<?xml version="1.0" encoding="utf-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: We Can Tell What You&#8217;re Typing, So Stop It!</title>
	<atom:link href="http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/</link>
	<description>General interest observations and true web-log.</description>
	<lastBuildDate>Sat, 21 Nov 2009 14:33:47 -0800</lastBuildDate>
	<generator>http://wordpress.org/?v=2.8.6</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: Common_Sense</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1553351</link>
		<dc:creator>Common_Sense</dc:creator>
		<pubDate>Thu, 16 Jul 2009 07:22:30 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1553351</guid>
		<description>The tinfoil hat crowd has most of this discussion right. 

MAC address filtering and WEP is good for preventing casual misuse - read: 95% of the people you re trying to keep out who have no hacking &quot;tools&quot; but will just steal your open wifi. It&#039;ll get beat in minutes (literally, single digit minutes) by anyone with hacking tools.

WPA/WPA2 with good passwords is secure enough for protecting your porn habits from prying eyes, or whatever it you think people will care about getting into your business for.

The techniques that are technically possible - I mean, power signal leakage, freezing your memory to get encryption keys, and even the monitor signal leakage, etc -- these are not the hacks of &quot;hackers&quot; as much as governments and industrial espionage types, maybe. You aren&#039;t important enough to draw that kind of technological threat. The individual&#039;s threat model is more along the lines of wifi snoopers, virus/trojan keyloggers, physical cameras, etc...

Know your threats and design your protection against them as best you can, and just accept that there&#039;s no perfect security against a foe with unlimited resources and motivation - fortunately, most of us will never face that foe. A properly shielded cable isn&#039;t worth a hill of beans if your wife still leaves herself logged into her computer 24/7 without locking the machine -- it&#039;d be easier for someone to break in and install a quick keylogger on her machine than to try to tap into my power line to pick out signals.

Interesting idea, though - signal leakage via improperly shielded cables. Cool.</description>
		<content:encoded><![CDATA[<p>The tinfoil hat crowd has most of this discussion right. </p>
<p>MAC address filtering and WEP is good for preventing casual misuse &#8211; read: 95% of the people you re trying to keep out who have no hacking &#8220;tools&#8221; but will just steal your open wifi. It&#8217;ll get beat in minutes (literally, single digit minutes) by anyone with hacking tools.</p>
<p>WPA/WPA2 with good passwords is secure enough for protecting your porn habits from prying eyes, or whatever it you think people will care about getting into your business for.</p>
<p>The techniques that are technically possible &#8211; I mean, power signal leakage, freezing your memory to get encryption keys, and even the monitor signal leakage, etc &#8212; these are not the hacks of &#8220;hackers&#8221; as much as governments and industrial espionage types, maybe. You aren&#8217;t important enough to draw that kind of technological threat. The individual&#8217;s threat model is more along the lines of wifi snoopers, virus/trojan keyloggers, physical cameras, etc&#8230;</p>
<p>Know your threats and design your protection against them as best you can, and just accept that there&#8217;s no perfect security against a foe with unlimited resources and motivation &#8211; fortunately, most of us will never face that foe. A properly shielded cable isn&#8217;t worth a hill of beans if your wife still leaves herself logged into her computer 24/7 without locking the machine &#8212; it&#8217;d be easier for someone to break in and install a quick keylogger on her machine than to try to tap into my power line to pick out signals.</p>
<p>Interesting idea, though &#8211; signal leakage via improperly shielded cables. Cool.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Rich</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552973</link>
		<dc:creator>Rich</dc:creator>
		<pubDate>Wed, 15 Jul 2009 02:05:34 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552973</guid>
		<description>&quot;so each key has it’s own voltage signature? And you can tell who is typing what by the power outlet? LAME and COMPLETE BS&quot;

Each key sends a unique signal from the keyboard to the PC. This is an electrical signal that both leaks into the ground system and radiates through space. A system used to monitor these signals would only provide a display of keys typed.</description>
		<content:encoded><![CDATA[<p>&#8220;so each key has it’s own voltage signature? And you can tell who is typing what by the power outlet? LAME and COMPLETE BS&#8221;</p>
<p>Each key sends a unique signal from the keyboard to the PC. This is an electrical signal that both leaks into the ground system and radiates through space. A system used to monitor these signals would only provide a display of keys typed.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Patrick</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552786</link>
		<dc:creator>Patrick</dc:creator>
		<pubDate>Tue, 14 Jul 2009 17:52:09 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552786</guid>
		<description># 20 Somebody_Else said,  &quot;Proper “WPA2″ encryption uses secure AES-based CCMP, and thus far there are no known exploits.&quot;

If you aren&#039;t handling certificate issues correctly you could get in by man in the middle.  Not likely though.</description>
		<content:encoded><![CDATA[<p># 20 Somebody_Else said,  &#8220;Proper “WPA2″ encryption uses secure AES-based CCMP, and thus far there are no known exploits.&#8221;</p>
<p>If you aren&#8217;t handling certificate issues correctly you could get in by man in the middle.  Not likely though.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Somebody_Else</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552736</link>
		<dc:creator>Somebody_Else</dc:creator>
		<pubDate>Tue, 14 Jul 2009 16:31:41 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552736</guid>
		<description>#11, UncleDave

If you actually looked at some of the links you&#039;d understand that WPA2 has not been &quot;cracked.&quot; The tools that come up all use brute force methods. Any encryption system is vulnerable to a brute force attack, the solution is simply to use a strong password.

