The Daily WTF: Curious Perversions in Information Technology

boog · 2011-07-25 Reply Admin

C-Octothorpe:
Encryption is NOT Encoding

You've got that backwards. Your link even says so in the first section:

Strictly speaking, encryption is an encoding operation...

2011-07-25 Reply Admin

C-Octothorpe:
Encryption is NOT Encoding[/url] Mariam Websters perhaps defines them as interchangeable terms, however in the context of computer science and cryptography specifically (which is what we're talking about, so get over it), they are wholly different things.

I'd put it this way:

Encryption might be considered a form of Encoding

...If we consider Encoding to mean moving data from one representation to another. Encryption in particular is then a way of encoding data such that it will be sufficiently difficult to decode. Decoding may be greatly facilitated by a key, it might even absolutely require it to make sure the data has been properly decoded.

A given Encoding is not necessarily a form of Encryption

Because encoding is just changing how we represent data. When I convert from Unicode to ASCII, is that encryption? What about when I make a ZIP archive? Or convert from one lossless image/audio format to another? Encryption? Really?

You could argue, if you wish, that the use of base64 here is encryption, just a really poor one. That discussion would end up mirroring "(Art/Not Art) vs (Good Art/Bad Art)".

2011-07-25 Reply Admin

I'm guessing that the objective was to scare off casual editing and the actual protection is a contract. Faking licensing for the company I work at's software is remarkably easy (all you need is to update a table) but unheard of because of:

A contract term allowing us to sue anybody who fakes a license into a fine mist.
The software being sufficiently complicated to configure that it's essentially unusable without a support contract.

boog · 2011-07-25 Reply Admin

nisl:
C-Octothorpe:
Encryption is NOT Encoding Mariam Websters perhaps defines them as interchangeable terms, however in the context of computer science and cryptography specifically (which is what we're talking about, so get over it), they are wholly different things.
Addendum (2011-07-25 14:54): This is such a stupid argument... Well, here is the be-all-end-all definition of hash, so I guess that means it no longer has anything to do with cryptographic hashing.
(Mispelled) Merriam Webster is not an acceptable source for definitions, but some guy named Dave Ireland in Australia is? Is that you're own personal website?

To be fair, not once did C-Octo say that Merriam Webster wasn't an acceptable source for definitions.

But don't let that stop you saying it for him. It might have the added benefit of making it sound like you actually have a point.

C-Octothorpe · 2011-07-25 Reply Admin

nisl:
C-Octothorpe:
Encryption is NOT Encoding Mariam Websters perhaps defines them as interchangeable terms, however in the context of computer science and cryptography specifically (which is what we're talking about, so get over it), they are wholly different things.
Addendum (2011-07-25 14:54): This is such a stupid argument... Well, here is the be-all-end-all definition of hash, so I guess that means it no longer has anything to do with cryptographic hashing.
(Mispelled) Merriam Webster is not an acceptable source for definitions, but some guy named Dave Ireland in Australia is? Is that you're own personal website?

Pointing out misspellings just makes you a childish dickweed, espeically if you have a mispelling in your very own post, dumbass.

Also, you seem to fail at reading comprehension as I never stated that the link I supplied is authoritative. He simply spent more time writing a good explanation than I have the time to right now.

It appears the level of pedantery is quite high, so let me rephrase: encryption is encoding, but not visa versa. They are two different things that are used for different purposes. I was just using broad terminology obviously when I shouldn't have.

2011-07-25 Reply Admin

Hortical:
the use of base64 here is encryption, just a really poor one

Really? Why don't you go do the above examples in this comment thread...by hand. Go ahead, I'll wait.

plaidfluff · 2011-07-25 Reply Admin

GFK:
BentFranklin:
For the convenience of readers of this thread, several past threads, and, one assumes, many future threads, perhaps The Daily WTF could put a Base64 decoder widget in the sidebar. But please, not an encoder.

