Down Mixing Quadrophic and 5.1 Surround Sound with SOX

 Computing, Working Notes  1 Response »
Jan 112014
 

As categorised, this is a “working note” and explains how I ‘down mix’ quadrophic FLAC files into stereo files with the assistance of sox. This may well not be the best method and indeed I may be getting it totally wrong – who knows what two channels are supposed to go where?

It turns out that my portable media player doesn’t understand FLAC files with more than two channels, and as I have a number of these obtained from somewhere I needed a way to make them playable. The first step is to identify FLAC files with more than two channels. It turns out that the venerable file does that quite adequately :-

% file one.flac two.flac
one.flac:              FLAC audio bitstream data, 24 bit, stereo, 96 kHz, 24179840 samples
two.flac:              FLAC audio bitstream data, 24 bit, 4 channels, 96 kHz, 24179840 samples

As you can see the third column of the information about the file identifies the number of channels; it also identifies 5.1 surround sound files as 6 channel files. And quite possibly wilder and woollier kinds of channel numbers too.

Now onto the conversion. This is simply the following :-

% sox input-file.flac output-file.flac remix 1v0.5,3v0.5 2v0.5,3v0.5 norm
% file output-file.flac
output-file.flac:      FLAC audio bitstream data, 24 bit, stereo, 96 kHz, 24179840 samples

The details of what sox command to use … and specifically the remix parameters came from a post discussing the problem here. I’m not qualified to assess the details, but the results seem fine. For extra points, the remix parameters for 5.1 surround sound are: 1v0.3694,3v0.2612,4v0.3694 2v0.3694,3v0.2612,5v0.3694.

Why Is Password Security So Important?

 Computing, Security  No Responses »
Dec 032013
 

People like me keep banging on about why the security of passwords is so important. We keep telling people they need strong passwords, when what people really want are easy to remember passwords. Of course we keep on saying the same message because not everyone pays any attention.

The truth is that it is possible; or at least partially possible to have both strong passwords and relatively easy to remember ones. But first why is it necessary at all?

The sad fact is that there are criminals out there; not spotty teenagers in basements having some sort of weird fun, but genuine criminals who want your account details for a variety of reasons. Organised crime has moved on from bathtub gin, bank robberies, and drugs realising that (amongst other activities) computer crime can be quite profitable with a lower risk of being caught.

The most obvious accounts targeted by criminals are bank accounts – online access to your bank. Whilst they will target such accounts, criminals will also target the most innocuous accounts as well – your ISP account, or a work account. The lowest level of usage of a stolen account is to send spam; not in vast quantities but even several hundred spams sent in your name can really ruin your day.

And will continue to have a less obvious negative effect over time – your email address will be less trusted by recipients if it has ever been used by a spammer. And of course that is the damage I know of. The criminals may use your account for other purposes.

In fact it is probable that any stolen account has a small but definite value on underground markets such as the Silk Road (or deeper and darker places).

And that is excluding the damage that criminals can more directly cause you by access to all the data contained within your account.

How Do Criminals Get Your Password?

So how do criminals get hold of account passwords? It turns out there are three main methods, and one is only useful in certain circumstances (and happens to be the most technical and so the most interesting to geeks).

Just Ask!

It may seem crazy, but probably the easiest method of obtaining account details is simply to ask for those details! The question is normally dressed up to confuse the situation so that it appears to be a legitimate organisation asking for the password. An email from your bank asking you to login via a provided link; an email from your IT support department asking for your password to increase your mail quota.

The defense against this is to never tell anyone your password. Your password is a method of demonstrating that you are yourself; if you give it away, you let other people pretend to be you.

Don’t do it.

Just Guess!

Some people use passwords so weak that they can be guessed relatively easily – or at least easily when the password guessing is scaled up. If a criminal has a 0.001% chance of guessing a password, but they try 1,000 different accounts with 10 different passwords at 1,000 different sites per day, they can expect to get 100 accounts a day!

The best defense against this sort of attack (for an individual) is to make sure you do not have a weak password – go for one that is long and strong (we’ll get to that later).

Password Cracking

The last method of getting account passwords is only possible with access to the password hashes which normally involves exploiting some kind of vulnerability. Once access to those hashes is obtained, it is possible to use a password cracking dictionary to generate a list of candidate passwords and calculate the password hash for each one. When the hash for a candidate password matches the hash of a real account, you know what the password is.

It shouldn’t be possible for a criminal to get access to password hashes, but they do get access to them on a regrettably frequent basis. In addition, it is not uncommon for password cracking to be used as the ultimate test of whether a password is “strong enough” – if it can be cracked with a reasonable level of resources, it is weak.

The best defense against this kind of attack is again to use a long and strong password.

