NEWBIE
Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
Register for free to join our community of investors and share your ideas. You will also get access to streaming quotes, interactive charts, trades, portfolio, live options flow and more tools.
And I think I figured out who it was.
Note: it was not me.
The SA lawyers did not mention "director of the preschool making the call instead of the front desk worker". (Yes, that would be OOB) "The lawyers would not have gone with it if it didn’t apply" - But they didn't go with that. It would also have to be done that way every time and not be an option for the front desk worker to make the call.
Other points:
IDs can be faked.
IDs can be used by twins.
Still have the human voice recognition issue.
Phones can be stolen and answered without unlocking.
Yes those are a bit overboard for picking up a kid from school, but SA is arguing that this is the same as getting remote access into users data where there may be financial cost.
Note: I am not saying a kids life is worthless, just stating hackers are more apt to want your money than your child and will go to greater lengths to gain access. Maybe if the kid has rich parents or something.
The "person picking up" and the Preschool worker (app server) are the first channel. That same Preschool worker cannot make the call. They would have to have someone else make the call (security server). If the 2nd person called that would be the 2nd channel.
There are 4 elements needed per the patent. The same 4 that are in SAs graphic on how this works. 3 elements would not be out of band.
User connects to app server, app server connects to security server, security server connect to phone, phone replies to security server, security server gives app server a response, and based on the response app server either allows or denies access to user. Meaning the app server cannot connect/talk to the phone to be OOB.
And to even add more stuff to this, there has not been any mention of the "person picking up" needing unique authentication themselves like a username and password for their own for identification.
The school and bank analogies just don't work for this. That is my only point to all of this.
But to be out of band with two channels as the patent is written, the person that gets the request cannot be the one that makes the call. Plus you still have the voice recognition issue.
Correct, phone security has increased amazingly since 2000. That only helps the software that uses the patent more secure.
Patent was in 2000. First iPhone was June 29, 2007. In 2000 there were Blackberries and Palm devices for the most part.
The patent did not make encryption on cell phones better. Encryption made the products that use the patent better.
The bank and school "solution" is not 2 channel out of band and it was also has bad 2nd factor "solution". SFORs patent was for a different solution to the same problem.
"Which goes back to the point that SA is making and a judge made. Did SFOR just take an existing solution and implement it into a computer environment because technology finally allowed it to be?" - No.
Please show me where I said "invisible". I did say it was as close to 100% as you can get and about as secure as you can get.
The only thing I added was how it actually works and the different points of the process that you would have to get through that are already built into the systems. Like 256 bit encryption built into phones and the software, lack of the ability to "clone" phones, and best practices like; users not sharing their passwords or loaning out their 2nd factor.
All of my arguments were to show how secure oob 2fa is over other forms of authentication including other forms of 2fa. I was also showing the school and bank analogies are bogus because it is not out of band since there is no separation for a first and second channels and the 2nd channel requires human voice recognition and not a secure response like from an encrypted phone.
Not the best source, but...
https://www.quora.com/Can-the-iPhone-be-cloned-or-otherwise-be-remotely-owned
Assuming that it is password-protected, this would depend on two things: the model of the iPhone and whether it has been “jailbroken” or not. The older iPhone models could be cloned and remotely controlled. For the newer ones, starting from 5S model, when a discrete encryption chip was introduced, it is virtually impossible to break into or remotely control these devices.
Hi Pennydream, First I would like to say that I have liked and agreed with your recent posts. Thanks.
The argument started out about how the school and bank analogies that SA is using are bad. Then it turned into how "easy" it is to hack into or clone a cell phone. Then the claim was anyone smart enough could hack 256 bit encryption.
I would have loved to stay on the first subject, but the responses I kept getting kept changing the subject and path of the conversation.
At one point the argument was "If I have someone's username, password, cell phone (and a way to unlock the cell phone) that I could get into that persons data" - well duh.
ok, 10.0.0.43 is my internal IP address on my PC. This message originated on my computer. Or are you wanting the message headers from the email that you think you can trace back to me? I will save you the trouble, my exchange system routes through Zix and we have Zix strip the headers so the originating IP address (my external IP address at my ISP) does not show.
