[Q] Diceware password size
Tue May 27 23:54:02 2003
Content-Type: text/plain; charset=us-ascii
Thanks for the info. It's good to be aware of possible avenues of=20
What precautions would you suggest be used to protect one's data?
I mean, if it's so easy to grab the passphrase as you say it is, why=20
bother with GnuPG at all?
I can't protect from a hired thief breaking into my home/office and=20
attaching a key-logger to my keyboard. Perhaps I can protect from the=20
software-based attacks. I already use Unix/Linux where viruses and worms=
are less common, and I don't generally install software from unknown=20
What advise would you offer?
Thanks for the help.
On Tue, May 27, 2003 at 03:56:54PM -0500, Ryan Malayter wrote:
> From: Daniel Carrera [mailto:firstname.lastname@example.org]=20
> >If I make sure that breaking my passphrase is=20
> >harder than putting a key-logger, all I have to=20
> >make sure is that putting a key-logger is more=20
> >expensive than the value of my data.
> This is going to be very hard for you to do. Almost every OS can be
> remotely compromised by a skilled hacker if you allow any connections
> from the Internet at all. There is undoubtedly a buffer overflow
> somewhere in the service you use. The "hack this box" contests security
> companies use to show of their wares routinely end in hours.
> A foreign attacker could easily bribe a local thief to break into your
> house for a few hundred dollars. They could write a virus, worm, patch,
> or game that includes a keystroke logger that you unwittingly install
> yourself. You may say, "I only use open-source software", but do you
> review each line of code yourself, or simply trust the PGP signature on
> the package came from someone trustworthy? Putting a keystroke logging
> program into your machine in this way is not too expensive or difficult
> for an organization with the right skills; the recent file-sharing
> viruses actually do this.
> This is why *really* secure systems need to be on isolated networks in
> extremely physically secure locations. The U.S. Department of Defense,
> CIA, FBI, and NSA, Britain's MI5, Russia's CSR, and the Israeli Mossad
> are probably still the leaders in this area.
Daniel Carrera | OpenPGP fingerprint:
Graduate TA, Math Dept | 6643 8C8B 3522 66CB D16C D779 2FDD 7DAC 9AF7 7A88
UMD (301) 405-5137 | http://www.math.umd.edu/~dcarrera/pgp.html
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (SunOS)
-----END PGP SIGNATURE-----