Barry Manilow Highlights 'Three Strikes' Law StupidityISP argues assumed guilt by IP isn't too smart... 04:08PM Friday Oct 16 2009 by Karl Bodetags: legal · Fileswapping · business · Op/Ed · worldIn the UK, the government is still working toward the entertainment industry's goal of booting heavy P2P users off of the Internet, should they be caught transferring pirated material three times. As we've covered at length, this is a bad idea for a number of reasons. Piracy technology detection systems are unreliable, expensive to implement, require tracking offenders across ISPs, there's usually no independently verifiable protection for falsely accused customers, and booting P2P users removes the possibility of turning these users into paying customers. ISPs don't want to pay for such systems, and unless they've got one foot in content like AT&T or Comcast, why should they? They're essentially using their revenues to pay for the entertainment industry's failure to adapt to the broadband age while at the same time losing a paying customer. Smaller ISPs in particular aren't exactly eager to take on the added support costs of such systems. All of this even assumes such a system would work. In order to highlight how susceptible such a system would be to manipulation and false positives, UK broadband ISP TalkTalk conducted a bit of a publicity stunt by driving around and leeching Barry Manilow songs via open hotspots: Within a couple of hours he had identified 23 wireless connections on the street – more than one-third of the total – which are vulnerable to Wi-Fi hijacking. These connections are either completely unsecured (6%) or use WEP technology (28%) which many users think is secure but is in fact easily hackable by anyone with a laptop computer. To show how vulnerable people are to unauthorised filesharing, our expert downloaded legal music files from two connections, including Barry Manilow’s hit Mandy and the soundtrack from the 1992 film Peter’s Friends. Obviously, assuming guilt by IP alone isn't too bright. In France, where President Nicolas Sarkozy has made that country's three strikes initiative a personal pet project, they've included provisions that fine broadband users who leave wireless access points unsecured. Again though, do you fine users for using WEP and being hacked? Who tracks this? Who tracks P2P users between ISPs? Who pays? It all seems like layer upon layer of unreliable technology, potential legal problems, and added taxpayer and ISP expense. Nothing will ever stop piracy, but it seems like an easier solution to weakening piracy exists: lawmakers should tell the entertainment industry to suck it up and adapt. Put the money spent lobbying for three strikes laws and suing customers into developing easy and inexpensive content platforms that compete with piracy.
Related:- Kicking People Off The Internet Is Not A Business Model
- Music Industry Wants ISPs To Adhere To Nonexistent Laws
- Spain Shoots Down 'Three Strikes' Idea
- The Pirate Bay Gets Sold
- Pirate Bay Sale Sees Insider Trading
- Swedish ISP Fights New Piracy Law
- British Cops, Spies Oppose 'Three Strikes'
- Will 'Three Strikes' Come To The United States?
|
 
El Quintron
Could you spare a consulting gig?
join:2008-04-28
Etobicoke, ON | Its almost poetic We used to have rick-rolling...
Now when MAFIAA trolls come into forums we should Barry-roll? Manilow-roll?
Fun fun... | |
|  | zipjay
join:2003-03-11
Louisville, KY | Re: Its almost poetic DO A BARRY ROLL!! | |
| | | 
Karl Bode
News Guy
join:2000-03-02 | Re: Its almost poetic Oh Mandy! | |
| | | | 
zachary1
you talkin' to me?
join:2004-03-07
right here | Re: Its almost poetic And I need you today oh Mandy
You kissed me and stopped me from shaking...
and I need yoooooooooouuuuuuu..... | |
| |
zachary1
you talkin' to me?
join:2004-03-07
right here | I write the songs that make the Whole World Siiiiiiiiiiiing... | |
| | |
zachary1
you talkin' to me?
join:2004-03-07
right here | Re: Its almost poetic I write the songs of love and special things,
I write the songs that make the young girls cry....
