Jump to content

pointertovoid

Member
  • Posts

    650
  • Joined

  • Last visited

  • Donations

    0.00 USD 
  • Country

    France

Everything posted by pointertovoid

  1. You shouldn't laugh at me, because this isn't fun. I've installed DosBox on 64b-Seven, looks easy and fine. Then I've started the Oxford-Hachette Dictionary (= the pasted executable folder) from DosBox. Error: "This program needs Windows". :angrym: The Oxford-Hachette Dictionary was written for Win 3.1, is that it? It runs on W95a-95b-98-98se-Me-2k-Xp (I didn't try it on Nt4) - but NOT on 64b-Seven nor in DosBox. Anyway, I keep for the coming eternity DosBox, which will certainly be useful. Maybe my nephew doesn't need a WinMe any more if his Dos games run on 2k or Xp. Does MiniBos create a bootable small Win? To run on Seven in a virtual machine maybe?
  2. I don't know whether MS is so much interested in peeping in customers' computers, or if all governments tell MS to do so - or if MS has just made choices that are wrong for me. As long as computer manufacturers continue to install Windows on every machine, MS will sell Windows, and users installing anything else will remain marginal. You know, most users want a desktop with ten icons to click on, and that's all. Smartthings tell that customers accept application stores fully controlled by the OS editor. The move will rather come from Russian or Chinese editors developing now their own operating system, very much (and officially said) to get rid of the Western peep into computers there. Everyone understands that local governments will peep instead of Western ones, but personally, I prefer the Chinese to spy me than my own government. I have several stone-old applications important to me (combustion computation, molecule conformation...) meant for Windows (or Dos!) which supposedly would be difficult to run on Linux, but - One has been refused by 64b Seven - I installed an Ubuntu and Seven recently and felt more comfortable on Linux despite using only Windows for two decades. That should be an alarm for MS. Ding-ding-ding!
  3. Looks very promising! I'll try and tell you.
  4. Thanks! ---------- Here is my concern. The Aes standard describes an Aes-Ctr mode (which I believe it shouldn't have) where Aes serves to create a pseudo-random stream which is Xored with the plaintext to produce the ciphertext - that's called stream cipher traditionally. Stream ciphers have a long tradition of failure. Not only is RC2 broken and RC4 badly wounded by over ten attacks; stream ciphers have also terrible weaknesses due to their very nature. An attacker can trivially forge a modified ciphertext that has a known effect on the deciphered text (=the same Xor modification as on the ciphertext), so all the security relies on authentication; though, message digests too have a long tradition of failure and are necessary to authentication.The Initial Value that feeds the pseudo-random generator must be unique - absolutely, totally, completely unique. If two Initial Values are identical, the user Xors the plaintexts with identical pseudo-random sequences.Identical pseudo-random sequences would mean that An attacker who knows one plaintext (for instance because he chose it) knows the pseudo-random sequence as well, even without knowledge of the encryption key, so he can decrypt the other ciphertext into the original plaintext;Or with enough ciphertexts that have been Xored with the same pseudo-random sequence, the attacker can rely on loose information about the plaintext (like: "it's a Utf text)" to deduce the pseudo-random sequence with a good probability.So identical sequences must be avoided at any cost, guaranteed to be impossible, and this is very hard - I'd say impractical. Some details there at "Ctr mode" https://tools.ietf.org/html/rfc3686 ---------- Alas, the Java example of Aes-Ctr by Chris Veness does exactly what shall not be done: http://www.movable-type.co.uk/scripts/aes.html that is, its Initial Value results from A block counter defined by the Aes standard - as predictable as a counter;A pseudorandom number obtained from Math.random() - predicatble and settable;And the computer's clock.What may give a misleading sense of security is that this Initial Value (known under varied names like nonce) gets encrypted by Aes using the user's secret key. As long as Aes isn't broken, an attacker who knows the stream cipher won't deduce the secret key nor the inital value - but as we've seen, the attacker who knows the stream cipher doesn't even need more information. Alas again, and as you had expected, it seems that many programmers have just kept the use of the system clock for serious cryptographic applications - in fact, they kept Chris Veness' code. The Aes standard had rather in mind that keys would be chosen in a complicated protocol, with very much entropy in them, and means to check that they were chosen honestly - certainly not the system clock and random(). ---------- So now, I wonder whether such cryptosoftware, which seems to have spread among computers, is very weak or rather extremely weak. The block number is a sequence, identical for all encryptions.The attacker can set Math.random() at will.If the attacker can set the computer's clock, all is lost.The attacker could then let encrypt an other text, known or chosen by him, with the same pseudo-random sequence as the coveted user's plaintext, end of the game. The examples of Atomic Clock Sync 2.7 (which runs