Sometimes I check my work email and see the message “Announcement of the report: Vertex elliptic cryptography in N-sided Bananotryahovykh
[1] spaces. I look at the annotation and it says something like “It is well known that the 5-sided exchange of secrets is illegal since the times of the Protestant Reformation [Luther 1517]. However, using new results in the field of Bananotryhovy projections that were performed during polynomial time, we show how many correspondents who pretend to be friends (but are opponents)
[2] , can send each other up to 5 sarcastic, stinging remarks that are resistant to attacks using the selected text from the banana text. It feels like the middle of a tragic but hardly interesting opera has begun. For what reason have we just been shoved into the elliptical world? Who exactly is this Bananotryah, and why do we not care what kind of plaintext it chooses? If because he has kidnapped our families, can I at least exchange messages with the kidnapped relatives, and if so, do the messages have to be malicious and sarcastic?
Researchers involved in such problems remind me of some of my friends, triathlon lovers. When I run into them, I say: “But in a normal normal universe, this is when they will chase you around the lake, then by bike, and then along the road where the car will not pass, but can you run in a wetsuit? Does this even happen in nature? And if so, maybe, instead of preparing for such an event, it would be better to find out why some madman makes people swim, then ride a bike, and then run. ”A friend usually replies,“ Triathlon is good training, ”and I I say to him, “Yes, if you made a bad choice several times and now the waterfowl Ronald McDonald is hunting you.” A friend says, "And where did you get that Ronald MacDonald was stalking me?", And I reply, "DO YOU EYE, WHO MORE THIS CAN BE?", And my friend stops talking to me about triathlon, and this result suits me perfectly .

In general, I think security researchers have a problem with PR. Safes as smug teenagers who listen to gothic music: they are overwhelmed with unhealthy and detailed monologues about the ubiquitous catastrophes around us, but to the practical question "what do people do before the inevitable death from ravens or from the lack of black mascara for their eyelashes" less. Well, like, websites are great, BUT DON'T CLICK ON THIS LINK, and your phone is capable of launching all this bunch of great apps, BUT MANY OF YOUR APPLICATIONS ARE EVIL, and if you order it on Craigslist
[3] a bride from Russia CAN COME TO THE REFLECTED MAN WITH PHILIPINN WHICH A TRIP TO THE BOX DON'T LIKE. At the same time, it is not clear what else to do with computers, except to click on all sorts of things, launch applications and fill in the voids in your soul by writing out poor foreigners. If the safeguards are right, then the only demonstrably safe activity is to stare at a horseshoe, whose integrity is certified by a quorum of Rivest, Shamir and Adleman
[4] . However, for some reason I do not feel enthusiastic about the prospects for life in the style of Pilgrim, who magically has access to any two of the trinity {Rivest, Shamir, Adleman}; mainly because if I were a bored Pilgrim and I had a time machine, then I would kidnap
Samuel Jackson or
Robocop , and not some wizard-mathematicians from the future, so that they would tease me with their knowledge of primes and the final of the series
"Breaking Bad" .
')
The only gift I ever wanted for Christmas is an automated method of generating such persistent passwords that you can remember. Unfortunately, most of the security community is obsessed with avant-garde horrors, such as the fact that during a solar eclipse you can remotely take control of your pacemaker using the garage door lifter and the cans of chips Pringles.
[5] . It is truly regrettable, of course, that the Pringles banks open the way for the little-known Sithobid Forces, applicable against those 0.002% of the world's population who simultaneously have a pacemaker and mortal enemies among amateur electronics engineers. However, if there is someone stubborn enough to kill you by focusing electromagnetic energy through the bank of Pringles, then you probably did something such that you deserve such a death. I do not declare that I wish you death, but I argue that you may have to die in order for researchers who are now studying photonic message authentication hash codes (HMAC) for cardiac pacemakers to finally make it easier to create good passwords. . "But James," you will argue, "there is a bunch of techniques for selecting passwords!" Yes, I am aware of the “choose a bright image” technique, and if I lived in the sensory deprivation chamber and never used the Internet, I could easily remember the phrase-password like “The party of giant Martian insects”. Alas, I
used the Internet, which means that I saw, heard, and in some places even paid money for everything that you can imagine. I saw the video “Giant Martian Insects Party”, and I saw another video, “Giant Martian Insects Party: Don't Tell Mom,” and I didn’t like both videos, but it didn’t stop me and I made a sequel, “Giant Martian Insects Party : Retribution
[6] . So it is incredibly difficult for me to come up with a well-remembered image, so that it stands out among the raging ocean of absurdities that fills my head as a result of consuming 31 hours of media content every 24 hours. It’s hard to come up with a memorable image, and so life doesn’t seem like honey, security officers say they also need
different passwords for
different websites. So it means that I have to remember
both the “Party of giant Martian insects”
and the “Structurally fragile Yeti bag”, and somehow, in addition, we need to remember which of these phrases is for my online bank, and which for another website that does not have nothing to do with extraterrestrial insects, nor with the equipment of the Yeti. This is barbarism and I demand more from life. So when security researchers say they don’t work on passwords, it’s as if WWII physicists said they don’t work on radars and nuclear bombs, but instead solve the mysteries of the flight of the bumblebee. Well, like, you're so close, but still so far. You almost understand, but it's worse than not understanding at all.

