ಈಈಈಈಈಈಈಈಈ ಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈouverಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈಈ and I have taken on-line course of data analytics, and I found it more easier than the assignments that are submitted earlier. As I am looking for a career in a data center, so I think this data analytics course will help me to achieve my career goals. , ఝలా సondsiyānd Priest ఇ వనంాన్చిలు perfume బరిన్. ఆర్క్ద౎ఉాలా క్త్దా� maw నోత్ . అప౔ఴేన్నో మన esf�త్ం స్డ్రంయెధత్ !وس runner పార్నాపాయాకించిండిందిందించిపార్నినిందిందిందింది. AUTA K David ఘానిల్ల్వి నివిన ఆగొద్లుఫిసిని, dilemma మెలు ద్వియా ఫి więks�ి పలరండహో మోవ్లి ! క undertakeబక మా� wereanna & nptl సంిలు కిని ఆదమిమి కabyrin! మానీఝన మ the questions in the examination were good all questions are very testing for the knowledge with accuracy so it is my part of examination I will be very happy to answer the questions, each and every question some questions are little bit difficult to understand so that's why overall the exam is good నితోలులి ,అసు ంొర్మై ఇదౌల్లి, దు నిదానాల్ లులు పార్ల్బు ప్కంికికుయస క్స్రికృరి ధారంర్లు నిస్రకంస్ముని మూర్లులు టిఆస్లుల ర్డ్నింివట్ం ర్షథడార్క్. పఠిందిటినుషి� the main aspect of this course is, we are going to learning some technical aspects of all the core-related subjects. Thank you so much for the organization NPTL organization. Thank you, thank you so much. My name is Babia and I am from VRC that the engineering college. The exam is quite well. I followed all the lectures and the questions are quite easy and it is similar to the questions which are from assignment. ఘ్రారంలిందాకేద్చాకెలోమినునులెను. మాడుందూదా, కేదుల్లింాటు. మైల్లంనులు, ఎప్పకోలులు. ఉల్లి, మారారులు. వాత్చనిక్కపోగార్ం. గావాసిపేసిం సామిందింథాధ్నం. వినిక్చిం, నాక్చిబెంకి. గ్నింకిక్టింలెందింక్బ. న్చింకిందిందికూ. And i could see that many questions which are there in assignments sheet was been more or less there in exam also. Its very useful for students to enhance their knowledge. Thank you. Hello. First, my name is Nitin. I am from K.L University working as an Assistant Professor in Mechanical department. First, I would like to thank to B. Welcome to Summan sir, and49 for their excellent performances during the course. రార్నాత్లుల్లు ఌతార్నరినినిసిలులూచాస్స్ని. పనిటేకాసిర్. ప్నికారంత్రిసినివరంగలని. ని పెఀలెలులరులమికారింధదలి. we nan got the exam, health research fundamentals. The questions in the exam mostly from the assignments and some of the questions are relevant to the assignments. Some of the questions are questions from the basic videos. Questions from the basic videos. And it is very useful for us in promoting the research in our college. And it is very unique program which I have found. .. but, to take the performance as much as well. Thank you. Yeah fine. This is Chaitanya and I am from V.E.R.Siddhartha College of Engineering. So I generally taking the Python course as my elective, so such a way that it provides a platform for every student to learn something through other sources. It is also very different from the college interactive of you so that it is easy to understand and the way of... so we had to consider various discussions. We thought it would be an programming test instead of multiple choice questions. However the contents what was delivered during the session helped us to take up this exam in a need way. We expect more number of courses coming ahead in the coming days. I'll be very happy to be a part of it, thank you and I'll see you in the next. సిన్టర్రటిచార్పిస్రి వార్లి౸ిసి codes ఇర్సికోవియడరాచారిటార్పటి . మిం లురం ఊరపెఁద్రందారందు వారందాకోదితిలులుండ్దిం. చలాతందినుల్వరం మరికోంతారందు మమాెనי׍దిందినం. నిందారందింది. but if it is blank answer we cannot check whether my answer is correct or not so for blank answer also if the mark is same then it will be good for me that is the problem I have faced I am Jay Apparau working as a student professor in SRK Institute of Technology I came here to appear for theory of competition NPTEL exam in theory of competition the video lectures are a little bit depth it is okay subject wise it is okay but coming to the questions so the questions asked in assignment and the explanation given in the video lectures it is not enough I think so and regarding the exam also in the exam they didn't give any questions which are covered in assignments so entirely they gave different questions and also in the questions they are giving check boxes even if one or two correct answers are there they are not considering exactly they want the answers so it is a little bit difficult for us to trace out the answers thank you my name is Manoj Kumar I am from HSCL Hindustan Steelworks Construction Limited appointed as a site engineer even now working I am doing this course I have done this and project planning and control it is a good course we do gain lots of knowledge in this basically in planning perspective we are gaining a lot of knowledge it is very useful in professional field because I too want to go for the quantity survey and the planning itself still now I am basically doing the quantity survey in my company and it will be very useful in my company itself I don't think any suggestion is required because it is competitive in the whole world I think so we are gaining lots of knowledge in this hopefully India will develop more so I am Dr. Anusha I have taken the biostatistics and design of experiment course and the professor has explained a lot of it we definitely increased the knowledge regarding the biostatistics and the lectures helped us a lot and regarding the assignments the lectures helped to solve the assignments and the basic suggestion I want to give this course is if the biostatistics and design of experiments are two separate courses the professor may have taken adequate time to make us more clear and previously I have took the health research fundamentals and in future also I want to continue these courses so I am a medical person so I want to conduct research if I want to conduct I want to know the basics that's why I have first taken the health research fundamentals and now the biostatistics so I am Sri Lekha from third year BTEC from PVP Siddhartha college I have attempted the exam in database I actually was afraid before coming to the exam hall as I couldn't complete some two to three modules I just referred the slides I thought I couldn't understand but coming to the assembling of the exam I could understand most of the questions except two or three which are ambiguous yes we have already completed this database in our second year and I have attempted in third year first exam and it was helpful in revising and going into the deep of the concepts yes there is lot of difference college course just consists of five units and a stipulated syllabus where we could go to the deep in NPTL modules I am Dr. Laanya and I have taken biostatistics and design of experiments course and we found this course as well as taking exam very useful for our future endeavors we will take as we are taking ICMR STS projects in guiding our students we need to learn statistics and the basic part of the statistics is nicely dealt in the chapters which they have taken in and assignments were also very useful because they made us how to deal with the data that is provided for every research that we are doing they were very regularly giving answers to what we were posing in the forums only thing is in biostatistics we felt that answers were not properly given certain times we had to post it again we have to get the answers and meanwhile we will get the report for our marks and then we feel a little low when we see lower marks after that they used to correct the answers and moreover we didn't find explanations for the questions that were given they were giving just hints rather than hints we need to have explanation of that answers assignment answers should be given in detail in form rather than just giving hints hello my name is Paun Kumar I am a Vishnu engineering college for women I am working in beam over I am already the second time exam rider second exam is first exam software testing and research method always compared with the first attempt first time with NPTEL course and this was very good second time the environment UI everything is good I am feeling very happy for attending the exam thank you my name is Sriram I am studying in SRK IIT of Vijayawada this is a nice program to encourage youth nowadays we are losing our practical knowledge about any course we are learning so we have to follow the NPTEL which is available on internet and we have to interact with you because in India IIT's and NIT's are the top most universities which are giving lot of knowledge to the students so this is a nice program and I am glad to participate in this course thanks I am Suresh from Lakrat Dibali college of engineering I am working as a student professor in IT department the NPTEL course is very good and getting the knowledge from others it is basically IIT professors it is very useful to us and teach to the students giving some more suggestions to our students to write these exams and get more knowledge on these ones thank you I am Dr. Srinivas Rao from Pirmani Siddhartha institute of medical sciences I have this is my second time I am taking an NPTEL exam first time I did the fundamentals of medical research and this time I did biostatistics and design of experiments so first time was very nice although quality also was good the examination also was very nice this time the videos were a little tough because biostatistics I feel is a tough subject and the material given also was not sufficient this time last time it was very good the center and all other things were satisfactory last time it was held in engineering college the facilities were better there so I am interested in taking more courses in this in NPTEL they are doing a really good job some questions were asked from the assignment questions were good the examination was good and really thought provoking so assignment questions also were asked and general questions were asked so that it tested the fundamentals that we know the questioning was very good thank you we are Siddhartha engineering college we just felt very happy to write the exam and the course is very nice and I think we can improve our skills by doing like these courses I am Sunaina and I am from Siddhartha engineering college Vijayawada course was very much helpful for us and the questions which were given in the examination was also relevant to the course so this was very much helpful for us this course was suggested to us by our faculty members it was because of them we had to do this course so my name is Karthik I am from Lakratibali college of engineering Vijayawada so I appeared for examination in the morning as well as in the afternoon session the course material is very good so actually I am lagging behind in the morning subject which is nature and properties of materials now I gained sufficient knowledge of the subject I am thankful to the team of NPTEL for putting a lot