Here's a simple tutorial on how to decode Base64: RG93bmxvYWQgYW5kIGluc3RhbGwgTm90ZXBhZCsrDQpPcGVuIGl0DQpQYXN0ZSB0aGUgdGV4dCBpbiBhIG5ldyBkb2N1bWVudA0KR28gdG8gbWVudSBQbHVnaW5zID4gTUlNRSA+IEJhc2U2NCBEZWNvZGU=

T3IgaWYgeW91J3JlIG9uIFVOSVggKExpbnV4LCBNYWMgT1MgWCwgZXRjLikgeW91IGNhbiBqdXN0IHVzZSAnYmFzZTY0IC1EJy4K

C-Octothorpe · 2011-07-25 Reply Admin

boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...

I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.

2011-07-25 Reply Admin

[quote user="EvanED"I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption")[/quote]

No, it's very easy to come up with a sharp line. If some data is transformed into some other form with the purpose of hiding it, then it's encryption. If data is transformed for the purpose of transporting or storing it, it's encoding. Whether or not an encryption is strong or not is beside the point. Sometimes you might do both to the same set of data.

XML, ASCII, Unicode are encodings. They are designed for ease and efficiency of storage and transmission of information.

RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.

C-Octothorpe · 2011-07-25 Reply Admin

The Teacher:
Hortical:
the use of base64 here is encryption, just a really poor one
Really? Why don't you go do the above examples in this comment thread...by hand. Go ahead, I'll wait.

I think you missed some (a lot) of context there.

2011-07-25 Reply Admin

C-Octothorpe:
The Teacher:
Hortical:
the use of base64 here is encryption, just a really poor one
Really? Why don't you go do the above examples in this comment thread...by hand. Go ahead, I'll wait.
I think you missed some (a lot) of context there.

It's a point-of-view thing, really.

2011-07-25 Reply Admin

COc:
Teacher:
Hor:
the use of er tion, st really oo one
you go do the in thi ...by hand. Go ahead, I'll .
you missed some (a lot).

2011-07-25 Reply Admin

Cans person plz post codes for Base-64 encrypting in Java syntax plz?

Captain Oblivious · 2011-07-25 Reply Admin

mah bonez:
C-Octothorpe:
Here is a hint: encoding != encrypting

Mason Wheeler:
There is no key in Base64 encoding, only an algorithm, so it does not qualify as encryption, oversimplified definitions in some dictionary notwithstanding.

The following statement is true: Encoding is a form of encryption. (i.e., encoding = encryption)

False.

This statement is true: "Encryption is a kind of encoding."

Encodings contains things other than encryptions. Your id est is a failure.

But you knew that already. Right? One can only hope people still learn the basic logic of the material implicative.

2011-07-25 Reply Admin

Anon:
EvanED:
I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption")

No, it's very easy to come up with a sharp line. If some data is transformed into some other form with the purpose of hiding it, then it's encryption. If data is transformed for the purpose of transporting or storing it, it's encoding. Whether or not an encryption is strong or not is beside the point. Sometimes you might do both to the same set of data.

XML, ASCII, Unicode are encodings. They are designed for ease and efficiency of storage and transmission of information.

RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.

I don't think I agree. I, for one, always encrypt data with the goal of being able to view it later.

C-Octothorpe · 2011-07-25 Reply Admin

EvanED:
Anon:
EvanED:
I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption")

No, it's very easy to come up with a sharp line. If some data is transformed into some other form with the purpose of hiding it, then it's encryption. If data is transformed for the purpose of transporting or storing it, it's encoding. Whether or not an encryption is strong or not is beside the point. Sometimes you might do both to the same set of data.

XML, ASCII, Unicode are encodings. They are designed for ease and efficiency of storage and transmission of information.

RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.
I don't think I agree. I, for one, always encrypt data with the goal of being able to view it later.

I was right about the level of pedantry today... :)

boog · 2011-07-25 Reply Admin

C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.

What? And miss out on all the entertainment of people confusing the two terms?

2011-07-25 Reply Admin

The Pope:
Galileo:
The Earth doth circle the Sun, and not t'other way 'round.
I was right about the level of pedantry today... :)

FTFY

2011-07-25 Reply Admin

GFK:
BentFranklin:
For the convenience of readers of this thread, several past threads, and, one assumes, many future threads, perhaps The Daily WTF could put a Base64 decoder widget in the sidebar. But please, not an encoder.

