3 ms·

So in your theory, bloodthirsty murdering cartels are going to kidnap people, but let them go if they hit the panic encryption button on their phones or happen

So in your theory, bloodthirsty murdering cartels are going to kidnap people, but let them go if they hit the panic encryption button on their phones or happen to be using a secret password. This is an interesting view of how drug cartels work. Personally, I don't know what the penalty for "contempt of drug cartel that just kidnapped you" is, but it seems unlikely to lead to a positive outcome.

monochr 12y ago
https://www.usenix.org/legacy/event/hotsec08/tech/full_papers/clark/clark_html/ https://www.usenix.org/legacy/event/hotsec08/tech/full_paper... 3.1 Security Assumptions Our threat model is based on four pragmatic assumptions. Kerckhoffs' principle: The details of the authentication system that is in place is public information and known to all participants, including Oscar. Alice and Bob retain a shared secret (e.g., a password or set of passwords) that is both private and the foundation upon which the security of the system rests. Observational principle: Alice communicates with Bob over a semi-private channel that can be observed by Oscar prior to the password being secured (i.e., encrypted or hashed). Namely, Oscar can observe the password(s) used by Alice and could even enter in Alice's password himself, after coercing her into revealing it. Iteration principle: Unless explicitly prevented by the underlying system, Oscar is not bound to a single instance of coercion against Alice. He may force Alice to authenticate multiple times. Combined with the observational principle (Assumption 2), Oscar can force Alice to use a different password each time. Forced-randomization principle: Oscar can choose to eliminate any strategy Alice may employ through the order in which she reveals the passwords she knows. For example, Oscar may force Alice into writing down a set of passwords so that he can randomly choose the order in which to iterate through them. The assumption is that this option is available to Oscar, not that he will necessarily employ it.
chaostheory 12y ago
Didn't they let the other medical workers go?
icpmacdo 12y ago
It would be interesting if you could have 2 codes to two different user accounts on the phone so she could give them the passcode "5555" and have it link to a harmless twitter/FB and then have another one to use for a private user account.
nailer 12y ago
They would have attached the doctor for the the four year old child dying (because they're bloodthirty morons) but no they would probably not have discovered the doctors alter ago. Just read the article.
deleted 12y ago
[deleted]

monochr 12y ago

https://www.usenix.org/legacy/event/hotsec08/tech/full_papers/clark/clark_html/ https://www.usenix.org/legacy/event/hotsec08/tech/full_paper... 3.1 Security Assumptions Our threat model is based on four pragmatic assumptions. Kerckhoffs' principle: The details of the authentication system that is in place is public information and known to all participants, including Oscar. Alice and Bob retain a shared secret (e.g., a password or set of passwords) that is both private and the foundation upon which the security of the system rests. Observational principle: Alice communicates with Bob over a semi-private channel that can be observed by Oscar prior to the password being secured (i.e., encrypted or hashed). Namely, Oscar can observe the password(s) used by Alice and could even enter in Alice's password himself, after coercing her into revealing it. Iteration principle: Unless explicitly prevented by the underlying system, Oscar is not bound to a single instance of coercion against Alice. He may force Alice to authenticate multiple times. Combined with the observational principle (Assumption 2), Oscar can force Alice to use a different password each time. Forced-randomization principle: Oscar can choose to eliminate any strategy Alice may employ through the order in which she reveals the passwords she knows. For example, Oscar may force Alice into writing down a set of passwords so that he can randomly choose the order in which to iterate through them. The assumption is that this option is available to Oscar, not that he will necessarily employ it.

chaostheory 12y ago

Didn't they let the other medical workers go?

icpmacdo 12y ago

It would be interesting if you could have 2 codes to two different user accounts on the phone so she could give them the passcode "5555" and have it link to a harmless twitter/FB and then have another one to use for a private user account.

nailer 12y ago

They would have attached the doctor for the the four year old child dying (because they're bloodthirty morons) but no they would probably not have discovered the doctors alter ago. Just read the article.

deleted 12y ago

[deleted]