of efforts to make this happen this is the fifth time I have experienced this examination I wrote four examinations earlier yet day by day improvement is consistent in this particular field as well as in this particular course providing new courses every time will always help us to enrich our knowledge as a person working in a college I always insist students to take this examination so that they can improve themselves and I would like to thank all the team people who worked for this and made this a huge success and locating the examination centers the modules they provided the examination questions that appeared in the exam are all relevant I always suggest my students to enroll in this course maybe few of my students are waiting outside just they have taken the examination so I always prefer this course to the students courses regarding software courses regarding new advanced techniques in engineering to our branch of mechanical that always it us, thank you Myself Dr. Yesri Krishna from Srivish engineering college for women I am working in the department of information technology as an associate professor I am very much interested in C language that is the reason I subscribe are registered for this course and this course is went well the faculty also thought well and the programming assignments and all everything is good and because nowadays most of the competitions are done in online so that same platform that are provided by using an NPTEL and they tell very interesting points in some of the specific subject also and coming to the exam it is very interesting because it is not a purely object oriented purely multiple choice questions it have some answers that you have to write that something went blank and it is somewhat difficult for me also because I thought it is very most of them are multiple choices but some of them are filling the blanks and I think somewhat interesting for me to write an exam for this one I thought I will complete them in 1 hour but it takes more than 2 hours for me to answer all the questions I am looking forward to see my result how it is happening and all Thank you I am Malika Ajna faculty so I attended this examination this is the first time I located this center in a very white man because we are having Google map and everything I expected too much depth in the question paper but the question paper is so easy and I comfortably complete the examination even though I am suffering from the fever I didn't face any type of problem but I am expecting any type of air conditioning system in AC rooms Thank you very much I will suggest this course even though because I am a specialised person for this subject I face very comfortable while writing the examination but when the students are facing this examination they may not be able to complete that exam as comfortable as possible so I am requesting the students as well as the remaining faculty members also please enroll the course and complete the course as good as possible I can't say this for this we depend upon the questions of the examiner so I face three hours is sufficient for this examination and two and half hours also is sufficient very few questions are asked from the assignment part very few one or two maximum of less than five questions only remaining all are based upon that lecturers they give the questions the question depth also little bit not too much or not too easy so as a faculty member I use this for further as per my NAC or NPA or some other college orientation and this certificate is very useful for me for showing my improving the academic calendar Thank you very much My name is Srinu Sreddy I am working as a student professor in Lakrati Baladi College of Engineering which is located at Vijayawada so I am from master of computer application department the intention of NPTEL so team is good so all the students are actively participating in this examination so the contents and resources provided by the NPTEL portal is good so we utilize them and we are here for writing exam so the exam is also good definitely it will helpful to the student and the faculty for enhancing their skills so I am very glad and I am appreciating your teamwork yeah I am following all the video lectures regularly so from video lectures we can get the new kind of information so regularly we teaching students so we get different questions from the students so those questions also we can address by using these video lectures and these kind of exams yes I am K Bhavana assistant professor P.P. Siddhartha institute of technology so I had a very good experience enrolling in this course my college has the NPTEL local chapter so through this way I knew the NPTEL course and it helped me a lot already I am teaching this subject and yes at this level students it is high thing to do the problems what the professors are telling definitely it is very useful to the students content which they are delivered through the videos is very helpful at the starting we felt a little bit difficult but later on the videos are related to the assignments which they have given so if you are doing the assignments definitely we can score good marks in the exam it is very helpful of course we will go through 3-4 prescribed books when we are teaching beyond the syllabus what is given in the college then that we can learn from this course we can keenly learn each and every topic of subject I am Anil Kumar from Lakhredi Balidi College of Engineering our college management our principals are encouraged us to write NPTEL exam and in this regard we came to know about NPTEL prior to that I am sorry to say I did not know it but once I reached to this NPTEL I found it very good to I found it very good to do these exercises and assignments and everything the lectures are good but the delivery of the content in the lectures is not up to the level it is not definitely I can say it is not at the level of IIT Madras it is far far below to some ordinary colleges even there are so many mistakes in the contents of the delivery but coming to the examination point of view the examination the way they conducted it is very good it is marvelous I am faculty of mathematics in engineering college it definitely improves my learning it takes me some to the next levels because as long as I am working in a college probably I feel myself completely equipped with everything but once when we reached to some course we will come to know about our shortcomings racing to this course it definitely helps to improve their knowledge first of all very good evening to one and all my name is Dr.P.S.V. Srinabhabu I am a assistant professor in engineering college then these NPTEL courses are very useful in terms of knowledge teachers too in terms of NPTEL courses there is no doubt about this then in terms of the assignments we have discussed each one discussing discussing increasing the research then in terms of knowledge we are also doing research after watching this there are a lot of people who are interested in this research they are using this if not the preparation of the kids I think it is not shown in the test why the test the morning between two days two tests were done first non-linear programming the numerical methods usually to solve the problems both of them will take some time to get the work done otherwise the kids are coming as soon as they write or they are feeling difficult but as soon as we give them 3 hours they will come out in an hour they will come out in an hour so we will have 3 hours to do the exams in the next phase I will learn the knowledge I have and will use it to the students then when we saw the online we thought we will get the work done thank you hello I am Dr. Vijay Lakshmi I am from Pirmani Siddhartha Medical College in Ganavaram I am a lecturer in biochemistry I am right now pursuing my PhD so I find this very useful for me because statistics and both the design of experiments have taken from NPTEL and I found that it's very useful only thing is there was some problem here like they said that attachments will open in the computer itself but that attachment didn't open and we had to get a hard copy that was one second thing is the shift option in the computer itself did not work that was again another problem that I had but otherwise on the whole everyone was quite friendly and cooperative so there was no problem at all I think a few of them have already come for that research methodology which is there in NPTEL we have told them some of them have come today they have appeared for that same exam because in our college a lot of importance is given to research so many more people will definitely come because we have spread the word in our college so they will definitely keep coming through one more faculty who is a pediatrician he is the one who completed the course and then he told us about it so we started we followed the video lectures and all that but compared to research methodology we didn't like this statistics course research methodology they have told elaborately that was by ICMR this one there is little difficulty in explaining and I think there was no repetition some of the homework which they had given that was also not very clear and especially the corrections even a single decimal which we do it manually that also because it is a computerized it is coming wrong that is also another problem which we faced in the discussion forum and or we ask questions in the discussion forum thank you okay the course is very good and it will give brief discussion number of the refrigeration and air conditioning unit and we are very as a faculty we are learning very in a practical way okay the videos are based upon the practical application of the refrigeration and air conditioning and it is also used to improve the efficiencies it is used to decrease the environmental pollution which is global warming effect due to the CFC gases etc by following the video lectures only we will get the good marks because the video lectures are very clear and it is very superb its explanation is very superb so by doing by following the video lectures and doing the assignments we will be able to we will be able to by following the video lectures and doing the assignments we will be very efficient I am from Lakrat Ibalredi college and I have written basic electrical circuits and I think so it was very easy and those are basics just I want to feedback to the NPTLE we need a little bit problematic part more they are saying just 3 part and problematic part is very less I think so they should improve it and its my opinion generally it is very useful and we are understanding concepts very easily but problematic part is a little bit different it was a time taking process and we need somewhat shortcuts like for preparation of gate and somewhat depth thats what I need there is a lot of difference between those two in our college they just say about introduction part but here they will analyze somewhat more they will go somewhat depth thats it so I am Dr. Srikanth professor of physiology I