Here's a simple tutorial on how to decode Base64: RG93bmxvYWQgYW5kIGluc3RhbGwgTm90ZXBhZCsrDQpPcGVuIGl0DQpQYXN0ZSB0aGUgdGV4dCBpbiBhIG5ldyBkb2N1bWVudA0KR28gdG8gbWVudSBQbHVnaW5zID4gTUlNRSA+IEJhc2U2NCBEZWNvZGU=

Here's a simpler one: Q29uZ3JhdHVsYXRpb25zLCB5b3UgaGF2ZSBwYXNzZWQgdGhpcyB0dXRvcmlhbC4=

2011-07-25 Reply Admin

EvanED:
Anon:
RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.
I don't think I agree. I, for one, always encrypt data with the goal of being able to view it later.

Your eyes are not "prying eyes" in that case, so what's your point?

2011-07-25 Reply Admin

boog:
C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.
What? And miss out on all the entertainment of people confusing the two terms?

Gah! What confusion? Does the word "synonym" mean anything to you?!?!

2011-07-25 Reply Admin

Charles Babbage:
C-Octothorpe:
The Teacher:
Hortical:
the use of base64 here is encryption, just a really poor one
Really? Why don't you go do the above examples in this comment thread...by hand. Go ahead, I'll wait.
I think you missed some (a lot) of context there.
It's a point-of-view thing, really.

And with a narrow one, you miss a lot of context.

FUCK!!!

Coyne · 2011-07-25 Reply Admin

We'll see how Thijs and his company feel about his cleverness after the company gets hit with a DMCA violation for circumventing the encryption on this product.

Won't be so funny, then...

boog · 2011-07-25 Reply Admin

Those who live in glass houses...:
boog:
C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.
What? And miss out on all the entertainment of people confusing the two terms?
Gah! What confusion? Does the word "synonym" mean anything to you?!?!

You're funny, but the people who really do think that encrypt and encode are mutual synonyms are way funnier.

2011-07-25 Reply Admin

boog:
Those who live in glass houses...:
boog:
C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.
What? And miss out on all the entertainment of people confusing the two terms?
Gah! What confusion? Does the word "synonym" mean anything to you?!?!
You're funny, but the people who really do think that encrypt and encode are mutual synonyms are way funnier.

I wish all you ivory tower wannabes would get off your high horses. Base-64 is encryption! Do you even know what encryption means? It means "to put in a code". Base-64 is a code. Now STFU.

2011-07-25 Reply Admin

Obligatory XKCD link:

http://xkcd.com/538/

NOT Spam, askimet.

boog · 2011-07-25 Reply Admin

Coyne:
We'll see how Thijs and his company feel about his cleverness after the company gets hit with a DMCA violation for circumventing the encryption on this product.

Technically, the DMCA allows you to circumvent protections on programs that you obtained legally (for interoperability purposes). That said, it's unlikely that the contract/license with the vendor allows this type of activity.

Coyne:
Won't be so funny, then...

I'll be laughing.

2011-07-25 Reply Admin

VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu

2011-07-25 Reply Admin

Because people from other countries NEVER come to the US to work. Yup.

2011-07-25 Reply Admin

Pedantic Professor:
The Pope:
Galileo:
The Pope:
Galileo:
The Pope:
Galileo:
The Earth doth circle the Sun, and not t'other way 'round.
Yeah, but that doesn't apply to the gist of what he was saying...
The Earth doth circle the Sun, and not t'other way 'round.
Sure, but you're missing the poi...
THE EARTH DOTH CIRCLE THE SUN, AND NOT T'OTHER WAY 'ROUND.
OMFG!!!!

FTFY

C-Octothorpe · 2011-07-25 Reply Admin

Anon:
VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu

T3IsIGZvciB0aGF0IG1hdHRlciwgdXNpbmcgYSBkb29yLi4uICBXaXRob 3V0IGtub3dpbmcgaG93IHRvIHR1cm4gYSBkb29yIGtub2IsIHRoZSBkb2 9yIGlzIGVmZmVjdGl2ZWx5IGxvY2tlZC4=

2011-07-25 Reply Admin

Pretty please?!

