<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Side Channels &#187; security</title>
	<atom:link href="http://weblog.saardrimer.com/index.php/category/security/feed/" rel="self" type="application/rss+xml" />
	<link>http://weblog.saardrimer.com</link>
	<description>you get what you pay for</description>
	<lastBuildDate>Sun, 29 Nov 2009 12:57:09 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>don&#8217;t tase me, bro</title>
		<link>http://weblog.saardrimer.com/index.php/dont-tase-me-bro_287/</link>
		<comments>http://weblog.saardrimer.com/index.php/dont-tase-me-bro_287/#comments</comments>
		<pubDate>Mon, 03 Dec 2007 09:16:19 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[personal]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[unintended consequences]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/dont-tase-me-bro_287/</guid>
		<description><![CDATA[In 1992, when I was 17, I traveled with my father to the US for a few weeks. We had a family friend living in Huston, whom we wanted to visit. He was away and due back a day of so after we arrived so he gave my father the alarm access-code so we can [...]]]></description>
			<content:encoded><![CDATA[<p>In 1992, when I was 17, I traveled with my father to the US for a few weeks. We had a family friend living in Huston, whom we wanted to visit. He was away and due back a day of so after we arrived so he gave my father the alarm access-code so we can help ourselves in. We arrived at the house late at night, something went wrong with entering the code, and the alarm went off. Almost instinctively my dad rushed me to the car and we drove off to check into a motel for the night. My dad explained that we were likely to end up in jail if the police got to the house, regardless of our explanation. Back then I thought it was a bit extreme; surely we can reason our way out of it, like we would be able to back in Israel. Looking back at it, it was probably a reasonable choice given the circumstances.</p>
<p>Today, if we were caught, in addition to being arrested we would surely be additionally <a href="http://en.wikipedia.org/wiki/Taser">tased</a> for bad measure. The near-daily news of people being tased for no good reason reminded me of my story above. Some taser cases and videos can be found on <a href="http://reddit.com/search?q=tased&#038;sort=top">top hits from reddit on the topic</a>; Andrew Meyer coined the &#8220;don&#8217;t tase me, bro&#8221; catch phrase while being <a href="http://www.timesonline.co.uk/tol/news/world/us_and_americas/article2489183.ece">tased after making a bit of a fuss</a> asking John Kerry some questions; here&#8217;s the <a href="http://images.salon.com/comics/boll/2007/10/04/boll/story.jpg">comic</a>. <a href="http://en.wikipedia.org/wiki/Taser_controversy#Deaths_and_injuries">Some people die after being tased</a>, though the marketing says that the tool is supposed to be non-lethal. But when you give people a &#8220;non-lethal&#8221; alternative to verbally or physically dealing with other people, it is a natural outcome that it turns from an alternative to a norm. This is the situation today, with cops tasing without much thought and it seems as though the chances of being tased is largely random, mostly depending on how the cop feels at the moment. With the general sense of paranoia and justification that anything is permissible in the name of security and anti-terrorism, all you have to do is act out of the ordinary, like <a href="http://www.statesman.com/news/mplayer/other/32386">being slow to hand a cop your proof of insurance</a>; Schneier calls this &#8220;<a href="http://www.schneier.com/blog/archives/2007/11/the_war_on_the.html">The War on the Unexpected</a>&#8220;.</p>
<p>This arbitrary taser treatment given by trigger happy cops is scary, and certainly does not contribute to a general feeling of security it was meant to promote. The long term effect is the continuous erosion of trust in police and the &#8220;system&#8221; &#8212; not that it is in any good shape currently &#8212; which will be difficult to recover from even if tighter controls are placed on taser use. When this happens the unintended consequence would be that police lost the &#8220;touch&#8221; of actually dealing with people, and even worse, they would use their lethal weapons (guns) more casually than before. I wouldn&#8217;t be surprised to hear in the near future of a case where a cop claims that he/she reached for the taser, but instead shot the poor speeder in the chest with a lethal bullet.</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/dont-tase-me-bro_287/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>well, gee, thanks!</title>
		<link>http://weblog.saardrimer.com/index.php/well-gee-thanks_279/</link>
		<comments>http://weblog.saardrimer.com/index.php/well-gee-thanks_279/#comments</comments>
		<pubDate>Mon, 09 Jul 2007 22:54:40 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[rants]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[tech]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/well-gee-thanks_279/</guid>
		<description><![CDATA[studentuniverse.com sells cheap airline tickets for students. They also have a neat little bonus they give for free to every student who signs up!

