Talk Back: Share Media With Your Family Using P2P

[dang]

Checkout our latest Talk Back: Share Media With Your Family Using P2P (http://news.designtechnica.com/talkback44.html)

[ECA]

I wouldnt USE P2P on a family network, if ANY one also had the internet on the machines.
If they were passworded, it would be cool. But a virus or BOT could spread threw it so fast, you would REALLy have fun removing it.
As soon as it was removed, it would reinfect from the other machines.
BUILT IN password, and firewall..

[llbbl]

grouper looks pretty sweet. nice article isaac

[kepaloha]

ECA, I see your concerns, that's why when you want to share the files, it's by invite only, and you have to use their software to be able to see the files that you want. It really is a slick little program. But I do understand your concerns about hackers.

[ECA]

My concern, is that the PASSWORDS are already in the program... Unless its only STORED on the Server side, and NO saved passwords, you can bs SCREWED so bad.

But even with that.. do you know what and whare Virus/trojans were made for in the FIRST place?? they were designed to look for SERVERS/interconnections, to look for any connection to another machine, modem, netcard, par/serial port... and they still are designed this way.
Be neet if it has, or can be integrated with an Anti virus program/firewall..

[ECA]

Ok,
Whats the WORSE, Virus/troajn you have EVER heard of???
How about SEEN?

I have seen one, that Erases your BIOS. Do you know whats left after that? A door stop, or hoping your Bios chip is removeable, as you will NEED to replace it...$80-160..
If the little computer in this machine is UPGRADEABLE, then the program is out there to do this..

[kepaloha]

Very good points on the security concerns. I hope this might answer your questions and concerns.

Grouper uses the AES (Advanced Encryption Standard, Rijndael) encryption algorithm, with 256 bits key size.
Each group has a cryptographically strong private key that is used for authentication, encryption and decryption.
Grouper Networks maintains the group keys and securely delivers them only to authenticated group members over SSL.
All sensitive information sent from peer to peer using Grouper is encrypted using the group key.
All network requests for file browsing, downloading or streaming are authenticated. Requests sent by non-group members are not served.
All communications between your Grouper software and the Grouper web server is encrypted using SSL to prevent a third party who may be monitoring your network traffic from obtaining any information regarding your Grouper user account or file sharing activities.
All Group chat and one-on-one IM text is encrypted and can only be read by group members or by your conversation remote user.

That also sounds like a nasty virus. The worst one that I've every seen was "Dark Avenger" which if I remeber, is a polymorphic virus. That one can be a hard one to track down.

[llbbl]

will grouper be able to operate after the lawsuits have driven it from the marketplace?

[ECA]

a KEY even 256bit, isnt Virus/trojan/malware/spam protection... It only guarentees that it will GET where it was sent.

and ASK PGP about 256bit encryption... It can be broken, esp if you just sit and decode it after you got it.. And big companies can do that...

[llbbl]

look the big companies aren't going to spend a hundred millions dollars on a massive supercomputer to crunch 256 AES encryption just so they can sue people . that wouldn't be very good use of their money.

[ECA]

MAKe a bet??
1. I monitor WHAt program is going where...
2. I unscramble the program, and the LIST from #1 I send lawyers after...SO WHAT it takes 1 year... I KNOW from the servers records that THIS program WENT "HERE" to THIS computer.
3, you dont think I can run 6-12 computer on a Chain, and crack this code in 1 month??? Thats just foolish. we are talking a 256bit, NOT 256 byte. and 90% of those will be a word LESS then 8 letters... And 75% of that 90% will be LESS then 6 letters..281,474,976,710,656 combinations of bits, that I can have SAVED on another comp, and SLAM at the combination..
ANd if nothing ELSE, i get the LAW on it, and say, PROVE you arent copying copyrighted material, GIVE US THE KEY.. so WE can check...
there is NO privacy, if there is ANY copyrighted material..

