Timeline for Technology that can survive a "Rubber-Hose attack"
Current License: CC BY-SA 3.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Mar 5, 2015 at 19:35 | comment | added | DoubleDouble | * imagines a game of "Missile Command" having to be played before being allowed to launch missiles at the enemy.. ironically you protect the cities too well and the enemy blows you up before you complete the game. | |
| Mar 4, 2015 at 21:53 | comment | added | Matthew Peters |
@AlexKuhl, the game analogy is great (thanks Armani) but the key is not necessarily how you play the game but rather the game itself. For instance, I can demonstrate how to swim but I cannot explain (in significant detail) how I learned how to swim. The process of learning (or the game) is the key -or rather contains the key, because a user will subconsciously inherit the item being taught and it is that subconscious level where the 'password' is stored in your brain. Bare in mind that this paper is a mere conceptual approach and not necessarily a ready to implement design...
|
|
| Mar 4, 2015 at 21:20 | comment | added | armani | You grabbed that part from their Intro, whereas in Section 5.1 they describe how it is solved, but they do apply certain unreasonable constraints such as the user being physically at some location to authenticate. Either way, this nitpicking doesn't answer the OP's question, and I believe implicit learning techniques might be what Snowden is referring to. | |
| Mar 4, 2015 at 19:11 | comment | added | Alex Kuhl | The part you're citing does not solve the problem I mention. They define their "basic threat model" where an attacker intercepts some number of users, gets info out of them, and then tries to impersonate them at some physically secure location where an alarm is raised after a failed login attempt. The scenario here is different: the encryption is local to one computer and the attacker can force the actual user to play the game, no impersonation required. This is mentioned here arstechnica.com/security/2012/07/… and in the comments. | |
| Mar 4, 2015 at 16:42 | comment | added | armani | The paper discusses that the user is not consciously aware that they have the password, nor might they even realize what the authentication mechanism is, especially under stress. Furthermore, check the "Basic Coercion Threat Model" section of that paper's Section 5.1 where they show the situation you describe as being impractical (for a 5-minute test it would take "about one year of nonstop testing per user which will either interfere with the user’s learned password rendering the user useless to the attacker, or alert security administrators.") | |
| Mar 4, 2015 at 16:30 | comment | added | Alex Kuhl | Could you not be tortured to (1) reveal how you decrypt (playing the game) and then (2) be forced to play it? I suppose, under torture, you could argue that you can't play the game the same way due to the stress? | |
| Mar 4, 2015 at 16:01 | history | answered | armani | CC BY-SA 3.0 |