have taken this cognition and emotion course everything regarding the course is good except the pdfs were not provided exam quality exam questions were nice and all the course you have done already health research biostatistics all the course is very much interesting thank you my name is Murali I am a student professor Vijayan store technology for women and working in ac department and the center facilities are very good and the examination pattern also very good and I am writing in that technical english for engineers actually the exam pattern and the facilities provided by the NPTL providers are very useful for all the students and people who are currently working as a faculty member and at the same time students who are forcing their b-techs or m-tech or phd whatever it may be and is very useful for one and all actually I am sensitive to all of my students actually and some of the students are also in the same center along with the faculty members actually we don't have any center in our college actually within short span of time we launch the center in our college and the NPTL excellence center in our college actually lectures are very good lectures at the same time they provide a timely manner all the doubts are clarified within short span of time and they maintain a predefined group for these what we call as questions and the exam pattern and the video lectures are very good even the pdf files available for people who are missing that video lecture and read the data this is Lavanya coming from Lakradi Baladi college of engineering Mai Lavaram and the course is very informatic and I am actually a faculty member even though I am a faculty member I am very much interested to take these kind of courses which helps us to improve our knowledge skills and also improved a teaching ability course and the exam pattern is also good and conducting assignment is also very good and we expecting I think I am I am actually taking this time introduction to machine learning last time I just taken a python programming so there they conducted programming assignment and for this kind of machine learning if they support some programming assignment kind of exam as a prior it will be very helpful for us thank you thank you for giving this opportunity my name is Mahesh I am from VR Siddhadha I am studying CSE for third year my college has encouraged me to join the course that is why I have come here and when the exam comes there is always something special like NPTL, video courses how human compiler would be I did not come for certificate actually I learnt how to pattern in LIIT first of all in LIIT we missed the seats so we used their faculty so it is a great advantage we know how they tell what is different for us how their way of teaching obviously it is very good to join every teacher should tell so when this video comes maximum they will cover main points we should get the skim by in the subject so self-learning is very good my name is Babya and I am from PVPS Prasadvi Patilur Siddhadha institution and I attended for the technical English exam and I felt it not much difficult and at the same time not very easy experience is very good and I thought of making this exams more and more so that I can gain the knowledge and I can get the experience I suggest my friends to enrol this exam so that we can understand and we can also know what are level in this national wide examinations I suggest them to attend the exams faculty also helps us in this and if we go and ask the doubts they will help us a lot


Let's get started today. The first thing that we have to do actually, so one of your fellow students wanted to invite you to a certificate of authority or some kind of scheme to assist you in homework two, part three, they'll explain in a second. But before we do that, know that them doing this does not mean that I endorse or have reviewed or otherwise am placing my trust or any endorsement on what they're doing. And so, since I'm giving these students this opportunity, if anybody else would like to come up with something similar for whatever reasons they see fit, you can definitely have time to advertise your, it's called a scheme. I like schemes, schemes are your general, your scheme on Tuesday. So just come up to me at the beginning of class and you can make this happen. So, you want to use the mic that way. So now that our scheme has been kind of introduced, I'd like to mention an opportunity that we might have thought. So, Ken and I were talking about Web of Trust over the weekend and just thought wouldn't it be nice to have a list of people in the class and just how that could, how we get that, how we know to trust it. And we thought, well, why don't we actually, we put our heads together, we had a little bit of a problem that we actually drafted up a charter, we have some new policies. We said we should, as a community, provide the list. So basically, we have a thing called key confidence. We're saying that after class, we should have a bunch of us to get together, just kind of do a public key signing. And also, you'll be able to get here about one thing, let's get access to the list. And just as a community, we can kind of all build a list of known trusted keys. All the list would be able to do would be give you the name of the person in the class, you need two forms of identification that we'll be checking. That way we know that you're real from this class, an ASU ID, and a government ID. And that way, when someone else sends you an email in the future and says, hey, sign my key, and you go, I don't know if this person's in the class, you can look up where you have read access to a list on Google Drive of authorized people. Or at the very least, we get 20 people up there and now we can get our 20 keys signed and that's 50%. So it's kind of in our hands if we want to create a little authority of ourselves. But anyway, so we have a charter, we have policies drafted up, I'd love to show them to you after class. We're going to hopefully get one of those up there or maybe on the stairs. We'll see you a little bit. Oh, the third thing we need is social security and a bank account. So this is a very good opportunity in learning how to trust or learning how to distrust or learning how to verify and trust people. Cool. Any questions on not that specifically, but homework's pretty straightforward, we're getting all the things worked out, should be good. I would highly recommend you start generating your keys and doing that now rather than the day before the assignments do. I can already envision a mass amount of emails flying about. Verifying trust in a short timeframe is always difficult. Cool. So we've finished talking about cryptography. So we've covered the, I mean, I guess I should say we've just scratched really the basics of cryptography, right? We didn't, we've learned about different types and what we use cryptography for, but we didn't really get super deep into the weeds there and that's deliberately we will not be doing that. Because this is an overview class and not a curriculum class. So the next topic we're going to talk about, so now that we've studied cryptography, we're going to actually circle BASH and study authentication. So the first question I have for you, what's the difference between authentication and authorization? Authentication is you as like letting me know, I'm saying I'm Richard and is am I Richard? I claim to be Richard, that's authenticated, authentication, authorization is like the level of privilege that I have, right? Am I authorized to view this class? Right. So authorization would be basically everything we looked at and studied in access control, right? What can a person do? Authentication is how are you actually, how do you verify that this, essentially this person is who they say they are or this person says they are who they are on this website or on this system. So I think it's like authentication is who are you, right? Trying to prove who you are. And then authorization is what can you do, right? So it's one of these tricky things. It's because we talk about this slightly backwards because in order to know what you can do, I first need to know who you are, right? But to get the authorization, we need to do crypto stuff and I think so that's why I organize it that way. Anyways, so the idea is, and this is kind of circling back, we reuse a lot of these terms in the authorization and access control. So the idea is we have, there's a principle, so there is some unique entity and the identity specifies that principle and is an internal representation of an entity. So you would be the principle, the identity would be let's say your account on the submission server, right? That name is tied to your specific identity or your entity. And then a subject acts on behalf of identity, we talked about this process, a process usually runs with a permission to the user. And finally, so using this authentication really is a little bit more formally binding some identity to some subject. So we can say that yes, this person is associated with this login information. So how do we do this? How do we do this in the real world? How do you know, and this gets back to kind of identity is how do you actually know who people are, who they say they are? How do you know that people are who they say they are? People have IDs. People have IDs, so what's that? Grab his license, school ID, some just a normal. So what does it have on that though? So how do you actually use that to try to verify that a person is who they say they are? Some kind of issuing authority. Does what? Not super, I mean, what's on an ID card that you look at? A picture and a name? What else do you look at? I just hand you a piece of cardboard paper where I pasted a photo and I've written my name on it. Is that an ID? What's that? It depends on the institution. So what actually are you trying to validate there? I mean, is it just the fact that there's a picture and a name there? So one thing you're doing in any case is you're trying to see does this picture, picture match you, right?  There's also a third party that has verified more information about you and issued the ID so that you can generally assume it's an ID. Right, so then there's, so the reason why we use some ID rather than just a random piece of cardboard or paper, right? Is the fact that we trust that some other entity has done this verification process of identifying your, you, the person, your, I don't know, what you look like with your name. What else? I'm just gonna, like, say that it kind of depends on if it's other people vouching for you. It's like an American passport. It's like the Secretary of State says, well, this is who it is, not a British passport. It's like, it's just different entities vouching for you with different levels. Interesting. So how do you get your driver's license or your ID? What do you need? Where should we get? Yeah, often another form of ID. It kind of depends if you may look this up at some point. Okay. So, okay. So you can verify that somebody is who they say they are based on, let's say, a photo ID.  