Create an Account
username: password:
 
  MemeStreams Logo

MemeStreams Discussion

search


This page contains all of the posts and discussion on MemeStreams referencing the following web page: A Method for Critical Data Theft. You can find discussions on MemeStreams as you surf the web, even if you aren't a MemeStreams member, using the Threads Bookmarklet.

A Method for Critical Data Theft
by possibly noteworthy at 6:50 am EST, Feb 22, 2008

Markoff covers Felten.

The technique, which could undermine security software protecting critical data on computers, is as easy as chilling a computer memory chip with a blast of frigid air from a can of dust remover.

Officials at the Department of Homeland Security, which paid for a portion of the research, did not return repeated calls for comment.

A federal magistrate ruled recently that forcing the suspect to disclose a password would be unconstitutional.


 
RE: A Method for Critical Data Theft
by Decius at 10:37 am EST, Feb 22, 2008

While the fact covered here is quite interesting, the way its being reported is annoying, which perhaps is to be expected.

The technique, which could undermine security software protecting critical data on computers, is as easy as chilling a computer memory chip with a blast of frigid air from a can of dust remover.

Thats kind of like saying brain surgery is as easy as cutting someone's head open with a saw.

Officials at the Department of Homeland Security, which paid for a portion of the research, did not return repeated calls for comment.

What sort of comment is he expecting? "Good job with the research, Ed?" Of course, the idea that police might show up to raids with a computer freezer is not completely far fetched now. I seriously doubt the DOJ comments publicly on forensic tactics.

A federal magistrate ruled recently that forcing the suspect to disclose a password would be unconstitutional.

That subject is rather controversial, apparently. Orin Kerr in particular has attempted to rationalize that forcing someone to disclose a password is not a 5th amendment violation because the password itself is not incriminating, just the information it protects. This, to me, is quite obviously the point where you ought to step back and wonder whether your over-thinking of the wording of the rules has put you in a place where you've managed to undermine the purpose those rules were put in place to serve... The fifth amendment is obviously intended to prevent the sort of situation where the the judicial system finds itself coercing people into aiding in their own convictions -- is this intended only to prevent the coersion of false confessions (which doesn't apply to passwords) or any situation were the system might be tempted to torture people.


 
 
Powered By Industrial Memetics