2011-07-25 Reply Admin

EvanED:
Anon:
EvanED:
I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption")

No, it's very easy to come up with a sharp line. If some data is transformed into some other form with the purpose of hiding it, then it's encryption. If data is transformed for the purpose of transporting or storing it, it's encoding. Whether or not an encryption is strong or not is beside the point. Sometimes you might do both to the same set of data.

XML, ASCII, Unicode are encodings. They are designed for ease and efficiency of storage and transmission of information.

RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.
I don't think I agree. I, for one, always encrypt data with the goal of being able to view it later.

Then I really don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.

boog · 2011-07-25 Reply Admin

C-Octothorpe:
Anon:
VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu
T3IsIGZvciB0aGF0IG1hdHRlciwgdXNpbmcgYSBkb29yLi4uICBXaXRob 3V0IGtub3dpbmcgaG93IHRvIHR1cm4gYSBkb29yIGtub2IsIHRoZSBkb2 9yIGlzIGVmZmVjdGl2ZWx5IGxvY2tlZC4=

T2YgY291cnNlLCBkb29ycyBhcmUgYmFkIGFuYWxvZ2llcyBmb3Igc2VjdXJpdHkuICBXaGV0aGVy IHRoZSBkb29yIGlzIGxvY2tlZCwgb3IgSSBkb24ndCBrbm93IGhvdyB0byBvcGVuIGl0LCB3aXRo IHRoZSByaWdodCB0b29scyBJIGNhbiBhbHdheXMgYnJ1dGUgZm9yY2UgbXkgd2F5IHRocm91Z2gu Cg==

2011-07-25 Reply Admin

Those who live in glass houses...:
I wish all you Ivory Tower wishyouhads would get off your sorry asses. Your dicks don't have to be small! Do you even know how rectal herbal remedies work? It means "to put in your ass". Ivory Tower is a suppository. Now buy some.
Call Now!

2011-07-25 Reply Admin

document.getElementById("ctl00_MainContent_lnkComments2").innerHTML="64 Comments";

Hey, I got that too!

C-Octothorpe · 2011-07-25 Reply Admin

Ivory Tower Certified Herbal Nutritionist:
Those who live in glass houses...:
I wish all you Ivory Tower wishyouhads would get off your sorry asses. Your dicks don't have to be small! Do you even know how rectal herbal remedies work? It means "to put in your ass". Ivory Tower is a suppository. Now buy some.
Call Now!

... and legitimate (arguable) posts from registered users get hog-tied by akismet...

Now buy my Real Official NHF Hats and Viagara!

2011-07-25 Reply Admin

boog:
C-Octothorpe:
Anon:
VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu
T3IsIGZvciB0aGF0IG1hdHRlciwgdXNpbmcgYSBkb29yLi4uICBXaXRob 3V0IGtub3dpbmcgaG93IHRvIHR1cm4gYSBkb29yIGtub2IsIHRoZSBkb2 9yIGlzIGVmZmVjdGl2ZWx5IGxvY2tlZC4=
T2YgY291cnNlLCBkb29ycyBhcmUgYmFkIGFuYWxvZ2llcyBmb3Igc2VjdXJpdHkuICBXaGV0aGVy IHRoZSBkb29yIGlzIGxvY2tlZCwgb3IgSSBkb24ndCBrbm93IGhvdyB0byBvcGVuIGl0LCB3aXRo IHRoZSByaWdodCB0b29scyBJIGNhbiBhbHdheXMgYnJ1dGUgZm9yY2UgbXkgd2F5IHRocm91Z2gu Cg==

Qm90aCBvZiBvdXIgZXhhbXBsZXMgd2VyZSB3aXRob3V0IGFueSBicnV0ZSBm b3JjZSByZXF1aXJlZC4gIEJhc2U2NCByZXF1aXJlcyBubyBicnV0ZSBmb3Jj ZS4gIEVuZ2xpc2ggbGFuZ3VhZ2UgcmVxdWlyZXMgbm8gYnJ1dGUgZm9yY2Uu ICBVbmxvY2tlZCBkb29yIHJlcXVpcmVzIG5vIGJydXRlIGZvcmNlLiAgV2Ug YXJlIGdpdmluZyBleGFtcGxlcyB0aGF0IGFyZSAqbm90KiBlbmNyeXB0aW9u LCB0byBzaG93IGhvdyB0aGV5IGFyZSBhbGwgdGhlIHNhbWUgYXMgZWFjaCBv dGhlciAoYW5kIG5vdCBlbmNyeXB0aW9uIGF0IGFsbCk=