I write the songs! | |
| | | | 
Noah Vail
Premium
join:2004-12-10
Lorton, VA
 ·RoadRunner Cable
| I've Been Alive Forever
Barry Barry Old |
NV | |
| | | | | 
Beachie
Stranded in paradise
join:2001-07-12
St. Pete, FL | Re: I've Been Alive Forever I'm a Pepper, he's a Pepper, she's a Pepper, wouldn't you like to be a Pepper, too?
(Be a Pepper. Drink Dr Pepper...) | |
| | | | | | 
My Favorite
@teksavvy.com | Re: I've Been Alive Forever I am stuck on Band-Ade,
Because Band-Ade's stuck on me. | |
| | 
Mospaw
D O N E
Hawaiian Jellyfish
join:2001-01-08
The Pacific | It's the Mani-roll! | |
| | | | | gorehound
join:2009-06-19
Portland, ME | and they should be scared cause the more folks they kick off the more folks will be pissed off and will never spend a dime on their shitty greedy industry. | |
| | | 
TKJunkMail
Enjoy the sun
Premium
join:2002-03-03
Avalon, NJ |  Fine unsecured APs
| |
| | Lazlow
join:2006-08-07
Saint Louis, MO
1 edit | Re: Fine unsecured APs But how secure is secure enough? Is wep enough? WPA? WPA2? All of these can and have been hacked. So is a higher layer required?
Edit: Keep in mind that Docsis has also been hacked. | |
| | | KodiacZiller
join:2008-09-04
73368
| Re: Fine unsecured APs said by Lazlow  :But how secure is secure enough? Is wep enough? WPA? WPA2? All of these can and have been hacked. So is a higher layer required? Edit: Keep in mind that Docsis has also been hacked. Maybe I am behind the times, but when was WPA2/PSK cracked? | |
| | | | Lazlow
join:2006-08-07
Saint Louis, MO | Re: Fine unsecured APs Just google WPA2 crack and you will see tons of howtos. The basics method has been around for at least a couple of years. | |
| | | | | 
BIGMIKE
Premium
join:2002-06-07
Westminster, CA
| Re: Fine unsecured APs said by Lazlow :Just google WPA2 crack and you will see tons of howtos. The basics method has been around for at least a couple of years. Russian WPA, WPA2 Crack
»hothardware.com/News/Russian-Fir···PA-WPA2/ | |
| | | | | | 
DataRiker
Premium
join:2002-05-19
Metairie, LA
clubs:
| Re: Fine unsecured APs said by BIGMIKE :said by Lazlow :Just google WPA2 crack and you will see tons of howtos. The basics method has been around for at least a couple of years. Russian WPA, WPA2 Crack » hothardware.com/News/Russian-Fir···PA-WPA2/ No, there is no "crack" for WPA or WPA2. Contrary to popular belief and numerous news articles here, brute force is still the only option. | |
| | | | | | | RvLeshrac
join:2000-08-13
Smyrna, GA
 ·EarthLink
| Re: Fine unsecured APs It does, indeed, take time to brute-force the WPA/2 keys. However, the whole "GPU-based cracking" approach speeds things up dramatically.
Now imagine someone with an SLI, quad-core laptop. That's two GPUs and four 'CPUs'.
Now imagine someone with an SLI, I7 laptop. That's two GPUs and eight "CPUs" crunching the data at an incredible rate. | |
| | | | | | | | | | | | | | | Angrychair
join:2000-09-20
Jacksonville, FL | Re: Fine unsecured APs Pride goeth before destruction, and a haughty spirit before a fall. | |
| | | | | | | | | 
Ian
Premium
join:2002-06-18
ON
·Bell Sympatico
| Re: Fine unsecured APs said by Angrychair :Pride goeth before destruction, and a haughty spirit before a fall. If an actual flaw in the WPA2 algorithm is discovered it is vulnerable, but the math dictates that brute force against a 256 bit key is not easy to do. And since the OP was referencing that software based brute-force attack and not a flaw here's how the math breaks down.
Number of possible keys = 2^256 which is 115,792,089,237,316,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 in base 10.
