9 ms·
Want to Block Common Passwords? Sorry, That is Patented
- elvinj 14y agoThere's a patent our there for just about any conceivable thing in computing. I'm pretty sure commenting on HN articles is patented and we're in violation right now. It's so ridiculous. No can ever really do anything with most of them (except maybe troll companies with deep pockets or if you're building a phone). I remember that 5 years ago when building a company people would still ask whether you had patents. I don't think they still do, but those are just my impressions.
- randall 14y agoOh they do. But now that's by the typically less sophisticated investors, in my experience anyway.
- rayiner 14y agoLike Google? http://www.behav.io/ http://www.behav.io/ (recent IP/engineer acquisition). "Nadav holds multiple patents in areas of social mobile networking, machine learning, network algorithms, and sensor technologies. His work has been featured in both academic and popular press (Technology Review, Businessweek.com, Wall Street Journal, Wired UK, and The Associated Press, among others), and received awards of recognition (including Best and Distinguished Paper awards, Knight News Challenge, SXSW Accelerator, IPSN Extreme Sensing Competition, and three Google Research Awards)."
- claudius 14y agoBut at least these seem to be patents that did require some effort, were novelties at the time and appear to be useful – otherwise that list of awards would be a list of awards you don’t want to receive. There is nothing wrong with patenting truly new, truly sensible solutions to actual problems, in my opinion. The problematic patents are the trivial ones that currently swamp the software industry.
- rayiner 14y agoI'm not commenting on the relative value of the patents, just the idea that investors don't care. Google does quite a few IP acquisitions.
- georgemcbay 14y agoGoogle's actions in this area speak for themselves. Even in the few instances where they have been involved in patent infringement cases on the "offensive" side, the suits have been quite obviously defensive in nature (eg. the suit vs British Telecom). The nature of reality as it applies to patent law is why I don't fault companies for acquiring lots of patents, but do fault them when they use those patents offensively. Google remains among the very few large tech companies I respect when it comes to patent actions.
- rayiner 14y agoThe fact that they're not on the offense is not really meaningful. Most of the value of property and contractual rights is prospective. I bet Google has never sued someone for planting a farm on their campus lawn--that doesn't mean they're indifferent to the existence of that property right. Google acquires a lot of companies for their IP. Not so they can sue people for infringing on it, but so they can use it. The property rights create a legal structure that allows those kinds of transactions to happen. Like with any other property right, that's the value of a patent--giving people a "thing" in which they can transact, which they can book as an asset, etc. Ideally, a lawsuit only happens when things go sideways.
- scromar 14y agoThat's one of the issues though. Which patents are the "truly new" ones and which are the "trivial ones"? It seems like many software patents seem obvious in hindsight, a few years down the road, but they were not obvious at the time of invention.
- claudius 14y agoThis is of course true, although there are really some rather trivial ones even at the time of invention (or already outdated at the time of filing). Maybe it would be helpful to adapt the protection period (20 years, IIRC) to the rate of innovation in the industry?
- eksith 14y agoThere are a couple of solutions (neither are "good" if you're worried about being sued to oblivion ) : 1) Don't publicize how you reject passwords (this, obviously, won't work for open source). You can reject with a generic "please choose a different one" or something similar. Just vague enough to not directly show that you're reading off a list of bad passwords. 2) Ignore the patent. I'm a fan of 2, but fighting a troll alone is most definitely not an option. If I do get sued, perhaps I can contact all other people who were also sued (since trolls tend to fire shotgun lawsuits to see which ones buckle) and fight back together to try and get the patent invalidated. Meanwhile, I can write to congress (have all the others do the same) and wait for it to have no effect whatsoever since, obviously, we all know that what really kills American jobs is those damn immigrants /sarcasm.
- bjxrn 14y agoIt's not just going over a blacklist though. If you do any form of checking/rejecting a password, you're probably infringing something. And it's not just the checking, the article also mentions "recovery of forgotten passwords, secure password resets, using one-time passwords, account lockout, generating pronounceable passwords, password hints, and even backdoor passwords".
- cynwoody 14y ago> generating pronounceable passwords Prior art! That program was written by thvv in 1994[1], based on much earlier work[2]. [1] http://manpages.ubuntu.com/manpages/quantal/en/man1/gpw.1.html http://manpages.ubuntu.com/manpages/quantal/en/man1/gpw.1.ht... [2] http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA017676 http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA017676
- msluyter 14y agoWhat if you didn't reject the passwords outright, but simply warned the user. I wonder if that would be considered a violation? Also the patent "Specifying a set of forbidden passwords" includes: "generating at least one symbolically equivalent password". What if you didn't generate a symbolically equivalent password (but just did a direct lookup?)
- nhebb 14y agoIs there a common repository of patent troll claims? It would be nice to have a list of things to avoid, with workarounds where possible.
- wahnfrieden 14y agoMost companies don't want their developers reading patents, it's a liability. Leave that up to the lawyers.
- djkz 14y agoI'd stay away from looking up things you might infringe. You will be liable for treble damages and most of the trivial things are probably patented by somebody (http://en.wikipedia.org/wiki/Treble_damages http://en.wikipedia.org/wiki/Treble_damages).
