14 September 2009

Zimbabwe wine

Unlike other so-called 'storm chasers', who are often labelled adrenaline junkies for their obsessive pursuit of extreme weather, Jim is driven by his love for art and his interaction with nature by documenting the unpredictable changes in weather and climate.

Read more: http://www.dailymail.co.uk/news/worldnews/article-1213339/Astonishing-twisters-captured-storm-chasing-photographer-Jim-Reed.html#ixzz0R8ROLtUQ

Hilarious. As if there is a difference.




Where's the Zimbabwe wine?

13 September 2009

Crypto Dad: secret ink

I was asking the nearly 10 year old about secret inks, he confessed he once
read of them and peed on a brush, painted paper, and then developed it on
a lightbulb after drying.

I was amazed to learn this. It has lighted up my whole week.

Crypto Dad: tools

http://www.cotse.com/tools/stega.htm

Crypto Dad

If you want to hide a whole "disk" work of space, use TrueCrypt
http://www.truecrypt.org/

You create a "volume" which is encrypted by a password. You open the volume
with the password, then it acts just like a regular E: drive (or whatever drive
letter you pick).

Winzip and WinRAR also have encryption options, and can package files together in compressed archives.

BTW, you must always compress before encrypting, because after encrypting, the data looks random and can't be compressed.

Crypto Dad: steganography for 10 year olds




This JPG contains a TXT file.

The tool is JPHSWin
The password is "password"

Save the fullsize image, open with JPHSWin, SEEK (and supply the not-so-secret password "password") then save the found file as f.txt.






The threat model is: someone sees an encrypted file, gets suspicious, forces you to reveal a password. In professional circles this is called the "rubber hose attack" but your parents would more likely simply deprive you of TV, car, etc.

The solution: hide one file inside another obvious boring file. Encrypt the hidden file before hiding it, too.

You could publish your picture and only those looking for hidden messages, and who have the secret key, will find them. Flickr, ebay, even 4chan :-)

Crypto Dad: Crypto for 10 year olds

Kids,
By now, you've learned that what you write can be important. For thousands of years people have kept diaries and wanted them to be private. You can still buy blank notebooks
with locks on them.

But those mechanical locks can be picked, or broken.

And you like to use computers to write. (Learn to type, BTW!) Can you control who reads your writing on a computer?

Sure you can. Controlling who reads your stuff is "confidentiality". Here's how we'll do it: You'll give a secret password "key" to a machine called a "cipher" which eats the key, your stuff, and produces a new file. That new file contains your stuff, but you can only read it if you know the key. Enciphering is also called encryption, which means "hiding".

The reverse process is simple: give the cipher the encrypted file and the key, you get your original stuff back.


If you deleted your original stuff, after making the encrypted one, then only someone with the key for that encrypted file can read it.

BTW, Your "stuff" is just a file. That file can mean music (eg mp3) or pictures (eg jpg) or fancy documents (eg doc) or plain text (eg txt) or anything.

BTW, the "cipher machine" is just a computer program.

Search for AxCrypt. Its a little Windows File Explorer plug-in that encrypts and decrypts files. http://www.axantum.com/AxCrypt/

If you share the "key" in person at the play ground you can control who reads
the file. That can be one person, or more, or just you. The "key" is just like a metal key to a door, they're all identical and anyone who has one can

Of course, someone could find the encrypted file and force you to reveal the password. In our next installment we learn about hiding the very fact that you've hidden a file!
(Steganography)

Other topics related to encryption:
authentication (knowing that a message came from your friend)
integrity (no one can change the message without getting caught)
non-repudiation (you can't back out of a signature!)

The "what I know, have, am" triad for identification --tying meatspace to information space. Governments love that stuff.

Anonymity
Traffic analysis

All stuff for the modern 10 year old!
Maybe we'll even dabble in RSA (publishable public keys, web certificates) and DHA (SSL).

06 September 2009

Crypto Dad

Took the kid on a short neighborhood walk. Along the way, found a 4 disk bike or motorcycle lock hanging loose on a fence. So, I took it walking.

By the time we reached the road I had found its code, 6193, and opened it. Actually
I thought I first found 9193; then the kid found several adjacent codes that worked,
and then eventually only one code worked. I think we might have inadvertently reprogrammed the combination, though I didn't that that was possible in that kind of lock.

We eventually wrapped it around an ornamental post. The kid did this, then ran away. I pointed out his fingerprints were all over it; he said they weren't in the DB yet; I said
they would be eventually; but that he could say he picked it up and dropped it, then
a gloved vandal locked it round the post.

Cover your ass. Plausible deniability. Think like the adversary. Crypto, safety engineering, reliability, availability, etc.

PS: I once brute forced a 3-digit lock I found in an airport, while waiting.

Hilarious.