[llbbl]

1. I monitor WHAt program is going where...

So I am saying that however much they might want to do what they do now with the kazaa network it would not be cost effective to do so.

2. I unscramble the program, and the LIST from #1 I send lawyers after...SO WHAT it takes 1 year... I KNOW from the servers records that THIS program WENT "HERE" to THIS computer.

They wouldn't do that because it costs to much to do so. Plus how are they going to intercept the traffic anyways ????

3, you dont think I can run 6-12 computer on a Chain, and crack this code in 1 month??? Thats just foolish. we are talking a 256bit, NOT 256 byte. and 90% of those will be a word LESS then 8 letters... And 75% of that 90% will be LESS then 6 letters..281,474,976,710,656 combinations of bits, that I can have SAVED on another comp, and SLAM at the combination..
ANd if nothing ELSE, i get the LAW on it, and say, PROVE you arent copying copyrighted material, GIVE US THE KEY.. so WE can check...
there is NO privacy, if there is ANY copyrighted material..

And your the expert on cracking AES encryption now are you? How do you know how long it takes. Your just making an estimate. You do not have evidence/experience to support your statement.

[llbbl]

Rijndael [22] is a substitution-linear transformation network with 10, 12 or 14
rounds, depending on the key size. A data block to be processed using Rijndael is
partitioned into an array of bytes, and each of the cipher operations is byte-oriented.
Rijndael’s round function consists of four layers. In the first layer, an 8x8 S-box is
applied to each byte. The second and third layers are linear mixing layers, in which
the rows of the array are shifted, and the columns are mixed. In the fourth layer,
subkey bytes are XORed into each byte of the array. In the last round, the column
mixing is omitted. Rijndael was submitted by Joan Daemen (Proton World
International) and Vincent Rijmen (Katholieke Universiteit Leuven).

That is the type of encryption algorithm they use for AES.

Here is a report on the standard.

http://csrc.nist.gov/CryptoToolkit/aes/round2/r2report.pdf

[ECA]

And I know HUMANS...
90% of passwords are less then 8 letter.
70% are less then 6 letters.
40% are mixed letters and numbers.
About 60-70% are REAL words, Names, there mothers madian name, or 1 of 100 commonly used words.
http://geodsoft.com/howto/password/common.htm
30% are just a straight line of latters off the KB.
http://www.searchlores.org/commonpass1.htm
20% use there Birthday
and a GREAT many use the SAMe password to EVEYTHING, Everysite, everyplace, including that combination lock on there FRONT DOOR.

I can setup a system with ALL the combinations on it, this isnt a combination lock, there are STILL only "THIS MANY" combinations. 281,474,976,710,656. Even with a double KEY system, It can be done..
I THEN have about 10 iterations of the program being HIT by groups of the encryption.
then I WALK away, and check about everyother day... NO COST... except the power of the computers.. And WHEN I crack it, NOT if... I sell the info to the company..FOR BUCKS...

as with many THIEVES,
Its easyier to carry A ring of keys, then to TRY and CUT a key on site.
ANd if I go to the governement, as the RIAA did, and COMPLAIN about it, they can FORCE the company to GIVE me there KEYs...
AND what company DONt put in a backDOOR, Just incase.....Even PGP, has a backdoor..
http://www.wired.com/news/technology/0,1282,53782,00.html
http://computercops.biz/article961.html

[llbbl]

Look there is a limit to how much the companies are going to be able to sue someone for stealing a song that costs .99 cents or an albumn that costs 10 dollars. They aren't going to spend hundred million dollars a year on expert code crackers and the hardware/software to go about it, if they can only get 2-3 thousand total from each offender they catch and it takes them a month or 6 months or more to break a single persons code.

I am not totally sure, but I think when they employ brute force decryption methods they would only be able to see that particular packet of information. So even if they did decrypt it they couldn't see what is the next thing that a particular person sends. However long it would take them it wouldn't be short/inexpensive/worthwhile to go through all that work just for *one* song.