I'm trying to say that the security men need to determine their priorities. The “threat model” section of any security article is reminiscent of a telenovela script written by a paranoid schizophrenic: there is an elaborate narrative and global conspiracy theories, there are heroes and there are villains with fantastic (but strangely limited) superpowers, which inevitably entails a painful battle for complete emotional and technical exhaustion. In the real world, threat models are much simpler, see fig. 1. On the fingers, you are dealing with either the Mossad or not the Mossad. If your opponent is not the Mossad, then if you choose a good password and you do not respond to emails from the address ChEaPestPAiNPi11s@virus-basket.biz.ru, everything will most likely be fine. And if your opponent is Mossad, YOU DIE AND WITH THIS YOU HAVE NOTHING TO DO ANYTHING. Mossad is not deterred by the fact that you use https. If Mossad needs your data, they will replace your mobile phone with a drone with a piece of uranium in the form of a phone, and when you die of cancer inside the tumors, they will gather a press conference and say, “It's not us,” without removing the T-shirts that say “IT'S ONLY WE », And then they will buy all your belongings on sale of property and look at the originals of photos from your vacation instead of reading boring emails about these photos. In general, for https: // and a couple of dollars you can buy a bus ticket to nowhere. And yet, GRADUATOR FROST NON-EXISTENT. Misfortune never comes alone.
Fig.1.
Threat | Decision |
Former / former hacked your mailbox and published your correspondence with the fan club "My Little Pony" | Strong passwords |
Organized criminals hacked your mailbox and send spam | Strong passwords + common sense (do not click on the spam of Viagra from healing herbs, this will lead to keyloggers and sorrows) |
Mossad is doing all sorts of Mossad things with your mail | - Magic amulets?
- Stage your death and move to a submarine?
- MOSSAD EVERYTHING WILL COME FOR YOU
|
Dualism "Mossad or not Mossad" is just one of the truths that security researchers are trying to hide. Their community uses a bunch of eye-catching tricks and comforting words, hiding the true nature of reality; in this sense, they resemble dealers of used cars and girl scouts (whose “cookie sales” are simply front companies for Yakuza). At the very beginning of the articles on security, there is often a sentence “suppose that there is a public key cryptosystem”. As planned by the authors, you will run through this offer with your eyes quickly and without thinking, as if organizing a scalable infrastructure for keys is a project for the weekend, well, as if the shelves in the closet are nailed or you can tame a chinchilla. Based on the public key infrastructure, the authors propose to do all sorts of fascinating things, like in “Bachelor Party in Vegas”
[7] , such as taking hashes from keys, and organizing keys into cool tree structures, and finding out which users are bad and whose keys can be destroyed, or revoked, or poured with concrete and deactivated. To better describe the Mendelian genetics of keys, the authors define wonderful, unnatural operators on keys; The operators Leviticus (the third book of the Old Testament) and the state of Alabama describe as ungodly, whose definitions force them to deal with incomprehensible, full of subscript indices like “Let K
r ₩ K
t mean a semi-Kasparov chot-plugging operation in a two-sided XY
abc space , such that they missed out about the exponent, but they did not create a new key. ”The party on key signing in the Caligula style looks like a very interesting thing, but in practice it’s extremely difficult to build a public key infrastructure lo. When someone says “suppose there is a public key cryptosystem”, this is roughly equivalent to saying “suppose it is possible to clone dinosaurs and fill the park with these dinosaurs, and you can buy a ticket in such a Jurassic Park and walk through this park , and you will not be devoured, you will not be torn off with claws and you will not get into a state of quantum coupling with a macroscopic dinosaur particle either. ”In the case of public-key-based cryptography, there is a monstrous, fundamental The real problem, the real challenge: to find someone, or at least someone, so that they create and maintain infrastructure. For example, you can subscribe to a well-known technology company, but this will offend the refined aesthetic feelings of the slightly vaguely Marxist and at the same time cozy bourgeois hacker community who want everything to be decentralized and without any irony believe Thor
[8] is really used for anything other than drug trafficking and conspiracy to steal. Or give another way, the public key infrastructure can use the decentralized “web of trust” model; in such an architecture, individuals make their own keys and certify the keys of trusted accomplices, thereby creating chains of evidence. “Chains of Testimonies” is a great name for a heavy metal band, but it is somewhat less practical in the real world, not based on events from the life of Ozzy Osbourne, because I don’t just need a chain of testimonies between me and some unknown vile stranger - I also need a chain of evidence
for each link in this chain . Such recursive evidence gradually leads to
fractals and insanity in the style of
GF Lovecraft . In addition, trust-based cryptosystems lead to the generation of emails with extremely short texts (for example, “well, are you in the saddle’s rocking bush?!?!?!?”) And many kilobyte PGP key attachments, which gives you 98.5% overhead in transferring network packets . PGP enthusiasts are like that guy with a university degree in ethno-literature, who has a few paragraphs with 14 Buddhist quotes about wisdom and about the relationship between humanity and trees. Well, like, good, good, I ALREADY UNDERSTOOD. You care about those things that you care about. Now please leave me alone, I want to reflect on the inevitability of death.

