Fifty Shades Follow Up

So, my previous post managed to make it to the front page of Hacker News! Woo! I essentially achieved my end goal which was to provoke some reasonably thoughtful debate on the topic of censorship of pornography.

Firstly, I'd like to thank those that took the time to read the post, and more so, I'd like to thank those who took part so vigorously in the debate, even if you didn't read the whole post ;-)

I would, however, like to address some of the recurring comments that came up on the Hacker News thread and the comments of this blog.

I would definitely like to see more intelligent discussion on the subject, even though the subject of censorship has been done to death. I personally find the idea that censorship can ever be a good thing an extremely hard pill to swallow, but bring me peer-reviewed evidence and I shall re-assess my position.

Onto the points made by the commentors.

You Didn't Read The Book

Yes! That's absolutely right, I do explain my assertion that the book contains depictions of rape, and they're not based on personally reading the book.

The assertions I have passed on were from a section towards the end of the novel where the protagonist declares that she never wanted anything from Mr. Grey, and that she felt forced to sign some form of "sex contract".

Rape issues aside, it's a blatant violation of standard BDSM practices. If a practitioner is not enjoying it and providing enthusiastic consent then someone is doing something horribly wrong.

The assertion was that this passage alone puts the whole book in a much darker context. I did not relay that assertion very well, as I wanted to focus on the outcomes of the logic and I had assumed that many of the people who'd read the book felt the same way about the acts portrayed in the novel.

It's Absurd to Claim Books will be Banned

"This is the first I've heard about books being banned. I'm extremely skeptical of this claim." --alayne

Well, clearly, you didn't read to the end of the post:

"... thus bringing this absurdist tirade to a close ..."

It is an absurdist piece -- of course it will be absurd! The piece is designed to stimulate discussion on the how far you can actually stretch the definition of "online pornography" and "depicting rape".

In a legal context, I presume this will be settled by precedence, but that's a worrying state of affairs. The discretion of a judge will be the arbiter of what's "pornographic", what's "online" and so on. Chose your battles and judges right (or alternatively, bring it to court often enough so statistically you get a friendly judge), and you'll be able to enforce your personal morality on the law.

BBC News is not a Legal Source

Definitely, and thankfully so! However, nor is the Oxford English Dictionary, which was referenced, so I don't know why people chose to run with BBC News being the problem.

That aside, I was working with what information I had to hand to demonstrate a point, not to make an actual legal assessment of the situation. I assume that something that looks vaguely like Mr. Cameron's vague comments will make it to a bill some time in the future, but it will not be as simple as BBC News has made it out to be. And I hope an actual lawyer will put out a good analysis of it at that time.

Any subject this complex, with so many tensions running high on both sides will undoubtedly have compromises and loop-holes that ensure that the legislation is primarily stifling to the general populace and is not fit for purpose.

A Clockwork Orange is not Porn

To be absolutely clear, I was referring to the book, wherein the protagonist takes two 10 year old girls from a shop, drugs and rapes them. The protagonist also rapes another woman, but my memories grow fuzzy at this point. I have not seen the film, but I gather a world of difference exists between the book and film version when it comes to the rapes. From the comments, I gather that the film may also come under this new legislation, but it's not quite as bad as the book.


I would say that is definitely true that A Clockwork Orange is not porn to me, however, depending on the wording of the law, this could go either way. There could be one set of rules for "online pornography" and one for the "depiction of rape or sexual abuse". This would lead to some difficulties with works like A Clockwork Orange.

Part of the problem is that the line between what is "Art" and what is "Pornography" is so blurred that sometimes, art is porn, and porn is art.

This is not to mention the uncomfortable issue that one man's rubbish is another's gold. Just because you don't find it "pornographic" or "titillating", it doesn't mean to say that another will not.

Fifty Shades Does Not Contain Rape

This has it's own special section, separate from above as I want to tackle something very different and actually very damaging:

"Been a while since I read it and, honestly, I wasn't really taking that much notice but I don't remember any forcible or coercive rape in FSOG." --zimpenfish

As covered above, I think that the protagonist was coerced, but that is besides my point. The comment subtly claims that rape must be forcible or coercive. Rape is sex without consent of one or more of the parties involved by my personal definition. This differs from the legal version and is much broader, but I feel it fits the "spirit" of the word better.

I feel that the kind of comment above implicitly narrows the definition of rape in a very bad way.

Work X is Also in Danger!

By my logic, almost any work that deals with rape or sexual abuse and has been distributed in any form "online" could be in danger. However, my list of works in potential danger is woefully short! I only included the ones off the top of my head early in the morning, so it's bound to be short.