Say they encrypt a song before they send it and then it is decrypted on the other side well, assuming they could identify that these two persons are running a particular program they would have to intercept the traffic between them which is next to impossible. Let me repeat that intercepting and monitoring traffic of this kind would be next to impossible. More likely they would try to pose as friends and infiltrate the network...

So how do you protect againt people who pose as people they are not? They think that you limit it to only people you trust. See this is the tricky part. Who can you trust?

[llbbl]

from wired link
The flaw allows a hacker to send a specially coded e-mail, which would appear as a blank message followed by an error warning and effectively seize control of the victim's computer. The hacker could then install spy software to record keystrokes, steal financial records or copy a person's secret unlocking keys to unscramble their sensitive e-mails. Other protective technology, such as corporate firewalls, could make this more difficult.

This is why having HTML view on is a bad thing. Besides do you really think that a person who is encrptying their emails is stupid enough to open a blank message?

[dang]

lively discussion, but let's keep the tension out of it. :) It's the holidays, enjoy em.

[ECA]

but what do the copyrights SAY, about it...
Whats the FINe for copying?? $250,000 and 5 years in jail..
and say you catch 1000 sharing 1 copy of Spiderman the movie.

[kepaloha]

Wow, this is a very lively conversation. It's with hopes that Grouper will not get sued and that the 30user limit loophole will hold true. The great thing about grouper is that you can stream the other persons media files. There will be no need to copy the music over(since that is against the law), you are able to stream the music and avi files. But then again, you know human nature. Grouper seems to be relying on the honor system on this one. If people honor it, the software should stay free.

As TecknoGeek stated, someone could try to pose as a friend or family, but I hope all of us out there would be smart enough to smell something fishy and then call your buddy and say "WHAT's UP?" I don't think any of us would be giving a complete stranger access to your computer. Hell, I won't give my sister access to my computer.

[ECA]

WELL,
One problem is THIS.
According to the LAWS made...
Only person that can listen to Music, or video is the person WHO bought it. PERIOD.

they are to a point where your neibhor cant borrow it, and the rest of your family cant watch it EITHER..
they are pusing laws REALLy hard.
Know why you cant listen to radio stations at the MALL, insted of MUSAK???
COPYRIGHTS.. NO public listening... Only private..
Even a TAXI cant let you listen to THERE radio...for fear of being sued.

[Ioman]

will grouper be able to operate after the lawsuits have driven it from the marketplace?

haha my thoughts exactly, the MPIAA and RIAA are going to try and put P2P under.

[llbbl]

haha my thoughts exactly, the MPIAA and RIAA are going to try and put P2P under.

those bastards lawyers should burn in hell for it too. time to donate to the EFF again i'm thinking.

[ECA]

I think the NRA might be nice also...
2million ppl march on the Lawyers associations in the US, would REALLY wake them up..
Lets just hit there convention, in south america, and wipe about 1/2 of ALL of them out..

[kepaloha]

I 2nd that motion!!

[JoeLove]

nteresting discussion. I kinda doubt that if thousands of people adopt Grouper, it's gonna be worth anyone's time trying to crack encryption or infiltrate private groups to find out if copyright violations are going on. Grouper is more of a new social option for using the Net than it is a nifty way to get past copyright. Hell, they don't even support MP3 downloads - though it's easy to get around.

I've been using Grouper for a few months now and finally they released V 1.3 that fixes some of the upstream/downstream balance problems that made it hard to use while streaming MP3s from others' members' drives while other members were downloading files from my drive.

But they've also added better search tools for finding files among all of the shared drives in your group, and the client is more powerful as a social tool, now, in addition to being a better technical tool.

You can check out the latest Release Notes here: http://www.grouper.com/v1/releasenotes.htm

You can ask questions about security in their Forums here: http://forums.grouper.com/index.php?