How would you know that it's me? So I have to do that, which has one. I don't know that. I have to take my fingerprints and they'll be through a card. So how can you verify that, though? Well, let's say you wanted to use my fingerprints. So how would you verify me, the same person? I don't care color and stuff. Nothing too wild has gone on. You can generally verify one or two other aspects of the person. So you mean, so, okay. So you're talking about not necessarily fingerprint, but back to the ID case. Well, I wasn't the question, how do you, if you grow out your hair and grow a beard, how do you tell it's still you? Yes. Well, on this data ID, you have approximate height and also approximate hair color. So you should use a couple other aspects plus the possession of the ID, which you know wasn't stolen, but it might be. Right. So yeah, so, okay. It's interesting. So there could be other metadata on this card that maybe helps us try to identify even if the picture doesn't match 100%. Let's say, yeah, as a, I mean, common what Mark under tactic is to then ask the date of birth or issue date or so it will require you to regurgitate some information from the ID. From the card that they just need. The tactic. No, because that's why I think issue dates the one, but I was like, I don't know. I never know my issue dates. So I had never asked that because I was like, no, sir.  Right. For somebody like comes back after 10 years. They don't have an ID or anything. I would you be able to verify that it's actually them. How would you verify me if I show that that I claim to be Adam. I don't have any documents. I'm all disfigured or my face and we can start to accept an accident whatever they use. So you need to like use like, you basically, you couldn't like, you couldn't probably unless you have like, maybe like fingerprints of like the government database, but otherwise like. Your friends got burned off in the accident. Yeah. So otherwise here until like, try and just find like the ponderance and evidence. So like, I don't know, like if you could like name some facts about like your childhood or whatever, like it basically like check your story lines up with. Okay. So what would that, so you have your thoughts over here. Oh, just DNA maybe. Interesting DNA. Yeah. I was thinking the same thing as him, like a question, like a security question to have online. Yeah. So what is that actually trying to prove that you know something about this? You have some information that only you know that you're so. So what kind of, what would you ask? Do you ask me what my favorite college football team is? Why or why not? Questions that are verifiable with the answers have been established before. Very viable. So that somebody can actually verify that. So that somebody has to be able to say whether that was a correct answer or not. Yeah. And like anything like DNA, you would have had to like submit your DNA prior to this theory. Yeah. And or you would have had to like, if there are other questions that can't be verified with your own means. Right. Yeah. So that's, yeah. So those are definitely good points, right? So you need to have actually had DNA either stored somewhere or it had to have some easily recoverable place that they can actually extract some usable DNA from an expert. So I don't know all these places where they could or could not extract that from. And then all these security questions is kind of what we think of them now. But even, you know, that's kind of just quizzing you on yourself. So, yeah. Why? I mean what are we trying to authorize you to work for the DOD or are we trying to give you a driver's license or anything? I mean because there's, depending on the context, depends on how sure or not sure you want to, I mean there's no way to be absolutely sure. I could take my friend's driver's license that I look kind of like and go to the DMV and get a new driver's license issue in his name and send to my address. There's no guarantee there. Yeah. Yeah. Two comments. I had an acquaintance in college that would buy booze with your sister's driver's license all the time. She was about 21. And we don't even have to go to the extreme of the soap opera. I'm sure that there are lots of transient or people currently experiencing homelessness maybe have varying degrees of paranoid schizophrenia that live out of a duffel bag and don't have identification. Yeah. And when you think about that problem where they need food, they need money, they need a job, how do you get a job? You have to file an I-9 to pay taxes and you have to have identification to do that. So there are constantly people even in this city and this town, you can probably see them on the street, that are in this state of I have no identification and I think I know my name and I need to collect my social security that I qualify for because I have a mental disability and they can't because they have no identification. So it's a very real problem. Definitely. Yeah. So that's a great point. Yeah. I'm going to continue to not all Americans have social security problems. So not everyone has a social security number? I think... It's the Amish or pre-national and whatnot but it used to be the Amish, the New York Police Department and the New York Firefighters and remember there are unions that said we don't want social security numbers and it's just not, especially with this percent we don't want to deal with that because we don't believe in things like that. Yeah. So yeah, this is definitely fraught with all kinds of issues. Let's go back to... I want to go back to the asking you something that you, let's say, knew in childhood or something, right? So if you ask me, what's my favorite... I would go back to the example college football team.  Right? So if you were to ask somebody who claimed to be me, hey, what's your favorite college, collegiate football team? If they're an imposter, what would they probably say? I would first guess UC Santa Barbara. They don't have a football team, so... Then I would guess whoever won the district championship with the year that you graduated around there and then probably Google what the most popular team was that would be my third guess. You're forgetting, like... So you don't have football class? Yeah, ASU, right? Because I don't have any other teams. You just weren't the actual none. Yeah, I work here, but... You could hear what you're saying, none. You could say none? So you could say I don't? Yeah, you could... Or you could try to learn more about me. You could stalk me on different social networks and try to figure that out beforehand before trying to be me. You could try to hack into my Gmail or my Dropbox to learn more information about me in order to get those questions and those answers. These are all really good. So... Now let's take it to... kind of the computer realm. So when you're actually... So we'll... Not to pick on any site in particular, so we'll use the submission site because I made it in my... So how does that submission site verify you? How does it actually tie that account back to you, the person? It asks you for an ASU ID number? It asks you for an ASU ID number before you register, right? So those are... This isn't a foolproof system. Those are not public knowledge and they are considered sensitive information, so it's... acceptable issue to use that. And nobody's complaining that somebody else signed up as them, so it's also fine. So they also have to be unique. You would be able to tell if somebody else signed up with yours. So after the ASU ID, so that ties what to what? The username to the individual. The username to... The ASU's record of the individual. ASU's record of the individual, yeah. What I would say is you can't really... even tie it back, like who actually verified it. You could be assuming somebody's identity or whatever. It's all kind of crazy. So that ties there and with there.  And now you go to login again because you need to submit homework too. But how does the website know that it's you? Does it remember you and go, hey, good to see you? I remember you from two months ago when you first signed in. Cool, but what does it do? I mean, what is the server doing? Right? So hey, most of the time I can't actually... Honestly, do not remember how long the session's last, but it should log you out of that interval. Is that correct? No. Okay, it didn't. Okay, it's assuming you've logged out for security purposes and you go to the website or you're on a different computer. Let's say that it's on a different computer. Have you proved to the site that you are that user account? Input your username and password, which does what? Where did that password come from? When? When you created the account. So that password is a piece of information that links that account number to you, the person who created the account. Right? So you have these two pieces of information. The password links you, links the person who created the account to the account, and then the ASUID links that account with your ASU information. Right? So... And actually, this is kind of similar in some way to what we talked about with using maybe something from the past. Right? So this... A password should be something that only you know. Right? You created that account.   And not somebody pretending to be you. So this is one of the main authentication mechanisms that we deal with now, which is essentially, so there's like four categories we'll talk about, very broadly what you know. So what do you know? So I can try to authenticate you based on what you know. So if I want to authenticate you as a student in the class, I would probably start, like we said, asking questions, right, interrogating you about what were the homeworks, what kind of things, what things have we talked about and try to see if you're actually in the class or you're just somebody pretending to say, yes, I am in this class, but you've never actually been to a class or watched any of the lectures. An ID card, something you know? It's something that you have that shows that you are... So if you've ever... That's not a good example. So yeah, so the second hand category is something that you possess, that you have, right? So this is the ID card, right? You can always lose your ID card, you can get issued new ID cards, but when you have this ID card, you can give that to somebody and they can try to authenticate that, yes, you are the name on this card and they'll do that through all the methods we talked about, right? Look at the picture, compare the picture with you, look at the other metadata on the card to try to compare that with the person they're talking to. They may quiz you questions about the card. They may even try to swipe the card to see what data is there or try to contact the card issuer to see if it's a valid card. They can try, which may get around the look-alike sister attack. They may ask you for other cards that you have that have the same name, right? So show me a credit card even if it doesn't have a picture with that same name on it, right? Which can then try to verify that, yeah, you're having, you're showing essentially multiple things that you possess to try to prove that you are this person, right? Yeah. But it depends on where the card is from too. Yep. Because like a school ID, you can't use it for like going to the airport. Absolutely. Why not? Just because it's, they can't verify that it's a source that can be trusted. Exactly. So yeah. And so that's definitely something when you think about when you're doing the verification, right?  