Bringing the total number of works which falls into this category up helps in a few ways:

1. I chose Fifty Shades because it's widely recognised. The more works we can get, the more recognition we get, and the more uncomfortable we can make people when they realise the amount sexual abuse, rape and child abuse is actually explored in literature.
2. More people will have these works in their houses, their local libraries, their places of study. This strengthens the point that if everyone is a criminal, then no one is by simply increasing the number of criminals to near-total coverage.

To be honest, this is some of my favourite feedback. I love hearing people's passion surrounding various artistic works; even those which deal with difficult subjects; come rushing to the surface when given even the gentlest of prods. Makes me feel that I'm not so alone in my ravenous appetite for books!

Fifty Shades has no Merit

I am not a great fan of Fifty Shades in terms of literary merit, I'll grant that. However, Fifty Shades has done something that the British public and media have struggled with for many years. Our culture is incredibly sexualised, and yet no one seems to discuss it in a sane way.

We have a sizable kink subculture that never gets discussed, and is often left out of discussions. Fifty Shades has changed that forever. Kink is finally becoming more accepted as the norm, and discussing sex and what is good during sex is no longer the sole domain of Cosmopolitan (and similar) magazines which carry with them unbearably bad advice.

That aside, you may benefit from some old poetry.

They Will Treat Male Rape Differently

Our culture at the moment does treat male rape differently. This unfortunate state of affairs could be extended to the proposed laws, and have some odd consequences.

The film "The Shawshank Redemption" does strongly imply and discuss the consequences of male rape in a prison environment. The treatment of the matter is neither funny nor in any way less "serious" than similar treatment of women in similar situations. However, I am aware that one film does not define our culture.

However, that all aside, why does gender matter in this discussion? Why bring up this particular issue in our culture that is only tangentially related?

The issue is clearly serious, but I don't feel that it's entirely relevant to this discussion. If the law does make distinctions, fair enough, let's play ball. Until then, I don't think it's relevant in this particular discussion.

Fifty Shades of Grey Made Illegal in the UK

BBC News has today reported:

"In addition, Mr Cameron will say possessing online pornography depicting rape will be illegal, bringing England and Wales in line with Scotland."

This move; applauded by book lovers, English Literature graduates and English teachers all over the country; was made by Mr. Cameron ostensibly to protect children, but he has luckily snuck in the bill the ability to ban Fifty Shades of Grey! Thank the Tory-gods!

The Logic

Put simply, the comment from BBC News above shows that possessing any "online pornography" which "depicts rape" is now a crime. 

Fifty Shades of Grey is unquestionably pornographic. It contains multiple graphic descriptions of sexual acts, and therefore the novel as a whole can be considered pornographic.

The next question is "What does it mean to depict something". I don't have a legal dictionary on hand, but the Oxford English Dictionary has this to say about it:

verb

[with object]

• represent by a drawing, painting, or other art form

And given that prose can definitely be used as a form of art -- especially when portraying the fictional -- we can conclude that 50 Shades of Grey does "depict rape".

Fifty Shades of Grey may have a get-out-of-censorship-free-card in that it is not online. It is a physical book. Well, mostly. It's available for Kindle, via Amazon's Whispernet. This is definitely on-line. So it is definitely on-line pornography that depicts rape.

The more difficult question is quite a simple one: does what is depicted in the novel constitute rape? I've never read the book; however; I have had some particularly revealing passages read to me. They show that the woman in the novel did not consent to the majority of the sexual acts carried out in the book.

This puts E. L. James, Amazon and a large portion of middle class women squarely in the "illegal" category of the law.

Everyone's a Criminal

Given that many contemporary novels (and less-contemporary) novels do deal with sexual abuse and rape, some of which explore the idea of "rape fantasy" (Herein referred to by the more accepted name, "ravishment") between consenting partners means that a large portion of those with an interest in BDSM and kink will fall into this category.

That is not to mention those who simply study the novels, or get no particular pleasure out of them, and those who read the novels because they'll read almost anything will all be suddenly criminals.

Let me be absolutely clear. Joe Haldeman's "Forever War" depicts a lot of sex (Some of it could be considered to be coerced), Joe Scalzi's "Old Man's War" depicts a lot of sex (although none that I remember was coerced or forced), A Scanner Darkly has a fair bit of sex. These are SF&F books, with no focus on sexuality or pornography, yet under some stretched definitions could fall foul of this law. 

These are books that I regularly recommend to family members, usually over the age of 16 because of their violent (not sexual) content.

Also falling into firmly into this category is Burgess' "A Clockwork Orange". Once again, it's available for Kindle, it definitely depicts rape, and it's read world-wide by millions.

