Matt Blaze

I stumbled on this page after reading Matt Blaze's legendary paper about deducing master keys from physically strong, but cryptographically weak, physical systems. The paper is really good, and worth a read, even though it is from 2003: https://www.mattblaze.org/papers/mk.pdf https://news.ycombinator.com/item?id=32306328

See https://www.mattblaze.org/blog/faraday/: > At least in the frequency ranges I tested, two commercial Faraday pouches (the EDEC OffGrid and Mission Darkness Window pouches) yielded excellent performance sufficient to provide assurance of signal isolation under most real-world circumstances.

While definitely better than the non-encryption of CTCSS etc, P25 encryption has some relatively concerning implementation problems. It's possible none of these actually matter for your usecase as many are related to UX around configuring and using encryption in an institutional setting, but the unauthenticated traffic injection, induced transmission and jamming issues are, well, not great no matter how you look at it. https://www.mattblaze.org/blog/p25 https://www.mattblaze.org/papers/p25sec.pdf I will grant that the open-source kfdtool keyloader boxes are neat. I have been meaning to see if I can repro the induced transmission via retransmission requests thing when the data packet stuff is fully disabled via CPS, but a friend permanently borrowed my hackrf so that project is on hold for now. I'm not optimistic, though, due to the comments in the paper about where in the stack the retransmission request is processed.

This reminded me of Matt Blaze's work on physical lock security back in 2003. He found a method of deriving the "master key" for a building (one key that opens all locks) from a single example: https://www.mattblaze.org/masterkey.html When he published about this he was bombarded with messages from locksmiths complaining that they all knew about this and kept it secret for a reason! https://www.mattblaze.org/papers/kiss.html It was a fascinating clash between computer security principles - disclose vulnerabilities - and physical locksmith culture, which was all about trade secrets.

And his recording of the Cuban numbers station, if you want to hear what these sound like: https://www.mattblaze.org/private/17435khz-200810041700.mp3 Here's a sample of the referenced "Linconshire Poacher": https://priyom.org/media/247818/e3.mp3

Matt Blaze's analysis of the flawed OTPs used by Cuban numbers stations: https://www.mattblaze.org/blog/neinnines/

Correction: that's the lock on the GTE clone of the Western Electric payphone. The actual Western Electric version used an unusual lever lock. The later variant, the 30C, is claimed to have never been picked. That's a really good lock design. It's simple, robust, and immune to standard picking techniques. But there is a vulnerability. The blocking wedge, which is only supposed to move along one axis, has some mechanical slop. See [2]. So it's possible to get some feedback on which levers are blocking bolt movement. It's still a huge pain to pick. [1] https://www.mattblaze.org/photos/misc/wecolock/ [2] https://www.youtube.com/watch?v=hXLhCvUgDYQ

When I saw the headline I assumed it'd be about the P25 unencrypted metadata leakage issue (specifically Unit Link ID) described in https://www.mattblaze.org/papers/p25sec.pdf - that indeed carries a lot further than BLE

This was the one, thank you https://www.mattblaze.org/blog/faraday/

https://www.mattblaze.org/blog/faraday/ Make of that what you want

The domain name itself is a pretty good investment too, I imagine. It used to belong to a professor I had in college, and I remember reading his tweets over the year or two before the sale about how many inquiries he had been getting for it: https://www.mattblaze.org/blog/newaddress

Yes. https://news.ycombinator.com/item?id=29413774 https://www.mattblaze.org/blog/faraday/

Police dispatch might be encrypted but not very well. https://www.mattblaze.org/blog/p25 It's actually worse than clear text radio in many ways. All cellphone call meta data and all SMSes are recorded, so while it avoids people listening in scanners and the public record it isn't very confidential. It's police using WhatsApp and Signal that will cause big problems.

The pre-print loophole is exploited by people who publish in IEEE (electrical engineering) and ACM (computer science) which require assigining exclusive rights to the final article but not the final pre-print. After the final article is accepted but before publication a new clone is put up on their personal website with the name “final pre-print”. It’s understood in these two fields in these two journals that IF the article was published, the “final pre-print” is identicle and is a “pre-print” in name only for licensing circumvention reasons. Don’t know about other fields. But CS and EE are particularly prickly about this issue. See for instance Matt Blaze’s discussion: http://www.mattblaze.org/blog/copywrongs

As far back as 2011, Matt Blaze was pushing for changes to the copyright policies of IEEE and ACM. http://www.mattblaze.org/blog/copywrongs