That's how it goes back to the example of a cardboard ID card you make yourself, right? You can hand that to anybody, but whether they actually believe it or not is up to them, right? That's a good point. So our fingerprints, either of these two, or DNA, is DNA something that you know? Are your fingerprints something that you know? You can look at that, yes. I agree. Do you possess them? That's it, a trait. What was that? That's it, they're a trait. They're a trait? I think that's part of it. You don't really possess them in the part of you. Right. So, exactly. Yeah, so they're not necessarily something you possess. They're not the part that you can just lose. You can't go get a new set of fingerprints or new DNA, at least not yet. So, yeah, so the third category is essentially what you are and things like fingerprint stanners, facial recognition, what are we talking about? DNA or retina scanning, right? These are all things that are what you are. Voice recognition, I think, would probably follow that, too. So again, just like the previous example, let's say they match, does that mean that they definitely are that person? No? So let's think about voice, right? If you're authenticating somebody because you know their voice and somebody comes up to you and you can't see them or whatever, it's dark and they start speaking in my voice, would you know that that's definitely me? Why not? People can mimic other people's voices. They mimic other people's voices. You can record the voice. You can probably string together co-nearing sentences from everything I've said in my lectures on YouTube. You could probably take that and use that to create co-nearing sentences, which is not scary now that I think about it, but whatever. So yeah, what you know, what you possess, what you are, these are the three main categories of things we think about that go into authentication. There's a fourth one that's actually really interesting. And that's... So I'm trying to think of a good example to give you that. Okay, so... Is there a difference? I'm just thinking about like a CEO attack. So there's this... basically this type of fraud where people will either call or email a... usually like a CFO or somebody in the financial department organization and they will say, is the CEO, I just closed this deal, this $2 million deal with this other company, I need you, this is going to be huge for us, we're going to make us tons of money. I'm jumping out of play right now, but I need you to wire $2 million to this account so that we can close this deal otherwise our company's going to go under. And so they'll either call or they'll send an email. And so one of the things that would go in there, right, is now the person on the receiving end essentially has to try to authenticate this even phone call or something, right? So is it any difference, let's say it's exactly the same voice content if it's somebody in person talking with you versus on the phone? Let's use a different example. Yeah, okay, this is too difficult, sorry. Where you are. So I was trying to get like in person versus somebody who's calling you on a phone call from far away. I think another example would be maybe the caller ID is also tricky. So you would think of like a local like maybe it's the CEO's number that's calling you versus it's an external foreign phone call coming in. That would tell you that they're out of the country and the caller ID can be trivially spooked so this is not a good example. It'd be like giving your credit card number over the phone or like to somebody in person could be a good example. Yes, that is a good example. I'm a little more hesitant to give somebody a credit card over the phone than in person. That's a good example, that's great. And then also Visa and MasterCard and the credit card companies feel the same way because they will charge the merchants different overhead rates depending on whether they have in person credit cards swiping and or sign the credit card versus doing over the phone or just over internet transactions. Because they know that the fraud rate could be higher. So these are kind of basically the way we think about different types of authentication mechanisms and I think, can anybody come up with one that doesn't fit into one of these categories? Yeah, it's similar. I'd say though that from the website's perspective it doesn't care or know that you're using a password manager, right? All it knows that it gets the correct password back that it got back before so you're proving that you know somebody. You're using that website to prove to someone else Right, right. So you can prove that I'm the person who owns avenuepay.com because I can change the content of the home page to be whatever I want. That would be... Yeah, I think that it's kind of a combination there because you need some of what you know in order to access the site individually but yeah, that's an interesting one. I know there was something with keyboard rate like how fast you typed and how you typed the passwords in or the information in so that would be kind of something between what you know and none of those categories. It's informed. It's trying to get at what you are. So there's also some work in authenticating doing continuous authentication on your phone. So you take your phone, type in either your pin or use your fingerprint to log into your phone and then while you're using the phone it's actually keeping track of your gate and it's trained before on the past on your gate and so that that way somebody else steals your phone and uses it even while it's unlocked it can lock itself because it doesn't think it's actually various types of things. It's trying to get at what you are. It's trying to develop some unique signal just from you that... But it is tricky because yeah, you can always change your gate maybe but consciously but unconsciously you shouldn't be able to do that. Similarly with typing so you can measure the speed in between key presses on the keyboard and that's roughly ish unique. Anything else? So just like when we looked at crypto systems we're going to be thinking about authentication systems in kind of a more abstract manner and this will actually help us then think about how do you attack these what's actually the attacker's goal how does different mechanisms that we're going to talk about salting, hashing, whatever how does that actually change the authentication system how can we think about this in a more rigorous way Actfulus I wish this was a good acronym that would be cool I think we'll think around later Catholus probably not good to just shout out random acronyms it's not realising Okay so A is a set of some authentication information that proves the identity so this similarly to the let's say the plain text key space right this information maybe restricted in some way some systems will only let's say accept as a password lowercase characters or if you're setting up let's say a pin code for your credit card or your debit card that can only be alphanumeric so A, the set of authentication information is all four digit four digit pin codes numeric codes some authentication systems are super broken and no matter what long password you type in will only use the first eight characters so the space there the A's you could possibly use is a lot lower too C is the complementary information so this is some information that's stored by the system that's used to validate the authentication information for now we can think of it as you know someone got a DNA example so A would be your DNA and C would be anybody a biologist or in a bioprogram and taking this class and knows how much how much data is stored in like a DNA sample from one person I know it's a lot I think it's a lot it's not a small amount of information even when it's compressed because you only have whatever the four I can't remember what they are I've got my head for DNA anyways rather than storing all that information what I may want to do is only store a subset of that and check that against new samples that that subset matches I want to make sure that the subsets are relatively unique among people but the idea is that C like I could just store the entire DNA sequence and then match that with whoever comes to me who claims that they're you and wants a DNA test but so C and A could be the same or they can be different or C is a restricted set so F F is a set of functions that can turn A's into C's so in this DNA case it would be the function that selects which gene sequences I think is the correct term which sequences it actually stores I should not use the examples where I don't actually know what I'm talking about so I apologize to any biologists who are listening to this and so L then are functions that verify the identity so these are functions that take in A and C and return either true or false so this is like the login function or in our DNA case this would be the DNA testing lab that you give them some new A they do you give them C no C comes from the system right C is stored on the system so you only externally get A the system takes C the complementary information that you've stored and will tell you yes this is you or no it's not you and then I think you could make this a little bit more complicated especially in the case of DNA where you can have percentage matching so you could change that but for now we'll think of it in binary terms either true or false and S is really just for completeness these are ways that you can change either create a new A or create or alter your stored C so this will be changing your password or something like that any questions here so we'll go with a super simple password system so these are just examples so we'll see kind of how this framework works so passwords stored in plain text so what does that mean normal so the authentication system here would be what so what would be that A is A is a set so describe the set A it's a system-wide thing or it's a system-wide thing in the sense that what does the system allow not a specific instantiation of the system so A is not if we go back A here is not so these are all sets so A is the set of possible authentication information that proves an identity so you as a user select some little A in A and that is your authentication information you have a select in the case of DNA you have some A in this little A in this big A and that generates with F so F takes in