Good thread. Just highlight a couple of points.
Original Message:
Sent: Nov 21, 2023 08:25:44 AM
From: Philip Griffiths
Subject: Reputable institutions that evaluate new cybersecurity patents
Got to agree with @boris taratine here with a few comments:
- Although the concept of infinity has a mathematical basis, we have yet to perform an experiment that yields an infinite result. Even in maths, the idea that something could have no limit is paradoxical.
- 'unbreakable' or 'unhackable' is superfluous, any system is breakable, its just a question of how hard. For example, what if your patent implementation has a 0day, vulnerability, or misconfiguration?
- As implied by Boris, if an attacker is next to the client/user, with a gun to their head, they can get into the system. Every system needs to be considered from the perspective of clever compromise.
- I don't think Boris is being negative or out of place. This is a public forum for conversation. I have spared with Boris in this forum before, he means well and is trying to elicit your value proposition and how it can be demonstrably measured. This is the scientific process which helps to make things better.
- On that note, I like to think of myself as technically literate across a wide variety of topics. From my brief reading of tuplezz I do not yet understand how it is unbreakable. If others do not understand, do not blame them, blame yourself for not being able to communicate in a simple manner. This is the art of communication and convincing people.
------------------------------
Philip Griffiths
Head of Business Development
NetFoundry
Original Message:
Sent: Nov 20, 2023 01:06:32 AM
From: boris taratine
Subject: Reputable institutions that evaluate new cybersecurity patents
- yes, as you say it is "unbreakable" - the only way it is possible is when to break the adversary need to break the laws of nature. and the common sense here is not a proof. appealing to a crowd is a fallacy, and there is no need to go personal - let's stay on the claims made and prove those claims are sound.
- i was wrong many times that gives me an advantage to see things better. so, let's look at the statement in red: * The Server is authenticating the AOTC and nobody else can cos they don't know: (A) how many Active Elements (AEs) are used; (B) what are the predetermined positions of the AEs inside the AOTC; (C) what are the AEs' corresponding numerical values; (D) what are the formulas to compute the authentication. how exactly will this prevent an adversary who compromised the remote system act on the user behalf and spoof any signal the server side is expecting? according to the claims this is the part of the problem space you claimed was solved by the solution described in the patent you promote.
- i ignore your second personal remark as this is not relevant to the conversation. what is relevant is an onus on you to prove your claims of "impossibility": extraordinary claims require extraordinary scrutiny. if you feel asking for proof or stating verifiable facts are negative comments there is little i can do about it, but to remind 1) our industry wastes hundreds of billions justifying spending by narrative fallacies without measurable improvement, 2) we have already seen extraordinary claims that spectacularly failed, e.g., wep, secureid, sha1, (next will be zerotrust), etc. - the list of extraordinary claims about unbreakable (i.e., "impossible" to break) things is too long to wholeheartedly jump on yet another extraordinary miracle (YAEM).
------------------------------
boris taratine
helping the internet become the safest digital place in the world
Original Message:
Sent: Nov 19, 2023 05:22:38 PM
From: Dan Mimis
Subject: Reputable institutions that evaluate new cybersecurity patents
@Boris:
- If you think that a "mathematical proof" is needed to show that a hacker can't win against the infinite, then I'm happy we didn't study math at the same school.
- Regarding the AOTC you're wrong again: nobody is sending the AOTC to the Client for Authentication. The "A" stands for Authenticated* -- obviously you failed to understand the AOTC concept. * The Server is authenticating the AOTC and nobody else can cos they don't know: (A) how many Active Elements (AEs) are used; (B) what are the predetermined positions of the AEs inside the AOTC; (C) what are the AEs' corresponding numerical values; (D) what are the formulas to compute the authentication.
- You are way off topic -- just check out the title of this thread. So, unless you are some "Reputable Entity" (which I highly doubt), your overall aggression and your 100% negative comments on patents that you clearly don't understand are out of place.
------------------------------
Dan Mimis
Original Message:
Sent: Nov 19, 2023 07:06:07 AM
From: boris taratine
Subject: Reputable institutions that evaluate new cybersecurity patents
the problem with this approach is twofold:
- security is unobservable property - it is impossible to prove security positive, i.e., design a test to demonstrate security. and no number of negative tests can serve as proof.
- necessary claims for security and sufficient claims for insecurity are unfalsifiable.
>>You'll also see that the new concept AOTC makes phishing impossible.
no, it is not. i can simply ask the user to authenticate and take over the channel.
------------------------------
boris taratine
helping the internet become the safest digital place in the world
Original Message:
Sent: Nov 19, 2023 05:56:06 AM
From: Dan Mimis
Subject: Reputable institutions that evaluate new cybersecurity patents
Then how about you take the top 3 authentication methods and compare them with TUPLEZZ: yep, use a top hacker as MitM. You'll notice that the method that you said "does not satisfy requirements of the lowest authentication level" will come up as the safest. You'll also see that the new concept AOTC makes phishing impossible.