You can crack simple, insecure passwords with dictionary attacks and short random passwords by guessing (brute forcing), but the time it would take to crack a complex password longer than 10 characters is prohibitive. Unless you have thousands of years to wait around, anyway.

Proper &quot;WPA2&quot; encryption uses secure AES-based CCMP, and thus far there are no known exploits.</description>
		<content:encoded><![CDATA[<p>#11, UncleDave</p>
<p>If you actually looked at some of the links you&#8217;d understand that WPA2 has not been &#8220;cracked.&#8221; The tools that come up all use brute force methods. Any encryption system is vulnerable to a brute force attack, the solution is simply to use a strong password.</p>
<p>You can crack simple, insecure passwords with dictionary attacks and short random passwords by guessing (brute forcing), but the time it would take to crack a complex password longer than 10 characters is prohibitive. Unless you have thousands of years to wait around, anyway.</p>
<p>Proper &#8220;WPA2&#8243; encryption uses secure AES-based CCMP, and thus far there are no known exploits.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Uncle Patso</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552678</link>
		<dc:creator>Uncle Patso</dc:creator>
		<pubDate>Tue, 14 Jul 2009 14:20:47 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552678</guid>
		<description>Reminds me of the passage in &quot;Cryptonomicon&quot; about &quot;Van Eck phreaking.&quot; I can&#039;t see this being a danger in most situations. Unless your neighbor is a spy or cybercrook out to get you...

On the other hand, checking your email over unencrypted public wi-fi could be iffy...</description>
		<content:encoded><![CDATA[<p>Reminds me of the passage in &#8220;Cryptonomicon&#8221; about &#8220;Van Eck phreaking.&#8221; I can&#8217;t see this being a danger in most situations. Unless your neighbor is a spy or cybercrook out to get you&#8230;</p>
<p>On the other hand, checking your email over unencrypted public wi-fi could be iffy&#8230;</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Patrick</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552659</link>
		<dc:creator>Patrick</dc:creator>
		<pubDate>Tue, 14 Jul 2009 13:53:59 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552659</guid>
		<description>News that is a couple decades old.</description>
		<content:encoded><![CDATA[<p>News that is a couple decades old.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Winston</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552652</link>
		<dc:creator>Winston</dc:creator>
		<pubDate>Tue, 14 Jul 2009 13:44:24 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552652</guid>
		<description>This &lt;a href=&quot;http://en.wikipedia.org/wiki/TEMPEST&quot; rel=&quot;nofollow&quot;&gt;&lt;u&gt;&quot;news&quot;&lt;/u&gt;&lt;/a&gt; is even more ancient than your Newsweek cover revelation.</description>
		<content:encoded><![CDATA[<p>This <a href="http://en.wikipedia.org/wiki/TEMPEST" rel="nofollow" rel="nofollow" target="_blank"><u>&#8220;news&#8221;</u></a> is even more ancient than your Newsweek cover revelation.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: orangetiki</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552636</link>
		<dc:creator>orangetiki</dc:creator>
		<pubDate>Tue, 14 Jul 2009 13:25:09 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552636</guid>
		<description>so each key has it&#039;s own voltage signature? And you can tell who is typing what by the power outlet? LAME and COMPLETE BS</description>
		<content:encoded><![CDATA[<p>so each key has it&#8217;s own voltage signature? And you can tell who is typing what by the power outlet? LAME and COMPLETE BS</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Mr Diesel</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552600</link>
		<dc:creator>Mr Diesel</dc:creator>
		<pubDate>Tue, 14 Jul 2009 11:23:36 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552600</guid>
		<description>#12 ridin the short bus

FakinMyMAC is correct.

Obviously you have never attended any hacking conferences or have done a search on MAC Spoofing or you wouldn&#039;t place so much confidence in MAC filtering.

Yeah, try that with any hacker older than 4 in the area and watched yourself get pwned.</description>
		<content:encoded><![CDATA[<p>#12 ridin the short bus</p>
<p>FakinMyMAC is correct.</p>
<p>Obviously you have never attended any hacking conferences or have done a search on MAC Spoofing or you wouldn&#8217;t place so much confidence in MAC filtering.</p>
<p>Yeah, try that with any hacker older than 4 in the area and watched yourself get pwned.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: slowth</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552573</link>
		<dc:creator>slowth</dc:creator>
		<pubDate>Tue, 14 Jul 2009 08:35:50 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552573</guid>
		<description>#11, Uncle Dave