that little A and produces some little C which is an element in C and that's your actual complementary information and then L can take A and C and return lowcase A and C and return either true or false so what would be the set A in this case alphanumeric A character alphanumeric cool so what about the set of complementary information are those the specific passwords that's the set of little Cs that have been chosen no that could be chosen could be chosen yes the same as A so it's any you're storing the password the most 8 digit alphanumerics then the sets obviously have to be the same cool so and maybe I think I just asked this so we're talking about this sense but couldn't we also talk about A in terms of like this system that we're talking about we haven't talked about a username but I would think that A well I would think that C as the information stored on the system would be a strict subset of A if the particular value is any of it would actually let you into the system why is C not the actual condensed box of a bag of passwords subset of A that's actually used so we're describing essentially all possible instantiation of a password system that uses plain text passwords that are 8 characters long alphanumeric so this is all possible instances so basically we're saying A is 1 through 8 alphanumeric C is exactly the same so those are what passwords and our complimentary information are drawn from if on the other hand we said we're using SHA-2 to D6 as our function as we'll see in a second passwords into complimentary information then C is not all alphanumeric characters it's actually limited to 256 byte numbers or whatever that is a hexadecimal I don't know but it's a hexadecimal hash so it just defines kind of the space there so it's not it's not talking about a specific system and say okay we have these complimentary information and these passwords and this is how we do this but it's nice because then we can use for instance f here is so f is a singleton set so there's only one element in that set that's f so it's the function f in this case the lowercase f that's the identity function so it's return whatever the argument is so this just maps every A to the exact same element in C and then L to test is very easy just do an equal so you test is the A that you're given equal to the C that you have and if so then the true and S is kind of in this case just whatever function is set or change the password and create new users in your system so this is a good model so let's think about what do we want from a authentication system C well I mean at a high level what do we actually want right we talked about what do we want the function we talked about we're talking specifically now about something that you know at least in this case right or I guess it doesn't matter but what do we actually want let's go back what do we want from this I mean this authentication system it's not a so access there's no access right so access implies access control yeah that actually authenticates the correct person that's trying to authenticate right so how did it do that using some of these terms making sure that the information right so definitely so that's so one thing we want is kind of as I think both of you are getting at a little bit is more just functionality right we want to see make sure that when I use the system if I provide the same A that I originally enrolled in the system or I created a user with that the that L will return true right if I come with the same A they should not dedicate me to the system but what if I have an L function that just always returns true which you laugh there's actually I'll try to find this bug but there's a bug in Dropbox I think it's probably back in the 8 or the 9 or something like that no it doesn't matter but they push some chains that cause all password checks return true so you can log in to anybody's Dropbox account just by putting a different email address and whatever you want for the password it would return true right we're just finding for a lot of people like using a password manager that automatically injects your password without knowing you would never know that it's actually doing this or even if you're just logging in correctly right you'd never know this I think somebody found it because I think it was live for like a half hour or a couple hours or something until somebody like that figured or knew they mistyped their password and then logged in and realized it still logged them in and so then they logged out and started testing and then told Dropbox who fixed it immediately so why don't we just turn this L function and say we'll always return true because it's still functional right if I come back with A and I can log in I'm in right L returns true I'm good purpose defeat the what? it defeats the purpose it defeats the what? what kind of purpose? the purpose of the system and everyone is authenticated all the time and everyone's happy right yeah so it's more about like a security or at least authentication requirement that we want to eliminate a group of people that don't have the necessary information correct so how would we then describe that requirement here in our system L is non-trivial no you could write something you could write an L that's complicated but that hasn't that still is not secure L could randomly say true or false right that's not trivial we want L to evaluate to true only when that specific A cross C happens right and to make sure that I don't think one to one is the right word but yeah so it's more about it's what we've been talking about we're trying to link we want to see basically what we want is when you register and you provide us with a lowercase a that later on you're providing us with that same lowercase a right but we don't actually always store A which is what the system says we're storing C so we're storing some transformation let's say of A to some other thing and so we check if those things match and then we usually say yes so then oh sorry L returns true if and only if the f of little A1 is equal to little c1 so if the we run the f function on a little a that it responds as output the corresponding little c yeah that's the way I would think about that there's a whole bunch of other ways to formulate that you could say like if if let's say some a that L returns true for some a and c1 then it must be the case that that a is equal to a1 right so that's saying like if you can get in with that same a that means that must have been the original a if it's anything else that you're violating that clause right if you could just type in gibberish and get in then that would violate that cool alright so does this get us what we want from those cases the two properties we just derived you literally gave us the the second one so functionality and security so is it the case of the system that if I walk in with an a an a1 or I create an account with a1 then I come back with that same a1 later will L return true is it the case that if somebody else comes with some a prime but it's not the same as my a1 will L return true tell me I just said it's not the a prime that isn't specifically not a anything any element that is not a a1 and no so it does it does satisfy our two basic requirements right it satisfies functionality and the basic let's say authentication requirement awesome cool look at one other one we did some of them and then we're going to talk about attacks and then we're going to circle back to think of why these are actually different methods but Unix kind of originally was one of the first systems to have this kind of standard hash function and the idea was so just like what we talked about so actually the set of all characters you could use in your password for Unix was eight characters or less it was not I think the only other restriction was no it was no null characters so the null byte was not acceptable but I believe everything else technically is look how you actually type those is interesting and so the idea here is rather than store the passwords in plain text we're going to run some hash function on the code and store that as our C so we actually are not storing the passwords themselves so we'll talk about that we have this ID concatenated with 11 character hash so why do we want to use a hash now that we know we're studying crypto or what is let's say this what does using a hash mean yes so assuming that we have a good as we talked about cryptographically secure hash function if you're able to take some little C in there you can't you shouldn't be able to go backwards to find that a right that's kind of the premise of hash functions right that was one of the main properties of hash we'll talk about what this ID does but you can basically think what they do is actually and this is why we have think about these things in terms of sets rather than f being a single function that does the hash right f is something that takes in and lowercase a and returns a C f they'll actually be 4096 different versions this two character hash ID will tell us which version to use L is the things that actually do the checking are the login function su any of these programs will try to verify your password and they basically will take the a run it through the algorithm f and then verify whether the f that the C that's stored is the same as the one that was generated from running on that new input and changing that is basically you have all kinds of ways to change your password so does this actually does this scheme satisfy the two requirements that we talked about does it satisfy the functionality of the requirement see if our other one our more basic case we said met the two requirements right so this is just restricted our basic basic case right I don't know that I would argue that way just because you never know just because something is based on something basic that you prove in or demonstrate yourself doesn't mean you didn't introduce changes that completely break things but we can use the same reasoning there right you can say okay if I have I register with some password a which is the strengthening characters or less the server will choose one of these 496 choose a function f will then generate a C which it will store and then later on if I get that same password a to the login program it will then look up C, C tells it what f to use and it will run the algorithm and check that that C matches the one that came out of running f again so it would say that yes these two match so that would verify that yes when I actually use it with the same password I get there so what if I put in a different password a1 that is not a yes, exactly so so why is it possible so it actually does fail this test that we just came up with is more or less that hash functions can map multiple passwords to the same it has to it's only 11 characters so you have a limited amount just what we talked about right a hash takes an infinite size space and shrinks it down to a fixed size output whether the thing I don't know for certain whether the set of