Right, we are going to talk about Parkrun because Parkrun has completely lost the plot. I love Parkrun. I've been attending Parkrun events since 2011. I'm not prolific. I've done 225, which works out at an average of around 17 Parkruns per year since I started. It's a fantastic community-driven event helping to get people outdoors, get people running and keep people motivated and challenged each week. And I'm all for inclusion. I want everyone to feel like they can take part in Parkrun. And I don't mind events evolving, moving, changing with the times, which is why I fully supported initiatives like ParkWalk and Junior Parkrun. They align perfectly with Parkrun's core mission of making physical activity accessible and enjoyable for everyone regardless of their fitness level. But the latest communication from Parkrun HQ has highlighted a fundamental issue from which Parkrun has suffered ever since that core mission was conceived. Let me explain. The very first Parkrun took place on October the 2nd, 2004. 13 people lined up in Bushey Park to take part in what was then called a 5k time trial. Many of you watching this will be very well aware that Parkrun started out as a 5k time trial event, the point of which is to run as hard as you can for those 5k to set a benchmark performance by which you can measure your fitness and hope to improve over time. So the following week you would try and better that time or at least maintain your fitness. And so it continued for four years as the time trial event. Parkrun didn't become Parkrun until 2008 when an increased emphasis on community and inclusivity meant that Parkrun grew to become what we all know it as today. But at its core, despite Parkrun HQ's attempts to distance itself from its own history, for many Parkrun has inherently remained a 5k time trial. When I started at Brighton and Hove Parkrun, we used to have volunteers standing at the kilometre marker points shouting out your time as you passed, and I know that still happens at some Parkruns today. And of course most relevant of all to this discussion is that the Parkrun website until this week had always displayed fastest times, age-graded data. It always noted the fastest times of male and female Parkrunners at different events and records across countries and across the world. And most crucially, it celebrated individual PBs, the core of time trial achievement beating your previous time. Now I'm going to argue to you that for the vast majority of Parkrunners, this has been and is absolutely fine. And for many is the entire reason they started doing Parkrun in the first place. It makes no difference whether you run Parkrun in 40 minutes or 20 minutes. The challenge is against yourself. You're not racing the person next to you, although some people do. And that's fine too. Fundamentally you are trying to beat your previous best time. Now of course there are thousands of Parkrunners who are there for the social aspect. We jog around, we chat to our friends and we enjoy the morning. I've done that plenty of times. But how many of you do keep a sneaky eye on the watch? How many of you speed up just that little bit in the last kilometre just to make sure you make it in under 30 minutes? Admit it.  Before we move on, if you are enjoying the video, you're finding it useful or interesting, then please do consider subscribing to the channel and do hit that bell notification icon just so you don't miss any of our upcoming videos. Right, on with the rant. This latest initiative by Parkrun to essentially remove as much information related to speed and competition as possible from its website, smacks of the worst kind of mollycoddling and pandering to what I believe is a minority of complainants. Honestly, we've got to get a grip. There will always be someone faster than you, and most likely, there will always be someone slower as well. And you know what? No one cares. Me and my wife will joke with each other when we achieve something that we're vaguely proud of in running. She'll say to me, Stephen, no one cares about your running but you. And I'll do the same to her when she starts droning on about having run the Boston Marathon again. What I'm saying is, truly, nobody cares if it takes you 60 minutes to do parkrun. What we do care about is the fact that you got up, got out of the house and did it. That's fantastic. That's what we care about. I love these lazy Saturdays. It's Wednesday, let the fast guys do 17, 16, 15 minutes. Great. Good for them. And let's celebrate them too without prejudice. There really is no need to feel intimidated if someone is faster than you. This is not about them. This is about you. Gain self-confidence, self-worth and self-validation from your own journey rather than comparing yourself to someone else. I'm sure there are things that you can do which that 16-minute parkrunner couldn't do to save their life.  Now, one argument put forward for removing the stats from the website is that it might put off potential new parkrunners who are registering for the first time and searching for their first event. The problem with that of course is that it then sets unrealistic ideas of what to expect when they turn up on the day. The speedy runners will still be there. I mean, if parkrun HQ really wants to remove all semblance of competition, then why time the event at all? We could all just gather together on a Saturday morning at around about 9 o'clock to cover 5k. There's going to be no need for a starting gun, no ready, steady go. I mean, that would also eliminate the need for barcodes and finishing tokens. Why even bother with that? And the GDPR privacy issue? Why even put the results online? No list of people online to look at? Why even bother registering? I love parkrun, I will continue to attend parkrun, but I do disagree with this initiative. And I think it has the potential to in fact discourage a lot of people from taking part in parkrun, which is actually the opposite of what they want to achieve. Here's a video of me and my daughter running the Lansing Beach Green Parkrun. We'll see you over there shortly. If you've enjoyed the video, please do consider subscribing to the channel. Take care and we will see you on the start line next time.


