.htm
What is glossed over in that nice quote is that, because it is not
'punishment' the court doesn't have to follow due process. That means no
trial by jury and no real chance to argue that you really did forget the
password.
Deniable encryption tries to get around this, but I'm waiting to see it
tested by an over zealous court. While it might be believable that the
person had turned over all of their keys, it could also be presented
that there is always one more key to turn over.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
>>> they may have even been spying on you already.
>>
>> Regardless of the suspected crime type, I'm still not very comfortable
>> if the police could legally spy on anyone they want.
>
> How are they meant to catch people downloading illegal material without
> spying on you? Don't ISPs already report suspected illegal activity to
> the police?
>
>
There is a difference between the ISP scanning their own traffic logs in
accordance with their own terms of service, and the police requiring
that the ISP scan, log, and report everything directly to them.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> How are they meant to catch people downloading illegal material without
>> spying on you? Don't ISPs already report suspected illegal activity to
>> the police?
>
> There is a difference between the ISP scanning their own traffic logs in
> accordance with their own terms of service, and the police requiring
> that the ISP scan, log, and report everything directly to them.
Can't the police demand info from ISPs if they suspect some customers (or
users of a website they host) to be acting illegally? I'm not an expert at
the law in this area, but it seems like common sense says the police should
(and do) get this information if they need it to help convince someone of a
crime.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
> Deniable encryption tries to get around this, but I'm waiting to see it
> tested by an over zealous court. While it might be believable that the
> person had turned over all of their keys, it could also be presented
> that there is always one more key to turn over.
Oh ok, I hadn't heard of deniable encryption before, I will look it up.
Another possibility is that your decryption key is stored on a USB stick,
and is far too long for you to possibly remember. After your PC has been
confiscated (before they realise it won't boot without the USB key) you can
destroy the USB stick.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott <sco### [at] laptopcom> wrote:
> How are they meant to catch people downloading illegal material without
> spying on you?
How is the police meant to stop domestic violence without installing
surveillance cameras in all homes?
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> How is the police meant to stop domestic violence without installing
> surveillance cameras in all homes?
Kill all men?
--
Tim Cook
http://home.bellsouth.net/p/PWP-empyrean
-----BEGIN GEEK CODE BLOCK-----
Version: 3.12
GFA dpu- s: a?-- C++(++++) U P? L E--- W++(+++)>$
N++ o? K- w(+) O? M-(--) V? PS+(+++) PE(--) Y(--)
PGP-(--) t* 5++>+++++ X+ R* tv+ b++(+++) DI
D++(---) G(++) e*>++ h+ !r--- !y--
------END GEEK CODE BLOCK------
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
>>> How are they meant to catch people downloading illegal material without
>>> spying on you? Don't ISPs already report suspected illegal activity to
>>> the police?
>>
>> There is a difference between the ISP scanning their own traffic logs in
>> accordance with their own terms of service, and the police requiring
>> that the ISP scan, log, and report everything directly to them.
>
> Can't the police demand info from ISPs if they suspect some customers
> (or users of a website they host) to be acting illegally? I'm not an
> expert at the law in this area, but it seems like common sense says the
> police should (and do) get this information if they need it to help
> convince someone of a crime.
>
>
In the USA, no, they can not just demand the information. They can ask
the ISP any way they want, but without a warrant, the ISP is not
required to turn over anything. Without a warrant* a cop asking for
something is doing just that, asking. The requirements to get a warrant
is 'probable cause', which is another loaded term because it has a
pretty strict legal meaning. Basically, the cop would have to show a
judge that there was already some evidence that someone committed a
crime before they could get a search warrant to invade that person's
privacy. Getting a search warrant for an ISPs logs would involve showing
some evidence that someone using the ISP did something illegal, and
would probably need to be more specific like what person committed what
possible crime over what time frame.
The trick, though, is that the ISP really had no reason not to turn over
your information. Because they own the data, and the terms of service
usually allow them to, they can turn over the information to the police
with out your consent. But they are not required to. If the police
asked, on a daily basis, for all information regarding all customers,
how long would it take for the ISP to just start ignoring them until the
police brought a warrant? An ISP might even require a warrant before any
information is handed over.