And it's well known that if we're all criminals, none of us are, thus bringing this absurdist tirade to a close and showing the law for what it really is: Propaganda codified as law.

Revisiting FreeBSD & Java

Introduction

Some time ago, I attempted to use FreeBSD to do a small amount of development work. I documented the frustration I encountered.

It turns out that I think I was wrong!

Wrong?!

It seems that the usual way to get packages on FreeBSD is to use the ports collection. However, this is not the only way to get packages

FreeBSD, like its rivals, OpenBSD, NetBSD and DragonflyBSD (And many proprietary Unix systems) has a tool for adding packages -- binary packages. This was found out after some time of hanging around in the OpenBSD IRC channel, and setting up an extremely locked-down Minecraft Server. That's another blog post!

Get it Right

Simply put:

#> pkg_add -r jre

Will get you a Java Runtime environment (OpenJDK 1.6.0_32). If you need the JDK, simply call:

#> pkg_add -r jdk

Instead. Job done. No faffing about trying to compile ports, no agreeing to Oracle's draconian licensing, just pure Java.

Bonus Section

We all love build systems! Automate everything, right? Well, it turns out that Maven3 is available under FreeBSD (But not Debian 6.0, my work machine). It's a similarly difficult task for getting Maven3 installed:

#> pkg_add -r maven3

And that's it. 

It's also similarly easy to get Java running on OpenBSD, just see the pkg_add man page for OpenBSD and set your PKG_PATH to your favourite mirror.

Salt with your Fries?

Overview

When storing a password or other sensitive data, a salt is a must. This post deals with the nitty-gritty of salt generation.

If you're here for simple advice, use bcrypt with a nice wrapper which handles salt generation for you.

Properties of a Salt

A decent salt must satisfy two minimal requirements: 

• Unique
• Unpredictable 

Uniqueness is fairly obvious, if your password database uses a static salt for all passwords, then it only defeats pre-computed dictionaries and rainbow tables. It does not protect you after your database is leaked, and your attacker knows the salt -- they can simply re-compute the dictionary using the salt and often break many passwords this way. Having a different salt for each password will force the attacker to create a dictionary for every password in the database.

Unpredictability is not immediately obvious. However, take a well known open-source system that uses a sequential integer as the primary key in the database and it's salt. This clearly satisfies uniqueness. However, if an account (say, for example, admin) is always the first account on the system and therefore always uses the salt "1". An attacker can pre-compute their dictionary with salt "1", when the database is leaked, the attacker can simply look up the hash value in the dictionary and see the password.

This however, presents a major problem. If I can't predict the value of a salt, how can I be sure it will not collide & violate uniqueness? 

The first, naive solution, is to simply throw away colliding salts. However, once you have a certain number of passwords, you'll spend all your time generating salts. 

The better solution is to ignore collisions, but make them extremely unlikely. With sufficient randomness, we can also ensure that collisions happen extremely rarely, even in a system which uses sharding or other "splitting" methods. It is this solution that we will explore. 

Unique Violations

The primary strength of a salt lies with the fact that an attacker must attack each password individually, or for our purposes, almost individually.

If each password can be expected to share a salt with two or three other passwords, then this is quite bad, as the amount of passwords that an attacker can crack by trying the salts is non-zero.

Ideally, an adversary picking a salt at random from a leaked set of passwords should have a negligible chance of picking a salt which will have suffered a collision, hence attacking any single salt gives them a negligible chance of breaking more than one password with that salt.

A simple manipulation of the Birthday Paradox allows us to determine the minimum bit-length for any salt conforming to this requirement, the equation that derived is:

b = log₂(n² - n) - log₂(p) - 1

Where p is the probability we're looking for, n is the expected size of the password database and b is the bit-length of the salt.

So, for our requirement on a system that's expected to use 10,000 passwords, and have an attacker not expect to have more than one collision in that set would need p set to 10^-5.

b = log₂(10¹⁰ - 10⁵) - log₂(10^-5) - 1
b = 48.83

Or about 48-bits of entropy, minimum.  

Existing Standards

NIST and RSA both give recommendations on the minimum salt length to be used in any key derivation function. NIST (NIST-SP800-132) recommends 128-bits and RSA (PKCS #5 v2.1) recommends only 64-bits. 

Most BCrypt implementations, when asked to get a salt for themselves will return a 128-bit salt, which is more than enough, and happens to comply with NIST's recommendations.

It is probably the case that RSA's recommendations are not sufficient for use in large organisations.

Conclusions

Simply put, if in doubt, just use bcrypt.