What's up guys, you know, so because last video I talked about why I thought that Top coder was better than code forces today I'm gonna talk about why I believe at coder is better than code forces and here I'll give a few reasons why All right, first of all if you look at at coder most of the time I have to wake up at 7 a.m. To go on to do a contest at at coder Well, if you look on code forces, I have to wake up at 4 a.m. To go on a Could to go and do this contest So if I go on if I compete on at coder, I get three more hours of sleep So that's actually a good benefit comparing to doing code forces contest at 4 a.m. In the morning Anyway, besides the time zone, I'll give you another good reason why I think at coder is better So if you go on at coder most of these problems that you see on at coder Well, they're pretty short. And what do I mean by that? I mean like the problem statements Like if I go on like one of these this We're on this problem statement, right? It's just like you have a Length a and integer x move all elements that are equal to x from a see that's a pretty short Short problem statement. Whereas if I go on code forces and I look at a problem statement There's always a bunch of Alice and Bob and all this all this Story I have to read like if I go here shifting stacks, you know, there's a lot of stories. I have to read This might not be a big story. Actually. Yeah, this is a huge story like oh like crap There's some houses and I have a friend and then I don't know Alice and Bob does some stuff I mean this hurts my brain, you know If you go on at coder the problem statements are really short and I don't have to deal with Bob or Alice So that's pretty good. Why I think at coder is better So another thing that I think why at coder is better than code forces is because at code has a lot of math problems something to do that code forces is starting to change by Incorporating more math problems with a lot of at Coder problems are really just math And I think the reason why is because I think the Japanese really love math But anyway, if we just go to at Coder regular contest 113 Here find the number of triplets But a B and C such that ABC is less when you go to K and the two triplets are disordered Ordered by a number that are distinguished only differ in one. See that's that's that is very hard These are combinatorics problems. So these are math combinatorics problems. Whereas if you go on code forces They don't really ask these type of qualms problems. Most of the problems are like ad hoc like the Elise division 2a and 2b they're mostly ad hoc or or You know basic number theory problems They're not really these difficult combinatorics problems because combinatorics is really hard and I think the Japanese really like that So another good thing why I think at coder is better than code forces because if you go on the yet Sometimes sometimes they almost never post the editorial and that's actually pretty fine. Like if we go on like a beginner contest 128 they didn't over here someone posted the editorial here, but like normally they posted editorial like weeks later We could actually go on 113. Let's see if they post the editorial for this one. Oh So here it says no editorial yet overall no editorial yet But only the users who actually you are pretty nice who decide and post an official editorial For them for some of the problems who actually solve them So that's good on the users. The good idea is that at coder editorials. They're mostly in Japanese like the actual Editorial they don't really have those. So if you enjoy Japanese And you like to read Japanese, I guess you would love to do Look at the editorial for at coder But besides that besides that sometimes editorials are a little late and stuff like that at coder is pretty good because Yeah, because of the math problems and stuff like that And also another good thing about at coder is that if you look at their rating system, you know, look at this Everyone starts out low and they have to get to high, right? And your your your rating distribution does has to converge only after 10 ratings So it's a good idea because here if I look at at coder on code forces It's more like everyone starts out 1400 and then you drop your rating your rating drops Whereas at coder I have to increase my rating. See like and in code forces Everyone starts out 1400 and it drops down and then somehow a sooner or later. I get back up But on at coder, you know, you just have every since everyone is starts bad They get better and they increase the rain that actually Tries to have people to do more contests, you know to improve the rating because your rating isn't the actual rating that you solved, okay? That's a good thing about at coder. Another the good thing about at coder is that there's a brown There's the brown color is right after gray. So if I want to reach green I have to reach brown first before I can reach green and that's pretty good because I don't I'm trying to reach green on code forces. So trying to reach green first I guess trying to I should reach brown first and that sounds pretty cool I mean brown is a better color than gray. So I guess, you know going on at coder It's better because you know brown is better than gray. But anyway, those are pretty much the gist of why I think at coder is better You know because because the problems are are more mathematical They're shorter and they're also better and also I don't think you could hack on at coder. I could be wrong though But if you look on at coder, I don't think you could actually hack. Well, let me see. Let me see Let me go on the standings. I could be completely wrong, but I haven't actually gotten gotten hacked from anybody Yeah, I don't think you could hack But regardless That's a good thing about at Cody because you don't have you can't hack But anyway, so it stopped it stops you from trying to actually read Other people's code or try to destroy other people's code But that's pretty main the gist of why I think at code is better than code forces It's just these statements. But yeah, right cop subscribe. I'll check you guys later. Peace


So to recap, what I need to find a way is in an energy landscape I need the barriers to be reasonably low and the way a barrier is low is if I have to search a bit but I don't have to search a lot to get over it. Why do we talk about searching? Well remember those curves I showed you right? When I'm moving from the unfolded to the folded states the energy helps me but I'm working against the entropy so it's an entropy barrier and entropy barriers are always about searching. Unfolding is much easier. Unfolding then I just have to heat it so it's easier to get over energy barriers when I unfold it's very hard to get over entropy barriers when I fold because I have to search. So I just need to find some sort of hierarchy if I first do A and then do B and then do C. I don't have to search as much.


