All right, folks, I'll be five minutes of homework questions, and then we'll get to the next thing. What are you saying? I got to this step, I turn in the key, and it gives me this. And you say to download, how do you download this? How do you download the key? I turn in my gbg file, and then it gives me my public key and my adversary key. And he said to download that, but I couldn't give it to him. Well, you have the key you're looking at, right? Yeah, and I say I backed it out of it, but just like a text, but that's not like... How's that not the key? That is, oh boy. So that's it. You're saving it as a text file? Yeah, it doesn't matter. I thought it was a gbg file. It is. That's an ask-it-or-gbg file. Okay. Yes, so you can copy that to your computer, you can do files saved as, saved as, whatever you want. But yeah, it's a good question. Other questions? Yeah. So, if you're trying to get something signed, you have to save it. That's good to say. You're going to separate people. Okay. And they will sign it. Yeah. How do you know if they're going to sign it? They have to send it back. They have to send your key back to you about their signature. Is there a way to work those two texts? Yeah. Yeah. Yeah. Hey folks, do you want to help them out more? Or do you want to talk to each other? Thank you. Is there a specific key to the command that will turn a Harvard file back into the, what are you calling it? What is the version of the file? Why? Because it's easier to get information from that version of the file. You just import it and then you can export it however you want, right? So your key ran past all your keys. So when you import it, you take a key in and you can export it as correct, exactly. You can also use gbg to interrogate that key to tell you something you need to know about that key. Okay. It adds a new signature to your public key. It doesn't fundamentally change your key, right? When you have your key, which is always the same, your fingerprint change doesn't have to be the same. When you have additional keys to metadata where everybody attests that they trust and they sign to it. What does it mean by key rings? Key rings, the key ring is just like a gbg concept of you can have as many keys as you want, right? So when you're on gbg, you can have as many keys that are your keys that you actually own. All the public keys that you import go into this long key ring. Yeah, just like the concept of literally like a ring of keys. Yeah. Can you or the TA test? It's from other students in the class. That's part of the assignment description. Yeah, you actually have to talk to each other. Words. People. That's like on minute 20. That's all the questions. And so for signing fake keys, is it such a long fake key that you lose 10 points in the lab? No. Right, that's it. Okay. 10 points of your score are based on not signing fake keys. Okay. If you sign zero fake keys, you are guaranteed 10 points. Okay. So it's not like all of them? Probably not. So if you don't do the assignment at all, then you sign no fake keys and you get at least 10 points. I do not have that happening. I guess technically yes. But yeah, I don't know. Don't play yourself in that situation. More questions. Yeah. I mean there's a link on the assignment description to the server's key. You should download that. But you can look at that, right? Import that in your key range. You can look at what the submission server's key is. You can see all the things about it. The fingerprints of the username. I think it's something just like CSE 365. Oh, right at the buzzer. All right. Yeah. But given the public key. Yeah. I'm assuming that has the person at the end of the step. Maybe. You tell me. Okay. So we're going to... So we're going to type in the public key and decrypt it. We're going to get the name and verify it's actually the number. Before you sign it? Yes. Right. So you can download. You should be getting their public key, right? You import that in the GVG. That doesn't mean anything. You have to actually take another step to sign their key. Right. It will show you everything like key ID, name, email, all that stuff. It's up to you to verify that before signing it. Once you've signed it and then send it back to them, then that's on you. Yeah. Can you unsign that key? No. Yeah. If someone sends a signed key back to you, how do you import just their signature? Or do you just override it all the way? It doesn't override it. It's smart. It just adds any new signatures that is present. So it's important that it's smart. Okay. Cool. All right. Cool. Now let's move on to the new stuff. So now we're going to talk about authentication. So what are these? So we've talked about in the past this concept of authorization and authentication. So what are the differences between these two concepts? Okay. So authentication is trying to verify somebody's identity, right? I say, who is this person? And authorization is what are they allowed to do on your system? So what are some types of authorization enforcement things that we've looked at? Group permissions in Unix. So like file system permissions in Unix? Yeah. Access control lists. Access control lists, discretionary access control, mandatory access control, originator, is it controlled access control or originator access control? Right. So you can think about these as, just like you said, answering these two questions of who are you and not in like a philosophical sense, but more in the sense of what is your identity to the system? Right. And authorization is what can you do? So this is the core idea that we should look at. So you have one without the other? Yes. Okay. Yes? What? So it must have lots of yeses and all of that. Yeah. I mean, you're just like, you could say someone is who they are and you don't want to find it. Some specific thing to verify is who they are. Okay. So you could have a system that has authentication of knowing who is who, but not actually restricting what anybody can do, right? You can have a system that doesn't check who you are, but limits what people say they can do. I'll pose a question in different ways. Any of these useful to securing a system on their own? No? Why? Why no? Because it doesn't matter who is authorized or just a matter to have a list of who is authorized to do what, if anyone could be any one of the panelists. And in the reverse, it doesn't matter who they are because you don't know what they're allowed to do it.  Although, you know, this breaks down slightly, right? So something like, let's say Wikipedia. Can you do stuff to Wikipedia that doesn't require authentication? Is that breaking the security of Wikipedia? Or are there all leaf hackers? You can go to the edit page. Why is that different? Okay, maybe afterwards somebody verifies the information that you give. Sensitive pages can be locked down by administrators and you actually need to know who you authenticate and administrator. So I was a little excited because I understand that if you put some nonsense on there, someone else will probably change it. Hopefully, somebody will change it. If you put nonsense on there. Any other thoughts? Technically authenticate through your IP address. Actually, is some form of authentication in the sense that they know your IP address, your authorization is as a guest, right? So they're not authenticating your identity to the system. You're essentially a guest on the system and I would also say they audit, right? So there's a log in the edit list of, even if not what person, what IP address, at what time made what changes. So somebody could easily reverse your changes, right? The other way to think about it is this is core functionality of Wikipedia. You don't have a wiki if everyone can't edit it or at least the Wikipedia side. Alright, so we're going to study different types of authentication. We're going to look at kind of what that means and how we... So what's... Before we get into kind of all these details here, what are some authentication systems that you're familiar with? Your username and password. Your username and password? For what? To what? Like sending to those websites like e-mail or AISMI ECU. Yeah, okay, so let's use e-mail, like Gmail, right? So why is your username and password important there? So you can access accounts, but how do they know that those accounts are your accounts? You would be the only one that knows that password. You would be the only one that knows that. You created it when you first created the account, right? So they're linking that account creation step and on their side they create some account. And later on when you try to access it, you can give them that same password that you originally had when you created this account. Cool. What other authentication systems do you have? Some sites is like a six-digit code that they'll send to your phone. Yeah, so sometimes some sites may send codes that they send to your phone over SMS message. Yeah. Token-based. Token-based in one sense. Oh, interesting. Okay, so yeah, so you could log in once. Yeah, it's kind of sometimes generating a unique next password every time you log in. They give you your next password. Next time you log in, you use that password and they give you a new password. What other styles? Biometrics. So fingerprints, right? Face recognition. Anybody have a phone that recognizes their face? Or a computer that recognizes your thumb print? These are all different ways of authenticating trying to see who a user is. What about something like, how do you share, let's say, files on... Wow. Yeah. So how can I share with you a file that's on my Dropbox? You send a link to my email and you're assuming that email is my email and nobody else has access to it so that you have a person access to it. Right, so I can generate on Dropbox or any of these cloud systems a link to a file and I can share that link and anyone with that link can then now access this file. So I'm not necessarily authenticating who you are but you can access this file with this link. Okay, this makes sense. So we are going to define some terms. So we first, in terms of talking about authentication, this will allow us to compare and discuss different types of authentication systems. So we'll talk about password-based systems, two-factor authentication systems, all these different types of systems. So we have the principle which is a unique entity and an identity which specifies a principle. So the key difference here is that a principle is the actual, unique, whatever entity in this case using entity, it could be a person, it could be a program, it could be a process, whatever. And the identity is inside the system, right?  