That&#8217;s like me demanding a medal for my good social conduct because I don&#8217;t go around randomly punching people in the face. 
Well, thank you very much studentuniverse.com for protecting me from [...]]]></description>
			<content:encoded><![CDATA[<p><a href="https://www.studentuniverse.com">studentuniverse.com</a> sells cheap airline tickets for students. They also have a neat little bonus they give <em>for free</em> to every student who signs up!</p>
<p><a href="http://www.saardrimer.com/pics/foryourprotection.jpg"><img width="450" src="http://www.saardrimer.com/pics/foryourprotection.jpg" alt="For your protections we will not spam you" /></a></p>
<p>That&#8217;s like me demanding a medal for my good social conduct because I don&#8217;t go around randomly punching people in the face. </p>
<p>Well, thank you very much studentuniverse.com for protecting me from yourself and for practicing restraint with regards to your right to spam me and sell my information! It is also much appreciated that you are using my private information <em>only</em> for the purpose I am providing it for. (<a href="https://www.studentuniverse.com/register/new?userType=Student">link</a> to page imaged above).</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/well-gee-thanks_279/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>journalism honesty</title>
		<link>http://weblog.saardrimer.com/index.php/journalism-honesty_269/</link>
		<comments>http://weblog.saardrimer.com/index.php/journalism-honesty_269/#comments</comments>
		<pubDate>Sat, 24 Feb 2007 17:28:19 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/journalism-honesty_269/</guid>
		<description><![CDATA[The Times is a pretty popular newspaper here (I always have to ask the locals, since there are so many). A couple of weeks ago, subsequennt to our Chip &#038; PIN relay attack, I got a call from a journalist regarding the use of Chip &#038; PIN cards in petrol (gas!) stations (there has been [...]]]></description>
			<content:encoded><![CDATA[<p><a href="http://www.timesonline.co.uk">The Times</a> is a pretty popular newspaper here (I always have to ask the locals, since there are so many). A couple of weeks ago, subsequennt to our Chip &#038; PIN relay attack, I got a call from a journalist regarding the use of Chip &#038; PIN cards in petrol (gas!) stations (there has been a surge of fraud lately, particularly in these shops). <a href="http://business.timesonline.co.uk/tol/business/money/consumer_affairs/article1400176.ece">This is the resulting article</a> with my quote below:</p>
<blockquote><p>
Saar Drimer, a security expert and researcher at Cambridge University, also said he had stopped using his cards at petrol stations. â€œThe more we look into the ways that you could be defrauded, the more worrying it becomes. Cash is always better to use because there is no record and youâ€™re not giving away any of your secrets,â€ he said.
