4 ms·

I agree it only proves security up to a certain value. Would you be happier if I increased the reward? Regardless, what do you think of someone who publicly ca

I agree it only proves security up to a certain value. Would you be happier if I increased the reward? Regardless, what do you think of someone who publicly calls something a terribly insecure idea, and then reacts with snark and doesn't actually attempt to crack the system when the opportunity is put before him by someone willing to bend over backwards to help him crack it? Propose a plan to actually crack the system. Do you want the database? Do you want to control the network where I log in?

tptacek 13y ago
Imagine if people built bridges the way you propose building secure software. "What do you think of someone who publicly calls a new bridge design unsafe, and then reacts with snark and doesn't actually attempt to destroy the bridge when the opportunity is put before her by someone willing to bend over backwards to help her do it?" Engineering doesn't work that way. Your proposed solution doesn't become more sound simply because you feel aggrieved at the way people react to it. Also: it's deeply dishonest to suggest that the only reaction you've received to this design is "snark". As I pointed out above, with a link and everything, and as you yourself acknowledged in your original post, you've been given a litany of reasons why your proposed design is flawed. You just don't seem to like hearing them.
- cheesypotato 13y ago
  If it's actually _as_ insecure as you say, why not collect your $1000? You'd make it back even more with gained reputation of your status as a security expert. Instead, I'm inclined to believe you just can't.
- chetanahuja 13y ago
  I'm inclined to agree with the original poster. If it's really as deeply insecure as you claim it is, you should be able to crack it in less than the 3 hours of time (that you also claim the proposed prize is worth). The OP even offered to increased the prize money if you think it'll take longer than that. In other words, sometimes, you have to put your money where your mouth is. The OP is doing that. You're not.
- absherwin 13y ago
  I'd expect them to propose a scenario that could be tested either with software or a miniature. You're under no obligation to but examples are persuasive. Feynman's ice water demonstration convinced far more people than his well-reasoned appendix. I'm attempting to give those who believe that JS crypto should never be used a way to make a clear public demonstration. What better target could you ask for? A web application hacked together in a few hours by someone with no training in computer security who isn't even a professional software engineer and who is willing to arrange scenarios favorable to the attacker. I'm not aggrieved by the negative reaction. I have no skin in this game. I don't earn anything if people walk away believing this idea is more secure. I just wish you wouldn't keep repeating the same canard about having to bootstrap the crypto on every use while attacking the messenger and the manner in which the message is being delivered.
e1ven 13y ago
I have put a sticky note on the front of my laptop. This sticky note contains a single english word. If you can tell me this English word, I will paypal you $10. -- Despite no one winning my "contest", my sticky-note encryption system is not particularly secure.
- tptacek 13y ago
  Ratatouille!
  - tcgv 13y ago
    Don't you get it, it is a catch, the sticker contains the phrase "a single english word".
- absherwin 13y ago
  I'll happily do that. When can I swing by to chat? Different systems are secure against different threats. Sticky notes are secure against people who can't get physical access to their location. The question in this case is what attacks this experiment is secure against.
  - e1ven 13y ago
    You posted your message because you said you wanted the discussion, and to see the flaws in your argument. But when people are answering you, you seem to be working hard to ignore them ;) I've taken the sticky note down. It had the word "contrite" There were plenty of exploits you could have done, without having local access to my machine. Just one example- If you view my profile, you can determine the company I work for. Use linked/etc to message someone there, and offer to split my generous reward with them, if they tell you the word. Just because no one took me up on my offer doesn't mean my sticky-note was secure. Yes, of course it was a silly "contest", but that's the point - Contests like this don't prove anything at all about how strong or weak your solution is.
    - absherwin 13y ago

tptacek 13y ago

Imagine if people built bridges the way you propose building secure software. "What do you think of someone who publicly calls a new bridge design unsafe, and then reacts with snark and doesn't actually attempt to destroy the bridge when the opportunity is put before her by someone willing to bend over backwards to help her do it?" Engineering doesn't work that way. Your proposed solution doesn't become more sound simply because you feel aggrieved at the way people react to it. Also: it's deeply dishonest to suggest that the only reaction you've received to this design is "snark". As I pointed out above, with a link and everything, and as you yourself acknowledged in your original post, you've been given a litany of reasons why your proposed design is flawed. You just don't seem to like hearing them.

cheesypotato 13y ago
If it's actually _as_ insecure as you say, why not collect your $1000? You'd make it back even more with gained reputation of your status as a security expert. Instead, I'm inclined to believe you just can't.
chetanahuja 13y ago
I'm inclined to agree with the original poster. If it's really as deeply insecure as you claim it is, you should be able to crack it in less than the 3 hours of time (that you also claim the proposed prize is worth). The OP even offered to increased the prize money if you think it'll take longer than that. In other words, sometimes, you have to put your money where your mouth is. The OP is doing that. You're not.
absherwin 13y ago
I'd expect them to propose a scenario that could be tested either with software or a miniature. You're under no obligation to but examples are persuasive. Feynman's ice water demonstration convinced far more people than his well-reasoned appendix. I'm attempting to give those who believe that JS crypto should never be used a way to make a clear public demonstration. What better target could you ask for? A web application hacked together in a few hours by someone with no training in computer security who isn't even a professional software engineer and who is willing to arrange scenarios favorable to the attacker. I'm not aggrieved by the negative reaction. I have no skin in this game. I don't earn anything if people walk away believing this idea is more secure. I just wish you wouldn't keep repeating the same canard about having to bootstrap the crypto on every use while attacking the messenger and the manner in which the message is being delivered.

e1ven 13y ago

I have put a sticky note on the front of my laptop. This sticky note contains a single english word. If you can tell me this English word, I will paypal you $10. -- Despite no one winning my "contest", my sticky-note encryption system is not particularly secure.

tptacek 13y ago
Ratatouille!
- tcgv 13y ago
  Don't you get it, it is a catch, the sticker contains the phrase "a single english word".
absherwin 13y ago
I'll happily do that. When can I swing by to chat? Different systems are secure against different threats. Sticky notes are secure against people who can't get physical access to their location. The question in this case is what attacks this experiment is secure against.
- e1ven 13y ago
  You posted your message because you said you wanted the discussion, and to see the flaws in your argument. But when people are answering you, you seem to be working hard to ignore them ;) I've taken the sticky note down. It had the word "contrite" There were plenty of exploits you could have done, without having local access to my machine. Just one example- If you view my profile, you can determine the company I work for. Use linked/etc to message someone there, and offer to split my generous reward with them, if they tell you the word. Just because no one took me up on my offer doesn't mean my sticky-note was secure. Yes, of course it was a silly "contest", but that's the point - Contests like this don't prove anything at all about how strong or weak your solution is.
  - absherwin 13y ago