"It sounds like you’ve changed your stance a little bit... “as secure as you can get” doesn’t mean invisible, as you originally claimed." invisible? or did you mean invulnerable? Nothing is 100%, but can you name something better? If the 2nd factor required a retinal scan it would be more secure. So "is about as secure" is correct.
"SFOR doesn’t have the patent right now. It’s invalidated." - No, the patent still exist it is only invalidated by 1 judge in CA and that is being appealed as you know. How that appeal ends no one knows other than the 3 judges.
You have seen the SA graphic of how they say their product works. It has all the elements of SFOR's patent claims.
So in order for you to hack my system you want me to allow you access to my system? Geee, So you could also steal my car if I give you the keys? Impressive!
Back to the original topic. People should not give their passwords to anyone, people should not lend their 2nd factor of authentication to anyone. If they do, they are as bad as you wanting me to give you access to hack my PC and me doing it.
OOB 2FA is about as secure as you can get for remote authentication and verification. SFOR has the patent on that in a form others have used.
Side Note: If I patent a widget and you copy that widget and put a handle on it. You are still violating my IP for coping my widget. Same as SA's product is using SFOR's IP.
So, you don't know how to do it? But you said it was easy. Odd.
"Also, your router doesn’t allow any external originating traffic? That’s very interesting. So you don’t revive any emails when you’re at home?" - My Outlook pulls the emails from the server. The TCP connection (RPC over HTTPS) originates at my PC not from the server/internet.
Did the 3rd judge say a word or even ask a question? I don't remember hearing him. I guess the real question would be if that was the case, Why? Already decided? For or Against and why?
And Discuss....
Again "Again, if I have your username and password and gotten into your phone, I have the keys to the kingdom. I can authenticate as you." Correct, but someone in Finland cannot get access to my phone. And you cannot copy my phone since you do not have access to the hardware chips inside it. Also, you still would need my username and password. You may be able to steal my physical phone or my password, but it is not likely for both.
If someone gives out their username and password AND loans their phone with the access into it. Then they deserve to have someone logon and steal their identity/money/email/whatever.
What?
"I’m not talking about cracking encryption." - The security server is waiting for an encrypted message back from the device. So if you don't crack the encryption it will not authenticate you. This is why I believe in this patent so much. It is as close to 100% as you can get for security and validating who someone is who they claim to be.
"Somebody really really good" - No one is that good with current technology.
https://blog.v-comply.com/256-bit-encryption/
If you assume:
Every person on the planet owns 10 computers.
There are 7 billion people on the planet.
Each of these computers can test 1 billion key combinations per second.
On average, you can crack the key after testing 50% of the possibilities.
Then the earth’s population can crack one encryption key in 77,000,000,000,000,000,000,000,000 years!
"SFOR’s patent puts a process that was a bit more flawed in the real world into a computer" - a bit more flawed? Only if you are referring to 2FA using keyfobs/sms text (or similar single channel authentiucation). It removes the major flaws in those. If you were referring to the bank/school thing they cant even compare since you cannot verify who someone is 100% over the phone. Heck, with digital sound processing you could sample and recreate someone's voice well enough to pass against a human over the phone. If you found "somebody more knowledgeable in a different area of expertise"
Source please "The COO Lori Glauser providesd staff in Oregon with the half of cannabis samples that should have been destroyed. Then actively worked to have them conceal those actions from investigators.". Not the staff taking samples part. The Lori knew and tried to hide this from investigators. (and not others opinions)
"There are three executives - waldrip Glauser smith earning $420,000 a year running a business with 4 labs." - You forgot the words "combined for 3 years". Your phasing makes it sound like each. Also, There are more than 4 labs or did you mean fully owned (ie non franchise and partner labs) and up and running ones?
"They don’t have an outsourced investor relations team" - They did and then everyone bitched because they posted stuff we already knew which is the stuff they could talk about.
"They’ve been through 5 FIVE CFO’s in the past three years." - I thought you counted 4 last time, I may be wrong.