</p></blockquote>
<p>After talking to the guy I learned that he first called Steven, who refused to spoon feed him the quote that he was after. Namely, &#8220;I recommend people not use Chip &#038; PIN cards at petrol stations.&#8221; Then, he called me, the media novice. I told him many things, among them that I don&#8217;t own a car and therefore, I don&#8217;t use petrol stations. He then massaged the questions such that I gave him the above (general) quote, which he wrapped in an untrue preamble. Ah, well, I should have known.</p>
<p>One of the things I told him was that I wouldn&#8217;t use those stand-alone ATMs because they are easier to manipulate (attachements or complete fakes, etc.); a point he wanted me to elaborate on. However, that may have put him in a bind because his point was that people should use cash in stations, but where would they get it? From the station&#8217;s ATM&#8230;</p>
<p>Anyway, next time a journalist type calls I&#8217;ll cut the bullshit and ask him what exact quote he is after and see if I am comfortable saying it. Someone suggested that next time I should write it down for him so there are no mistakes, and that&#8217;s what press releases are for. Lesson learnt ;)</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/journalism-honesty_269/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>&#8220;I&#8217;ve got a customer&#8221;</title>
		<link>http://weblog.saardrimer.com/index.php/ive-got-a-customer_268/</link>
		<comments>http://weblog.saardrimer.com/index.php/ive-got-a-customer_268/#comments</comments>
		<pubDate>Sat, 10 Feb 2007 14:17:40 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[personal]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[tech]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/ive-got-a-customer_268/</guid>
		<description><![CDATA[A few weeks ago Steven J. Murdoch and I released a video of a Chip &#038; PIN terminal playing Tetris (YouTube version). Back then, I alluded to the fact that this is just a small part of something grander. We were working on an experiment that showed a particular vulnerability Chip &#038; PIN is prone [...]]]></description>
			<content:encoded><![CDATA[<p>A few weeks ago <a href="http://www.cl.cam.ac.uk/~sjm217/">Steven J. Murdoch</a> and I released a video of a <a href="http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playing-tetris/">Chip &#038; PIN terminal playing Tetris</a> (<a href="http://www.youtube.com/watch?v=wWTzkD9M0sU">YouTube version</a>). Back then, I <a href="http://weblog.saardrimer.com/index.php/been-busy_266/">alluded</a> to the fact that this is just a small part of something grander. We were working on an experiment that showed a particular vulnerability Chip &#038; PIN is prone to. This is important because banks now maintain that if the PIN was used, then the customers must prove they were not negligent, which is impossible (given that they do not have access to the evidence and no way to show that no one has been looking over their shoulder, for example). Therefore, due to at least one way of defrauding customers who clearly have not been negligent with their PIN, they should be reimbursed. </p>
<p><img class="alignright" src="http://www.saardrimer.com/pics/watchdog.jpg" alt="saar drimer, steven murdoch on watchdog bbc1" />Anyway, there is a somewhat of a technical article on <a href="http://news.zdnet.com/2100-1009_22-6156601.html">ZDNet</a>, with more info <a href="http://www.lightbluetouchpaper.org/2007/02/06/chip-pin-relay-attacks/">here</a>, and Steven dissecting an <a href="http://www.lightbluetouchpaper.org/2007/02/08/financial-ombudsman-on-chip-pin-infallibility/">insulting response</a> from the <a href="http://www.financial-ombudsman.org.uk/">Financial Ombudsman Service</a> to a customer who seeks to know on what grounds he has been refused a refund.</p>
<p>What was missing from the media hype over this is what is included in the <a href="http://www.cl.cam.ac.uk/research/security/projects/banking/relay/bounding.pdf">academic paper</a>. In it, not only do we describe the attack in detail, including background, we also describe and implement a defense against it called &#8220;distance bounding&#8221;, which is the main contribution.  </p>
<p>In addition, we spilled the beans on prime-time TV here on the island&#8217;s BBC1, in a program called &#8220;<a href="http://www.bbc.co.uk/consumer/tv_and_radio/watchdog/">Watchdog</a>&#8220;, which is a popular and long running consumer-watch program. This was quite an experience and I learned a lot from it. We spent about 11 hours with the crew, with the outcome of about 2 minutes of us appearing and a not-so-clear representation of the attack. Sigh. Before all this, I thought TV was evil; let&#8217;s just say I have not changed my mind.</p>