Cal OES logo, quick look, oesnews.com. I'm Brian May in the California State Emergency Operations Center at Cal OES Headquarters. This is just one of the locations where crews continue to work in response to the 6.4 earthquake that occurred near the town of Ridgecrest on July 4th. The State Operations Center continues to be activated at a level two. Our inland region Emergency Operations Center is activated as well. We've got a number of state agencies co-located with us. We're looking to actively monitor the situation in Kern County and specifically the town of Ridgecrest. Cockpit of a helicopter flying over the area, then an aerial view of Ridgecrest. Although we have not had any reports of damage or injuries as a result of the aftershock this morning, we know that there's a significant possibility of additional aftershocks with consequences and we want to be prepared for that. Aftershocks continue in the area. It's something that we expected. Every time there is a large earthquake, we always expect to have aftershocks in the area. We had one early this morning, in fact, magnitude 5.4. Breaking news. Ridgecrest Library closes due to quake. Staff needs to clear out fallen books, materials. 23 ABC shows bookshelves with books scattered on the floor. We don't know exactly when those aftershocks will be. We don't know how big they'll be, but we do know that they're coming. So it's something that we want to make sure we're reminding the first responders in the area, the residents that live in the area, that we live in earthquake country. We need to be prepared if you do feel an earthquake. Drop cover and hold on. The State Operations Center will continue to monitor earthquake activity and assess any needs from the impacted communities throughout the weekend and as long as needed. Cal OES is a 24-7 agency. Disasters don't understand dates. They don't understand folks trying to be with family and friends. We've got a tremendous workforce here at Cal OES and everybody really stepped up, shifted course, said goodbye to their families, came in here to support those communities that were impacted by this event. For more information on how to stay safe during and after an earthquake, you can visit the Earthquake page on our website at caloes.ca.gov. For all of us at Cal OES, I'm Brian May. Thanks for watching.


We're focusing just on with this topic was originally about authentic authenticating users, but we're focusing just on passwords So let's go through and just Skip through some slides that we've already seen in detail and return to the ones we've missed So we know that we want to authenticate a user We use an ID to identify them like a username and we use some Other information for the verification to check they are that right user Password is what we're going to focus on But there are other things and passwords pin a passphrase we can think the same concept as a password But there are other things things we possess tokens and then biometrics things. We are and things we do But we're not focusing on them Just be aware that it's not just passwords that we use for authentication. So the basic way to use passwords is that For the system that you want access to you register a username and password and Then when you want to access that system you supply a username and password and the system compares the supplied values with the Registered values if they match everything's okay, and you get access. That's the basic approach So we've mentioned this before and there are many issues involved with how do that? How does that work securely and we've looked at a few of them a few slides here that we've skipped over? So let's go through them now So what's the problem with passwords and we may have talked about some of these but let's go through some some different names an offline attack offline means that the attacker is Not Trying to access the system to get Access they've somehow managed to get some information about passwords and trying to guess your password So let's say the system that we're protecting is The Moodle website that you log in for the quizzes So that system has the list of usernames and passwords an offline attack would be some attacker has somehow managed to gain the list of passwords or what we know from last lecture hashed and salted passwords and Then they get that list and they take that back to their house and on their computer and from that They try and do a brute-force attack to guess your password So in an offline attack The attacker is not submitting attempts to the system They doing the attack in their own time and with their own resources an online attack is When let's say we have the Moodle website an online attack would be that someone submits a username and password Trying to guess your acts your password and the system would return an error or or success offline is that they're trying to guess your password using other measures measures outside the system and We the last topic we looked at how to store passwords and we'll summarize that later But we saw that we don't store the password in the database We should store a hash of the password so that if someone does discover the database they can't get the original password and Even better store the hash of the password combined with some random value assault So offline dictionary attack The attacker gets this database of hashed passwords So what they do is that they take those hash values and try and work backwards to find the correct password of of the users and We gave a few examples of how they could do that a brute-force approach is try every possible value a dictionary attack is try values, which are most likely of the 40 users in this class that have access on Moodle I suspect some of them may have passwords which are much more likely to occur than others like from common words from a dictionary Therefore the attacker would try those first Rather than trying random passwords So there's an offline dictionary attack How do you stop it? Control access to the database try and set up your system so that a malicious user cannot access this list of hash values the database of password information Reissue passwords if they're compromised Let's say I run the Moodle website and I realize someone has accessed the database due to some other floor Then immediately I should tell all the students Your password has been canceled. You need to get a set up a new one through other means So that even even if the attacker finds your password, they will not be able to access the system so stop using the passwords once you know that they're compromised and What we got to in the last lecture is store the passwords such that even if the database is accessed It's a takes a lot of effort for the attacker to take that hash value and get the original password. So use good hashing algorithms and Use salts as these random values to make it harder against rainbow attacks So offline the attacker gets access to some password information and then tries to guess in their own time Let's look at a few other attacks and I think most of them not all are online attacks a Specific account attack The attacker Submits guesses to the system for a specific account You're the attacker you want to log into Moodle as me You know my username. So what you do is you go to the website you type in my username and guess the password The system returns an error saying no incorrect So you try again and you keep trying until you get your past T and you get my password So you're attacking a specific account One way to stop that is once there's been a certain number of attempts failed attempts on that specific account Don't let any more attempts to take place lock the account Okay, and I think you know that with if you've had the bad luck if you forgot your pin for your ATM you go to the ATM and you type in your pin if you get it wrong what three times Your card gets eaten by the ATM. It doesn't come back So you can no longer make attempts. So there's a simple example