However, for your organisation, you can easily calculate the minimum bit-length required to ensure the desired amount of salt collisions. I would always plonk myself down on the safe-side of town and go with NIST's recommendations of 128-bits.

You should always bear in mind that poor random number generation from your OS or other source can lead to more collisions. The post above assumes good, uniformly distributed salts.

Cracking Postgres Passwords

Overview

This article is a brief overview of using HashCat to recover a Postgres 8.4 password.

Hash Format

The format for Postgres is md5(secret || username) where || denotes string concatenation. 

HashCat

HashCat as a tool is more traditionally associated with oclHashCat-lite and oclHashCat-plus, which delegates the work to the GPU, significantly increasing the cracking speed.

At this point, I am using HashCat because of it's simplicity and flexibility in attack modes and hashing algorithms, however, most of what is written here could be translated for a suitably configured oclHashCat-lite and run on the GPU.

Retrieving the Hashes

In Postgres, if you have read access to pg_roles, you can simply use:

SELECT username,passwd FROM pg_roles;

This will show you a result like:

   usename   |               passwd                |
-------------+-------------------------------------+
 postgres    | md50f7e63611a98a9936285c7d609b044da |

The field "md50f7e63611a98a9936285c7d609b044da" is the md5 hash. Simply strip it down to just the hash (removing the "md5" from the front to), and that is what you're attacking.

Using HashCat

If you download HashCat from their site, you'll likely be able to follow these instructions exactly, but these instructions were written using HashCat v0.42.

First, you must make a hash file:

echo 0f7e63611a98a9936285c7d609b044da:postgres > hashfile

Then you may run HashCat:

./hashcat-cli32.bin -m 10 hashfile -a 3 ?a?a?a?a?a?a

The flags we're using are as follows:

• -m 10 : Use the hashing scheme md5(pass.salt)
• -a 3 : Use the brute-force attack mode.
• ?a?a?a?a?a?a?a : Search all passwords up to 7 characters from the character set [a-zA-Z0-9] + symbols.

Results?

Mine is still running vs. a password of my choosing, but after around 10 minutes, HashCat reported that it was now trying to crack all 6-character passwords and would take on the order of 16 hours to try them all.

HashCat's current status is that it's trying 12.22M words on my CPU every second. I'll update this blog when real results are found. I suspect at this rate, I'll give up after a couple of days, as all 7 character passwords will take on the order of 2 months.

Update

Having finished running HashCat on my machine with the above arguments, the search finished after a full 15 hours, however, it did not find the password, as it was longer than 6 chars. For this experiment, I mainly wanted to confirm that I could get HashCat to run and attempt to crack a password. The hash given above is for a *very* long password, that actually has more entropy than an MD5 hash!

Doing Passwords Wrong with PayPal

What They've Done Wrong

PayPal do a lot to argue that their system is secure, however, their outward-facing practices don't necessarily live up to their own hype. If you can't make a security conscious user feel secure about their password policy, how do you think that one might feel about them having my EMV card details?

Let's look at the problems with their passwords.

Minimum Length

PayPal's minimum length is too low at 8 chars. This gives the minimal password an entropy of approximately 38-bits. Most folks can brute-force that on their phone these days. Even DES thought that 56-bits was good enough in '77. Times have changed (no, they haven't gone backwards!)

Maximum Length

They enforce a maximum length which is too low (it exists!?): 20 chars. This gives the absolute maximum entropy of a password of around 132 bits. I like to make my passwords around 256 bits. It's 2013, let me make a passphrase that's more than 20 characters, it's not that big of a performance hit!

No Copy Paste

In my opinion, this is a huge sin. As a person who uses a password manager, I use an application to generate a very long (~257 bits of entropy), very random password. I then copy and paste this password (having never seen it) into the password field.

This allows me to easily avoid re-using passwords across multiple sites, and ensures that I always pick a strong password.

Allowing Bad Passwords

PayPal does not (client-side!) check if the password you have types is a bad password. In fact, it allows 'password' and '12345678' as passwords. Yes it labels these as "weak", but it doesn't prevent you using them.

Dense Strength Checker

The strength checker offers a false sense of security. I can make it claim an 8 character password is strong. It simply is not! Even the best 8 character password is at most 53-bits of entropy.

What They Should be Doing

• Minimum length: 12 chars
• No Maximum Length
• Allow Copy/Paste for users who use password managers (such as myself)
• DropBox keeps a list of really bad passwords, and warns against them by checking client-side.

How To Deal With This

you only (unfortunately) have two options:

• Complain to PayPal. I already have done, and I'll post the follow up.
• Leave PayPal.