<p>I cannot post the video publicly (it would probably infringe on someone&#8217;s rights) but if you&#8217;d like to see yours truly say the line in the heading of this post on TV, email me at &lt;first name&gt;&lt;last name&gt;@gmail.com.</p>
<p><strong>UPDATE: </strong>Someone has posted the segment on YouTube, <a href="http://youtube.com/watch?v=X7pjUIxKoEc">here</a>. If you want a better quality version, email me.</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/ive-got-a-customer_268/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>been busy</title>
		<link>http://weblog.saardrimer.com/index.php/been-busy_266/</link>
		<comments>http://weblog.saardrimer.com/index.php/been-busy_266/#comments</comments>
		<pubDate>Tue, 09 Jan 2007 22:39:55 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[personal]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[tech]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/been-busy_266/</guid>
		<description><![CDATA[All good things, though&#8230;
On Christmas day, Steven Murdoch and I decided it would be fun to post a video of a Chip &#038; PIN terminal playing Tetris on our group&#8217;s weblog. It was an excuse to say merry Christmas and happy new year to our readers. Then, I spent a week in Edinburgh, which is [...]]]></description>
			<content:encoded><![CDATA[<p>All good things, though&#8230;</p>
<p>On Christmas day, <a href="http://www.cl.cam.ac.uk/~sjm217/">Steven Murdoch</a> and I decided it would be fun to post a <a href="http://www.lightbluetouchpaper.org/2006/12/24/chip-pin-terminal-playing-tetris/">video of a Chip &#038; PIN terminal playing Tetris</a> on our group&#8217;s weblog. It was an excuse to say merry Christmas and happy new year to our readers. Then, I spent a week in Edinburgh, which is a lovely city, even in the winter. If you haven&#8217;t been, I&#8217;d recommend. <a href="http://www.rosslynchapel.org.uk/">Rosslyn chapel</a> was really nice. They are doing really well due to the &#8220;Da Vinci Code Effect&#8221;&#8211;people flocking places Brown mentions in the book. Regardless, worth a visit. The Scottish parliament was nice, people were nice&#8230; I&#8217;ve seen enough castles for a year or so, though. I also learned about the Scottish history and now understand better the &#8220;situation&#8221; between them and the English. The <a href="http://www.edinburghshogmanay.org/">Hogmanay</a> on new year&#8217;s eve was canceled due to 70 mph winds, but that wasn&#8217;t a big deal. </p>
<p>When I got back I found out that a paper of mine got accepted to a workshop, and I need to produce a final version. Then, our little &#8220;<a href="http://digitaldebateblogs.typepad.com/digital_money/2007/01/threats_and_thr.html#more">Tetris stunt</a>&#8221; was picked up by some blogs and it went crazy from there&#8230; newspapers, radio&#8230; I&#8217;ll save you the details. It did, however, culminated in a <a href="http://hardware.slashdot.org/hardware/07/01/08/1355221.shtml">Slashdot mention</a>, which made us pretty damn happy. </p>
<p>Since no one is reading this very weblog anyway, I can say that there is more surprises to come on the &#8220;Tetris&#8221; front! Stay tuned.</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/been-busy_266/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>exposed: online, people sometimes lie about themselves</title>
		<link>http://weblog.saardrimer.com/index.php/exposed-online-people-sometimes-lie-about-themselves_265/</link>
		<comments>http://weblog.saardrimer.com/index.php/exposed-online-people-sometimes-lie-about-themselves_265/#comments</comments>
		<pubDate>Sat, 23 Dec 2006 12:43:21 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[blogging]]></category>
		<category><![CDATA[cambridge]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[unintended consequences]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/exposed-online-people-sometimes-lie-about-themselves_265/</guid>
		<description><![CDATA[Todd Shriber contacted, what may be considered, random people online soliciting them to hack into his former college and give his GPA a face lift. He gave them all his personal information, including SSN, and some pictures of local squirrels the &#8220;hackers&#8221; required as &#8220;proof&#8221;. They, in turn, put the e-mail correspondence online, of course.