all strings you can do in 8 characters there would be a collision but it probably will be at some point you can assume that there will be some so it actually fails this basic test case but how would you find so let's say I do find some 8 prime that hashes to that same value will server let me in that is not the original password it definitely will because all it does is take whatever I give it run it through the hash function and then compare that hashes to the same thing as the original A that actually doesn't matter that I don't know the original password what matters is that the hashes match and that's what the server uses does it use the C? does it use the 2-char hash ID of lookup which modified des is to use? yes yeah that's the only thing so it can use that later but you can think of it or you can just think of it as it stores the modified des is a hash it's not a symmetric the important thing here is it's a hash not that it's des they took that as something that can generate random stuff this was way back in the day we now have much better hash functions that we would use here not that it's modified weirdness of des so how many so let's say it's it doesn't actually say but let's say the hash is 11 bytes how many passwords would you have to try to find that new A prime that hashes of the same value 254 to the 8 yeah because uh for an 11 byte hash would we do the 11? oh sorry sorry I was thinking the 8 yeah with the hash so the end of the hash so it's 2-56 to the 11 which is a fairly large value but and so this is kind of then when you analyze the security of this you say okay so we know it's not it doesn't provide us with perfect security where the password definitely is but because we do know that an adversary could try 254 to the 11th tries to get something that hashes of that same hash of course the trick is it has to be something of A so that's another part there but they could find something so it doesn't provide this kind of perfect secrecy but we know if we're using a secure hash function that they would likely have to try all of these possibilities before they get a collision right they would have to do 2 to the or what we just said 254 to the 11th so at least then we know that's what the security of this is predicated on so if we use a 2 byte that would not be good because they could do that easily or even a 1 byte hash value it's highly likely that they'll find something very quickly so how this works kind of in practice is the subject says hey I want to sorry it uses an S this is the function to create a password that says hey I would like to register with the system I want the user account Alice and the password is password this is a bad example we'll talk about why in a second so what does the service provider then do that store password so this is an example of the Unix standard hash function yeah so it uses something of f it then generates the name so it always has to associate kind of back to the identity so it needs to be some way to map back there and then it calculates the uh Unix hash of this password which is here so this is a this is c that gets generated from this is the lowercase a and the lowercase c that gets generated from here it stores this yeah so that's very easy so then it stores this in a file which we'll see in a second which I think we've already looked at a little bit and then hey this is Alice right she'll provide the password and so the service provider will take Alice's take the given password the new a hash it with the function and verify that outcome with the stored c that it's stored in server if it's correct if it's true or not in return false so I'm going to break this I don't want to think about this like an attacker what is our goal as an attacker access the system as another user right so um so this I think is an important distinction right because it actually doesn't matter as long as we can get onto the system as the other user I actually don't care if I know their password or not and we can express that in our language by just saying that hey we want to find some a so some password in the password space such that for the f that's used well when we run that on f it's the same and c is associated with the entity that we want so it's usually two types of ways we can go about this so think about this now from an attacker's perspective so what information does the attacker actually have probably have the user name that's usually we'll touch on this a little bit but yeah definitely we want to think okay the attacker knows the identity of let's say a person that they're trying to do the attacks but what else do they know think about the different situations maybe you use this I have at least a vague idea what this is they probably know I would say f they would know f right they would know the set of functions that are used do they know the given c's or do they know I guess that's a good question do they know the c's the yes when right so let's say this let's say you're trying to break into my account on the submission server and you're trying to do this do you know the list of c's no nobody's found one yet through four security courses I don't think so not to say there's not yes no do you know your hash or any fellow hashes from anyone else do you know what algorithm I'm using to hash your passwords no what do you have access to how would you know how do you know when it matches right so you have access to L right you have access to the login function and that will take whatever password you give it and would say yes you're allowed or no you're not allowed so there's two ways to think about this basically direct approach indirect approach online attack offline attack are two different they're all different names for similar things one way is direct attack which is the offline approach so the attacker has the c value so you have like we said the hash you broke it into my sql database you've dumped all the information so you know all the user names and all the hashes or like actually what used to happen in unix is all the passwords were stored all the hashes were stored in etc password that's what literally the name came from it's the password file and so anyone could see those hashes they weren't a secret information so the goal of this approach is that the attacker has some c so they want to find any a where running after a gives you c that's usually what the attacker's goal is so should be an indirect approach here so the indirect approach which gives us directly 100x the indirect approach is the attacker does not have c but we know that they have access to l they should always try to be able to log on otherwise your users who are using the system can't actually log on and the idea is if you could tell if it was an attacker or an imposter or an authenticated user when they're trying to log in then you've literally already authenticated them so you can't make that determination because that is what your authentication method is this is actually a super important distinction to keep in mind so it's not purely hypothetical we'll talk about why that's important in a second so this is kind of our high level attacking goals right so we think about the attacker this is what the attacker wants to do and we always need to consider these two cases so how do we prevent attacks in general that's the attacker's goal so maybe it'll help to think about well how would you then so let's say we're on a system so let's say we have a direct approach you're on an old school unix system in the 70s 80s it has an etc password file that has everyone's hash in it how do you break that that doesn't just give you how do you do it root force well we have we have a hash right so that's where we just start running through every possible combination and seeing what that hashed out to and then when we found what would you how would you root force it so you just try it so let's say we're going to guess it's just all alphanumeric characters so you start with a string full of let's say 5 or whatever group length you want to do and then you start with all of our case A's you try that hash it compare and then you change the last one to B hash it, compare, change the last one to C hash it, compare for a strict root force, yeah that one but a better I don't know if you'd call it more of an intelligent root force but try to find common passwords or like when we thought of earlier with what interests you had try typing in password or admin or hashed so that could be our way that's not the best way I'm sure yeah so yes one thing would be if you found if you were able to actually break the underlying hash function then you could maybe try it that way a much easier approach is you always need to remember these are humans creating passwords most times unless you're using a password generator automatically generate that password but fundamentally there must be some that a user created to try to know because they need to remember that when they come back this isn't something we necessarily talk about here so we could try for a given C we could try let's say the top 10,000 or 100,000 most common passwords yeah that would definitely work let's even transport us so let's go let's simplify this version so actually the original version I believe did not have this two character hash ID so it just had a was used let's say MB5 or some hash function so now the idea is you have not only just some C that you're interested in you actually have a list of all the C's on the system you have every single hash on the system so if you just want to break into any account all you need to do is run your password cracker run your brute force algorithm generating common passwords maybe try English words and try hashes and compare those hashes with all of the list of all the users on the system when you get a match that's when you know you've found something and you've broken that password so how can we prevent this is it impossible limit the amount of attempts, password attempts with like a time variable so where would you do that in our system in our system it would be at the access function what does that have S in manipulation function or login L so we could have L be such that usually you may have an unsuccessful login you actually add some delay right so would this would this help in the case that we actually have access so that you can see the hashes to help in the case of the websites so have you probably noticed this before I think most systems when you type in your password to login to your computer incorrectly it'll usually delay it and there are sometimes I think in some systems will be an exponentially longer delay how do I tell this story about the phone maybe so you can also set that up with your phone so that when you put in an incorrect passcode it will lock you up for I think first 30 seconds and then a minute so I had a friend who thought it was hilarious to do this to people to lock them out of their own phones so he was doing this on somebody's phone and putting the incorrect pin code locked it out to 5 minutes and then did it one more time and then the group policy kicked in to delete the entire contents of the phone so the phone started wiping and he felt really mad luckily the person had everything packed up I think so I think it was a good story but maybe I should check I don't know if they're, I think they're still friends but yeah, he no longer does that to people because it's not funny because you can actually set up policies like that on your phone and point the phone after a certain number of tries so that way if somebody wants to try to reinforce it they have 5 tries oh I should bring my device so I actually bought a device for older iPhones where I was living here to try to crack the pin using that interface and then you also put it up to something I think it's on the battery or on the reset or something and so before it actually triggers that you input it in correctly it resets the phone so it doesn't actually store the fact that you made an attempt and so it just keeps doing this I think a 4 digit pin in like 3 or 4 days or something anyway it's really cool so when we come back we'll talk about preventing attacks if anybody, once again maybe wants to make any announcements for good or evil at the class on Tuesday go free