------------------------------
Dan Mimis
Original Message:
Sent: Nov 19, 2023 05:42:00 AM
From: boris taratine
Subject: Reputable institutions that evaluate new cybersecurity patents
first, to break something it is not necessary to have a quantum computer, it is sufficient to invalidate assumptions. in this case, "mathematical common sense" is not "mathematical proof", therefore, your claim of "impossibility" is at best questionable.
second, you claimed this is an "authentication method", therefore, even for its lowest level (by nist definition) the claimant shall demonstrate possession and control of the token. the problem telling apart remotely the legit user of the remote system and the adversary compromised that system is still an opened question. and you have not demonstrated how exactly this is done without circular reasoning, that is a fallacy by definition.
no doubts, your method is novel - granted patent assured that. however, the patent does not assure the strength of the method - so far this is only your unsubstantiated claim on something that does not satisfy requirements of the lowest authentication level.
------------------------------
boris taratine
helping the internet become the safest digital place in the world
Original Message:
Sent: Nov 18, 2023 04:59:19 AM
From: Dan Mimis
Subject: Reputable institutions that evaluate new cybersecurity patents
It's really simple, as stated in the White Paper #3: "Due to the infinite number of possible formulas that can be used, a brute force attack to figure out the algorithm is impossible."
So, I dare a top hacker to be the MitM with a quantum computer and figure out (after he recorded 1,000,000 logins):
- The formulas used, out of an INFINITE number of possible formulas! -- it's impossible, it's mathematical common sense;
- The predetermined positions of the Active Elements inside the AOTC;
- The numerical correspondents of the Active Elements;
- The position of Rc;
- The relationship between Rc and the sets of formulas.
Yes, I know that not many people have access to a quantum computer, so just ask a mathematician. It doesn't even need to be a mathematician, any highschooler should know the answer: one just can't "solve" the infinite.
------------------------------
Dan Mimis
TUPLEZZ
TUPLEZZ
Original Message:
Sent: Nov 18, 2023 03:24:47 AM
From: boris taratine
Subject: Reputable institutions that evaluate new cybersecurity patents
thank you, Dan
you claimed your method makes *it* "impossible". the only way it is possible is when an attacker shall break laws of physics or mathematics to circumvent.
so, here is my question: what are those laws the attacker shall break that makes it impossible to defeat your method?
------------------------------
boris taratine
helping the internet become the safest digital place in the world
Original Message:
Sent: Nov 17, 2023 05:06:10 PM
From: Dan Mimis
Subject: Reputable institutions that evaluate new cybersecurity patents
The patent number is mentioned on my blog. Here it is: US11290444B2
The method is by far better explained on my blog (where I posted the Provisional in plain English AND the White Paper, which I'll post below) for anybody who is not a patent attorney. The non-Provisional is way longer and you'll enjoy all the legal mumbo jumbo ...
White Paper:
------------------------------
Dan Mimis
TUPLEZZ
TUPLEZZ
Original Message:
Sent: Nov 17, 2023 12:50:47 PM
From: boris taratine
Subject: Reputable institutions that evaluate new cybersecurity patents
I am not interested in promotional marketing sales materials. would you share the patent number?
------------------------------
boris taratine
helping the internet become the safest digital place in the world
Original Message:
Sent: Nov 17, 2023 12:12:59 PM
From: Dan Mimis
Subject: Reputable institutions that evaluate new cybersecurity patents
Yes, you can find all the details at https://tuplezz.blogspot.com/
(The link was in my first post but the moderator deleted it)
------------------------------
Dan Mimis
TUPLEZZ
TUPLEZZ
Original Message:
Sent: Nov 17, 2023 08:23:39 AM
From: boris taratine
Subject: Reputable institutions that evaluate new cybersecurity patents
would you share the patent no?
------------------------------
boris taratine
helping the internet become the safest digital place in the world
Original Message:
Sent: Nov 15, 2023 10:40:22 AM
From: Dan Mimis
Subject: Reputable institutions that evaluate new cybersecurity patents
Hi guys!
My patent for 'METHOD AND SYSTEM FOR STRONG AUTHENTICATION AND SECURE COMMUNICATION' has been recently granted.
I believe that TUPLEZZ is, most likely, the strongest phishing-resistant MFA ever invented, designed to be very beneficial to our national interest and security – but I could use some inputs.
Do you know of any reputable institutions (say, universities, but not only) that review and provide an evaluation for new patents in cybersecurity?
Thank you,
------------------------------
Dan Mimis
TUPLEZZ
TUPLEZZ
------------------------------