Long And Strong (And Memorable) Passwords

The best passwords are long and random, but very definitely not memorable – as an example, a typical random password might be Y2JkOGY3OTg0YzY1NGMyNTUxMmUzZDkyNDFhZTU2OWYgIC0K. Not the sort of password anyone would want to remember, although password stores such as LastPass allow the use of such passwords. Certainly worth investigating.

However it still needs a master password and there are other circumstances where passwords you have to remember are essential. In such cases memorable becomes a requirement, but we still need strong passwords.

For most of us, a memorable password is made up of dictionary words, yet we are often told that a word-based password (no matter how cleverly transformed it might be) is a weak password. It turns out to be correct for single word passwords, but multi-word passwords are still relatively strong. A lot weaker than truly random passwords of an equivalent length, but somewhat surprisingly a lot stronger than short truly random passwords.

The mathematics of this gets a bit hairy, so take it on trust – length is the most important factor in determining password strength with certain exceptions (a very long word isn’t strong no matter how long it is).

The XKCD Password strength comic

Stringing together a whole bunch of words may not seem the most sensible way to come up with a memorable password; in fact I’ve been using a five word password for many years, and at this point I can’t forget it! I would suggest though that the XKCD method can be strengthened a wee bit by adding a symbol between every word – pick a random symbol like “@”.

Now pick three to four “random” words, and string them together with your random symbol :-

${word 1}${symbol}${word 2}${symbol}${word 3}${symbol}${word 4}${symbol}

Becomes: four@blatter@pong@zoo@

One thing to watch out for – you should have at least one “unusual” word in the list of random words, and don’t have too many short words – the password trustno1 is a weak password!

Google and Microsoft To Block Child Abuse Images?

 Computing, Security  No Responses »
Nov 182013
 

Today the news comes that Google and Microsoft have agreed to block child abuse images. Great!

Anyone reading (or watching) the news story could be forgiven for thinking that this will solve the problem of child abuse images on the Internet, but that won’t happen. What Microsoft and Google have done is a tiny increment on what they were already doing – instead of just excluding hosts given to them by the Internet Watch Foundation, they are also going to ‘clean up’ the search results for certain searches.

It isn’t blocking child abuse images. The search companies can’t do that; anything who thinks so needs to go and learn a bit more about the Internet which includes the government. Who have of course come out of their rabbit hutch spitting lettuce leaves everywhere, saying that if this action by the search companies isn’t effective they’ll legislate.

Which is just about the clearest evidence so far that the government is completely clueless when it comes to technology; obviously Eton‘s reputation is overstated when it comes to technology education.

People tend to think of child abuse images as being a little bit like anything else you browse to on the Internet – you just search for it, and up it pops. I haven’t tried, but I suspect what you would get is a large number of pages like this one – talking about child abuse images in some way, but no real images. Undoubtedly there are some really dumb child pornographers out there who stick up their filth on ordinary web servers; whereby they’ll quickly get indexed by the search engines and someone law enforcement bods will come pounding on the door.

However the biggest area of child abuse image distribution is likely to be one of the variety of ‘stealth’ Internets … the “dark nets’, or ‘deep web‘.

The later are web sites that cannot be indexed by the search engines for various reasons – password protection, links have never been published, etc. These would be the choice of the not quite so dumb child pornographer.

The former are harder to find – they are roughly analogous to peer-to-peer file sharing networks such as Bittorrent which is widely used for sharing copyrighted material (films, music, etc.). But ‘friend to friend’ file sharing networks are private and not public; you need an invitation to join one. This is where the intelligent child pornographer lurks.

And all the hot air we’ve heard from the government so far is going to do pretty much bugger all about the really serious stuff. If you are a clueless politician reading this, get a clue and ask someone with half a brain cell about this stuff. And don’t invent half-arsed measures before asking someone with a clue about whether they’re likely to be effective or not.

How Strong Are XKCD-Style Passwords? And Other Thoughts

 Computing, Security  No Responses »
Nov 082013
 

One of the odd things about telling people about password security is that you have to learn just a little bit more than what you are saying. This leads to the frustration of not being able to talk about ideas you might have – such as that perhaps xkcd-style passwords (“word1word2word3word4”) are not quite as strong as is made out.

Not that they’re weak of course, and indeed I encourage their use wherever it is inconvenient to use “line noise” style passwords such as “JyP;$u5+Q\hzrU[C”. But how was the strength of the password “correcthorsebatterystaple” calculated? And was that calculation correct?

When we want a quantitative value for the strength of a password, it is traditional to calculate the information entropy of the password for the simple reason that the number of bits of entropy is very quickly turned into the number of password guesses necessary to get the password. Simply calculate 2^(entropy bits) and you have the number of guesses necessary to exhaustively search all possible passwords; of course on average it is only necessary to search through half of the possible passwords to guess the correct password.