of locking the number of attempts after too many failed Attempts any other ideas how to stop a specific account attack you want to Stop them What else can you do? Just alright, that's that one disable the account if there are too many attempts. Okay, what's the problem with that? What's the problem with the countermeasure? Sorry All right If I forget the password myself and I'd make let's say I'm limited to three attempts and I make three attempts Or I hit the wrong key when I type it in and I've locked myself out. That's an inconvenience Yeah Okay, so that leads to if I once the account is locked. How do you deal with that? So if I lock myself out because I type the password or forget it then I Need some other way to securely make sure I can get the correct password. What happens with the bank? Anyone done it type the pin wrong three times in the ATM Yeah, I've done it Your ATM stuck in there, okay So you need to go to the bank the actual branch and provide some identity and Then go through some steps to prove you are the right person and they'll set up a new pin Okay, but that takes time. It's an inconvenience. So and it's something you cannot do online Okay, so there may be other ways, but it's very inconvenient once the account is locked What's the other problem with this countermeasure? I think you're an attacker. What can how can you take advantage of this? you want to let's say let's say there's a Quiz the deadline is in 10 minutes and you know that some student in the class if they do it They're going to get a higher score than you. So what you do is you? Go and try and log in as they're in their account 10 times until the account's locked and that means they can't do the quiz because they can't log in You've denied them access to the system meaning they Have lost something there. Okay, so it's called a denial of service attack you or the attacker Forces the account to be locked Locking it for the normal user so the normal user cannot access their account So very inconvenient because now the normal user has to go and manually get it enabled So although the countermeasure works it can also be easily used as some form of denial of service by the attacker Get the account to be locked so that the normal users can't use it another one popular password attack Let's say a popular password is remember any from the last slides. What's a popular password? One two three four, okay, let's say of the the hundreds of students at SIT It's likely that someone has chosen one two three four or similar. So what the attacker does is For the first student ID they try and log in as one two three four if it doesn't work They try the next student ID and Log in using the popular password one two three four and they keep going trying all the different students and It's likely after they've tried all the students that at least one of them had that password and they get access so it's not accessing a specific account is trying to access any account and Using popular passwords not just one you can try a range of popular passwords Locking the account doesn't help Because you only take make one or two attempts on that one user's account Locking the account is only really useful if It's multiple attempts on one user's account, but the popular password attack try each user once So their account won't be locked. How do we fix that or how do we make it harder? Make sure that the users select good passwords. They don't select popular passwords So when they use a registers their password that they don't have the opportunity to select any value There may be some restrictions What are some restrictions that you've seen on different websites and different systems? Yeah Okay, minimum length of the password your password cannot be four characters and it must contain a combination of characters Numbers maybe at least one uppercase Maybe at least one special punctuation character. So some websites and some systems will have such rules They can check against dictionaries if your password is In a dictionary that an attacker may use then they don't allow you to use that password. Okay, so the The system controls the passwords you can select. They don't allow any choice Let's say the attacker. It's me and I'm attacking. I'm trying to log in as many other students on the registration system The system could then start to detect. Okay from the same source computer. There are attempts to log in at many different accounts That's unlikely to occur So the system can start to block computers that make multiple failed attempts Okay, so if the the website recognizes this one web browser Is making thousands of attempts on many different user accounts within a short period of time? Then after some some number of attempts block that computer So use a firewall for example to automatically set up a rule to disable that computer accessing the system Problems with the counter measures What can go wrong? What about controlling password selection? What if I create a rule? Your password it must be 12 characters long. It must have three uppercase three numbers three lowercase and three Punctuation characters it cannot combine letters in this way Then it makes it very hard for you to choose a a nice password that you can remember and that you can type in So if we control the selection too much Then the password becomes inconvenient and then users write them down then they forget them okay, so you need a trade-off between Having a little bit of control over what they can select but having them some freedom so that they can select a password That's useful or easy for them to remember What about blocking computers that make multiple attempts? What's wrong with that? Well, how can it go wrong? Let's say Facebook blocks If if a computer makes five wrong attempts on any account To any Facebook account then Facebook blocks and all Subsequent requests from that one computer are blocked from accessing Facebook What can go wrong in that case? Someone could misuse it change the IP and more practical thing It's more about the network structure is that most networks use this concept of network address translation Nat What that means is when you access a website out on the internet The IP address from the perspective of that website is the IP address of SIT You check it one day you go to a website like what's my IP address and Everyone will get the same IP address the way that many networks are structured that even though your computer internally has a different IP address from the perspective of outside They look like they all have that one SIT IP address Therefore from the Facebook web server It doesn't know that it's a different person trying to log in So things can go wrong if you do that people can use fake addresses People can take advantage of this and it may not work in some network scenarios See if we can finish the next three Password guessing against a single user Again, you want to get access to my account on Moodle So you gain knowledge about me You're specifically attacking me so you know me and you try and guess my password You don't have to do a brute force and try many passwords because you know me Then maybe there's a higher chance that you can guess my password Okay, maybe I mistakenly told you that I create my password based upon my my birth year and my last name Then since you know me and you know how that's like how I create my password. It's much easier for you to Guess my password That's different to let's say you want to just get access to any random users account If you know the user you've got more chance as the attacker again make sure the users don't choose easy to guess passwords and train the users educate them to use passwords which are Strong I go. I'm logged in on my computer I go to have a break five minutes outside someone sneaks up to my laptop and They can log in to my account okay computer hijacking The simple example that is in computers that other people can get access to Then the password information or the login