And the guys who claim that you can use social networks for the initial launch of the key infrastructure - these guys are even worse than the PGP minions. Alas, people in social networks are the same stupid Krivorukovy bad guys that inhabit the physical world. That is, people from social networks are the same people who put toolbars for search, try to click on a monkey and win an iPad and are not ready to confidently deny that buying an application to predict fate for any non-zero amount of money is a good idea. These are not the best people in the history of people, however, somehow, I have to embroider these clowns on a luxurious cryptographic tapestry with the support of key recall and verified audit logs. I once flew on an airplane, and a neighbor asked me why his laptop did not turn on, and I tried to press the power button, and I noticed that the button was sticking, and I asked, uh, and why the button is sticking, and he said, Well, THIS IS BECAUSE I HAVE DRAWN THROUGH THE GOVERNING BANK OF GAS, BUT IT'S NOT A PROBLEM, TRUE? I do not think that this dude is ready to organize cryptographic operations with 2048-bit integers.
Another myth disseminated by researchers in the field of security argues that planet Earth contains more than 6 programmers who are able to correctly use security labels and information flow control (ITP). This belief requires us to assume that despite the fact that the two most frequent variable names in the code are “thing” and “thing2”, at the moment when programmers are confronted with a type system in the Dungeons-and-Dragons style (the rules system for role-playing games), which causes each variable to annotate with exhaustive biographical data, as well as a list of vulnerabilities to unverified user input
[9] , they, programmers, magically become disciplined software architects. In humans, a real neurosis happens when they are asked if you want in addition a large french fries for only 50 cents, so I doubt that the incomprehensible grid calculation will be a big hit among young people. Well, in a sense, yes, I understand how to place tags in order to write a safe version of HelloWorld (), but as soon as my program grows to 10 functions, the desire to think about combinatorial tag flows gradually decreases and is replaced by an urgent desire to DECREASE () go home and stop worrying about morally difficult expressions like "taint-blast", that is, "blast of pollution"
[10] , which are typically associated with the diaper industry or the MES. I understand that in an ideal world, I would sort and recycle all the garbage, send 10% of my income to charity, and would voluntarily and with a song agree to cognitive overhead due to abundantly spaced security tags. However, pragmatists understand that I will spend most of my free money on comic books, and instead of sorting garbage, I’ll throw it all out in New Jersey, where it organizes itself into a complex Matrix-like simulation of the world of gulls; simulation, consisting entirely of particles unsafe for swallowing size and objects in the shape of gulls, but not gulls and not reacting to the nuptial rituals of gulls by creating new small gulls. This is, of course, a problem, but it is precisely the identification of problems that makes science interesting, and now we know that special forces must be sent to New Jersey to neutralize the cellular automaton that threatens the gulls' way of life. Similarly, we know that TTI research should not focus on what happens if I somehow use 17 types of tags to describe 3 types of variables. Instead, the UIP should focus on the question of what happens if I put the Mark of the Lord on all my variables, so that my program compiles and I return to my beloved family.
[By the way, I think that “The Mark of the Lord” was an important element of the plot in
Dune’s sixth novel, but I stopped reading the series after the fifth book and the seven hundredth report, started with “
WHO CONTROLS SPICE , CONTROLS (SOMETHING NOT SPICE)”. , , ,
, , . , „“ .]
, . , ; , , .. , , ; , . , . , , „, “. - , - DefConHat 2014 , SMS- . , . , : , . , , , , , , ,
: , .

- Bojangle. , , balls jangle , . „“ , ; „“ ; „“ - (-) , … , .
- Frenemies.
- Craigslist , -, . ( , Craiglist.)
- , , , , . (, ,
, , ). - , ?!
- Into Darkness. Star Trek: Intro Darkness „: “.
- Ferris Bueller . , ? .
- Tor, - . !
- Output sinks. .
- Taint explosion, taint analysis. , „ “: (, ) , (tainted); , , . -, , „“ 3 3 , 7, 13 9 … taint explosion.