Hi everyone, I'm Emma, I am the Director of Studies at Griffith College here in Cork. And I'm going to talk about controversial issues in EFL classrooms. This is based on some of the research that I did as part of my dissertation from my MA in English language teaching and applied linguistics. So I'll explain a little bit more about the context in a second, but first I just want to show you a few examples of some recent world events really and I just want you to have a think about what happened in your classroom surrounding these events. So did they come up in class? Did you raise them? Did students raise them? And as a result was any controversy emerge from them? So the US elections and I guess since then as well, Brexit, the equality referendum here, the refugee crisis and the Charlie Hebdo attacks in Paris. So if you want to just have a think about it and reflect on it for a few seconds or if you would prefer to maybe choose one or two of them to have a quick discussion. Okay. So the reason that I selected these topics, I could have chosen any number of topics, but the reason that I selected these was for the most part, quite a few of them are seemingly fairly innocuous, but in my experience they have led to potential controversy in classrooms, in multilingual diverse classrooms. And it was actually the Charlie Hebdo attacks and the aftermath of that that led me to my research. So before I, again, before I go on to that in more detail, what have we got here? Parsnips. Yeah. So what are the parsnips? What's the relevance? So parsnips is this acronym for a kind of a list of taboo topics that publishers, so publishers use this list of kind of taboo topics as a guideline for what not to include in course books. Okay. So politics, alcohol, religion, and sexuality, narcotics, the I, it's isms, basically ideology. So anything from communism to racism. Pork can also be sometimes it's pornography, this is a non-official list. And so my kind of second question that led me to the research was, is this sanitization that is appearing increasingly in globalized course books, is this creeping into classrooms as well? So there are the kind of two questions that led me to my research, which was how teachers approach politically and culturally sensitive issues in multilingual classrooms. A bit of a mouthful and a huge area, but what I was interested in looking at was, you know, I wasn't so interested in the specific topics, or I thought it was more about how teachers deal with them when they arise both in a planned way and spontaneously in class, which is why I was looking at it as a kind of the springboard, I guess, was the kind of current affairs things, the more unavoidable topics. So I interviewed experienced EFL teachers with the track record of excellence in the classroom. So it was teachers that I was working with who I had, you know, who I knew for a long time, who I, who were very, very experienced and had, you know, high levels of qualifications. I was in a typical language school context, it was actually in London, very, very mixed demographics and very mixed motivations as well of the students and very mixed ages, a super diverse multilingual setting. So there was a huge range of nationalities among students. And the key thing is that, you know, in a language school where people are there specifically to learn English language, there is no specific content. Okay, so the content is driven by the language. So I was focused on what, you know, what teachers are using in the context. So the first question was, what are teachers' attitudes towards sensitive issues? And overwhelmingly and surprisingly, given that they were experienced teachers who considered themselves to be, you know, very politically aware, the overwhelming attitude was fear. And that seems quite dramatic, but actually the language that teachers used during the interviews was very dramatic and it was very much related to fear and I'm afraid and I'm terrified of approaching these kind of things. So what kind of things were teachers afraid of? So they were afraid of the teacher causing offence of being ethnocentric, possibly, you know, as I said, it was in London, so maybe a bit of colonial heritage, colonial guilt there as well, but they were afraid of offending students and imposing their views in some way. They were afraid of students causing offence. They were afraid of relinquishing the expert, their expert status. So if there was a topic, say for instance, if it was a geopolitical conflict between learners' regions. So at the time, it was while the Russia and Ukraine incident was ongoing and the teachers were dealing with classes with, you know, a lot of Russians and Ukrainians in the classrooms. And rather than, you know, moving to them, moving to the students and getting their thoughts and feelings and opinions and expertise really as people from the area, they were more comfortable with just standing back and not approaching it at all because they didn't want to be the ones who didn't know. And they're afraid, of course, of conflict and tension within the classroom, especially given situations like what I just described. So the strategies then the teachers use. So if fear is the main approach, the main strategy that they used was avoidance. So rather than approaching these topics. And again, I'm talking about a lot of topics that that would have been, you know, world issues, global issues that would have been there, you know, in the classroom, at the touch of a button. All of these teachers were dealing in classrooms with technology, with Wi-Fi. So they all had access to various news sources. They would have used them quite a lot. But still, they were reluctant to approach any of these kinds of issues. But what I found through, so throughout the interviews, through reflection and narrative inquiry, where the kind of conclusions that the teachers almost unanimously came to themselves when they thought about it was actually this fear and their assumptions were mostly unfounded. It wasn't based on anything. They, as I said, experienced teachers, they hadn't actually had any experiences that justified the fears. The worst case scenario that they discussed was a kind of, okay, let's agree to disagree on that one, you know. Or there might have been kind of some mild tension in the class, which quickly blew over. And then, you know, again, teachers came to the realization that actually, that was kind of good because it broke the ice and it freed up discussion. Okay? This is just a quote from one teacher who described a situation where there was, from the coursebook, there was a discussion on evolution. And there was a student in the class who had never heard of the concept of evolution. And other students were surprised and shocked and were kind of, you know, quite aghast at it. And the teacher got into this difficult situation where he felt very ambivalent. He didn't know how to deal with, he didn't know how to deal with it. And this is what he said in the interview, that if it was anywhere else apart from a classroom, of course, I would say that evolution is a fact, not for debate. But I think in a multicultural, multinational classroom, it's difficult to be so forthright. So something that he even considered, you know, that he would consider to be a fact, even that he didn't want to, he didn't want to project his own beliefs. And what ended up in his words happening was that the student who, he described it himself as a mislearning opportunity, because the student who hadn't heard of the concept of evolution, because it wasn't in his educational background, through no fault of his own, felt, I think, a little bit ostracised and distanced from the rest of the class, because he just kind of brushed over it, but was never actually dealt with. And, you know, he felt that other students were kind of talking about him and laughing at him, and it created a bit of a division in the class by not confronting it. So I want to look at how these types of incidents can be developed as positive learning opportunities. And also the teacher's role in that. Okay.  So research has shown that what those, the beliefs of those teachers, what they showed was actually unfounded in terms of learner beliefs. So research has shown that learners, the teachers tend to underestimate learners' resilience, their ability to manage conflict, and their emotional intelligence, keeping in mind, of course, that these are adult learners with a very broad background. However, there is evidence of benefits of approaching these issues. So it increases learner and teacher motivation. More challenging and controversial content can lead to deeper engagement. Non-trivial content, as it's sometimes described, can engage learners both cognitively and effectively, leading to fuller self-investment. So when learners are more concerned about their message rather than how it's getting across, teachers who are willing to embrace sociocultural difference are received better by learners. So acknowledging difference. And as one of my interviewees said, if it's a good, healthy discussion, the elephant in the room is let out and they can relax and talk about something that matters rather than shopping. So finally, just some suggestions for the teacher's role in avoiding this kind of avoidance. Facilitate respectful debate. Encourage critical thinking among learners. Allow space for more than one narrative. So allow multiple perspectives. Don't position yourself as the expert. We're experts in language, not necessarily in the content. And allow the students themselves to be cultural informants. So give them that power. And there's plenty of other ways, so anything else that you might be able to think of yourselves. That's it.