1.)Go to Google
2.)Enter &quot;rainbow table&quot;
3.)Change WPA password from &quot;Dog&quot; or &quot;Bartholomews&quot; to a 63 character monster password
4.)Wait for many times the age of the universe to crack your new password
5.)Don&#039;t spread misinformation</description>
		<content:encoded><![CDATA[<p>#11, Uncle Dave</p>
<p>1.)Go to Google<br />
2.)Enter &#8220;rainbow table&#8221;<br />
3.)Change WPA password from &#8220;Dog&#8221; or &#8220;Bartholomews&#8221; to a 63 character monster password<br />
4.)Wait for many times the age of the universe to crack your new password<br />
5.)Don&#8217;t spread misinformation</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: FakinMyMAC</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552553</link>
		<dc:creator>FakinMyMAC</dc:creator>
		<pubDate>Tue, 14 Jul 2009 05:47:29 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552553</guid>
		<description>#12:
It&#039;s trivial to fake your MAC address.  You can also determine MAC addresses in use easily and then tame ones of those over.  You might need to boot the other person off if they don&#039;t go away nicely, but MAC address filtering is only a single step in the overall picture of wireness network defense.</description>
		<content:encoded><![CDATA[<p>#12:<br />
It&#8217;s trivial to fake your MAC address.  You can also determine MAC addresses in use easily and then tame ones of those over.  You might need to boot the other person off if they don&#8217;t go away nicely, but MAC address filtering is only a single step in the overall picture of wireness network defense.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: ridin the short bus</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552545</link>
		<dc:creator>ridin the short bus</dc:creator>
		<pubDate>Tue, 14 Jul 2009 04:31:57 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552545</guid>
		<description>All a non story here too... Damn the Blog is getting boring these days...
The &quot;Tempest&quot; computers / shielding etc, idea is used on Military Installations or Government Installations, its almost Ironic, in nature, because the people interested in cracking or spying would be the government?.. And if on a Military Base even less chance to be spied upon.. due to access of the location.. 
As for Network Access security, I use MAC Address Fitering.. this limits exactly what PC can log onto my network, period. We use this at work, as well. If we have a guest that needs access to our network, we just ask them for their laptop MAC Address then provide them with the Access Key and put thier Mac Address on our system. This cant be cracked, due to Physical Hardware Unique Address.</description>
		<content:encoded><![CDATA[<p>All a non story here too&#8230; Damn the Blog is getting boring these days&#8230;<br />
The &#8220;Tempest&#8221; computers / shielding etc, idea is used on Military Installations or Government Installations, its almost Ironic, in nature, because the people interested in cracking or spying would be the government?.. And if on a Military Base even less chance to be spied upon.. due to access of the location..<br />
As for Network Access security, I use MAC Address Fitering.. this limits exactly what PC can log onto my network, period. We use this at work, as well. If we have a guest that needs access to our network, we just ask them for their laptop MAC Address then provide them with the Access Key and put thier Mac Address on our system. This cant be cracked, due to Physical Hardware Unique Address.</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: Uncle Dave</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552540</link>
		<dc:creator>Uncle Dave</dc:creator>
		<pubDate>Tue, 14 Jul 2009 04:12:39 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552540</guid>
		<description>1) Go to Google
2) Enter &#039;wpa2 hack&#039;</description>
		<content:encoded><![CDATA[<p>1) Go to Google<br />
2) Enter &#8216;wpa2 hack&#8217;</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: qb</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552536</link>
		<dc:creator>qb</dc:creator>
		<pubDate>Tue, 14 Jul 2009 03:50:12 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552536</guid>
		<description>Or you could do the easy thing. 61165 - that was the pin of the women in line in front of me this evening. Did I mention she leaves her wallet in the outside wallet of her purse?</description>
		<content:encoded><![CDATA[<p>Or you could do the easy thing. 61165 &#8211; that was the pin of the women in line in front of me this evening. Did I mention she leaves her wallet in the outside wallet of her purse?</p>
]]></content:encoded>
	</item>
	<item>
		<title>By: dusanmal</title>
		<link>http://www.dvorak.org/blog/2009/07/13/we-can-tell-what-youre-typing-so-stop-it/comment-page-1/#comment-1552532</link>
		<dc:creator>dusanmal</dc:creator>
		<pubDate>Tue, 14 Jul 2009 03:47:42 +0000</pubDate>
		<guid isPermaLink="false">http://www.dvorak.org/blog/?p=53063#comment-1552532</guid>
		<description>@#5,8 (agreement) as well as original poster (disagreement): &quot;rather than more secure, but still crackable, WPA &amp; WPA2&quot;.

If you use WPA to its full capability, you can bet your life on it against any existing foe. Though 16 char&#039;s #5 mentions are fair defense, that is not the full capability. Random 63 characters from the complete available character set provide full protection. Anyone using less may ask themselves: why?</description>
		<content:encoded><![CDATA[<p>@#5,8 (agreement) as well as original poster (disagreement): &#8220;rather than more secure, but still crackable, WPA &amp; WPA2&#8243;.</p>
<p>If you use WPA to its full capability, you can bet your life on it against any existing foe. Though 16 char&#8217;s #5 mentions are fair defense, that is not the full capability. Random 63 characters from the complete available character set provide full protection. Anyone using less may ask themselves: why?</p>
]]></content:encoded>
	</item>
</channel>
</rss>