- eksith 14y agoThis feels counter-intuitive to me. I understand why patents are tainted by these, but how am I supposed to know if I'm not infringing if I don't research the idea before shipping out? Shouldn't there be a way to make sure at least it's sufficiently different to make sure I'm not repeating something?
- drakaal 14y agoYour lawyer or a consultant does a technology audit. I used to do these on behalf of VCS on young startups to ensure they had not infringed on a patent that would put the investment at risk.
- eksith 14y agoSo basically a lot of NDAs ;) We're going to be doing feature lists for our last project before going to marketing, so I guess this is as good a time as any to make sure the lawyer combs though them.
- throwawaykf 14y ago
- drakaal 14y agoLarge companies patent everything that they use that doesn't have a patent already. Better to have a patent for entry of text in to a form using a keyboard than to pay a troll later. But it is also mutually ensured destruction for fights between big companies. You can't sue me for a billion dollars because you are infringing on 2 patents for every on of yours I am infringing. Apple vs Samsung was an example of this.
- gav 14y agoHere's an example going back to the 80's when IBM shook down Sun[1]: >> Finally, the chief suit responded. "OK," he said, "maybe you don't infringe these seven patents. But we have 10,000 U.S. patents. Do you really want us to go back to Armonk and find seven patents you do infringe? Or do you want to make this easy and just pay us $20 million?" [1] http://www.forbes.com/asap/2002/0624/044.html http://www.forbes.com/asap/2002/0624/044.html
- xorgar831 14y agoThis is how the lawyers at my large company described it as well, mutually ensured destruction. If you're a big company, you're essentially forced to play the patent game.
- apendleton 14y agoWould there be any obvious problems with defend-it-or-lose-it laws around patents, like there already are around trademarks? Seems like it would kill the submarine-patent market entirely, and would discourage companies from bothering to file for patents they didn't plan on vigorously defending (I could imagine drug companies continuing to file; software companies, not so much). I don't tend to hear this suggested in patent-reform discussions, though, so I assume there's a reason not to go this route.
- zerovox 14y agoUnless I'm mistaken, it certainly wouldn't stop patent trolls, who buy/keep patents precisely so they can use them. The only thing it would stop is companies holding patents for defensive reasons, who have no intention of actively pursuing patent violators but who patent their ideas in-case they are sued by a patent troll with a similar idea/patent. Google claims to follow this in terms of open source projects[1]. [1]:http://www.google.com/patents/opnpledge/ http://www.google.com/patents/opnpledge/
- jcromartie 14y agoBut "defend it or lose it" means going after all infringers, which patent trolls certainly don't do. They are currently very selective about enforcing their patents, choosing to assert where they will win.
- chawco 14y agoI'm not sure it's completely practical, but this would have some interesting interactions with obviousness -- if you need to sue half the industry, it may say something about the obviousness of the patent itself.
- Pwnguinz 14y agoHindsight is 20/20. Everything is obvious, once someone already paves the way to the solution. This is why, in principle, there is the "prior art" clause. It's just not enforced well enough in the software realm--but the mechanism to prevent patenting something widely known a posteriori does technically exist.
- throwawaykf 14y agoThis has been posted here before, and I exchanged a couple of messages in the comments section with the author to clarify some misconceptions. If you read the claims (as everyone always should but nobody ever does), most of the patents he mentions are actually pretty "decent", some of which are discussed in the comments.
- harshreality 14y agoAre any of those patents not algorithm, hence math, patents? Or, is your argument that certain types of math patents are "decent" and should be allowed? Because they're not (at least in theory), according to judicial precedent; in practice, courts seem to have difficulty knowing math when they see it.
- throwawaykf 14y agoYour views are rooted in one of the more common misconceptions about so-called software patents: None of them are algorithm patents, because you cannot patent algorithms. What is patented is the application of certain algorithms to solve a practical, real world problem. The algorithms involved are not covered, and can freely be used for other purposes. In this case, that happens to be preventing poor passwords. That is a concrete, real-world problem, requiring practical solutions, which these patents purport to provide (probably) novel, non-obvious variations of. For example, one of the less "decent" patents uses (what seem to be) bloom filters to track and test for poor passwords. This does not mean all uses of bloom filters are covered by it. The claims specifically cover the method of using bloom filters to test for bad passwords. Really, it becomes clear what is covered when you simply read the claims.
- harshreality 14y agoMathematical equations representing (approximate) solutions to physics problems are patentable, then? Let's turn the clocks back to 1900 and figure out where we'd be technologically if every such "invention" had a 20-year period of exclusivity.
- danielrm26 14y agoHow about "keeping bad things from happening"? That's only one level of abstraction up from that. Could be lucrative.
- thisishugo 14y agoHow about a "Facility for preventing disasters."[1] [1]http://www.google.com/patents/EP0279864B1 http://www.google.com/patents/EP0279864B1
- deleted 14y ago[deleted]
- davidroberts 14y agoPatents: Meant to encourage innovation, and now destroying it. Is there anything lawyers touch these days that doesn't get irrevocably corrupted? Law was supposed to protect rights and clarify correct behavior, not become a profit center for parasites.