on Windows with user privilieges to set the clock) and RunAsDate (which provides a fake GetSystemTime() to an application) show that setting or providing a wrong system time doesn't need installation nor administrator privileges. I may detail later attack protocols that look feasible to my eyes. Some may even be simpler than that. ---------- Hence my query, whether an Internet webpage can set the clock (in html, Java...). Administrator isn't a barrier: most computers have only administrators.Unnoticed isn't so critical: many users would accept a query to adjust the clock or run a well-named program.I wonder if a change made in one displayed webpage (like GetSystemTime() faked) would act on the other webpage displayed by the victim's computer.And do you confirm that the persistent value of Math.random() is shared by all applications, processes, threads and webpages? Last time I checked it was so - as the only way to get different seeds for each start of an application.Your help is welcome, thanks!
  5. I also have a tiny program called RunAsDate www.nirsoft.net/utils/run_as_date.html which provides a user-chosen date and time to an application. It just exposes additional functions GetSystemTime, GetLocalTime, GetSystemTimeAsFileTime and these being called instead of the Windows functions give the chosen information. Simple and tasteful. Very nice for some applications. For instance FdTach was a beta version that stopped working on 20050101 but no final version was ever made. Could an Internet webpage do the same? Bring the additional functions to be used by the computer on that same page? Or even, to be used on other pages - at least on some versions of some browsers? The reason behind my query is that I'm worried about some encryption packages that rely on the computer's clock. I believe that this is very unsafe (in fact, all serious books warn against), but apparently such packages exist, so I try to evaluate the risk.
  6. Pity, because the Oxford-Hachette is better than my other dictionaries. I hadn't even noticed before that it's a Dos application, but in fact, it predates Win95 and Nt3. Though, it does nothing acrobatic, since W2k and Xp accept it. It's a strong argument against Seven - or would the 32b Seven accept it? I don't have the 32b install Dvd but could buy one. Or pick Wow from Xp32 or Xp64 and try to graft it on Seven64...? I can understand the software providers who stick at 32b. If they don't need >4GB Ram, the 64b mode brings little. Recompiling would be quick for sure, but then they would add all the complexity of offering and maintaining two versions: twice as many compatibility tests, customers trying to install the wrong version, updates for two versions with the associated mistakes... That's a switch to make only if mandatory, which nearly means: if needing >4GB.
  7. I tried Classic Shell, and it is indeed what I need. The start menu gets usable again. It also puts some Explorer behaviours back on their feets. Very nice, thank you! Apparently, Seven has a Start Menu folder for each user - it just conceals this folder, at least with the default settings. Supposedly, this folder can be tuned to one's needs. After a short trial, I could modify the "Programs" in the start menu, but not the root - I use to add other trees with "Explore", "Web", "Tools" and so on, at the same level as "Programs". I just wonder why Microsoft makes Windows ever less direct from one version to the next one beginning with Xp, with folder names that are not the actual ones, access paths that don't match the folder path, file protections that differ from Ntfs capabilities, and so on and so forth. Personally, I don't feel it any easier.
  8. Hello dear friends! Would it be possible for a webpage designed purposely to set the clock of the computer that displays this page? For instance, I have a small program called Atomic Clock Sync, found there http://www.worldtimeserver.com/atomic-clock/ which visits the websites of a few atomic clock standards and sets my computer's clock. I know, Xp does it alone. But up to 2k, Windows doesn't. Correspondingly, the v3.5 of Atomic Clock Sync installs on Xp only a user interface that tunes the behaviour of Xp's built-in synchronization. But from the same website, you can download the v2.7 through the link there http://www.worldtimeserver.com/atomic-clock/oldversion/atomic.exe which does on Xp the same as on W95-98-Me-Nt4-2k: it sets the clock autonomously. Interestingly enough, this v2.7 works perfectly even from a regular user session - no admin, no power user. Including on Xp, despite Xp throws normal users off if they try to use the Control panel for it. Once again, Xp protects only against legitimate users... And, well, Atomic Clock Sync displays a message because it's polite, but besides that, the user gets no warning from Windows and has nothing to accept nor confirm. In other words: a less benevolent program could set the clock without the user noticing it. I can't exclude that several Api functions exist for that purpose, the older unrestricted, the newer demanding some privileges. https://msdn.microsoft.com/en-us/library/windows/desktop/ms724942(v=vs.85).aspx but anyway, the unrestricted function is available at least up to Xp. The clock set wrongly could have some unpleasant consequences for the user. so: Do you believe a webpage could do it? Say, by launching a Windows command or a Java program.Would it need administrator privilege? (Not a big deal, since Oem computers use to have only admin sessions).Would it need some sort of confirmation by the user? (Not a big deal neither, since most users would accept it)Thank you!
