On 10/7/19 5:00 AM, Konrad Rosenbaum wrote:
Hi,
On 10/5/19 2:17 AM, Roland Hughes wrote:
_ALL_ electronic encryption is security by obscurity.
Take a moment and let that sink in because it is fact.
Okay, out with it! What secret service are you working for and why are
you trying to sell everybody on bullshit that weakens our collective
security?
SCNR, Konrad
LOL,
Konrad,
I haven't had any active clearance in a very long time, assuming nobody
was lying during those projects early in my career.
This is a world of big data. Infobright, OrientDB, Riak, etc. OpenSource
and massive, some with data compression up to 40:1. That's assuming you
don't scope your attacks to the 32TB single table limit of PostgreSQL.
We have botnets available to evil doers with sizes in the millions.
Screaming about the size of the forest one will hide there tree in
doesn't change the security by obscurity aspect of it. Thumping the desk
and claiming a forest which is 2^128 * 2^key-bit-width doesn't mean you
aren't relying on obscurity, especially when they know what tree they
are looking for.
Removing the tree is how one has to proceed.
Let us not forget we are at the end of the x86 era when it comes to what
evil-doers will use to generate a fingerprint database, or brute force
crack.
https://www.technologyreview.com/s/613596/how-a-quantum-computer-could-break-2048-bit-rsa-encryption-in-8-hours/
[Now Gidney and Ekerå have shown how a quantum computer could do the
calculation with just 20 million qubits. Indeed, they show that such a
device would take just eight hours to complete the calculation. “[As a
result], the worst case estimate of how many qubits will be needed to
factor 2048 bit RSA integers has dropped nearly two orders of
magnitude,” they say.]
While there are those here claiming 128-bit and 256-bit are
"uncrackable" people with money long since moved to 2048-bit because 128
and 256 are the new 64-bit encryption levels. They know that an entity
wanting to decrypt their sniffed packets doesn't need the complete
database, just a few fingerprints which work relatively reliably. They
won't get everything, but they might get the critical stuff.
Haven't you noticed a pattern over the decades?
X-bit encryption would take a "super computer" (never actually
identifying which one) N-years running flat out to crack.
A few years later
Y-bit encryption would take a "super computer" (never actually
identifying which one) N-years running flat out to crack (without any
mention of why they were/are wrong about X-bit).
Oh! You wanted "Why?" Sorry.
I get this list in digest form. Most of the time I don't read it. Only a
tiny fraction of my life revolves around Qt and small systems. This
whole security thing came up in another part of my world, then I
actually read something here.
*nix did it wrong. No application should be allowed to open its own
TCP/IP or network connection. No application should have any knowledge
of transport layer security, certificates or anything else. Unisys and a
few other "big systems" platforms are baking into their OS a Network
Software Appliance. This allows system managers to dynamically change
transport layer communications protocols on a whim. Not just transport
layer security, but what network is in use, even non-TCP based things
like Token Ring, DECNet, left-handed-monkey-wrench, etc.
All of that is well and good. It's how things should have been done to
start with.
The fly in the ointment is developers using "human interpretable" data
formats for transmission. Moving to a non-IP based network (meaning not
running a different protocol on top of IP but running a completely
different network protocol on machines which don't even have the IP
stack software installed) can buy you a lot, but if you are a high value
target and that network runs between data centers someone will
eventually find a way to tap into it.
Even if that is not your point of penetration some people/developers
store this human readable stuff on disk. My God, CouchDB actually stores
JSON! Yeah, that's how you want to see someone storing a mass quantity
of CC information along with answers to security questions and mother's
maiden name.
My having to ponder all of this is how we got here.
--
Roland Hughes, President
Logikal Solutions
(630)-205-1593
http://www.theminimumyouneedtoknow.com
http://www.infiniteexposure.net
http://www.johnsmith-book.com
http://www.logikalblog.com
http://www.interestingauthors.com/blog
_______________________________________________
Interest mailing list
Interest@qt-project.org
https://lists.qt-project.org/listinfo/interest