Ok, lets get back to the OOB 2FA patent.
"There are many ways someone can get past all of this in their basement in Finland if they really wanted to" - How would someone in Finland preform a "man in the middle" attack AND break 256 bit encryption? Having my username and password does not help for the 2nd factor.
"Then I would need the notification to go to a different phone thinking it’s the same number." - How? You would have to logon to my account and change that number plus break the 256 bit encryption. Remember the SMS text messages are not part of this. This is an app on my phone with a private key that is registered at Okta (or SecureID in SFORs case).
"Do you know how easy that is?" - It isn't. In fact it is close to impossible. https://www.thesslstore.com/blog/what-is-256-bit-encryption/
"...may seem like a normal number, but don’t you dare underestimate its power. 256-bit will have 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936 (78 digits) possible combinations." and "Even if you use Tianhe-2 (MilkyWay-2), the fastest supercomputer in the world, it will take millions of years to crack the 256-bit encryption."
GOOD LUCK FINLAND!!!!
Wow, where to start...
Lets start with recognizing voices. So you are saying the person at the front desk of a school would recognize and can differentiate the sound of every parents voice for every child at the school? I guess if there were only 20 students, maybe, but if there are 100s of students, I doubt it.
Here is a scenario of my OOB 2FA logon and what it would take for someone to get into my email via webmail on Office365 using Okta as the Identity Provider.
I launch my web browser and go to the webmail logon page.
I enter my email address (easily known)
I enter my password (not known by anyone)
Office365 initiates 2FA with Okta
Okta sends a request to my phone using Okta Verify
My cell phone receives the push notification
I unlock my phone using my thumbprint, pin, or my face
I click "accept"
Okta sends Office365 a response saying I am who I am
The webpage lets me into my email.
Since I am the only one that knows my password (protected by GuardedID) and my phone (that never leaves my side) and no one knows/has my PIN/thumbprint. There is no way for anyone to hack into my email using OOB/2FA. This is also works for any application that I have configured in Okta like ServiceNow, Concur, ADP, SalesForce, Oracle, etc.
You are correct that if someone had your username and password plus your phone and a way to unlock your phone that they could access your account. But that would be the users fault and not the software's. Plus most hackers would be in another location and would not have physical access to your phone.
You forgot the person's cell phone and being able to unlock it (thumbprint or pin) in "If you have someone’s username, password, and information (maybe even a voice recording), you can get past SFOR’s system as well.". So if a hacker has all of those things, the user is screwed anyway. But yes, that would get around SFORs patent.
"parent confirmation is a “yes” is out of band authentication" - how do we know it was the parent saying "yes"? Do schools have voice patterns of all the parents to compare to? If they do it would probably be on a computer and not tape.
This is correct for a voice verification, but would need to be matched to something:
User -> app -> security server -> user (out of band) -> user says yes -> security server -> app -> user.
But is has not been invented before SFORs patent. The bank and the pre-school arguments are flawed.
OOB 2FA is for a single user to authenticate. Not for "here, use my logon".
If the bank calls the owner of the account, they would have no way on knowing it was the correct person. The SA attorney said something like "They could recognize the voice". I call BS on that. Do they know all customers voices? I doubt that. And what if the person they call only sounds like the voice they know. As an extreme case, what if that person was being held at gunpoint and the person that is at the bank is in on it? (long shot I know). Also, the teller could not be making the call since they are in the first channel. They would have to call someone else to make the call and then tell the teller Yes or No if the transaction is valid.
The pre-school argument is basically the same.
Sorry, just a bit of quick rambling. Got to go.
Why do you care what others are saying? I don't. I only fact check others and decide for myself.
The part that bothers me are the claims with no supporting evidence on both boards. I ask for the evidence and when I get "Do your own DD" or similar I consider the claim invalid. If I am proven wrong, then I change my speculation with that in mind.
The petty arguing about "The other board says" is just a waste of time in my opinion.
Wasn't that you that said "there wasn’t an advantage over being there and hearing the recording?"?
I think there is an advantage to seeing the body language of the Judges and the Lawyers. Not that I was there or trust other peoples reading of the body language. But it does make a difference.