Turns [...]]]></description>
			<content:encoded><![CDATA[<p>Todd Shriber contacted, what may be considered, random people online soliciting them to hack into his former college and give his GPA a face lift. He gave them all his personal information, including SSN, and some pictures of local squirrels the &#8220;hackers&#8221; required as &#8220;proof&#8221;. They, in turn, put the <a href="http://www.attrition.org/postal/z/033/0871.html">e-mail correspondence</a> online, of course.</p>
<p>Turns out the idiot <a href="http://www.networkworld.com/community/?q=node/9999&#038;nothing">works as a communications director</a> for a Montana congressman. He was later <a href="http://www.havredailynews.com/articles/2006/12/22/local_headlines/state.txt">fired</a> after his extracurricular contractual endeavors were publicized in sites like <a href="http://www.reddit.com">reddit</a>.</p>
<p>So, two things. Firstly, not everyone who talks shop is an expert&#8230; this applies to real life too. Secondly, if people still have not realized that other people are not who they say they are (in real life too!) they deserve this kind of treatment. The more this happens, the more people be careful what they say or write, mostly in consideration of their future. In our world, where everything is recorded and <a href="http://www.archive.org/index.php">archived</a>, nothing is forgotten. Memory is cheap. Remember this when, in five years&#8217; time, your potential employer asks you about the time you got drunk, busted, and jailed on new years&#8217; eve, as you detailed with pride on your now moldy myspace page. Old-school cool becomes new-school stupid.</p>
<p>Oh, yeah, some fucker stole my bike; the joy of living in Cambridge. Somehow, uncharacteristically to the island, no security cameras covered the scene.</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/exposed-online-people-sometimes-lie-about-themselves_265/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>building on privacy</title>
		<link>http://weblog.saardrimer.com/index.php/building-on-privacy_250/</link>
		<comments>http://weblog.saardrimer.com/index.php/building-on-privacy_250/#comments</comments>
		<pubDate>Fri, 21 Jul 2006 00:53:21 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/building-on-privacy_250/</guid>
		<description><![CDATA[
Through reddit.com.
Edit: I found the proper credit for the image&#8230; Clay Bennet&#8230; who appears to do great work!
]]></description>
			<content:encoded><![CDATA[<p><a href="http://www.claybennett.com/pages/security_fence.html"><img src="http://www.claybennett.com/images/archivetoons/security_fence.jpg" alt="building on privacy" /></a></p>
<p>Through <a href="http://www.reddit.com">reddit.com</a>.</p>
<p>Edit: I found the proper credit for the image&#8230; <a href="http://www.claybennett.com/">Clay Bennet</a>&#8230; who appears to do great work!</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/building-on-privacy_250/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>conference clicks</title>
		<link>http://weblog.saardrimer.com/index.php/conference-clicks_244/</link>
		<comments>http://weblog.saardrimer.com/index.php/conference-clicks_244/#comments</comments>
		<pubDate>Sat, 01 Jul 2006 14:01:03 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[ideas]]></category>
		<category><![CDATA[rants]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/conference-clicks_244/</guid>
		<description><![CDATA[Last week I attended most of the WEIS and PET sessions. The topic is a bit removed from my interests but it was good to hear what is out there and chat with all the interesting people. The most valuable thing I learned, however, was that I am happy where I&#8217;m at, as far as [...]]]></description>
			<content:encoded><![CDATA[<p>Last week I attended most of the <a href="http://weis2006.econinfosec.org/">WEIS</a> and <a href="http://petworkshop.org/2006/">PET</a> sessions. The topic is a bit removed from my interests but it was good to hear what is out there and chat with all the interesting people. The most valuable thing I learned, however, was that I am happy where I&#8217;m at, as far as research interests goes.</p>