2011-07-25 Reply Admin

QWN0dWFsbHksIGh1bWFuIGxhbmd1YWdlIGlzIGV4Y2VsbGVudCBlbmNyeXB0aW9uLiAgUmVtZW1i ZXIgdGhlIGNvZGUgdGFsa2VycyBvZiBXV0lJPyAgSXQgd2FzIHRoZSBvbmx5IEFtZXJpY2FuIGNv ZGUgdGhhdCB0aGUgSmFwYW5lc2UgbmV2ZXIgYnJva2Uu

C-Octothorpe · 2011-07-25 Reply Admin

Billy Bob Boe:
QWN0dWFsbHksIGh1bWFuIGxhbmd1YWdlIGlzIGV4Y2VsbGVudCBlbmNyeXB0aW9uLiAgUmVtZW1i ZXIgdGhlIGNvZGUgdGFsa2VycyBvZiBXV0lJPyAgSXQgd2FzIHRoZSBvbmx5IEFtZXJpY2FuIGNv ZGUgdGhhdCB0aGUgSmFwYW5lc2UgbmV2ZXIgYnJva2Uu

VG8gdGhpcyB2ZXJ5IGRheS4uLiAqa2lkZGluZyo=

EvanED · 2011-07-25 Reply Admin

Anon:
EvanED:
I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption")

No, it's very easy to come up with a sharp line. If some data is transformed into some other form with the purpose of hiding it, then it's encryption. If data is transformed for the purpose of transporting or storing it, it's encoding. Whether or not an encryption is strong or not is beside the point. Sometimes you might do both to the same set of data.

XML, ASCII, Unicode are encodings. They are designed for ease and efficiency of storage and transmission of information.

RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.

I should have also excluded intent, for a couple reasons. (However, I do agree that's a large part of where the line falls.)

The first reason is that it removes the property of "being encryption" from the actual algorithm, and places it on the person doing the encoding. Is base64 encryption or mere encoding? In some cases it's definitely the latter, because you want to transfer some binary information over a channel that doesn't support it. But now if someone else comes along and says "oh, base64 is hard to understand" (they're bad at crypto) and code data in it because they think it'll keep it out of prying eyes, suddenly base64 is encryption?

The second reason is if you make it based on the motive, then you can't say. Take this case. It'd be easy to argue that the company pretty clearly wanted to keep prying eyes off. So for them, base64 falls into the encryption category. But are you sure of that? What if whoever it was that suggested that there was a coder/management disconnect is right? Then the people actually writing it didn't fully intend it as encryption. So is it or isn't it?

You can certainly say that intent is your dividing line -- but recognize that there are a lot of cases where you won't be able to figure out which it is.

Anon:
Then I *really* don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.

Now this I rather disagree with: encryption is basically by definition intended to be two-way.