Ok, I just saw that. Like I said, I was just curious.
Did someone actually say “Ram is wrong and lying” since you quoted it or are you putting words in someone else's mouth?
Just curious.
Which was? I thought it was 53, but that states "A software method for employing a multichannel security system to control access to a computer, comprising the steps of:"
Which claim number are you referring to then?
Sure sounds like this is computer specific to me.
https://patents.google.com/patent/US8484698
A multichannel security system is disclosed, which system is for granting and denying access to a host computer in response to a demand from an access-seeking individual and computer. The access-seeker has a peripheral device operative within an authentication channel to communicate with the security system. The access-seeker initially presents identification and password data over an access channel which is intercepted and transmitted to the security computer. The security computer then communicates with the access-seeker. A biometric analyzer—a voice or fingerprint recognition device—operates upon instructions from the authentication program to analyze the monitored parameter of the individual. In the security computer, a comparator matches the biometric sample with stored data, and, upon obtaining a match, provides authentication. The security computer instructs the host computer to grant access and communicates the same to the access-seeker, whereupon access is initiated over the access channel.
Didn't the stock increase "prior to the news"? In this case, prior to the appeal hearing.
I agree, I was not impressed with R&G. They could have done better in their arguments.
But the whole preschool thing is such a bad analogy. 2 factor is authentication for a single person. It is not used for someone else to get into another persons information/data. Plus 4 things are involved with the patent (user, system being accessed, security system, and other use device). In order for the school thing to apply the school person would have to have another person call the phone on file and know 100% that is the correct person on the other end.
I guess we wait for their decisions.
Anything in particular?
LOL, I can see that being a bad move. Hell, maybe it was, I just remembered seeing that and found it again in the 8K.
Those were in the latest 8K: https://ih.advfn.com/stock-market/USOTC/evio-inc-EVIO/stock-news/79080960/current-report-filing-8-k
You can listen for yourself here: http://www.cafc.uscourts.gov/node/24320
Nope, in fact I made a post refuting that. SFORs patent has nothing to do with Push Notifications. SFORs products USE Push.
I am sure they do have other plans, and I am sure one of them is to settle, one of them is to file bankruptcy, one of them is go to court. Who knows what others they may have.
I have no idea what is going to happen tomorrow much less Monday or beyond. But I have time and I can wait. It still comes down to it is worth the risk to hold this stock. Even if it is just to see how the Gallagher thing turns out.
The patent is on oob 2fa and not push notification. It does not matter how the phone application is activated/notified. The important part is the authentication.
If you really believe it is important and invalidates the appeal, that is up to you.
It shows that detail.
Step 6: user's phone send info security server
Step 7: security server sends info to user's phone
Step 8: app prompt user with accept (or deny)
Step 9: User selects option
Step 10: phone sends response to Security server
Look again please. the Google/Apple part is only the push notification (Steps 4 and 5). Just like all phone push notifications work.
Steps 6 to 10 are the user side of the authentication with the security server.
Look at "Push-to-Accept Architecture" image
https://docs.secureauth.com/display/82docs/Mobile+Login+Requests+%28Push+Notifications%29+Registration+Method+for+2-Factor+Authentication
Client -> App Server -> Security Server -> Phone (via provider) -> "user accepts" -> Security Server -> App Server.
That IS what SFOR patent is for exactly.
I know what I know and I believe what I believe. I don't care what you believe or think.
There are basically 3 results that may happen on Monday.
Court rules against SFOR and the stock tanks.
Court rules for SFOR and sends case back to the lower court to be tried.
Court rules patent is valid and SA is infringing.
We will have to wait and see.
As far as when we know. It is the same for all 3. Maybe know the ruling on the 4th or maybe a few days after. I don't see it taking longer that a week to know what the ruling was. Especially since they will post the audio of the hearing.
Since I have actually read and understand the patent, and with all of the other Alice cases that have been overturned, I do feel that it will go in SFOR's favor. So I will either lose a little or make a lot (potentially).
"Spot on" that "Post is WAY off the mark"? Glad you agree.