Yeah, so the key is in this internal representation, right? So each of you can think about, like, you all have ASU ID? Are you that ID? Is that your person? Is that, is an ID? What is that ID? Yes, it's your representation inside ASU's system, right? It's just a unique number that uniquely identifies you in their system, right? So in that case, you the person or the principle, your identity to ASU is your ASU ID. Similarly, the same thing with, you know, email accounts will have an identifier, all these kinds of things, right? Some uniquely for the system to identify you. So we have a subject that acts on the system on behalf of the entity. We'll see more clearly how this works. And the key thing we're talking about here is authentication essentially binds an identity to a subject, right? So that says, okay, this user, so the subject here would be the user acts like your browser, right? The browser again is not actually you. It's a software program that's running on your system. You access my ASU, right? And then the authentication system binds your identity, your ASU account, with your web browser depending on the information that you give it and how it authenticates it. Okay, and so we've talked about a different, so we've actually talked about a lot of different types of authentication systems here. So let's kind of bring it down a little bit. So what is, so when we talk about a password, right? So what is a password actually checking? We're going to retread it a little bit. Right, so it's some secret value that only you should know, right? So a password should be a value that it's checking that you know something. So is, wow. So, and this is different ways of thinking about different authentication methods of something that you know. And there's kind of an implicit requirement here. Should it be your name? Should it be the name of the account? Those aren't private information that only you know, right? So in here, in here is the something you know, comma, that nobody else knows. And again, so why is a password, think about it, why is a password something that you know and other people know? Because it's unique to you. So it's unique to you? Or why is it unique to you? Well, the decor was that you don't share it with people. It's supposed to be secret. Yeah, so you created it, right? Inside your brain, you created some password.  And then later on, they asked you about this piece of information. And if you haven't shared it with anyone, and nobody else has stolen your password, every type of data, whatever, it's something that only you should know. Now, how does this break down? Yeah, so social engineering, which is kind of a theme of your homework assignment, right? So if somebody tricks you into you giving them your password. Oh, I should have done this earlier. By the way, maybe I'll post something out later too. Ground rules for the assignment. So no actual breaking into anybody's computer. No physical harm to anything. Okay, set those ground rules that everything else is fair game.  Alright. Okay, I'll re-close this. Okay, sorry, I forgot about that. Okay, so, now think about those other ways that we talked about of authenticating to a system. So for instance, receiving a six digit code over text. Is that, what is that actually testing? Yeah? You're in possession of the phone number, right? It's not testing something that you know, right? Because this code, you don't know this code until you get the text message. Right? But it's testing that you own a device that can receive text messages at a specific phone number. Yeah, do you have something to add? It does like fingerprint involved in that possession. Almost. There's a split of a difference there. We'll talk about that in a second, right? So, and this is kind of broadly this area of what do you possess? So what do you have? Right? So that could be a phone. Anyway, I have two back-up notifications with my ASU. You use Duo on your phone. So what does that do? Somebody walk us through what happens. Yeah? Right, so you log in on your computer and then rather than a text message being sent, they send a push notification to your phone that you have to accept on your phone that allows you to log into the system, right? So this is testing something you possess. You possess a phone where you've already logged into the Duo app, which is not the website that you're logging into on that device. But it's testing that you actually possess the phone. What other things would it be able to do, things that you possess? So a government computer to have a card? Yeah, exactly. So government computers, you may need a key card, also corporations. When I was at Microsoft, you had to use your key card to access the VPN. Yeah, I can't really say the CAC is that the name of the system. Yeah, so your card, also, anybody who used two background notifications on Gmail? Yes, well you should answer this class. So I can show you here. So this is a bunch of randomly changing the Google Authenticator app.  And I can freely share these to you because they update every minute, 30 seconds. And even if you have one of these, it's only valid for that 60 seconds. And a new one is generated that's completely different from this one. It's similar of a UB keys or RSA keys, if you've ever seen those, that have randomly generated numbers so you try to log in. Some banks have this where you log in and you have to prove that you still have this physical device because there's some private secret data there that's shared between you and the bank that they can verify that that's actually that device. This is again verifying that it's something that you possess. Another example of this would be you can, it's actually kind of, well, it can be a security vulnerability, but you can authenticate and unlock my computer by kind of my watch. So the watch will actually unlock the computer, so it's not authenticated me, right? It's not authenticated. Something I know is that I'm possessing this watch. You do, yes. So that's, so there's multiple things there, right? That way if you can't just rip, if you ripped off my watch and then tried to go and open my computer because the watch auto locks when it's not on your wrist or it detects that it's not on your wrist, I suppose you could cut off my arm and then quickly go, but I will just give you access to my computer if we're ever in that situation. Okay, so what's the difference between, let's say, the what you possess, right? Like a text message to your phone to prove that you have that phone number. What's different between that and your fingerprint? Something that you have versus something that you are. So like somebody else could take your phone, but they can't necessarily take your fingerprint. Yeah, or I think about a different way rather than taking, I would say that the difference is not can you change it, right? So when you change your fingerprints, I mean you have 10 of them, but after 10 you're kind of, I don't know if the toe prints work, but maybe those are a thing, right? So the other thing that we can think about is what are you, like what are factors of you, right, that are supposed to be unchangeable. So what are these types of things? So we talked about fingerprints. What else? Retina. Retina, so like a retina scan of your eye, which I've only ever seen those in movies, but allegedly they're real. I've heard they're real devices. What else? Yeah? Your veins. Your veins? Yeah, because they scan your whole head, and it's like a x-ray. Whoa, that's good. Okay, veins are a hand, I would say. Or generally, yeah. The structure of your face in terms of like the face recognition systems, right? Can you just easily change your face? I mean, you can, but it would be very, very extensive, right? It's more of a what you are than what you possess. Have you ever seen the movie Face Off? I have. I'm just saying this is a real one. Yeah, so, and so this is another aspect, right? We can see how this compares. It's not something that you know. Your fingerprint is not something that you know. You can't just like, I don't know, write down your fingerprint, right? It's not a secret that only you know. It's something that you have that you can put on a fingerprint or a fingerprint. Yeah. So, what's even got to do with you, though, is I still feel like it could be something you possess, because for example, if someone were to take a fingerprint by scanning into their system, they could easily make a replica of that fingerprint that worked on a fingerprint. Or, heck, the face scanner, or at least the ones on red to the lower end stuff, you can hold a picture of the person that was in that mode the most of the time. Right, so this gets into more, that's why I wanted to not do it on mode. It's more about how easy is it to change it and get a new thing that you possess. Right, so with a phone, if I lose my phone or whatever, I can just get a new phone and say this is not a phone I possess, or a new UB key, those type of things, right? I can get new devices. I can't change who I am necessarily, easily. And which become the problem if it's stolen, right? So, if somebody steals your fingerprint, sure you can deactivate it into the other ones. And there's problems with all these methods, right?  And then you could unlock their device and authenticate as them. They got around that by trying to do what's called liveness detection. So this is a whole area of how you tell that that thing you're looking at is alive and not a fake piece of paper. So they developed this basically by kind of looking at the eyes and seeing if there's movement.  It acts like the eye's moving and it logs in. Or, like, I think the iPhone now, I want to say, does like 3D reconstruction of your face using some crazy sensors, right? So you can tell the difference between a picture that you hold up and the actual person. But then I could take a picture of you and create, use a 3D printer to create a 3D version of your face. Yeah. I know in the settings, like on iPhone 10 at least, there's a setting you can toggle called like require attention or something.  Yeah. So the required attention is really cool because, yeah, and that's other bypasses, right? Of like making sure the person actually wants to unlock their phone. So that way you can't just hold the phone up to me and it will unlock. This was, I know, a problem in our lab at the PhD with fingerprint unlocks of phones. Somebody falls asleep and you'd unlock their phone with their fingerprint. With the faces. So then the arms race to detect lightness of faces try to look for the like blood vessels in your face to see if those would like pulsate lightness detection. Of course you can also fake it.  