metaweta

metaweta@gmail.com

Thanks!

I think he ended up only spending around $5-10K on compute. I'd have to check with Nash.

Yeah, he knew it was a long passphrase.

There's no way that the AccessData job I had would exist today. Most services are online, with data encrypted in transit and stored in the cloud. TLS security has improved dramatically over the last decade in response to attacks like BEAST and BREACH and CRIME and POODLE. Google drops (? is going to drop?) your SEO ranking if you don't have proper certs installed. Nowadays, it's rare to find an attack on the connection from the browser to the server. Instead, it's either malware on the client or hacking into the servers, where the operators have terrible security practices like storing data unencrypted at rest.

The field of cryptography has grown tremendously, and there's still a lot of research being done. There have been many competitions for developing strong cryptographic primitives. There's a lot of work being done on zero knowledge proofs and verifiable computation. Cryptocurrency has encouraged lots of bright young minds to get involved.

One thing we learned from the Snowden revelations is that crypto works where it's applied, so every little bit of crypto helps. Run a Tor node if you can.

I kept a Cryptonomicon!

lol yeah

Looking, thanks!

Glad to hear it!

Lol thanks!

Thanks!

That little animation was put there by the guy who hired me. We got rid of it in the Password Recovery ToolKit that combined all the modules I'd written into a single tool. In that one, we had a big list of any encrypted files we found and their passwords. With enough modules, it was entertaining enough to watch the list grow. And it was very satisfying when the user reused a password on something trivial to crack that let us open a Word 97 file.

He actually tried that without success.

I'm in the USA. He paid us for some work up front and agreed to pay the rest on delivery of the key. He expected to spend most of the $100K he'd budgeted on GPU costs, so we got much less than that for the work; we took the job because it sounded like fun. We didn't need the information in the archived files, just the encryption headers, so he set most of the bytes to zero. I couldn't have spent the coins even if I wanted to.

Yeah, and it's why I left that job for something else.

Hahaha, thanks!

Exactly. We created some zip files we knew the password to and then checked that our code found the right one. Each stage would generate a bunch of files with different candidate ranges, so when testing the next stage, we'd choose the one file we knew had the correct key in it.

RChain is an Ethereum competitor. It aims to fix several problems with Ethereum.

First, it will scale better: Ethereum currently runs every contract on every computer running a node, and insists on a total order on all transactions. RChain will have a notion of a rooted directed acyclic graph of regions in which contracts will run, a much finer-grained notion of transaction, and will only insist on a partial order for transactions: when they do not conflict, they can be in any order.

Second, Ethereum has no type system. This has led to bugs in various contracts and wallets. In June 2016, a buggy contract led to the theft of $50M in ETH from the DAO. The Ethereum community split into two parts: the first part insisted that "code is law" and that the hacker engaged in a series of perfectly valid transactions with the contract, so he was entitled to the ETH; the second part wanted human intervention to roll back a large transaction that was obviously a bug. They never reconciled, and "Ethereum Classic" forked off as a separate currency. Last year, someone exploited a bug in a Parity wallet and locked up $380M. Contracts are expressions of programmer intent, but programmers are human and make mistakes. Type systems allow programmers to write a kind of "summary" of their intent as a type. The compiler compares the two expressions and fails if they are not consistent. Greg Meredith (President of RChain) showed that one could have defended against the theft using a spatial-behavioral type system: https://docs.google.com/document/d/1sGlObhGhoEizBXC30Ww4h1KH...

Third, the Ethereum VM has suffered from various bugs (https://bounty.ethereum.org/) and relies on a find-and-patch system. RChain intends to formally verify as much of the platform as possible.

Last and probably least, Ethereum uses proof of work, which is basically proof of stake, but you're staking GPUs and ongoing electricity costs. RChain will use Vlad Zamfir's "correct by construction" proof of stake algorithm.

-- Mike Stay