  9. Since I had to install the Oxford-Hachette Dictionary on Xp, I tried to take a copy of the fresh installation there and paste it on Seven. Same failure. The installer (copyright 1990-94 approx) wasn't rejected by 64b-Seven as it was absent, but the program was rejected with the same message. Something ilke "DosOnSeven" would be nice.
  10. Well done! It was indeed the "simple file sharing" that made everything complicated. Thanks you bro!
  11. Not sure about "now", but I know the online activation did work for me on 22 Mar 2015. Two days without XP telling me to activate. I don't see the key icon in the taskbar neither. Apparently, the online activation worked in mid-may 2015. It's just that the activation program got stuck instead of telling me "succeeded".
  12. Found the download for "XP mode"... 660MB, recommends free 15GB on the disk. Porca miseria!
  13. Yes, phone is the probable solution. I wanted to avoid it because I have no line, only Gsm/Umts. Last time I had to bring the PC to the shop just for the activation... Do you confirm that the online registration doesn't work any more?
  14. Jump to May 2015. Is it still possible to activate XP online? Mine fails.
  15. http://www.tp-link.com.de/support/download/?model=TL-WN722N&version=V1 Apparently a driver for W2k. Surprising, because W2k and wireless don't go together usually.
  16. Thank you all! The Oxford-Hachette is a dictionary. A good one: just the paper contents, with pronunciation and some tenses, all the fuss, but in a software that runs much faster than a website and which I do access offline often. Not really replaceable. What is the "XP mode"? An option of Seven? A third-party add?
  17. Thanks Jaclaz! I still believe I've Xp Pro, unless something is fishy of course. The install Cd tells it, the start menu too, the control panel as well. Meanwhile I've seen the the Explorer optionally (right click) displays a column "owner" in the filelist, together with the filetype and other info. Better than nothing. I had hoped the Properties popup for each file would have a tab "Manage protections" like on W2k. I'll try the Nt4 bit - we owe Nt4 so much already.
  18. Well then, I'm pleased with a special identity always called "Administrator". It's the best way to do. I had just gotten fooled by something I read. I firmly believe to have Xp Pro because it's written on the install Cd and the start menu displays it. I'll change my mind in case the Ctrl-Alt-Suppr fails. Can I suppress the Zeus identity? I definitely have no documents there. I don't need two admin sessions, it's clumsy and more risky.
  19. Thank you all! So there are at least two solutions. Nice, since without the start menu I'd just eliminate Seven.
  20. Hi native Xp users! Having installed my first Xp with several session identities, obviously some things go wrong... Possibly the best question to start with is: How do I display the protections on files and folders? Like: "this folder pertains to the identity Ulysses, other sessions can read but not write, and this results from the parent folder". Once I can see the protections, the rest should go better - or at least I'll come with more accurate questions. Presently it's like fighting the invisible man. Thank you!
  21. Hello Xp fans! I've just reinstalled an Xp, for my first time with several user identities, in order to navigate as a user rather than an admin. Having read (...and believed) that one can add and suppress identities at will on Xp, provided one keeps one or more admin session, I had imagined that I had to create one identity I called, say, "Zeus" and one "Ulysses". But now I have three identities: Administrator, Zeus and Ulysses. Not what I wanted. Questions: - Can Administrator and Zeus do the same operations? - Why do I access Administrator only through F8? It's still a special identity, then! - Can I suppress Administrator or Zeus? Thanks!
  22. Hello the experts! I use Windows' start menu with the keyboard to open within a decent time folders, applications... like many people here I guess, adding my own tree of shortcuts. This works naturally on W95 to W2k, and on Xp with the option "classical start menu". Trying Seven shortly, I didn't find such an option. Is there any possiblity to make the start menu usable? Thank you!
  23. Hello nice people! I gladly used the Oxford-Hachette dictionary on Win95a-b-98se-Me-2k-Xp, possibly with the compatibility option, anyway, it runs with something like Wowexec. I shortly tried Seven 64b recently, and even with the compatibility option set as "run as Win95", launching it answers approximately "this program is not meant for this version of Windows". I really appreciate the dictionary. Is there a solution? Thanks!
  24. Hello dear friends! I can't access from my location (presently Germany) a forum I like: http://saposjoint.net/Forum/ nor through its IP: 173.174.43.146 and http://www.downblocked.com/saposjoint.netanswers "is down" A tiny forum, where the owner and manager knows everyone by name. He gave no warning, and his personal mailboxes answer "550 invalid", so I get seriously worried about him. Could you check if you access it from your location, please? Thank you so much!
  25. Thanks! I do other things right now but will try your suggestions.
×
×
  • Create New...