- Zuider 14y agoIt was always like this. The main way to become wealthy in ancient times was through lawsuits. As soon as well meaning intentions are put into legal words, they can be subverted.
- coldarchon 14y agoConclusion after reading this text, there are so many patent trolls because the patent system in USA is trolling the industry. It is a failure ..
- kmfrk 14y agoIs there a go-to password list, if you still want to go ahead and use it?
- saber_taylor 14y agoYou'd probably set a chron with crack or John the Ripper which would come with a small password list and do some common permutations and then lock accounts. Ars Technica mentioned a RockYou.com password list that is now the go to list for serious cracking. I think it would be hard to enforce this patent for sysadmins who implement their own system.
- notatoad 14y agoWe really need to start naming and shaming the people willing to have their names listed on frivolous patents like this, and not just their employers. If you're listed as an inventor on an unethical patent, you have violated the implicit moral code of technologists and positioned yourself in opposition to progress. Michael Stephen Brown and Herbert Anthony Little: you are not good people.
- sillysaurus 14y agoWe really need to start naming and shaming the people willing to have their names listed on frivolous patents like this, and not just their employers. If you're listed as an inventor on an unethical patent, you have violated the implicit moral code of technologists and positioned yourself in opposition to progress. http://paulgraham.com/6631327.html http://paulgraham.com/6631327.html Paul's patent would seem frivolous now, but it wasn't then. By applying for a patent, did he position himself in opposition to progress? Seems doubtful. Here's another example: http://www.google.com/patents/US5204966 http://www.google.com/patents/US5204966 This patent was filed in 1990. I was two years old. The internet hardly existed then. Was this patent frivolous? Should these inventors be punished according to your ethics? So what's our criteria for a frivolous patent? Perhaps "(a) it was filed since 2010, and (b) it covers some well-known technique." Yet that's completely arbitrary. Punishing someone for violating an arbitrary moral code is a recipe for evil.
- psionski 14y agoIt's a software patent, therefore it's frivolous. "The basic algorithmic ideas that people are now rushing to patent are so fundamental, the result threatens to be like what would happen if we allowed authors to have patents on individual words and concepts." - God himself, http://progfree.org/Patents/knuth-to-pto.txt http://progfree.org/Patents/knuth-to-pto.txt
- mercuryrising 14y agoThat's not very good reasoning. If all software patents are bunk, so are many electrical engineering patents. If software is built on hardware, anything I represent in software can be 1:1 related to the digital circuit equivalent. It may be silly or infeasible to do so - but I could make an ASIC or FPGA that runs my latest piece of code. Maybe those wouldn't count because they're too close to the way we think of software. Okay - I lay out my PCB with just 4011s NAND gates. Is this sufficiently far from software to get me a patent for my ideas? I think software should move towards a trade secret model and abolish software specific patents entirely. Unless you can demand to see the source code, you can never prove whether or not I used your algorithm. That - or, software developers need to make one gigantic document of every single idea they have implemented and used. If everyone has 5 ideas a day that they implemented and wrote down, we'd hit some sticky situations where a new problem is found. And, much like the patent system, if we put it online where anyone could potentially see it, we can say that it was prior art for any future patent. Then - as they don't have to be good ideas necessarily, we run through and make all permutations of every single word on the page, leading to every possible idea that can be thought of in that context. Prior art for everything. Or just get Pi out and start translating it to English.
- fishbacon 14y agoThis site is completely unreadable at least on my iPad, why is tweeting and Facebooking more important than the content!?
- bnegreve 14y agoThis one in especially good: Specifying a set of forbidden passwords How can one spend time and money for this?
- droithomme 14y agoOh great, now I have to remove this common and obvious functionality from all the web sites I have any input to.
- legierski 14y agogood luck!
- codeoclock 14y agoSurely you could just do it anyway, because there's no way a patent like that would hold up in court if they tried to sue you. I realise though that obviously it shouldn't happen in the first place, and doing it anyway could incur legal costs.
- okamiueru 14y agoDo you have the money for the legal counsel required to take it to court? If you do, what about Joe and his new startup, he might just go for the suggested settlement.
- codeoclock 14y agoThe fact that it would cost any money at all is completely ludicrous, any judge with any basic concept of logic can see that it's an obvious development of technology and therefore can't be patented. You shouldn't have to hire a lawyer to prove that.
- colinshark 14y agoWe shouldn't be able to patent any idea just by running it on a "processor and memory". I'm convinced that trademark and copyright gives us all the IP tools we need. Patents can get f'ed.
- pixelcort 14y agoWhat about using a bloom filter of common passwords? It would prevent some safe passwords from being used, but otherwise would allow for disallowing unsafe passwords without holding a dictionary of them, potentially avoiding existing patents.
- thyrsus 14y agoThe "passwd" program on page 282 of the first edition of Wall & Schwartz "Programming Perl", copyright 1990, would appear to constitute prior art to most of these claims.