They showed examples of 100 million guesses a second. Impressive, yes, except even if we assume getting it right on average in half the keys, that would still take 578,960,446,186,581,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 seconds. Which is 18,358,715,315,404,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000,000 years. Which incidentally is many times more than the age of the Universe itself. Now let's say they for some reason get 100 million such equipped PCs to work on the problem of leeching my bandwidth around the world (for some reason). That would still take 183,587,153,154,040,000,000,000,000,000,000,000,000,000,000,000,000,000 years. 
Granted if you set your passphrase as "Linksys" the problem is simpler....
--
“Any claim that the root of a problem is simple should be treated the same as a claim that the root of a problem is Bigfoot. Simplicity and Bigfoot are found in the real world with about the same frequency.” – David Wong | |
| | | | | | | | | | | | | | | | | | | | Lazlow
join:2006-08-07
Saint Louis, MO
| Ian
The thing you are leaving out of the equation is the human element. The vast majority of users will only use common phrases, which (generally) narrows down the choices to a few hundred thousand variations(which is where GPUs can really shine). Since one can passively grab the encrypted phrase and brute force it off line, it drops the attackers risk to almost zero. Add this to the fact that the vast majority of people seldom change their pass phrase more than once a year, and it becomes obvious how easy access can be obtained. | |
| | | | | | | | | |
Ian
Premium
join:2002-06-18
ON
·Bell Sympatico
| Re: Fine unsecured APs said by Lazlow :Ian The thing you are leaving out of the equation is the human element. The vast majority of users will only use common phrases, which (generally) narrows down the choices to a few hundred thousand variations(which is where GPUs can really shine). Since one can passively grab the encrypted phrase and brute force it off line, it drops the attackers risk to almost zero. Add this to the fact that the vast majority of people seldom change their pass phrase more than once a year, and it becomes obvious how easy access can be obtained. Oh, I know. And as was stated, the vast majority of users leave it with WEP, or entirely unsecured. However, we're talking about hypothetically fining people for leaving their access unsecured. To me, that includes users who set up weak passwords that can be dictionary attacked.
That said, even a passphrase generated with dictionary words sky-rockets in complexity when the word count is beyond two words and includes numbers and other symbols.
And looking at the real world implications... So I want to leech off of my neighbours WiFi, which is protected by WPA2. Do I shell out hundreds of dollars for a Russian program to attempt to crack into it, not knowing (yet) whether or not he used his pet's name "Princess" or "Gh6$#@L!(s72tTyfij6sb2hidFFWEFdfsd" to encrypt it?
--
“Any claim that the root of a problem is simple should be treated the same as a claim that the root of a problem is Bigfoot. Simplicity and Bigfoot are found in the real world with about the same frequency.” – David Wong | |
| | | | | | | | | | Lazlow
join:2006-08-07
Saint Louis, MO
| Re: Fine unsecured APs »dookie.dkearns.ca/?p=49
Above is an example of breaking a probably above average password. The tools used to break it are all open source (no cost). It probably took less than 15 minutes from start to finish.
You can change my original question to how(and who) decides if a pass phrase is strong enough? Remember one can add any pass phrase one wishes to one's attack dictionary. You can even link it to things like john the ripper, that will generate even your example password. It is just a matter of time. With the use of rainbow tables and simple parallel processors(GPUs), the time required is dramatically reduces. | |
| | | | | | | | | |
Ian
Premium
join:2002-06-18
ON
·Bell Sympatico
1 edit | Re: Fine unsecured APs said by Lazlow :» dookie.dkearns.ca/?p=49Above is an example of breaking a probably above average password. The tools used to break it are all open source (no cost). It probably took less than 15 minutes from start to finish. You can change my original question to how(and who) decides if a pass phrase is strong enough? Remember one can add any pass phrase one wishes to one's attack dictionary. You can even link it to things like john the ripper, that will generate even your example password. It is just a matter of time. With the use of rainbow tables and simple parallel processors(GPUs), the time required is dramatically reduces. Interesting video. Although that was WPA, not WPA2, and with an extremely short password.
Still calls to question though the lengths that the "average" person should go through to have their home wireless considered "secure" enough to avoid the hypothetical fine. And the flip-side is that if we consider WPA2 with a decent passphrase "insecure", we've now created a defense for someone who has allegedly broken copyright by trading files.