But for a lot of people, the benefit, you know, if the alternative is you either have a passcode on your phone or you don't, like you don't have any passcode or anyone can unlock it, or you have facial recognition where your phone is actually locked and encrypted. Even if it's bypassable, it's probably still better. In my opinion. Okay, are these the only three things? So anytime we want to authenticate to a system, these would be the three things. I think you could say like where you are. Where you are, why? I have the ASU two factor authentication. I can have it in my work computer. Okay, cool. So yeah, so you could, okay, that's an interesting version of where. So yeah, you could say where are you in terms of, has this subject authenticated before? Exactly. So yeah, so your physical location could actually change your authentication. It could be where are you in terms of using credit card? Yeah, so it could be different ways. It could be an internal IP address that's only accessible inside the company. It could be an external service that's limited by IP address. You have a whitelist specific IP address that's better only visible there. Yeah, the last place you blogging was in Arizona, but the IP address maps to somewhere in the United States. Yeah, so it could be different ways. It could be an internal IP address that's only accessible inside the company. It could be an external service that's limited by IP address maps to somewhere in Eastern Europe. It's probably not the same person. Yeah, so Gmail uses this, and we travel internationally and use Gmail, and it pops up like crazy warnings of like your machine's been used in whatever country you're in, and yeah, those are real things. Yeah. Could you type in like behavior, like if you're using the credit card example, like what they're buying and stuff like that? Yeah, okay, so behavior, and we're kind of, hey, I put that more under what you are, or maybe it would be more of what you do. So you could do things, and people have done this of developing systems like with your phone. You could try to develop some kind of like fingerprint of how you type on your phone, and so you could tell if somebody else picks up your phone and starts typing. It's different, and so you can lock the device if they detect weird behavior. There's also, they've done things with phones like the gate, like the way that you walk is relatively unique, so you can learn that from a person. So if somebody else picks up your phone and starts walking away, it would automatically lock itself in that case. Yeah.  Yeah, is that sad if you wouldn't be able to? Not enough. Not enough signals to unlock. Yeah, so you can kind of also, what are you, right? What are you in terms of brain signals or EKGs or whatever kind of craziness, right? And so A, it's important for a kind of multiple reasons. A, this is how we, in security, this is how we think about different types of medication mechanisms, right? It probably falls into one of these buckets, and so we can start thinking about this in terms of what are some of the pros and cons of different types of things. So let's talk about what are some of the benefits of what you know. You've been using passwords for years. You don't think there's any benefits. Yeah, so it's something that only you know, right? And so in the security sense, it should be very good in that nobody else should know this password, right? It has to be really to share passwords between things, because in my life, I mean, I've literally been like hundreds of passwords, and I don't make them in one every single time. I have a set of different ones that I use for different things. Yeah? Yeah, or Netflix, or any of those kinds of things, right? So a password, so can you share your fingerprint with somebody? No? What's this to say no? You can add somebody else's fingerprint as a way to add anything to your account, but you can't fundamentally share your fingerprint with them and just clone it into that, right? What if I can possess, again, somewhere, then you can't physically own the same device, right? To make you share a device that you give them, whatever. So yeah, in that sense, there's a lot of benefit to a password that you can control who you share it with. It's actually very similar to the key idea that we talked about a long time ago of getting into houses, right? It's like, if key is nice, you can copy it and share it with people, but it has a lot of drawbacks. So what are some of the drawbacks that I know of, of what you know? Not password specifically, but... Yeah? Do you think passwords are something you want us to create or any things that are easier to remember? Yeah, so the problem with... Well, okay, so another way to say that is your password needs to be something that you can remember and that is difficult for other people to guess. All right, if my password was my name, that would be a very bad password because that's something that you could easily guess is my password. You could forget knowledge? Yeah, ooh, forgetting knowledge, interesting. I won't make you do it, but... A lot of people have asked me to reset their password on the submission site, right? So this is a very, very example. So some of you get passwords talking about how difficult it is to remember passwords, or how you'll always remember your password forever and ever as your new passwords.  Right, so then the counter example, and this is... Is this in Ferris Bueller's down? No. Oh, maybe this is interesting. Yeah, so the problem is, okay, so then you know if you forget your password, you can't access the system. So what do you do? You write it down somewhere. So if there was a sticky note on my laptop here and a password to this computer, is that very secure? No. No, it's probably better than, you know, I don't know, there's... better than having a password to password, right? But still, it's probably not great because it's working. Cool. Okay, what about what you possess for some browsing cons there? Oh, possess, not R. So possess would be device. Oh, yeah. Well, I mean, if it's a device, it's a lot of the time you use it. Are you? You ever lost a phone? Yes. Have you ever lost a phone? Well, that's like the central word for me to forget. Okay. Yes, that was a fair, a fair concede kind of thing. Yeah, but on the flip side, I can't give you my phone. Right, it's hard to share. It would be hard to share, in that sense. Yeah.  Yeah, so you may not have, you may be in a situation where you need to authenticate to the system and like you've either lost your phone, you've left it at home, you've, you know, whatever, yeah. Key card in a way. Mm-hmm. And it's just like, say you're trying to get access into different departments, you have these key cards you don't have to remember to pass them. Right. But the cause of that is something easily stolen. Yeah, and if somebody steals it, that's all they need is that device to access the system, yeah. Yeah, so like that, it has to have some sort of physical component. Mm-hmm. It's like, well, you know, you could write it down, if you don't write it down, you know, physical component would just be stolen. Right, so there's actually a really interesting dichotomy there, right? It's a physical device where you can steal it. But on the flip side or the password, if it's all in your mind, there's not always a way for somebody to steal that, although they can convince you to reveal your password, right? If you're sharing your resource, it's like a physical key, and you'll lose it at the moment so like, maybe replace that with a key. Ah, yeah, so, which actually I'd say is similar in some sense to a password, right? If you lost control of your password and had to change it, you'd have to tell everyone, but even worse, sitting in the terms of a key, right? If you're losing, like, oftentimes, apartments may have a key to the front door and then a key, different keys for the individual doors that if somebody loses the key to the front door, you have to re-key it. Everyone needs a new key. It's a pain. Cool, okay. So, that was your discussion. Let's move on a little bit and start thinking more formally about these systems. So we're going to think of an authentication system as some function or method. Again, here we're talking a bit abstractly. So we're going to talk about A is the capital A is this some authentication information that proves somebody's identity on the system. C is some complimentary information, so something that's stored on it and used to validate that authentication information. So we'll see what this kind of looks like in real systems. F is a function that maps between them, so very simply, some kind of function that maps from authentication information to complimentary information. L is the function that actually verifies the identity, so that it takes in the authentication information, all of the complimentary information, and then says true or false, so authenticate or not. S is just some function that allows somebody to create or alter information. So this will be changing your password all these kind of things. I know this is very, very abstract. Let's think of a simple password system where the passwords are stored in plain text. So what does that mean when I say the passwords are stored in plain text? Yeah. Can you just open the file and read it? How do you do it? Can you do it? Yeah, so you're writing a system. How would you write a system that authenticates you based on plain text? How's your store in plain text being in plain text while you use just to pair up those two things? Yeah. So you could all write this, right? An authentication system that was a plain password, right? So somebody, so you have to have some way to register a new user to your system. You take a username password, you store that username password to a file or append it to a file, and then when somebody logs in, you go through all the entries in your file and says, does this username and password match? If it does good, you get access to the system. So we could model that using this framework we just showed. So here, so what would then be our authentication system? So what would be the A, what would be the things that users authenticate with? Yeah. Is there a username and password? Yeah. A username and password will focus just on the password right now. So we'll say it's a set of strings that can be used for passwords, right? So you, have you ever tried to use a password on a service and told you that you couldn't use those specific characters? Yeah. Very annoying. This is actually very bad for security, but it happens. So then what's the complementary information? So what information is stored by the system in order to verify this? Yeah. A username? A username and password. A set of all used strings. What was that? A set of all passwords that have been used. Yeah. So the set of all passwords, so, which is the same set, right? So this set, so all the strings that we use for the passwords are exactly the same as our complementary information.  