is Currently valid for that computer so that the user who access that computer is logged in as you And it could be more complex using web attacks and so on but The idea is that if you're using a computer that either multiple people access or an attacker could get physical access to then you want to log out before you leave that computer and Websites and systems should have some form of automatic log out If you go to a lab computer and access Facebook and Then tomorrow someone goes and access is the same at lab computer They shouldn't be able to access your Facebook account the system the Facebook website should automatically log you out after some time So that's this general idea of computer hijacking what else can go wrong Users make mistakes because we force them to control to select Complex passwords they write them down on a piece of paper and they stick it on a post-it note on their monitor or They make mistakes and they tell their friend. Oh, can you please log in for me? So here's my password So their friend now learns their password Or that tricked into revealing a password You call up the SIT computer center and say hi, I'm dr. Steve and I want to I Forgot my password. Can you tell me my password? And they tell you my password, okay? so tricking people into telling you their password or don't use Don't change default passwords. You install some software on Your website and that comes with a default password and you never change it So the attacker can try that default password to try and log in How do you fix it? Make sure users are smarter provide them some training about how to use passwords and Maybe combine passwords with other forms of authentication And I think you've known of some with mobile phones. You can use other factors for Authenticating users getting an SMS and so on a big problem Many users use passwords the same password across different systems. I Think we may have asked a couple of last week who uses a password who reuses a password a Game will try anyone has a password that's used on two different systems Think of all the tens maybe hundreds of websites that you have passwords for all your accounts I'm sure most people reuse passwords what's the problem if One of those systems is compromised and the attacker finds your password for that system Now all the other systems that use that same password are effectively compromised so Now it's the weakest point that leads to the failure if just one of those websites that you've reused your password is compromised Effectively all of those websites from your perspective are compromised the attacker has your password for all those other websites alright, there's complexity of How do they know which other websites you visit? But I think they could learn that in many cases or try so this is a major problem because That suggests we should use different passwords across different sites But who can remember 100 different passwords? Okay, so that suggests we need some other way to manage passwords and in many cases things like password managers Software that will keep track of your passwords for different systems is one way to get around that How can you stop this? How do you stop a user from me using a password? Well, you cannot in a public system, but say SIT could of all the services the SIT uses registration moodle and others They because they're just separate services, but all under control of SIT We could set up a system that forces you to use different passwords across each It would be hard to do but it's possible final The other way that attackers find passwords is by intercepting the packets which contain them sent across a public network. I Visit a website on my laptop and I log into that website My computer my laptop is sending wirelessly to that access point which then goes across the land and then out to the Internet It'd be very easy for any of you with your laptop to intercept and take a copy of the packets my laptop sends to the access point and Hence in those packets one of them will contain my username and password Basically, the only way to stop it is to encrypt those communications Make sure that where people can intercept anything that is sent that contains a password is encrypted first How do you do that? What techniques used normally in the in the Internet? When you log into Facebook How come no one can intercept your password HTTPS Okay, when you visit the website many websites not all but some will at least when you log in and Submit the username and password. They'll be using HTTPS, which it means that the communications between your browser and The web server in the US are encrypted So even if someone intercepts, they'll just see some random characters. They will not see my actual pass. What's the problem with that? What's the problem with encrypting? it's Yeah, it's It's easy for the user, but it's it's slow for Sometimes the computers especially the server and maybe it slows down the communication. So performance is the problem Okay, so if the web server has to handle many encrypted Connections encryption takes some time and it slows down the server Performance, I think most of them you may have heard of before but we just try and put them down as common problems with passwords You may get a question in the exam about them similar issues with passwords any questions That was one thing that we missed in in the earlier lectures Any questions on those vulnerabilities of passwords? password entropy How do you calculate it? Calculate the password entropy guarantee question in the exam. How are you going to do it? again log base 2 of what of the number of possible passwords, okay, so If a password selection scheme allows you to have a billion different possible combinations Then we say the entropy of that or a password using that selection scheme is log base 2 of 1 billion Have a look at the the lecture notes on which we've covered already on password entropy a quick test then If a password so look at that slide if a password was made up of say a random password, but made up it had to have Two digits it had to contain two English characters lowercase They must be two lowercase English characters and maybe Any two of the 94 characters on the keyboard. I'll say two printable characters What's the entropy of that password? Try and calculate if you can do that you'll be on track for the exam So the password is six characters long Two of the did two of the characters must be numbers any numbers are random two of them must be lowercase English letters And two of them must be any of those 94 printable characters on your keyboard uppercase lowercase numbers punctuation What's the entropy of that password? so entropy Anyone have an answer? think about from the ind that the sets of characters and As a hint you can look at the individual characters where you can go the long way Remember entropy of the password is the log base two of all possible combinations Anyone have an approximate answer? While you're calculating. I'll just record what we know Digits we have 10 possible values lowercase we have 26 printable characters is a Total of 94 possible values We're assuming that That is lowercase uppercase numbers plus the 32 punctuation characters entropy Well, let's look Just go back to our slides here. We said the entropy of a single digit Zero to ten is 3.32 Where does that come from? Well with ten possible values log base two of ten is three point three two So the entropy of one digit is three point three two The entropy of a lowercase character is four point seven and the entropy of so log base two of twenty six Entropy of the ninety four printable characters is six point five five Log base two of ninety four just make note of the entropy of them We have this was four point seven. I can remember That's the entropy of one character of that type If you do the maths you see remember we're using log So in fact because we have two digits the entropy of a two digit Number is what? Well, we have 100 Possible values ten