2011-07-25 Reply Admin

Anon:
VGhpcyB0ZXh0IElTIE5PVCBFTkNSWVBURUQuICBJZiBpdCB3ZXJlLCB5b3Ug d291bGQgYmUgdW5hYmxlIHRvIGRlY2lwaGVyIGl0IHdpdGhvdXQgJ3NwZWNp YWwga25vd2xlZGdlJyAobGlrZSBhIGtleSkgYXMgZGVmaW5lZCBoZXJlOiAg aHR0cDovL2VuLndpa2lwZWRpYS5vcmcvd2lraS9FbmNyeXB0aW9uICBJZiB5 b3UgdGFrZSB0aGUga25vd2xlZGdlIG9mIGRlY3J5cHRpbmcgYmFzZTY0IGFz IHRoaXMgJ3NwZWNpYWwga25vd2xlZGdlJywgdGhlbiBieSB0aGF0IGxvZ2lj IHRoZSBlbmdsaXNoIGxhbmd1YWdlIGl0c2VsZiBpcyBhbiBlbmNyeXB0aW9u IGJlY2F1c2Ugb25seSBwZW9wbGUgd2l0aCAnc3BlY2lhbCBrbm93bGVkZ2Un ICh0aG9zZSB3aG8gdW5kZXJzdGFuZCBlbmdsaXNoIGNoYXJhY3RlciBnbHlw aHMsIHRoZWlyIG1lYW5pbmdzLCBhbmQgdGhlIGFiaWxpdHkgdG8gZm9ybSB0 aG91Z2h0cyBhbmQgaWRlYXMgdXNpbmcgdGhlIGVuZ2xpc2ggZW5jcnlwdGlv biBhbGdvcml0aG0pIGNhbiB1c2UgaXQgb3IgZGVjaXBoZXIgaXQu

Here's the key I used to "decrypt" this: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

Yes, that's a pretty insecure key because it's stupid simple and the MIME default, but it is still technically a key... the algorithm involved is actually used with many other keys, often it's just a change to the last two characters (eg base64 for filenames and URLs would be complicated by '/'), but using the ASCII characters, in order, from 32-95 used to be the previous default (aka uuencode).

Which isn't to say that I think that base64 is encryption... but there is a matter of intent. Normally base64 is intended to encode binary data as printable plain text, but if you have intent to obscure the data, it may be said to be "encryption" of a sort in that particular case.

C-Octothorpe · 2011-07-25 Reply Admin

EvanED:
Anon:
Then I *really* don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.
Now this I rather disagree with: encryption is basically by definition intended to be two-way.

I think he was making a joke that you encrypt once, and decrypt once...

2011-07-25 Reply Admin

EvanED:
Anon:
EvanED:
I agree in the sense that there is a very different connotation to each. I disagree in the sense that I think it would be quite hard to come up with a definition that draws a sharp line between the two (or separating out a subset of encodings as "not encryption")

No, it's very easy to come up with a sharp line. If some data is transformed into some other form with the purpose of hiding it, then it's encryption. If data is transformed for the purpose of transporting or storing it, it's encoding. Whether or not an encryption is strong or not is beside the point. Sometimes you might do both to the same set of data.

XML, ASCII, Unicode are encodings. They are designed for ease and efficiency of storage and transmission of information.

RSA is encryption, regardless of whether or not it's breakable. Nobody would use RSA just for transporting or storing data unless they also intended to hide it from prying eyes.

I should have also excluded intent, for a couple reasons. (However, I do agree that's a large part of where the line falls.)

The first reason is that it removes the property of "being encryption" from the actual algorithm, and places it on the person doing the encoding. Is base64 encryption or mere encoding? In some cases it's definitely the latter, because you want to transfer some binary information over a channel that doesn't support it. But now if someone else comes along and says "oh, base64 is hard to understand" (they're bad at crypto) and code data in it because they think it'll keep it out of prying eyes, suddenly base64 is encryption?

The second reason is if you make it based on the motive, then you can't say. Take this case. It'd be easy to argue that the company pretty clearly wanted to keep prying eyes off. So for them, base64 falls into the encryption category. But are you sure of that? What if whoever it was that suggested that there was a coder/management disconnect is right? Then the people actually writing it didn't fully intend it as encryption. So is it or isn't it?

You can certainly say that intent is your dividing line -- but recognize that there are a lot of cases where you won't be able to figure out which it is.

Anon:
Then I *really* don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.
Now this I rather disagree with: encryption is basically by definition intended to be two-way.

FTFY

2011-07-25 Reply Admin

Brent:
Which isn't to say that I think that base64 is encryption... but there is a matter of intent. Normally base64 is intended to encode binary data as printable plain text, but if you have intent to obscure the data, it may be said to be "encryption" of a sort in that particular case.

Interesting.

It's possible that the guys who wrote the software from the article intended base64 to be used as an encryption.

2011-07-25 Reply Admin

This post is in reply to several posts since my previous post.