We'll see why the set makes sense. We'll look at this common, this function is f. So what's our test? So how do we test if a username and password is correct or the same? If the password given by the user equals the password in the database for that user. Yeah, perfect. So it's just an equal function, right? Quality. We just want to see are these strings exactly equal of what the user gave us as their password and what data we've stored in our system to check them. And we got some functions to set and change passwords. Okay. So what's the problem with this? Is it's access to where you're storing those passwords? People know everyone's password. Yeah, so we already stored this password, right? So let's say it's a website you're making, right? On the server. On the server. It has to be on the server, right? In order to check if people are who they say they are, all your passwords must be stored on the server. Can you guarantee that nobody else can ever get access to your system? No, it's happened all the time, right? So there's a lot of technical facts, office of personnel management, all these companies that have huge target credit card processing companies, hard-lived payment systems, and there's a ton of these companies that have had breaches where people have had access to their systems and their servers. So then if all those passwords are stored in plain text then when somebody breaks into your system what can they get access to? Every single password of somebody who is breaking into our system, what other threats do we need to think about? If you're trusting the administrator or the server? Yeah, who else can access the administrator of the server, right? And do you want the administrator of the server to know all of your passwords? Thinking about going back a little bit, right? So what can, I mean, is that really a problem? I'll play the devil's advocate a little bit. So the user names and passwords they are the administrator's system, they control the system, they can do whatever they want as any of these users. So somebody gets access, so now not only do we have to worry about people breaking into the server but also the administrator's account, yeah. So does anybody use the same password on more than one site? So your user names are email addresses, right? So I'm an malicious administrator, I go through all of my username passwords, my email addresses and passwords. What account do I want to get access to? Bank account, I actually don't care about your bank account. Yeah. Email. Email, why email? Because I can get access to everything else through a setup filters to silently forward every email you get to their email account or to an email account they control at which point you've completely lost control and secrecy of your email. So I go through I can see what are all the Gmail user names in your account. I can see all the passwords and I'll just try each of them. Is it likely that one of your users is reusing their Gmail password on this random site? Yes, and so this is another threat we need to consider is the threat of not just somebody breaking into the server, but an administrator or an employee who goes rogue and has access to these data. Yeah. On the same sort of note, okay, you can say, although I trust that Google is pretty secure, like probably people aren't able to get into that, they don't want a really big site. Somebody might be able to get into that site and get that password of, okay, I'm going to try this password back at, you know, their email, which is, as you said, more valuable than to reset everything. Yeah, so we'll have a full discussion on that in a bit, but but first, I want us to realize that this is what we're going to talk about ways to that users can kind of use informant and mobile effectively. Yeah, so another interesting thing is, so we talked about cryptography, right? The whole point is to keep the communication between two parties secret, right? So if there's somebody listening to you logging in with their username password, then what can they do? Yeah, steal your username password and log in as you. And does the system have any way to know that it's not you? We looked at crypto before looking at authentication, so we did realize that we need some cryptographically secure mechanism to talk to the other end. So this is why in the real world we want to make sure that you're logging in over an HVPS, basically always. Yeah. All right, so what about verifying the addresses for a while? They might not be able to log in although if they're, let's say, if they're in a position where they can man in the middle of a traffic and they're in between you and the other system, it's highly likely that they can impersonate your IP address and log in as you. Or the way this usually works is rather than getting on the network in between you two, you downloaded some game or some game crack or something on your computer and now they're on your physical device. So rather than stealing your username password setting first, you can even do things like they try to fingerprint browsers. So they try to, like websites will try to see what browser are you coming as, all this kind of extra security mechanisms. So sites that steal your browser information will then or sorry, sites that try to fish and steal your username password will record all of that fingerprint information so they can recreate it later. The other way the other problem with IP addresses is how often is your IP address set. Yeah, so it changes when you use Wi-Fi, so think about your laptop, any mobile device like a laptop, a phone, these kind of things. Every time you connect to a new Wi-Fi network, it's going to have a different IP address so you can log out of all your services so it's actually just a real inconvenience for people so most sites don't have a password. Yeah, that's a good point. Cool. Okay. Think about maybe like a system like not necessarily well, we talked about web, we can talk about a similar type of authentication system in terms of like a shared multi-user system like a Unix-like system, right? Or everyone to read. I'm clearly too bad. So what's the solution here? Have a better C? Well, technically we could get better F, I think. Oh, sure. Yeah, or a better C works. Okay. So basically the core problem is the fact that we're storing in all of the passwords in plain text. So our complementary information is exactly the same so we don't want to do that. So let's say we store nothing. We need to store something, right? So what do we store? Encrypt it. So encrypt uh, okay, so take the the password when they log in encrypt the password encrypt it with what? I just feel like some cypher on it that causes it to not be the original message. Do you use some cypher types? Sure. But encrypt it on a lot. Like with what key? Yeah. The username? Okay. So take the username and password use the username as a key to encrypt the password store that. So and then we store the username database and so when they log in what do we do? So they log in now with username and password. What do we do? We compare it with the cypher uh, like the cypher type that we have on the database with the cypher. Yeah. So I can recreate this. I can rerun this operation. I have the username they're doing me. I have their password. I encrypt the password with the username. I create a cypher and I compare it. If they're equal, I let them in. Okay. Cool. So now I've stored in my server everyone's username and cypher. Now you break into my server and steal all of it. Yeah. Wait. So yes, let's think about that. So you steal all my username and cypher. Can you steal everybody's password? Yeah. Yeah. Why? Because the key on the site is what they use. The username is the key. So you use the username to encrypt that cypher and then you find out where it's password. You do that for every individual user. Just for the cypher like assuming that's sufficiently unique enough encryption systems where you aren't going to have another combination of key or username and password that would come out to the same result. Can you then just store the cypher and just combine to make one of these things? Well, you need their identity, right? You need your system to have some way to say what is this user, right? So the user name just maps the name that they attribute to your internal identity of their user identity. Okay. So you need something. Should we instead of using encryption just use a hash to store the password? So instead of encryption use a hash. Well, let's let's pause that for a minute and let's keep going with this encryption idea, right? Because so the problem here so the problem here is using the user name as the key, right? Everyone agree? So what should we use as the key then? Password you need to the server like the admin password? Sure. Yeah. So let's generate some new key K some random good key that we use. So now we use AES on the key K along with the password and we get cybertext and we can store now in the database we store user name and the cybertext, right? What do you store the key now? So where do you store the key? If it has to be on my server somehow because I need it to create users and I need it to login users. So this has a slight benefit, right? In the sense that if somebody just were to steal my list of user names and cyphers they now shouldn't be able to easily decrypt the cypher because they don't have the key. The problem is in this situation let's say somebody breaks into your server has full access to everything that that server can access what do they need to steal now? Yeah, they need to steal the list of user name and cypher and the key and with those information they've been on the clock everything. Also think about the administrator scenario the administrator threat so the administrator does the administrator have access to the key K? Yes, sir. For sure. The administrator has access to the key K so they could decrypt all of these passwords and go backwards and so it really not it's in some sense better than just storing plain text passwords but it has a lot of products and it still enables a lot of scenarios. So Spencer suggested we use hash so what would be my sum? Yeah. Well since it's one way we don't need a key. So since it's one way we don't need a key so let's do all right Shaw here we'll say I need Shaw 256 okay so now what do I hash? The password gets some output pass and then when I store my database you can hash it out of it sure let's say it's all the same I'm always going to use Shaw 256 right so now so I store a bunch of usernames and the hash of their passwords and now the user logs in what do I do? Hash the password check if that hash password equals this password if it does what do I know for what do I know? Do I know that what they've given me is the password we gave you originally? No. No why not? It's collusion solutions. Yeah it's possible that I mean there will be other inputs that hash of that same value but because of the nature of hash functions that we talked about it should be very difficult they would need to try to the 256th possibilities in order to find something that the same hash of a lot of group forcing. Yeah. So Ms. Woman would it be secure if you hash their password on the front end and then just send that without encryption? Yes. Let's we'll think about that in a second I have a point so I'll make