times ten log base two of 100 is what? calculator about six point six four two times three point three two the log of 100 is Two times the log of ten Because 100 is ten squared So in fact with two digits each having an entropy of three point three two and Then two lowercase letters having an entropy of four point seven and Another two printable characters with an entropy of six point five five That gives us the total entropy of this six-character password Which is whatever it is About 27 you can get it more accurate That's the beauty of entropy you can add them add them up for individual characters Because it's a log base measure What's easier adding or multiplying adding is easier. That's why we use logs sometimes You could have done it calculated a long way. You could have said okay. There are two digits There's a hundred possible value or ten times ten possible values 26 here so ten times ten times 26 times 26 times 94 times 94 and Take log base two of that large number and you should get about 27 so if we know the entropy of an individual character if we just Increase the length we can easily calculate the entropy of the whole password. I just 26 I approximate it. I think if you calculate with a calculator, you'll get closer to 29 okay My adding is not as good as a calculator Any questions on entropy if you wanted to do it the long way it would be log base two of First a digit of ten characters by another ten digits 26 for the two English lowercase letters and 94 Times 94 if you calculate that I think you also get 29 or approximately 29 It's the same math just Calculated differently. How do you store passwords? Hmm? Put it into a database. Okay. He won't get full marks in the exam Anyone else? How are you going to store a password in the exam? If a question says how do you store a password? And hash hash them you'll get wrong zero marks hash them hash the Yeah, okay hide them hide them No zero marks So the password then hash generally called assaulted password or assaulted hash assaulted password and We didn't we sort of run out of time to go through the detailed explanations, especially rainbow tables I went through that quite quick last lecture. I will not ask a question about rainbow tables in the exam What's first? What's the problem with just storing the password in the clear? well If the systems compromised Someone's immediately learned all the passwords so we can't do that We could encrypt Okay, it's possible we saw a possible way last week There are a few issues with encryption especially if we use the same key to encrypt all passwords We need to store the key somewhere So it's possible, but usually It's no better than using a hash And usually we need to use a hash even if we encrypt anyway Because if you encrypt sometimes it's hard to know whether it successfully decrypts or not especially if you encrypt random passwords We said and we said we could hash the password But there are some problems in that it's possible that people can do a look up on this concept of a rainbow table What you should remember if you can't if you don't know about rainbow tables and all this that we went through last week Remember how we recommended to store the passwords You store the username or the ID Assault what is a salt? Random value different for every user Okay, so a random value It's just called assault here and we hash the password combined with the salt. I Don't care how that combined Password salt salt password by that combined So we store a hash value the random value and the username and When someone submits their use their password and username we look up find the username We take the submitted password combine it with the stored salt Hash and compare to the hash value if they're the same they log in if not failed attempt It would be nice to talk more about Rainbow tables and and why this is needed versus just a hash password, but unfortunately we're out of time so There won't be a question about rainbow tables in the in the exam next week There may be a question about how to store the recommended way okay So remember that All right in more specifically the which hash function do you use there are some recommended hash functions for Making it harder for the attacker, but that's we didn't get to cover that we designed for failure It would be nice if no one could ever Access the database no one who doesn't have authorization if not they couldn't access it doesn't matter how we store the passwords But designing for failure is saying okay assume something can go wrong and An attacker can access the database then that's designed such that it's still hard for them to get the passwords and we in our first discussion of this topic we will Gave a few examples of how people choose passwords, and I think you gave me a few written Written down password selection strategies and some common ones and to summarize and finish this topic All right to make sure that people use passwords well and select good passwords People need to be aware the users need to be aware of how important the passwords are and How easy it is for an attacker to get some forms of passwords computer-generated passwords sometimes are useful The computer generates a password for you the user doesn't get to choose More secure but can be more inconvenient because you get some strange-looking password that you have to remember I think everyone when they first got an account on Moodle got an email with this random password computer-generated I suspect if you haven't changed it then you've got that email and you go always look it up. You haven't remembered it That's the problem You can have variations where it's generated is pseudo random, but has It's maybe pronounceable Okay, you combine the letters in a way such that It's a little bit easier to actually say it and if something's pronounceable It's a little bit easier to remember Okay, so you don't generate a password which is QTX ZB maybe you generate a password which is not a real word but has The correct arrangement of consonants and vowels so someone can remember it easier reactive password checking when if they've the users of your system have selected their passwords you could check Go through and check and see if they're easy to break and then advise them to change their password or Check as they're selecting the password and many websites do this you type in a password It shows you some graphical feedback saying this is weak or this is strong or Even may say sorry you can't use that password. It's too weak Okay, so some advice on selecting passwords many other interesting things about passwords But that is all the time we have to cover it


Hi, I'm Andy from readle and in this video We're going to be talking about the term hot swappable now when I say hot swappable I don't mean the kind of party where you would put your car keys into a bowl in the intercom world Hot swappable refers to the fact that you can take different elements of the system Unplug them plug them back in remove them put them back in all without having to shut the system down We can take out the power supply or the CPU card of an intercom system While it's in operation and the user will not notice any difference