To be clear, I'm not saying encoding and encrypting are identical words. Using the previous definition posted from Wikipedia (which I grant may not be the best definition out there): "encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, usually referred to as a key".

By this definition, encoding schemes (ROT-13, Base64, etc.) fit the bill as both the algorithm of transforming the information and as the encryption. Thus, my statement of encodings are a form of encryption (the encoding scheme is itself the algorithm, and knowledge of the scheme utilized is the key to deciphering it).

A better definition, in my view, would be as Anon put it which adds an element of intention: "with the purpose of hiding it". Base64 in this regard would then generally be an encoding scheme and not an encryption method, but then the moment it is utilized to hide the original information (such as from the original article), it becomes encryption (even if its not a very good form of encryption).

The [lack of] quality of an encryption scheme does not determine whether or not it is an encryption scheme; it is the intent to hide information that makes it an encryption scheme. Similarly, it doesn't matter if the "key" is well known (ROT-13 for example) or a well-kept secret; it is still encryption.

In regard to ROT-13, yes, it is encryption (it's just a specialized case of Caesar's cipher, which is encryption) regardless of Mason Wheeler's definition (which was what exactly?).

2011-07-25 Reply Admin

EvanED:
The second reason is if you make it based on the motive, then you can't say. Take this case. It'd be easy to argue that the company pretty clearly wanted to keep prying eyes off. So for them, base64 falls into the encryption category. But are you sure of that? What if whoever it was that suggested that there was a coder/management disconnect is right? Then the people actually writing it didn't fully intend it as encryption. So is it or isn't it?

The "prying eyes" that might be targeted by the coders here might simply be people not bright enough to recognize and decode/encode base64. Basically, it's an intelligence test to see if you're smart enough to modify the XML by hand, hoping to reduce bad configurations by people that don't know what they're doing by forcing them to use a tool that checks their work.

hoodaticus · 2011-07-25 Reply Admin

Those who live in glass houses...:
boog:
Those who live in glass houses...:
boog:
C-Octothorpe:
boog:
C-Octothorpe:
Encryption is NOT Encoding
You've got that backwards. Your link even says so in the first section:
Strictly speaking, encryption is an encoding operation...
I realized that after I posted. I was simply saying that in the context of IT security, they *should* be treated as completely different things, even though there is some overlap between the two.
What? And miss out on all the entertainment of people confusing the two terms?
Gah! What confusion? Does the word "synonym" mean anything to you?!?!
You're funny, but the people who really do think that encrypt and encode are mutual synonyms are way funnier.
I wish all you ivory tower wannabes would get off your high horses. Base-64 is encryption! Do you even know what encryption means? It means "to put in a code". Base-64 is a code. Now STFU.

No, that's what encoding means. En-cod[e]-ing. En-crypt-ing means to make cryptic.

2011-07-25 Reply Admin

C-Octothorpe:
EvanED:
Anon:
Then I *really* don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.
Now this I rather disagree with: encryption is basically by definition intended to be two-way.
I think he was making a joke that you encrypt once, and decrypt once...

Not at all, if you can do that you are violating CWE-257: http://cwe.mitre.org/data/definitions/257.html

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
Potential Mitigations Use strong, non-reversible encryption to protect stored passwords.

Other Notes The use of recoverable passwords significantly increases the chance that passwords will be used maliciously. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plain-text passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders.

C-Octothorpe · 2011-07-25 Reply Admin

Anon:
C-Octothorpe:
EvanED:
Anon:
Then I *really* don't want to sign up to any highish profile websites that you designed the authentication mechanism for. Passwords are meant to be encrypted 1-way.
Now this I rather disagree with: encryption is basically by definition intended to be two-way.
I think he was making a joke that you encrypt once, and decrypt once...

Not at all, if you can do that you are violating CWE-257: http://cwe.mitre.org/data/definitions/257.html

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
Potential Mitigations Use strong, non-reversible encryption to protect stored passwords.

Other Notes The use of recoverable passwords significantly increases the chance that passwords will be used maliciously. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plain-text passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders.

I get that, but I think if he meant one-way encrypt, he would've used the word hash...

At least that's how I read his post.

Encrypted XML

Leave a comment on “Encrypted XML”