"I'm sorry your honour, but that wasn't my accessing those files. Someone must have cracked my WPA2."
But as an intellectual exercise, let's say my WPA2 password is not gibberish (much more secure), but three English language words separated by 2 random characters.
The use of Rainbow Tables, I assume, is already part of this Russian software to achieve 100 million guesses per second.
There are 500,000 words in the Oxford English Dictionary. If we assume the random characters are among even a short set (128), and assuming even all lower case for the words, that gives 2,048,000,000,000,000,000,000 possible word/character combinations to test. Even at 100 million per second, we're talking 300-700 millenia to crack with one machine. And that's with the foreknowledge that the vector to attack is three English words separated by 2 random characters. Which is not likely to have been known.
--
“Any claim that the root of a problem is simple should be treated the same as a claim that the root of a problem is Bigfoot. Simplicity and Bigfoot are found in the real world with about the same frequency.” – David Wong | |
| | | | | | | | | |
DataRiker
Premium
join:2002-05-19
Metairie, LA
clubs:
| Re: Fine unsecured APs Firstly, there are no rainbow tables ( technically precomputed hash tables) large enough to store anything but "worded" dictionaries. Even good dictionaries contain several languages and are enormous, hundred's and thousands of gigabytes.
Secondly, a good password, say 21+ characters when chosen properly is secure against any GPU or CPU attack ( assuming WPA or WPA2 ).
To reiterate, even the fastest GPU on the market is just a drop in the bucket when it comes to brute forcing anything but the lamest passwords. | |
| | | | | | | | | | Lazlow
join:2006-08-07
Saint Louis, MO
1 edit | 1st. In reality that is a relatively secure password as compared to what is commonly used. Yes, much stronger(and longer) passwords can (and probably should be) used, but the fact is that they are not.
The other thing you are missing (again) is that people do not (generally) use the vast majority of words in the (regular) dictionary. The vast majority of passwords(actually used) use a very small subset of those words. First names, god, and other key words, are still used in the vast majority of passwords. Even the selection of "random" characters chosen in a password is subject to human limitations. People will generally only use characters that they can easily type (in other words, ones that they commonly use).
Edit: After auditing a lot of small business over the last few years, VERY few had even a 15 character pass phrase much less a 21 character. | |
| | | | | | | | | |
DataRiker
Premium
join:2002-05-19
Metairie, LA
clubs:
2 edits | Re: Fine unsecured APs I agree 100%. Bad passwords are to blame, not a falsely accused "cracked" cipher like WPA and WPA2.
Also I would like to note that anything above 8-9 characters is a formidable password ( assuming its not in the dictionary )
My issue is with the fact that people assume a rainbow table is helpful. I have found most passwords contain a NAME + some simple number like "Austin21" for example.
You can kiss that rainbow table goodbye. | |
| | | | | | | | | |
See 8 replies to this post | |
| | | | | | 
menumorut
BE an American.
join:2005-07-04
Queens Village, NY | Thank GOD (and you)!
I was panicking there for a minute! | |
| | | | | | | |
Karl Bode
News Guy
join:2000-03-02
Host:
Road Runner
PC gaming GAMES
PC gaming Tech
1 edit | I like France's idea Who would have guessed. 
What about WEP. Do you fine a user for using WEP?
Do you like the idea of taxpayer dollars going toward a government agency that tracks P2P users between ISPs for the entertainment industry? | |
| | |
TKJunkMail
Enjoy the sun
Premium
join:2002-03-03
Avalon, NJ
 ·Sprint Mobile Broa..
·Comcast
2 edits | Re: Fine unsecured APs said by Karl Bode :I like France's idea Who would have guessed. What about WEP. Do you fine a user for using WEP? Do you like the idea of taxpayer dollars going toward a government agency that tracks P2P users between ISPs for the entertainment industry? NO. Only the "throw the infected bums who won't secure their system off the internet" idea.