Greetings friends.  I have a couple of things I want to talk to you about today But first of all because I realized that not everyone is going to watch this video all the way to the end There's an announcement. I want to go ahead and get out there If you're signed up to receive my emails and if you're not receiving my emails I'm not talking about the email sent by YouTube, but I'm talking about the email sent directly from me from my mailing list that you signed up for on my website if you're not receiving my emails It's a good chance that you were dropped from the list and Please ask you to go back to my website and sign up again If you are already on the list it will tell you it won't let you sign up twice So you won't be getting two emails. So if you're already on the list no harm will be done They'll just say that you are already subscribed But in case you were dropped from the list it'll put you back on the list now I don't share my emails with anyone. You'll never get any spam I try not to abuse this service the purpose for my emails is so that I can stay in contact with my viewers Especially considering that they're making taking a lot of steps to censor the internet. I've had sensors censorship of my YouTube videos. I've had censorship of my Blog I've had censorship of my Twitter account and So I figure email is the best way there. They could still censor email But they cannot as easily drop you from my email alert list as they can from my Twitter Which they've been dropping people from my Twitter Account, alright, so this is just a way that I could stay in contact with you If if they really if they shut down my website or shut down my YouTube channel So like I said, I try not to abuse this service. I just send out very important messages Generally, maybe one message a week So please if you're if you're interested get on that mailing list You go to my website the new survivalist calm and at the top click on join my mailing list and submit your name and email address Okay, how did these email addresses get dropped from my list? Well if you have if you use a Gmail email or a yahoo.com email and there are some others too But those are the two big ones All right these services have a Spam blocking feature Where you cannot send more than 60 Messages to say a gmail.com address And what happens if within an hour's time? All right, so what happens is if I have a mailing list Where I have over a hundred say gmail email addresses and When I send out my my list it goes out to all those email addresses very quickly in a short period of time so As soon as they get number 60 They will stop accepting gmail will stop accepting Emails from from me yahoo does the same thing 60. I have a limit of 60. There are these are two very popular Email formats yahoo.com and gmail.com All right, and in this video. I'm going to talk about why you should not have a gmail or yahoo account This is just one reason Is because of this so-called feature and then what happens with my email mailing program is once my mailing program Gets hard bounces gets a certain number of hard bounces from one email address It drops that address from my mailing list and I didn't realize and so I lose that address forever Or until you resubscribe and I didn't realize that this was happening until all of a sudden I just lost half of my mailing list and I Tried to figure out what was wrong and I researched the topic and I found out that that's that's what was happening My email program is will drop your address after a certain number of hard bounces It receives a hard bounce when your email server rejects it and gmail and yahoo.com are The big the big bad ones. There are also some others as well All right, I'm going to talk about some better email addresses to use in this video now What's wrong with gmail? All right gmail I like to think of gmail government mail Gmail of course actually stands for Google, but Google is in bed with the government Google receives millions of dollars from the government for the purpose of spying on you and the Government has has paid Google to create all these very complicated programs where they They they scan every single thing that you do And put it in a database and talk about searches when you do a Google search They make a profile of you Depending on what you're searching for say if you're a gun lover and you do a lot of internet searches For topics that are related to guns It makes a profile of that. All right, and then say you look at anti-government sites And other of these what the government is considered radical sites Say sites dealing with freedom. That's a radical topic these days according to our government Google is making a profile of you and they are making that available to the government and the government is paying Google very large amounts of Money to write these programs and to give them that information yahoo does the same thing and there are other Web servers out there that do the same thing and I'm going to give you a couple of alternatives that I recommend today All right, let's say Google searches That's one thing you should do is I recommend that you don't do at least as I recommend that you do not use Google searches All right, there is a very good search Page out there. It's called start page Start page dot com. I recommend you use start page as your search On the internet you can set your browser to use start page automatically, I don't know what Search engine your browser is currently set, but you're you're by default Your browser will be set to use a certain search engine a lot of times. It's Google But you can change that You can change that setting to where you can use whichever search engine you want to and you can I have changed My browser to where I use start page start page was Created by a patriot All right, the purpose of start page is it keeps all of your information all of your searches private They will not release the information to anyone including the government The good thing about start page is it actually uses Google search and the good thing about that is let's face it Google as evil as they are Google has the best search database. I mean they were they built it from with our taxpayer money Government gave them to spy on us. So they do have the best database So you can use their database with start page with start page uses a proxy in other words when you put a search into start page Start page searches Google for you Excuse me and it returns The Google search information to you, but they use a proxy so Google cannot collect information on you All right gmail Google mail or government mail Gmail has admittedly Keeps records of They've admitted that they keep records of the topics that you talk about on your emails Not just the emails that you send out but emails that you receive All right, therefore and then and again they use this to create a profile of you for the government All right, and so even though I wouldn't use Google gmail When I send an email to your address if you use a gmail address and I send an email to your address They actually create a profile of me All right, and they have computer programs that automatically search for certain key words Like they'll look for words like guns or look for supposedly terrorist Key words, of course, we all know who the real terrorists are but they look for Any anti-government they do a keyword searches for people who say on anti-government Remarks and a vast number of other things, but they just create a profile on you And if you use these services, you're gonna end up if you're not already on a list You're gonna end up a list one of the one of these days and and and who knows you may try to buy an Airplant line ticket and you might not be able to buy one or you might go try to buy a gun and you're on a no buy gun list because of some of the Anti-government Things that you've been you've been doing so I don't recommend gmail. I don't recommend yahoo yahoo does the same thing too let me give you a Email address a free email address service you can use I use hush mail hush mail Dot-com it's a free service You can get on there and hush mail will never give anybody your personal information For one thing they don't collect personal information So they don't even have the personal information you can go to hush mail dot-com you can sign up for a free account They also have better accounts that you can pay for but you can get just a basic free account And you do not have to submit any type of personal information to them at all So you can remain totally anonymous anonymous with that email using hush mail using start page or you can start making these Databases that they're creating on us you can start making making them why make it easy for the government to track us but so not only is there