*Not counting such nice modern laws like the Patriot Act and the option
to get a warrant after the search using the stuff obtained in the search
as justification.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Sun, 14 Oct 2007 20:19:00 -0400, Warp wrote:
> Jim Henderson <nos### [at] nospamcom> wrote:
>> > Optimally only the person who knows the root password has direct
>> > access
>> > to the computer.
>
>> This is certainly true for servers. Unfortunately, we also have these
>> things called "users" who use computers. ;-)
>
> Users should only use the computer remotely. Just give the users a
> dummy "multimedia" PC with no valuable information stored in it and
> which HD can be reset to default each night. (That's what they do at the
> university here.)
We could do terminal server - how about just dumb terminals?
That's not really the reality of how computers are used these days - I
travel occasionally, not having files on my laptop would cripple my
ability to do work. A not insignificant amount of the population works
that way.
> Networked file systems exist for a reason.
Yes, mostly for recovery. If a desktop is compromised, the network
filesystem can also be compromised. It's not as easy, but it's certainly
possible.
Why? Because users do stupid things with passwords. They leave access
cards in their desks, etc, etc, etc.
But even more significantly, social engineering attacks lead to more
compromise of data than any technical hacking does.
I've only been working with data security for about 15 years, with my
first environment being an academic computer lab at a university,
though. ;-)
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Jim Henderson <nos### [at] nospamcom> wrote:
> We could do terminal server - how about just dumb terminals?
VT100 rules.
(Ok, I have never actually used a VT100 terminal. I have used a VT220 one,
though. Back then it was enough to do everything you had to do... :) )
> But even more significantly, social engineering attacks lead to more
> compromise of data than any technical hacking does.
I read recently about a test they did somewhere (I don't remember if
it was done in Finland or the US). It's surprising how many people will
write their account name and password on a paper questionnaire simply
because the questionnaire asks for them.
--
- Warp
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 15 Oct 2007 12:30:42 -0400, Warp wrote:
> Jim Henderson <nos### [at] nospamcom> wrote:
>> We could do terminal server - how about just dumb terminals?
>
> VT100 rules.
>
> (Ok, I have never actually used a VT100 terminal. I have used a VT220
> one,
> though. Back then it was enough to do everything you had to do... :) )
I think I have used a VT100 terminal. Orange phosphor type screen, IIRC.
:-)
Jim
>> But even more significantly, social engineering attacks lead to more
>> compromise of data than any technical hacking does.
>
> I read recently about a test they did somewhere (I don't remember if
> it was done in Finland or the US). It's surprising how many people will
> write their account name and password on a paper questionnaire simply
> because the questionnaire asks for them.
Yep, but even worse than that is that help desk personnel will tend to
reset passwords for anyone who says they are the person calling in.
Call one:
"Hi, I'm Joe Smith, and I can't seem to get in with my username - isn't
it jsmith?"
"No, it's johnsmith, no spaces, all lowercase."
"Huh, I could've sworn it was jsmith, must've been thinking about a
different system. I'm in now, thanks!"
Followed by a second call to a different tech:
"Hi, I'm Joe Smith, just got back from vacation and I've forgotten my
password, can you reset it for me?"
"Sure, no problem - it's now 'password', and you'll be forced to change
it on your next login."
"Thanks, appreciate it."
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Jim Henderson wrote:
> On Mon, 15 Oct 2007 12:30:42 -0400, Warp wrote:
>
>> Jim Henderson <nos### [at] nospamcom> wrote:
>>> We could do terminal server - how about just dumb terminals?
>> VT100 rules.
>>
>> (Ok, I have never actually used a VT100 terminal. I have used a VT220
>> one,
>> though. Back then it was enough to do everything you had to do... :) )
>
> I think I have used a VT100 terminal. Orange phosphor type screen, IIRC.
>
> :-)
>
vt52, vt100, vt220 and vt240 (using its grahical modes to plot things
IIRC) but I started on on a beehive terminal where you could edit one
line locally and then use the 'send' button to send to the mainframe.