it here. Okay so now let's go through this. So I have a bunch of usernames and hash passwords on the server so we'll go through the form somebody steals this list of usernames and hash passwords what do they know? They have they know the username then they know the hash for some hash and so then what they can do is possibly you know go through a bunch of random algorithms and try to guess what that password might be. Yeah. Okay so they can try guessing passwords if they can stop them from hashing Adam and then seeing if my username maps that password there's nothing correctly that can do that they can do that. What about let's say that you and I have the same password as password one. Would you be able to tell who has the same password here? Yeah why? Yeah they both hash the same value so you'd actually be able to see who has the same password here. So it's actually making brute force fairly easy you've been in brute force the list of common passwords and you can check in this list what accounts have exactly that password but it's still better than the other cases now there's no cane to steal right the user's job is to brute force these username passwords. Okay let's then change our situation a little bit to say that now client-side we shot 256 the password and then we passed the server the age pass which then the server checks and it's in the database. How does that change things? In what sense? Yeah so it's an interesting thing it doesn't fundamentally get us anything it's one of these things where you it seems that it's better because instead of sending your password over the wire you're sending now a hash version of your password so nobody can go backwards to know your original password but to authenticate to this website they don't need your original password what do they need the hash of your password which if you're sending this without encryption they can just steal the hash of your password and log into the site as you without ever knowing your password so you still have to you still have to encrypt the communication scheme and if that's your requirement you might as well just give them your password so how do we get around this problem? yeah please can you explain the whole thing about how the inside hash can be sure so the question was we'll draw all of the client in all of these models the client sends then the server has to validate and not only the client from the password but also the user name and the password so it has to tell them what account they're trying to log in as but we can think of let's say the server knows what user they're trying to log in as doesn't matter sends the password what we said is so anyone in the middle right so you have Eve here in the middle Eve can now steal this password we know that we can create an encrypted communication channel between the client and the server and this way Eve can no longer steal our password right and this is why this public key infrastructure is so important because the only way we can do this if we haven't already shared an AES key with the server is use public key crypto to send essentially first application or whatever but essentially we need to use public key crypto this is why the client needs to know who the server is which is why verifying the way games is so important so you're not accidentally sending your password to an attacker's paypal.com you're sending it to the real paypal.com no so this was the scenario scenario one scenario two the recommendation was send it over the network to the server communication channels of pain what if we just sent the hash of the password right because here it seems better because now if Eve steals this and can't get our original password the problem is all they need to log in is our hash of our password so we still so at this point Eve can steal the shop of our password our password can be as insanely complicated as we want it to be but Eve doesn't care if she has the password so fundamentally we need we still need encryption on this communication channel therefore in most cases if you gotta build this anyways you might be able to do the first it's a good question um yeah yeah so they benefit in some it's very difficult because in some sense if somebody's even if you're hashing and your password they're storing best practices right so your database leads an administrator can't see what all the passwords is if somebody's on the server they see every password that gets sent right this was actually a major um Twitter had a problem and some other companies I think where they were accidentally logging plain text passwords so their database they logged plain text passwords to it a log file um so that this so in this sense it should be better because in this because essentially they can't just simply see all the passwords like you're trying to hide the passwords so only the user does the passwords they should only send the hash but this has a problem there are other schemes that you can do where the server sends a one-time random value to the client the client hashes the password and the random value and then sends that back and then the server can check and that has better properties so you can kind of get there but in almost all cases this adds a lot more communication like a lot more complexity overhead when really you should be thinking if you're trying to authenticate you need you need this channel secure channel anyways right but presumably you want to do stuff to the server and you want to protect your user's privacy by encrypting that communication anyways yeah it seems like beyond like pretty much both channels are encrypted it's still better to not hash on the client side because if you're hashing on the client side then anyone who breaks into the server hashes can just log in directly yeah that's actually a good point because then they can just bypass the client side logic and just send the hash directly to the server yeah the other approach it's going to be double hash I was going to say if you're hashing on the client side or if you're hashing on the client side then if the website has a unique hash versus if they stole a password like we're assuming we're unencrypting it on the server side if they stole the direct password after being encrypted it's different than stealing a hash actually yeah so that's interesting that does impact the multi-website problem so if somebody stole in this sense all these big passwords they can log into this site as all of them but can't log into other sites but are some benefits but yeah the other thing is you need to change your client such that to make sure that it supports this break you have to verify that everyone it just depends on how much control you have you can just store a hash of the hash it's still the same thing it doesn't matter because fundamentally if you take the hash of this password and hash it in compared to this database then I guess for the other for the other passwords you should be able to go back but you still have to encrypt the communication channel anyways so oh yeah it's usually just better than a server but what if we triple-hash it first what if we just remember hashes of simple passwords yeah stuff happens all right so let's okay so we still have this problem so think about a shared system like a Unix server right so now we actually have a nice thing where we can store user names and hashes and we know that assuming we have a good hash function it should be difficult to go backwards right from that hashes to passwords but we still have this problem that if we both have the same password then I can just let's say if I look at this list and I have a password right because they all hash to the same value yeah so can we just limit the set of like more unique passwords but requiring like a special character and then exclamation points so yes we can try to make our passwords more let's say sure we did that but still it's going to be likely that the passwords will be able to see exactly what those passwords are retraction yeah so I've heard the term salting like just a salt enhancer password how do I know what that means does that address that maybe depends on what it means okay yeah if we add a little bit of something to maybe the password call it a salt and then hash that okay so or another in some time you could say what if we use different hash functions for each user right so every user uses some variation of this hash function you would have to store what hash function is used which kind of is like to your point what hash function is used for these or another way to do it would be so when the user creates their password so we have so the user is going oh man okay so the user okay so the user logs in so we have a username and we're going to generate some random data with a lot of salt some random data and what we store is we hash the salt and the password because our double bar just depending on it doesn't really matter how we combine it but we need to combine it we store that so now we get the hash I'll call it an s-h salt and hash on the password and now what we need to store is the salt and hash on the pass and the salt so let's say we go so let's say they log in and they give us username and password so then how do I verify that this is correctly this user how does the salt generation do this randomly it has to be predictable okay so I need this salt in order to recreate and redo this hash so the salt has to be part of the data that we store here so I can take the shop of the salt and the password and say does this equal this if so yes otherwise no right and the key is that each salt is different so if you have a password that's password and you have a password that's password the salt and hash will actually be different it also means in an interesting way so now if I'm going to guess so if I have thousands of user names we said before when we just had a hash I could hash the password password and just see every single user that has the user name of the password can I do that in this scheme yeah because every user has a unique different salt which means I have to go through every user use their salt combining it with password with the password password hash it and check if they have the user name password so now I'm at least required and we'll talk about reinforcing later but this is significantly better here so we'll just go back real quick let's do this so you guys even had this way back in the day I'll talk about this in a minute so the hash so it had strings so you guys only got to educate with passwords of eight characters or less which is kind of crazy and then so the idea was what we store is an 11 character hash in the password and a two character hash ID in this case essentially our salt and what we think about and you can think about in this sense how high BPS that depended on the hash ID so this is the idea of having your salt change the hash function and we have all of these nice things here so yeah so we can see so basically we can ask the thing hey Alice wants to create a password called password the Unix system will create that and then transform this password into the complementary information so here we have and this is we've seen this inside the EEC password file we looked at this a long time ago we have the user name Alice and then here I think these first two bytes are the salt and the rest of this is the hash of the password password cool alright so when we come back do you think we'll talk about breaking stuff Thursday Thursday Thursday Thursday Thursday