the problem with gmail like I mentioned with you not getting your your mail because Like a situation where I have on my mailing list or yahoo, but then you also have them tracking creating databases and tracking you So I recommend that people who are concerned about their privacy and concerned about their liberty and freedom in this country I recommend you don't use these services. Of course, I use YouTube. You can't really avoid it in order a YouTube is by Google YouTube does I've had them a sensor my videos and what's going on right now? They're moving to censor the internet and they're doing this by steps Just like they're moving to gun control in this country, but they're not just passing a law just making guns illegal They do it by increments as a matter of fact They have actually stated that that is their goal to subtly do this by increments just a little bit at a times every time every little legislation they Push through in order to say make it more difficult make the waiting make waiting period longer Saying we can't have this type of person can't buy guns, you know, you can't buy magazines With more than this many rounds in it, or you can't buy more than this many Guns within a certain time period all of these are just little increments That they're working toward their eventually their eventual goal is to get to complete control of the guns They're also working complete to completely control the internet So they're working by increments and one of the techniques they use and I'm sure that you have Run into this at some point is a technique called marginalization Our marginalization is where they take you and push you out of the mainstream and they push you over to the margin We're hopefully nobody will see you if you want to see an example of marginalization Look at what the media does to Ron Paul He wins all these polls. He comes in first place and all these polls and what do they do? They just don't report that poll Are and and everybody everybody is aware of The marginalization that Ron Paul has received in the media.  That's the way that they are Sensor and the internet at this point to a large extent is When I put a YouTube video up if it's up if it's a topic that the government doesn't like So whenever I put a video up on That's anti-war at all if I come out with any kind of video that criticizes the wars in the Middle East YouTube will marginalize that video one thing they'll do is they won't allow me to promote that video All right, which means again, they push it off to the side to marginalize it They're anything that they can do to prevent a the video from becoming viral and there are also been cases Where people have discovered where YouTube has I say a video has become very popular It's gotten like a million hits and of course when you put in a search The search gives preference to Those videos that have the most hits because they figure those are the best videos our YouTube is repeatedly just Manipulated those numbers. I've had them do that to my videos Well, it's all of a sudden just knock all the numbers back down to zero and I've had a video When the old Osama bin Laden hoax came out that they said they killed Osama bin Laden Of course, Osama bin Laden was killed back in 2001 when they came out with this recent hoax I made a video on it that video went viral and then the very next day It was that's knocked right back down to zero All right, so marginalization is one of the techniques they use With Gmail When you send and I've had this happen to me when you send a message to a Gmail address if It has a key word in it and it doesn't seem to happen all the time, but it does happen. I've had it happen Say one of the keywords I've noticed in there is anything that is anti Obama I send out an email that was critical of Obama and Guess what the email never got there. So they are actually not only are they scanning for keywords, but they are actually Blocking some emails are my Twitter account. I know that they are blocking my Twitter account have a lot of anti New world order a lot of anti corrupt government.  I think this is the best country to live in I am a patriot but being a patriot doesn't mean that You are loyal to a corrupt government as a matter of fact What happens when a when a government is taken over by a foreign power?  No, no matter what. No, that's not the way that's not that's not being patriotic Anyway, getting back to Twitter I know that they are dropping people from my Twitter account whenever someone subscribes to my Twitter Account I receive an email saying so-and-so subscribe to your Twitter account I get several of those every single day and It's amazing that my subscribers never Increase even though I I know that you can lose subscribers I know that people can unsubscribe but there are no way that people are unsubscribing at the rate that they are Subscribing I get two or three people who are subscribing every single day And I check the numbers on my Twitter account Generally, it stays at about 260 it has been at 260 for like two years All right. Now when I appeared on television on the learning channel it went up to about 288 All right, but then from there 288 it started going back down against the present list about 280 But for two years it stayed at 260. I mean almost exactly 260 I'd have three people subscribe and it would go up to 263 and then within the next day or so it would drop back down to 260 again, even though every single day people are subscribing and I have no way to prove this of course because it doesn't Tell me when people unsubscribe but I know that there is no way with the number of subscriptions I'm getting to my Twitter account I know that there's no way that I'm having as many people unsubscribe Subscribe As I have subscribed and I have several people subscribe every single day and it should be growing, but it's not again That's marginalization.  Hopefully so no one will notice it And on the topic of Twitter if you have signed up to receive my Twitter feeds in the past And if you're not getting them Then there's a possibility that you were one of the people who were dropped for my list All right, so if you're not getting my tweet tweet Twitter feeds and you'd like to please go to Twitter and subscribe My Twitter account is obama phobia. So go to Twitter comm slash Obama phobia and click on subscribe And then if you subscribe and then you are dropped from the list Please let me know because I'd like to kind of try to keep track of this But anyway Getting back to the topic of this video Web censorship is real.  That's the big one all right, so That's the reason I started my mailing list because of if they remove my YouTube videos or if they remove my blog or They drop people from my Twitter account At least I will have your email address so that I can stay in touch with you and now as I mentioned I'm having trouble with that because policies like Gmail and Yahoo and I Think that if you're Patriot or survivalist the prepper and you have a Gmail account I think you're making a huge mistake. There are a lot of other free services out there Check it. Yeah, I would use a Gmail is the last one in the world I'd use and the next the last one I'd use is Yahoo. They're almost as bad and there are other bad ones They don't think they're that those are the only ones All right, um Check out hushmail.com. I'm not affiliated with the company. I don't make anything. I'm just I'm just doing this saying this to protect your privacy Don't use Google searches. Why use a Google search when you can use start page dot com Which is just as good it's just as fast it doesn't slow down the searches at all But when you use start page dot com they don't they can't Collect any information from you you start page dot com use hushmail.com or some other service and Let's try to Put an end to or let's at least fight this web sensor set ship Remember we're all in this together. This is survival doc reminding you be prepared or be prepared to be pleased