<p>I have a Dell Inspiron 9300 laptop, better described as a &#8220;<a href="http://en.wikipedia.org/wiki/Desktop_replacement">desktop replacement</a>.&#8221; It&#8217;s a great computer, but not for hauling around. I don&#8217;t take it to conferences or workshops; some of it has to do with the weight of the thing, but mostly, I believe that if I am somewhere, I should be <em>fully</em> there and give my undivided attention to the person on the podium&#8211;they deserve it.</p>
<p>As an experiment, I tried to phase out the speaker&#8217;s voice and listen to what I&#8217;ll call &#8220;conference clicks,&#8221; it&#8217;s quite astounding, you should try it. Looking around, I see that many people stare at their screens, meaning that they are not fully there; I can only imagine how the speaker feels (I have not spoken in front of this large crowed before.) I&#8217;d feel quite insulted, to be honest; I&#8217;d rather people not be there at all than not being <em>fully</em> there.</p>
<p>My solution? Cut the WiFi during sessions and have cabled ports outside the hall for people who choose not to attend the lecture. This may sound outrageous to some, but I think this is where we are headed. </p>
<p>To tie in one of my other rants, I&#8217;d ban laptops from business meetings too. When I am king/CEO, that will be corporate policy and I think this will become more wide spread soon as well.</p>
<p>Say no to &#8220;conference clicks&#8221;!</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/conference-clicks_244/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>SHARCS and seat belts</title>
		<link>http://weblog.saardrimer.com/index.php/sharcs-and-seat-belts_231/</link>
		<comments>http://weblog.saardrimer.com/index.php/sharcs-and-seat-belts_231/#comments</comments>
		<pubDate>Wed, 05 Apr 2006 23:36:47 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[security]]></category>
		<category><![CDATA[tech]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/sharcs-and-seat-belts_231/</guid>
		<description><![CDATA[I was in Cologne, Germany for a few days attending SHARCS &#8216;06- Special-purpose Hardware for Attacking Cryptographic Systems workshop. It was great meeting people in the field and talk hardware and crypto and hear the presentations. I came back with a few ideas for projects and increased motivation. I&#8217;ll have a more detailed and technical [...]]]></description>
			<content:encoded><![CDATA[<p>I was in Cologne, Germany for a few days attending <a href="http://www.ruhr-uni-bochum.de/itsc/tanja/SHARCS/">SHARCS &#8216;06</a>- Special-purpose Hardware for Attacking Cryptographic Systems workshop. It was great meeting people in the field and talk hardware and crypto and hear the presentations. I came back with a few ideas for projects and increased motivation. I&#8217;ll have a more detailed and technical post on our group&#8217;s <a href="http://www.lightbluetouchpaper.org">weblog</a> in a couple of days. One notable hardware project is <a href="http://www.copacobana.org/">COPACOBANA</a>: &#8220;<a href="http://www.copacobana.org/paper/copacobana_SHARCS2006.pdf">How to Break DES for â‚¬ 8,980</a>[in 9 days]&#8221; by Sandeep Kumar, Christof Paar, Jan Pelzl, Gerd Pfeiffer, Andy Rupp and Manfred Schimmler. It uses 120 low-cost Spartan3&#8217;s (XC3S1000) from Xilinx. </p>
<p>I&#8217;d like to thank the organizers for providing for my attendance; it is much appreciated.</p>
<p>On a questionably related topic&#8230; why do taxi drivers never wear seat belts? I&#8217;ve taken a few taxi rides recently to notice that it is  common practice even outside Israel (where no respectable taxi driver be caught &#8230; wearing one.) I mean, do they think statistics don&#8217;t apply to them? physics? Someone have a good answer? Just wondering out loud here.</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/sharcs-and-seat-belts_231/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Israeli elections today</title>
		<link>http://weblog.saardrimer.com/index.php/israeli-elections-today_229/</link>
		<comments>http://weblog.saardrimer.com/index.php/israeli-elections-today_229/#comments</comments>
		<pubDate>Tue, 28 Mar 2006 14:10:44 +0000</pubDate>
		<dc:creator>Saar Drimer</dc:creator>
				<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://weblog.saardrimer.com/index.php/israeli-elections-today_229/</guid>
		<description><![CDATA[In case anyone is interested (seems like most Israeli&#8217;s don&#8217;t, judging by the turnout) Israel is voting today. I thought it would be nice to provide some details on the how elections are done in Israel. Purely on a mechanical level, no politics.