It's always a pleasure connecting for the purposes of sharing the knowledge. And amongst us today we have Honourable Mr. Justice Paramjeet Singh, he is presently presiding over the Punjab State Consumers Registration Commission and he has been a former judge of Punjab. And today we are having a session on Northern India Canal and Drainage Act 1873. Since Justice Paramjeet Singh has been presently presiding over the Punjab State Consumers Registration Commission as the President, we have had varied sessions on the consumer perspective law and those have gone very well. And since he's an expert on the land laws and the topic of today in respect of Northern India Canal and Drainage Act coupled with the other revenue aspects, we thought we should have also some sessions in perspective of the revenue law. Consequently when we requested him and as usual because of his magnanimity to accept his participation for the purposes of knowledge sharing has always been well received not only on this platform but other platforms. People feel that the knowledge which he shares gives a deep in size and precise suggestions and the legal journey. We all know that while we discuss about the Northern India Canal and Drainage Act, the canal and the drainage work are the important perspectives within this act and it's quite a technical subject for the purposes of understanding the nuances for this aspect and the lawyers down in the districts have these different aspects which ultimately culminate into the reputations and supreme court if need be. Therefore as to how the proceedings are before these proceedings and how they culminate eventually and what is the legal journey. On these all aspects, Honourable Mr. Justice, Paramjit Singh would be sharing his knowledge. Thank you for accepting our invite, over to you, sir. Thank you. Good evening to all of you, all the participants specifically to be cast. I can never refuse him whenever he asked me to deliver lecture on some topic. Whatever knowledge I have I want to share with my colleagues I will say that within four to five months I will be also on your side as one of the advocates. I may be submitting, I will be doing most likely my office in end of July. So today we will start with the canal, Northern India Canal and Drainage Act which is applicable to the state of Punjab, state of Haryana, wherever these canal irrigation system is existing. First of all we would like to understand the terminology for which the irrigation is done. For every irrigable which is to be irrigated area, area is identified. One is known as command total area where the water is to be supplied. This must be minimum 300 acres for a check. This is prescribed under the rules out of which the cultural command area where actual irrigation is done, it must be 300. There are two things, CCA which you know then the terminology used is CCA, cultural command area and uncommand area where the irrigation is not possible may be due to the higher level of the fields or for other reason no water course is existing there. So we will talk of the cultural command area. Command statement is prepared where it is specifically mentioned that this area is cultural commandable and the irrigation is to be done to this area. Irrigation system in Punjab and Haryana is there are major Sarhanda canal, Pakhda canal from which the irrigation is done. The main supply line are known as canals. There after further smaller canals which are also known as in the local angle is the Rajabahas. There after the water courses. In every canal there is a outlet which is known as in Punjabi, Hindi Moga. After Moga does it depend upon the area to be irrigated what will be the size of the Moga. And at which level it will be there it will be fixed keeping in view the level of the fields. There after when it goes to the water courses then there are nakas from which point it is to be distributed to the fields there are nakas are fixed in water courses you know we call as Khaal water course. How these nakas are fixed firstly we will have the total chak area then we will determine the total flow of water from a particular outlet for a particular Moga. There after we will divide how much per acre per minute or 6 minutes are required 10 minutes are required it will depend upon the flow of the water at that particular point. In that the actually discharge from the major main canal to the water course. What is the level of discharge on that basis irrigation is determined that it will take 6 minutes or 10 minutes for a acre to be irrigated accordingly total cultural command area is taken into consideration there after the time period is given for each of the acre as per the then the turn of waters are fixed. Can we the turn of water when they are fixed this is known as Vara Bandhi. Vara Bandhi is fixed by the dipty collector the field surveys are done by the junior engineers Gurdawars there after the turns are fixed. How the turns are fixed the turns are fixed from taking the first point that is the takeoff point down the stream from the upper side it comes to downward then there is a possibility that at some point because against when the water course is carved out generally on both sides of the water course there are fields when we fix the Naka we fix the Naka keeping in view the convenience for a particular shareholder in that very Chuck say I am having a 20 acre land then Naka whichever is convenient to me I will suggest that from this point I can irrigate my land properly and Naka is fixed in concentration with the shareholders then Naka's are given to everybody right side or left side of the water course both sides it depends upon the field which it exists which side it exists then question comes what will happen to the fields which comes at the end of the water course we will have to look into this aspect also you which is very relevant and must understand when the water comes at the mouth of a moga that the outlet the field at that very point has a maximum water pressure and the irrigation of those field is very quick because discharge is flow flow is much more when it goes to the 300 acre lands it's slowly slowly it's decreases at the end field there is a very slow process that is known as Naka Naka is when the last person will come the water level water flow will be much less whatever water is left in the water course the entire water course to that person Naka means residue water course water left in the water course residue water will be availed by the person who is at the end of the field it will determine on the basis of the Naka sometime there is a dispute with regard to the fixing of Nakaal also because sometime peoples are at the end they are similarly situated otherwise and we will have to determine as per the revenue required where the fields exist for that reason you will have to be very careful how the field arrangement is there where the Naka is fixed all these things are to be taken care first come first survey the basic principle for fixing the Naka because first come first serve means it depends upon the fields when the whole fields are coming first firstly right side then left side then right side left side alternatively in this manner the Naka are fixed there is a question regarding the Bara Vandhi we have perennial canals which continue throughout the year hence there are two systems there is a one appendix e attached to the Northern India canal and drainage act which is create which is the notification by Punjab government where this pattern is specifically mentioned how the terms are to be fixed class 8 of the appendix e defines how the terms are to be fixed it is specifically mentioned we can look into this in two ways one is seven day period then the term at the morning and evenings by rotation comes every every Monday or Tuesday on the it will come on the same day on this at the same time then there is another method it should be 10 days in section 68 of the Northern India canal and drainage act the terms are fixed the terms are in Punjab and Haryana are fixed on seven day basis every seven days the turn is fixed this is more convenient and everybody knows that his turn will come on particular day at particular time there is no change in time this turns are fixed like this if you look into that then you will have to find out sometime the line which are coinciding they are same at the same level well I mean when the fields are at the same level then which one should get if the since the it is upstream to downstream then then whatever is coming on the right side it will get the first term thereafter left side this is the principle which they have said this this turns are to be very relevant now we will come to the war existence of water courses section 30 F section 30 of the Northern India canal and drainage act specifically refers to the water courses how they exist even temporary the Punjab government has made an amendment that even temporary water course will be treated as a water course once the water course is passed to a field then it will continue you cannot demolish it this is the law this is what very much harsha in fact sometime with in the brotherhood the permission is granted then they take it for granted that the water course should be there but the remedy is available with the owner of the land that he can ask that if they want the permanent water course they should acquire the land pay the compensation that it will be paid under section 30 D thereafter permanent water courses should be established this is this is regarding the Baravandi then then comes the issue regarding the transferring of the area from one outlet to another outlet or if you are having a land at a place and also at B place sometime but the people do that they say that we will not irrigate this field but what turn should be fixed in the another another area transfer area is also transferred because the reason is if a person having a small holding he is not in a position to irrigate his entire land at both the places if ship if he shifts the turns to other places he is in a position to irrigate that very area that is most relevant for those people who have a small holdings they consolidate their turn at that point of time say in a field I am having four acres and my turn of 24 minutes at the other field I am having a seven acre and the my turn is 42 minutes 42 minutes I