No fancy full screen editors like VI yet.
Output to be collected the next day at the front desk.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Mon, 15 Oct 2007 22:40:44 +0200, andrel wrote:
> Jim Henderson wrote:
>> On Mon, 15 Oct 2007 12:30:42 -0400, Warp wrote:
>>
>>> Jim Henderson <nos### [at] nospamcom> wrote:
>>>> We could do terminal server - how about just dumb terminals?
>>> VT100 rules.
>>>
>>> (Ok, I have never actually used a VT100 terminal. I have used a
>>> VT220 one,
>>> though. Back then it was enough to do everything you had to do... :) )
>>
>> I think I have used a VT100 terminal. Orange phosphor type screen,
>> IIRC.
>>
>> :-)
>>
> vt52, vt100, vt220 and vt240 (using its grahical modes to plot things
> IIRC) but I started on on a beehive terminal where you could edit one
> line locally and then use the 'send' button to send to the mainframe. No
> fancy full screen editors like VI yet. Output to be collected the next
> day at the front desk.
Technically, I think my first terminal was a real teletype - I remember
my dad bringing one home from the office for the IBM 305 they had,
acoustic coupler and all.
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Warp wrote:
> Regardless of the suspected crime type, I'm still not very comfortable
> if the police could legally spy on anyone they want.
In the USA, the police are *supposed* to go to a judge and convince the
judge of the need to do this. That this is being ignored is troublesome
to me. But I don't have much of a problem with it when the judge is
involved.
Of course, the bit of "let's watch everyone always who is in public, and
record any data leaving or entering their private house" is also
troublesome, but certainly easier to get around.
--
Darren New / San Diego, CA, USA (PST)
Remember the good old days, when we
used to complain about cryptography
being export-restricted?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Tim Cook wrote:
> Warp wrote:
>> How is the police meant to stop domestic violence without installing
>> surveillance cameras in all homes?
>
> Kill all men?
You *are* aware that men are abused more often than women are, right?
--
Darren New / San Diego, CA, USA (PST)
Remember the good old days, when we
used to complain about cryptography
being export-restricted?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
scott wrote:
> After your PC
> has been confiscated (before they realise it won't boot without the USB
> key) you can destroy the USB stick.
That's called "destruction of evidence" and it's also illegal. Not that
they could do much about it, but it's illegal.
--
Darren New / San Diego, CA, USA (PST)
Remember the good old days, when we
used to complain about cryptography
being export-restricted?
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> Tim Cook wrote:
>> Warp wrote:
>>> How is the police meant to stop domestic violence without installing
>>> surveillance cameras in all homes?
>>
>> Kill all men?
>
> You *are* aware that men are abused more often than women are, right?
>
It still works.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
On Tue, 16 Oct 2007 07:07:01 +0200, andrel wrote:
> Darren New wrote:
>> Tim Cook wrote:
>>> Warp wrote:
>>>> How is the police meant to stop domestic violence without
>>>> installing
>>>> surveillance cameras in all homes?
>>>
>>> Kill all men?
>>
>> You *are* aware that men are abused more often than women are, right?
>>
> It still works.
Arguably for the women abusers it sure does....
Jim
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> How are they meant to catch people downloading illegal material without
>> spying on you?
>
> How is the police meant to stop domestic violence without installing
> surveillance cameras in all homes?
Looking at IP logs of suspects is a bit different to having a camera inside
your house.
By using the internet you are effectively agreeing that everyone else can
see what you are doing. By living in a house you are certainly not agreeing
to that.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
>> After your PC has been confiscated (before they realise it won't boot
>> without the USB key) you can destroy the USB stick.
>
> That's called "destruction of evidence" and it's also illegal. Not that
> they could do much about it, but it's illegal.
Yeh I guess it depends on how bad the punishments will be relatively. I
mean if there was evidence on your PC that would incriminate you for murder,
would it be beneficial to destroy the decryption device? What if you just
"lost" it ("i thought it was plugged into the PC when you guys took it
away")? They couldn't prove that you destroyed it.
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