To calculate the information entropy of a password is a slightly tricky calculation: entropy = log2 (number of possible symbols) ^ (length of password). Or to be more general: entropy = log2 * (number of different possible passwords). Of course this only applies to truly random passwords, so is strictly speaking the maximum possible entropy. The “log2” is base 2 logarithm which doesn’t usually appear on a calculator, but can be calculated as logx(X) = log(X)/log(2).

If we calculate the information entropy of the “correcthorsebatterystaple” we get :-

$ calc
(suppressed)
; ln(26 ^ (5 + 7 + 6 + 7))/ln(2)
	~117.51099295352730400945

Which is far in excess of the 44 bits calculated in the cartoon.

But is it correct? If you were to translate the “correcthorsebatterystaple” password into Chinese you would get “正馬電池 訂” (don’t blame me for the poor translation) which isn’t quite what I was hoping for, as it is five “symbols” instead of four … because we have four words. If we think of the password as being four symbols long, we have a somewhat different calculation where we raise “something” to the power of 4.

Now if we count all the words in the file /usr/share/dict/words as symbols (and add 96 for the ASCII character set), we end up with a total of 99267 symbols which is greater by far than the minimal 26 symbols that we started with. But the calculation comes out differently :-

$ calc
(suppressed)
; ln(99267 ^ 4)/ln(2)
	~66.39610628854963984846

Which is a lot less … we’ve gone from the verging on overkill on terms of strength towards the lower end of “strong”. But that isn’t all. If we remove all words longer than 8 characters from /usr/share/dict/words we get a total of 31321 which gives a somewhat different result :-

$ egrep -e "^.{1,7}$" /usr/share/dict/words | grep -v "'"  | wc -l
31225
$ calc
(suppressed)
; 31225 + 96
	31321
; ln(31321^4)/ln(2)
	~59.73937061801244336267

Which is now dropping to the “reasonable” category. But that still has way more words in it than are likely to be used in passwords. If we restrict it to the top 5000 most common words in episodes of The Simpsons (it happened to be a good list easily obtainable) then we go down yet again :-

; ln(5096^4)/ln(2)
	~49.26059824902520150092

Which is now in the mid-range of the “reasonable” category. We are still above the xkcd calculated value of 44 bits of entropy (they may have used NIST 800-63 to calculate the entropy). And way higher than the amount of entropy in the typical weak password … which is a simple word, or perhaps a word with a symbol added to the end. The amount of entropy in that sort of password is around 18 bits (when we treat a word as a symbol).

As a result we can conclude that :-

  1. The xkcd method results in much stronger passwords than the typical password (49 > 18).
  2. The xkcd method is much weaker than a truly random password (49 < 164). The 164 comes from calculating the entropy of a random password with a choice of 96 possible symbols.
  3. Nobody could argue that the xkcd method is a lot easier to remember than a truly random password.
  4. The xkcd method can become very weak if an attacker can predict what dictionary of words are used. For instance if passwords are generated from a very restricted set of words (say 25 words), then the entropy drops to just over 18 bits which is in the insanely weak category.

At present (as far as we know), there aren’t any tools out there to attack xkcd-style passwords but there soon will be.

OSX: The “Thunderbolt Bridge”

 Computing  No Responses »
Nov 072013
 

I am not aware of how widely it has been publicised, but it was certainly a surprise to me … and a few others. After upgrading to OSX 10.9 (Mavericks), and when going into the “Network Settings”, a new network device appeared. Specifically something called the “Thunderbolt Bridge”.

It turns out that this is a new feature of OSX where you can connect two Macs (or potentially other kinds of system) together with a thunderbolt cable, and run IP over that connection. Which is fast compared with normal ethernet, although it is comparable with 10GE and slower than 40GE, and 100GE (and of course slower than modern InfiniBand).

But it probably isn’t as usable as 10GE at present for the following reasons :-

  1. There’s no networking hardware support for thunderbolt networks at present.
  2. The cables are different, so offices would have to be rewired for it. Which would be very expensive.
  3. It turns out that thunderbolt takes a lot of processor power to run networking at that speed.

That’s not to say it won’t make a fine way to connect two Macs together for data transfers. With any luck (unfortunately I can’t test it), it should be a case of just plugging the two Macs together and using normal sharing mechanisms to do a transfer. Both sides should automatically configure an IP address, so normal networking services should be able to see the other Mac across the “Thunderbolt Bridge”.

The only problem with this new feature is the name – “Thunderbolt Bridge” – which might be user-friendly, but is likely to make networking people flinch. User configured network bridges have been known to cause problems!

For more details have a look here.

 Older Entries  Newer Entries