irrigate my that area 24 will not irrigate my this area at a so I will lift my turn and go to B point by getting this 24 minutes added to that so that there may be a proper irrigation this is the commonly used method in Punjab this is this is a very small topic and only very technical in the real sense I have already explained once about the how the the arrangement of the field is there I will just show that the arrangement of fields for a particular rectangle rectangle I just draw it and perhaps you will be able to consider it and it will be visible to you here is a line this is a rectangle consisting of 25 acres of land 1 2 3 4 1 2 3 4 how the arrangement is there it start from 1 1 2 3 4 5 then below 5 6 7 8 9 10 below 10 will be 11 12 13 14 15 below 15 16 17 18 19 20 below 20 21 22 23 24 25 it means you start with this and this in this manner the fields are arranged on the basis of this your terms are fixed these are based on the rectangles your total holding is considered then the time period is fixed for that any anyone want to explanation any question by any of the audience I can answer for clarification Mr. Mr. Vikas so we will take it at the end if somebody wants to ask all right then then there is a question of fixing the outlets total total command area of the whole village is taken into consideration firstly we have to look into the how much area of a village can be irrigated that is known as cultural command area on that basis the we would have to look say that this canal main canal is passing through this village then keeping in view the total holding of the village which is a command which is a cultural command then knuckas are fixed that outlets are fixed in the canal at particular distance from where the major water courses are drawn then the small water courses are drawn which are known as brunt water courses on that basis you are getting the irrigation this is the same this is the only system in our irrigation system there is not much complicated only few chapters and you are master of this subject I think there is not much more in this case anyone any have any question I can answer Mr. Vikas I think that it's quite self-explanatory and as you said that it's a small small topic only yes and that's why Varavandi are particular individuals and out fixing of outlets I can only say that and then I will say now the procedure I will ask who can do that so far as the fixing of Varavandi is concerned it is done by the DPT collector against the order of the DPT collector appeal lies to the DCO against the DCO order of DCO it goes to the superintendent canal officer so far as the fixing of the outlet is concerned there is a specific procedure for that for that the publication is made that this much is the total area for this very area the outlets is being fixed it is within the preview of the DCO divisional canal officer they fix the outlet against that order appeal lies to the SCO and the RIT thereafter in Haryana it is the SDO then DCO against the SCO there is a provision for the engineer in chief for that purposes also they can there is a some Haryana irrigation act this is the only procedure shareholder has right to object to the fixing of the outlet because they will have there before fixing the outlet junior engineer take the total command area against each field he will mention the level from that very canal at what level that area falls of that particular field on that basis the outlets are fixed in the main canals this is this is the this much is the only topic any question by any person no as such questions are not there but while pleading I would say since as we had discussed this is not a topic which goes pan India what should be kept in mind while drafting the claim before the DC and then the DCO appeal what specific provisions and aspects should be taken into consideration when the case is prepared and filed by the party no no no only your land your level whether it is irrigable or not irrigable on that basis the area can be included in this otherwise there is no provision if the land is much higher and this is not possibly irrigated it is it is known as on command area only cultural command area I think what particular aspect should be highlighted for claim to substantiate and ultimately succeed there is a now there is a provision in the Punjab Act amendment is there even if there is a land at higher level then they have this is chilari chilar chilar maybe understanding this is a particular in particular field which is at a low proper level a pit is created where the water collects from there by way of a Varma it is just like a instrument it is lifted to a higher place for that some extra efforts are to be done this is this can also be done for those purposes only you will have to highlight that you can irrigate your land it should be included in the cultural command area which is declared as a command area so ultimately the bottom line is that you have to substantiate that it's a cultural and a cultivable area yes yes no this can be cultivable not this is only cultural command means culture means cultural command means the land which is which can be command mean which which can come under the irrigation of water command area is which is irrigated by flow okay so we don't have the question I will just check it on the Facebook but I don't think yes sir we don't have and as usual we have all enjoyed the session the way you have shared your knowledge and friends since we were doing now one or two sessions in a week but since there are bisacifications this time we are doing some more sessions and tomorrow we will be having proclamation for the person's absconding section 82 of the CRPC kindly do join us tomorrow at 6 p.m. by Justice Emil Ilyani a former judge of the Mumbai High Court so do stay connected with us and sir it was a pleasure hearing you it is always a pleasure having insights and what we have discussed also this is a very niche area and very limited people are there but we wanted that the young lawyers should understand as well as the agriculturalist this area because I don't think you will find such topic as such on the YouTube or on the Facebook we wanted that everybody should be enraged and you have also been kind enough thank you on behalf of all those participants who have been watching us live on the Facebook YouTube and on this platform we are obliged that you are helping us to support this system of knowledge sharing so thank you thank you sir


Welcome to Digital Asset News to get top stories in crypto. They have a big amount of bite-sized pieces today. There's like a thumbnail suggests there is some fake news and even I got caught up in it. So we're going to talk about some fake news and it looks like maybe potentially a little pump and dump. We'll take a look at what's going on. But this was all about Ripple and the XRP case with the SEC. We're also going to take a look at Drone Power giving us a little bit of clarity about what the United States wants to do as far as crypto and digital assets. We're going to take a look at Plan B's stock to flow or more importantly some of this technical analysis about where things are going for not just this month but the next two months and it's pretty exciting. Also take a look at Volcano Power and Bitcoin being used in El Salvador. And lastly, I think this is the most important story honestly is Visa partnering up with Ethereum. So we'll get to all those things. But first, let's take a look at what's going on the market. So today it is Friday. It is late. A lot of things going on.  But hey, total market cap. Look at that busting through 2.1 almost 2.2 trillion.  We just call it a Friday here in Cryptoville. If you're from traditional markets, welcome. This would be crazy to you, but it's really not for us. Anyhow, Bitcoin daily sentiment 59 out of 100 and we're using trade the chain for sentiment analysis. Coins up across the board. I mean, let's just be honest. It's just huge. So Bitcoin, 25 hour change, 11% Ethereum, 11%. Cardano, 7%, 10%. The big winner, Solana at 16%. 13% for Polkadot, 10% for Uniswap. Look, if you bought the dips like I have, it's a pretty good day. Also, look at, man, Axie Infinity just crushing it. 52% for the day. Sweet Marion Joseph, that is huge. Anyhow, that's going on the market. I mean, it's a great day. These are the days we live for and I think the best is yet to come. I'm going to tell you why. So first of all, before I get into all that, let's take a look at the fake story of the day and this one got me. This one actually, I was sent this article by a friend. It was in Yahoo News. And Yahoo News had actually picked up from another publication and I had actually tweeted this out that the SEC and Ripple had settled their case and I was like, wow, this is pretty good. But then within like 10 minutes, this is what's great about Twitter because in YouTube, I can put this video out but it's very slow. On Twitter, everything happens just like that and never was like, this is not real. This is fake. And I was like, oh, I took it down immediately and didn't spread any kind of good will which could have led to a pump and dump. And this is what's going on. And before I go on, let's just make sure. So XRP right now is up a whopping, gosh, what do we got? 9% for XRP for 24 hours.  