If you are over 18, you can register to vote. Once you do, [...]]]></description>
			<content:encoded><![CDATA[<p>In case anyone is interested (seems like most Israeli&#8217;s don&#8217;t, judging by the turnout) Israel is voting today. I thought it would be nice to provide some details on the how elections are done in Israel. Purely on a mechanical level, no politics.<br />
<img class="alignleft" src="http://www.ynet.co.il/PicServer2/20122005/754134/JRL114_ot.jpg" alt="voting" />If you are over 18, you can register to vote. Once you do, you get a little certificate telling you where you can vote, usually it&#8217;s in a school or other public venue near your residence. You may only vote there. If you are a soldier, you vote at your base. If you are not present in Israel on the day of elections, you <em>cannot</em> vote unless you were sent abroad by the country; in this case you vote at an embassy.<br />
When you get to the polling station (there are observers from multiple parties present) you hand in your certificate with an ID (Israel has national IDs) and are marked on a <em>pen-and-paper</em> list and given a single blue envelope. You then go behind a cardboard set on a table that conceals most of your upper body. You are faced with a frame that has many compartments.<br />
<img class="alignright" src="http://www.ynet.co.il/PicServer2/20122005/753055/JRL126_a.jpg" alt="vote" />In each compartment lies a stack of rectangular pieces of paper with <a href="http://www.ynet.co.il/articles/0,7340,L-3233140,00.html">one to three Hebrew letters</a> printed on them designating each party; there is also a blank stack so you can abstain. These letters may or may not correspond to the actual name of the party. For example, the &#8220;Labor&#8221; party has the designation ××ž×ª which means &#8220;truth&#8221; or &#8220;true.&#8221; But this is more an exception than the rule. This year there is confusion between the &#8220;Kadima&#8221; party with the designated letters ×›×Ÿ that mean &#8220;yes&#8221; and the &#8220;Green Leaf&#8221; party that promotes the legalization of marijuana, designated ×§×  which is short of cannabis. Yes, these designations sound the same: &#8220;ken.&#8221; I doubt there will be an equivalent <a href="http://en.wikipedia.org/wiki/Chad_%28paper%29">chad</a> fiasco over this; although these confusions should have been thought of upfront. So, you are there, behind this cardboard&#8230; you pick one piece of paper of your choice, put it in the envelope and seal it. Then you come out and drop the envelope in a slotted box in full view. Then you leave. If there is more than one piece of paper, or it is defaced in any way your vote will not be counted.<br />
<img class="alignleft" src="http://www.ynet.co.il/PicServer2/20122005/754290/photo-haim-zach-01_a.jpg" alt="Katzav voting" />As you noticed, the whole process is purely manual, there are no electronics involved or fancy punch machines. I, for one, think it is better this way. There is no reason to automate or complicate (i.e. jeopardize, open to mass cheating and coercion and so on) the process by introducing functions that are foreign to the voter; putting a piece of paper in an envelope is a universally simple task. If this means that manual counting will take a few more hours, so be it, it&#8217;s not a big deal; there are exit polls for people who can&#8217;t wait for the real numbers. The only time where we should consider electronic voting is when it can produce a paper trail that would enable the voter to verify that his or her vote was counted <em>towards their choice candidate or party</em> without the ability to be coerced. We are not there yet, and frankly, I don&#8217;t think we ever will be. I can think of one powerful attack against most proposed systems: the cellphone camera.</p>
]]></content:encoded>
			<wfw:commentRss>http://weblog.saardrimer.com/index.php/israeli-elections-today_229/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>