If PayPal don't correct these simple issues, I will most likely be leaving PayPal, as I do not trust them with my details if they can't manage passwords correctly.

Overcoming The Ban

Overview

I am a member of the Pirate Party UK, and there are a number of very good reasons to support them. This blog post isn't about that, this blog post is about censorship on the web.

The Pirate Bay has been blocked by major ISPs in the UK since about February of this year, and recently, the power to block sites was abused, shutting off access to the Promo Bay.

This article is about how to keep your connection to the network free and unhindered during these troubling times.

Why Bother?

This is absolutely necessary, as giving the government or corporations the power to silence people at will is a really bad idea, for numerous reasons. 

First and foremost is that freedom of association and speech is vital for a civilized society. The correct response to speech that you don't like is more speech, not an attempt to silence them.

Secondly, giving these powers to people is poor civil hygiene. Why give someone a power that can be abused? You don't know the kind of people that will be in power in the future. 

Let's have a thought experiment. Assume the BNP get into power. They decree that all immigrants are bad, and sites associated with foreigners should be banned. The result of this is that perfectly legitimate sites will be banned, for example, many sites about Islam would be illegal, as would many sites critical of Christianity (there's a lot of atheist videos on YouTube!). This brings sites like Reddit, YouTube, Wikipedia, etc. into the firing line.

Thirdly, a broken business model is not an excuse to infringe on a person's rights. Times have moved on, and as yet, the publishing industry is failing to do so. The copyright lobby represents a government-backed monopoly that morally should not exist, so why are we doing all that is in our power to strengthen their monopoly?

Beat The Ban

There are three broad methods for beating the ban. The first is to rely on web proxies, like the Pirate Party's, secondly, you can use a VPN service in a more free country, and finally, you can use The Onion Router (TOR) for the ultimate power

Web Proxies

These are the simplest, easiest-to-use methods of overcoming the ban. Instead of navigating to a web page which displays the contents of The Pirate Bay to you. 

You can find a list of such proxies on Pirate Reverse, but Google will serve you well too.

Problems?

If your ISP is very much against all of this, you can bet that they'll be adding proxies to the list of banned sites very soon. 

Not to mention the BPI, MPAA & RIAA going after the proxy hosters directly and taking them offline. They're far too centralised.

Your ISP can also see that you are visiting a known proxy, and potentially take actions based on that fact. Not good.

Virtual Private Networks

By using a Virtual Private Network (VPN) provider in a more free country, you can easily get around the ban. 

Using a VPN means that you basically make an encrypted connection to the VPN provider, and then you appear to be using their network. This can also be achieved by using a virtual private hosting service, and forwarding all of your traffic through that (usually using SSH).

These are traditionally used for pushing large amounts of "illegal" data through a connection, but can be used specifically to circumvent the ban. 

There is one which is advertised by TorrentFreak, it is Private Internet Access. I've never used it, so I can't vouch for it. Have a look around for one that suits you if you choose this route.

Problems?

Usually, VPN services cost money, or are severely limited, not to mention the single point of failure that is the VPN provider, which, if you're using it to only access the front page of the Pirate Bay, it's a little bit overkill.

The Onion Router

The Onion Router (Tor) is a fantastic bit of technology. By wrapping up your data in multiple layers of encryption and sending it into the network to be bounced around, you can be sure that any one node cannot determine the source and destination of the data. Most of the exit nodes (The places that your data leaves the network to enter the rest of the internet, effectively) exist in relatively free countries, so accessing The Pirate Bay via this method is extremely effective.

It also means that your ISP can't see what you're browsing. All they can see is "Tor user". You could be looking at literally anything, from kittens, to the pirate bay, from medical information to bomb making instructions.

Tor is the ultimate in censorship-free browsing, but it does not guarantee anonymity. Your movements online can be tracked by things like tracking cookies and other techniques, so be sure to use the full Tor Browser Bundle, which is pre-configured to get around these issues.

Problems?

Tor can be a pain to set up, but it should be very easy when using the Tor Browser Bundle. 

It can also be quite slow to use, but if all you're doing is loading up your favorite torrent sites to view some magnet links, you're basically sorted.

Do not push BitTorrent traffic through Tor. It was not designed for this, and it is unfair to the operators of the relay and exit nodes who make their bandwidth available for those who really need it; for example, Syrian dissidents and the like.

Conclusion

The ban is bad, but more than that, it has the potential to spiral out of control and seriously damage the ecosystem of the internet. We should reject censorship unconditionally, and take up our tools to assert our rights.

Information is always going to make it's way in and out of countries, through blockades and around damage. The only question is if it arrives in a timely and convenient manner.