So this is what we got. So in this one, there was a press release posted on news platform, Access Wire. That was the first one. Say the SEC had dropped its charges against the company. The too good to be true hoax was syndicated by Yahoo Finance. That's where I saw it and then made the rounds on social media and I stopped that immediately as fast as I could because I'm like, oh my God, I got hoodwinked. I got bamboozled. And this is from Ripple. They say we are working to get it taken down but totally false and not sent by us. And this is from DAI, Digital Asset Investor, big XRP fan. He sent a tweet out to the lawyer of Ripple. Said, hey man, is this real? He said, no, it's fake. And that's pretty much it. And I will say it's pretty disappointing that these publications pick it up so fast and what happens. But this time worked out okay. However, a bogus announcement about Walmart partnering with Litecoin made the price of the altcoin jump roughly 30% on September 13th. So when people go, just go to the source, just go to the source, go to the source, go to the official channels. Well, look at this. After news was picked up by several mainstream media outlets and even the official Litecoin account on Twitter was like, yeah, we're working with Walmart. So yeah, invest in us and that's what happened. So I think what happened here, someone got the better of us and said, hey, this is actually being stopped and this is really market manipulation that it's finest. Now we would rather market manipulation go to the top than go down, but it is a spate of spate. What's called spate is paid. It's marketing manipulation and shouldn't be done. So on this one, hopefully we can stop the flow of misinformation and go from there. Anyhow, let me just think about that in the comment section. Let's move on to our next piece about, and this is pretty cool, Fed Clarity. And what we got here, this was a little snippet from Congressman Ted Budd. Ted Budd was interviewing Jerome Powell, the Fed Chairman. And I'm saying, listen to it, 37 seconds, check this out. As a matter of policy, is it your intention to ban or limit the use of cryptocurrencies like we're seeing in China? No, and I immediately realized I had spoken there. I didn't mean to take the word cryptocurrency out of that sense and I would say fairly widely understood that central bank digital currencies could perform some of the, could make, But no intention to ban, less, no intention to ban it. No intention to ban it, but the stable coins are like money market funds, they're like bank deposits, but they're, to some extent, outside the regulatory perimeter and it's appropriate that they be regulated, same activity, same regulation. So yeah, great news. I mean, this is exactly what we want to hear. The thing is though is that, I have to remember that the Federal Reserve is about as federal as federal express. They are not a part of the government. They are another entity outside. However, they do set monetary policy. And so when we talk about the Fed has no intention to ban cryptocurrencies, it's not like the Fed can ban anything. They can't, they would have to go through the legal process. It would have to go to the high courts and so on and so forth. But it is reassuring to hear that Jerome Powell is saying, now we don't want to do that, but we do want to regulate central bank digital currencies because that really competes with the dollar and that's pretty much what it is. And that's fine. Look, I know people's not a very popular opinion. I think we should have a little bit of clarity. Worked out pretty well for the internet back in the 1990s. Allowed to flourish, gives people clarity. We can move on. So this I think is something that was desperately needed in this time of super Gensler getting out there and trying to say everything's a security. So let me know what you think about that in the comment section and let's move on to our next piece. And this was a good one because it shows us where things are going. And I always like to see what's happening. This is from Plan B, famous from Stock to Flow. And he talks about right here. He says, look, he goes, here's the numbers. And it says, these are the, he calls them floor prices, but this is the closing price. Now, some people say that's the lowest price in the month or it's the closing price in the month. And he adds closing price. That's what I got from it. And he says, look, August closing price is going to be 47K. September was 43K. Let's take a look at how he did. So here we have monthly candles and not the wicks. We don't really care about that, but the closing, right? The close was a bit 44, 43, 7, somewhere around there, 43, 8, somewhere around there. And then over here you had, so, sorry, it seemed to be 47, excuse me, so, because it was a green one. So this one, he's right, 47 and 43. So now his next targets, October, is he's looking at 63K. Okay, he's been right so far, November 98K, December 135K. Great, so when people here plan B, they automatically think this is the stock to flow. It's not, this is not the stock to flow. And he makes it very clear right here. He says to be clear. The worst-case floor model is not, I repeat, not based on stock to flow. It's based on price and on-chain data, like I wrote on the June 20 tweet. So, so great that August closed 47K and September is now around 43K, but it says nothing about stock to flow. His stock to flow is actually a little inaccurate. He says it should be 100,000 now. So what he's talking about is on-chain analysis and TA to get these things. And he's been right so far. So, right now, I think I will go with these numbers. I like these numbers. I don't know if 63K is gonna hit. He's been right so far, but that seems kind of far. I would say somewhere in the 50s. High 50s, mid 50s, I'd be happy with that. I think everybody else would be. So, the next thing about that in the comments section, let's move on to our second to last piece. So, this is interesting because there's this big hullabaloo about what's going on as far as like, ah, Bitcoin is not environmentally sensitive and it's using up too much power and blah, blah, blah. And the president of Al-Salera goes, oh yeah, hold my beer because what I'm gonna do is I'm gonna use volcanoes to run Bitcoin mining and he did it. I'll be darned. This is what's going on. So, I'm not gonna read it. I'm just gonna show you some of these great pictures. He goes, look, I've just instructed the president of LA LaGiosv, our state-owned geothermal electric company to put up a planned offer facilities for Bitcoin mining with very cheap, 100% clean, renewable, no emissions, energy from all volcanoes. This is going to evolve fast. And then also scrolling down, he says this, our engineers just informed me that they dug a new well that will provide approximately 95 megawatts of 100% clean, zero emissions, geothermal energy from all volcanoes. Sorry to design a full Bitcoin mining hub around it. What do you see coming out the well is pure water vapor, which will be energy. So these, let me correct myself. These are just the first steps. It hasn't been done yet, but these are things that are going, this is on the side where all the geothermal energy is coming from as far as the volcano. So it looks like they're going to go through with it. And then to me, I think this is a step in the right direction. Let's see if it all plays out. Anyhow, that is that about volcanoes at Bitcoin. And lastly, I wanna talk about Visa and Ethereum. I think this is probably one of the most interesting stories I've read about partnerships. So real quick, Visa working on interoperability platform for stablecoins. The channel will allow cryptos to be transferred between different blockchains with Visa being at the forefront. What is going on here? There's two snippets. The Universal Payments Channel, or UPC, aims to allow the cryptocurrencies to be transferred between different blockchain networks. The UPC tech can play an important role between private stablecoins and public CBDCs by providing permissioned access, that's a big word, permissioned access for whitelisted stablecoins to be interoperable with CBDCs. So that's great as far as like this article, but I wanna dig deeper into it because I'm like, what is really going on here? This is from Decrypt. And really what it is, it's a Layer 2 solution pretty much Universal Payments Channel. Project is still in its early stages, like everything else. And if you wanna take a look at what's going on as far as like crypto, current digital assets and the adoption level, just take a look at what's going on with Visa. Visa's one very older company that as far as just payments and that's about it. When you see what they're doing and how much money and time and manpower they're investing into crypto, you have to think to yourself, okay, this is gonna be around for a while if Visa is coming out full swing. And I mean, even Visa has bought up NFTs. I know it's just for one thing, not too much, but when they're working with these crypto companies, I mean, with Circle and USDC, where do you think things are going? They see the writing on the wall. They're like, we don't wanna be blockbustered. We're here for payments and crypto is here to take our lunch. Why don't we just, if you can't beat them, you might as well join them or at least partner up with them. I think that's what's going on. So in this situation, I'll just go down here. Layer two solutions, so if you don't know, projects the process of initial transactions on a separate layer from the underlying blockchain and uses the blockchain to finalize. So just like in El Salvador, it's not using Bitcoin, you're using Lightning Network, it's a layer two solution. All the transactions happen over there and then the actual blockchain finalizes the transactions. So you get two things. You can use, you get the user can actually enjoy, like it says here, the transaction speed while enjoying the tamper proof record of blockchain and the very hard level of hacking that it would take as far as 51%. But here's the big thing. This is the last sentence. As far as Visa goes, that says the proposed base layer for its universal payments channel is Ethereum. Now extrapolate that and think to yourself, how big will Ethereum be? I've been a big critic of Ethereum and their gas fees. And I think a lot of people also have but there's also a big critic of Bitcoin and those fees and they got those all with Lightning. So I think layer two solutions of MATIC and things like that can come about and just go, you know what? Yes, there are very high gas fees, but don't worry. We got a layer two solution and a layer three solution coming to the pipe. And guess what? We got Visa back in us.  So that is what's going on. And that is pretty much next to last. A little bonus real quick. I sent out this tweet a couple of days ago. I said, I'm going to start giving away tomato coin. And that is a real thing. It's built on Cardano blockchain. And I'm going to be giving away thousands and thousands. I need to, I need to give it out to more people. I already gave a ton out to everybody who stakes with DNews, with the DNews stake pool for Cardano. But for every live stream, I'm going to start giving away thousands, tens of thousands, I don't know, of tomato coin because it's just sitting there right now. And I want to just give it to people. So if you have a deadless or an Adelite or even a Yoroi wallet, you can come on over to any live stream on that. And I'll be giving away at random. I'm going to give away a bunch. And the first one I'm going to do it is with my friend, Jerry Hall. He's over there in Costa Rica. We're going to talk tonight about a video I did yesterday, about my lessons, learns and all the things that I wish I would have known back when I first started investing in cryptocurrency and how I would position myself now. So I'll be on Jerry Hall's show tonight. I will link that in the description whenever Jerry gets around and give me the link and then we'll go from there. So look, that is it for today. So if you stuck with me all the way to the end, first thanks, I appreciate it. If you like these types of videos, give it a thumbs up, give it a like. Also consider subscribing. Everything is time sensitive. So if you could subscribe, we do a video every single day to keep you up to date and you can make the best decision for your investments as far as crypto. Not financial advice, just financial opinion. And yeah, thanks so much for watching. I appreciate it and I'll see you on the next one.