--
My BLOG .. .. Internet News .. .. My Web Page
| |
| | | | 
Ebolla
join:2005-09-28
Dracut, MA | Re: Fine unsecured APs unsecured wireless does not mean infected PC's, you know this as well as the rest of us. | |
| | | | | jjeffeory
join:2002-12-04
USA
1 edit | Re: Fine unsecured APs Yes, but he is playing games with us. | |
| | | | 
bender
Bite my shiny metal ass
Premium
join:2005-03-19
Evanston, IL
clubs:
1 edit | so you think starbucks will start running secured wireless? thats lame. | |
| | |
zachary1
you talkin' to me?
join:2004-03-07
right here | People think WEP is lockbox secure! lol | |
| | ck9
join:2004-06-12
Portland, OR
| said by TKJunkMail :I like France's idea. Users with unsecured APs SHOULD be fined. Until individuals, and their ISPs, make sure computers are secure, they should be kicked off the internet. It will be the only way to minimize malware on the internet. So we are going to fine grandma and grandpa who have a wireless network at home which is unsecured because they didn't know that BY LAW all wireless AP's/routers must ship with SECURITY DISABLED BY DEFAULT and don't know how to enable it?
Hmmm, great idea...And it's already been brought up about people who have WEP enabled and get hacked, that's their fault as well because they are the ones who placed their faith in something they were told would secure their network...Doesn't seem very well thought out to me... | |
| | |
See 6 replies to this post | |
| jjeffeory
join:2002-12-04
USA | Right...
Grandma needs to be a net admin in order to use the internet.
LOL.... | |
| | | | |
TKJunkMail
Enjoy the sun
Premium
join:2002-03-03
Avalon, NJ
·Sprint Mobile Broa..
·Comcast
| Re: Fine unsecured APs said by Jameson : Grandma and Grandpa are still not going to know how to secure their wireless. Then they can hire someone to do it. | |
| | | | 
Jameson
10-8
Premium
join:2004-05-28
Fallbrook, CA
clubs: | Re: Fine unsecured APs You missed an important part of my post. | |
| | |
DataRiker
Premium
join:2002-05-19
Metairie, LA
clubs:
| Re: Cracking WPA and WPA2 is not all that hard Good luck breaking anything but the lamest of passwords with that. CUDA is not some magical crack against WPA, but a slight acceleration on CPU's ( although the new i7's are closing that gap rapidly ).
Since no one has ever produced a real crack for WPA - on the order of the WEP crack - a reasonable password will keep your AP secure.
and a little footnote, the so called WPA "crack" is not even close. Under the most unbelievable circumstances somebody **could** decrypt some of your packets. Almost completely useless if trying to gain IP access to an AP. | |
| dentman42
join:2001-10-02
Columbus, OH | Manilow?? Anyone caught pirating (or buying or listening to) Barry Manilow should be locked in a rubber room!
BURY MANILOW! | |
| | ChuckIL9
join:2005-11-07
Peoria, IL | Re: Manilow?? Aww...cmon now...Barry Manilow music is in your head right now.
Her name was Lola...she was a showgirl... | |
| Stumbles
join:2002-12-17
Port Saint Lucie, FL
1 edit | Ha! That'll never happen. This part made me giggle; "...developing easy and inexpensive content platforms that compete with piracy...", like that will ever happen. The entertainment industry along with their mafia styled RIAA/MPAA have had butt-cheek blinders on for so long competing is a foreign concept. | |
| 
cline3621
Mr. Yuk is MEAN Mr. Yuk is GREEN
Premium
join:2006-06-14
Clarksville, TN
 ·CDE
| Mandy? or Bob? I was unaware that Barry Manilow did the voice of Krusty the Clown on the Simpsons. | |
| | | | 
FastiBook
join:2003-01-08
Newtown, PA
·Verizon FIOS
| Anyone, anywhere.... If you have an internet connection, or a wireless network, people can still get to your music if they wanna break into your computer. Music will never be fully secure on any medium. RIAA go blow it out your ***.
- A
--
LETS GO METS! | |
| | | |
|
|
Re: Its almost poetic
·
·
Some stupid title to please the forum rules