PrimeNet Security

[Damian]

I have some questions regarding GIMPS security.
Is the connection between my computer and Primenet encrypted? If not, what prevents someone else sending a double checking with the same residue on the same number without actually checking it?
The other question is what is the purpose of a user password if the browser doesn't encrypt it when I check my statistics...
As I don't mind if anyone else reads my statistics I would like to delete my password, does anyone know how I can do that?.

[moo]

needs to be changed in primenet hopefully when v5 comes along....

Originally Posted by Damian

Is the connection between my computer and Primenet encrypted?

No

what prevents someone else sending a double checking with the same residue on the same number without actually checking it?

Lack of incentive -- there's not much of value to steal/hack/forge/vandalize in GIMPS.

One could gain undeserved credit to move up on the Top Producers list, but a rapid rise could provoke close scrutiny by other GIMPSters.

One could "sabotage" GIMPS LL double-check results with a false confirmation, but if it's just another of the 99.999% of DCs that confirm compositeness, what difference will that make? That exponent was already reported to be composite and will probably get factored sometime in the future anyway.

A fake DC report with a nonzero residue that doesn't match the original residue will just provoke a prompt triple-check. (And, of course, submitting a false DC residue of zero will instantly attract high-powered attention and exposure -- we already saw that happen when a false zero residue was _un_intentionally reported!)

Suppose an undetected hardware/software error resulted in an erroneous nonzero residue in the original sincere LL, then someone fakes a matching DC with the same erroneous residue? Well ... hmmm .. I guess someday someone will do a correct triple-check and discover the error ... but anyway this could be an actual problem scenario, and it could even conceiveably (at long odds) hide a real Mersenne prime for a long time.

Richard "cheesehead" Woods (on vacation)

[Damian]

And with respect with the password, what's the purpose of the User/Team password?
As far as i know, in a User account anyone accessing his account could stole his credits by changing his name, or merging it with another account. Or I am wrong
That's not tha case in a Team account because the Team name can't be changed that easily (has to email primenet first)
So in the Team case I don't see the point of having a password at all, so anyone can join to the team simply by using the Team name.

[cheesehead]

Originally Posted by chee(s)ehead

Suppose an undetected hardware/software error resulted in an erroneous nonzero residue in the original sincere LL, then someone fakes a matching DC with the same erroneous residue?

But I forgot: since the last two hex digits of residues are hidden in all reports, trying to fake a matching DC with the same residue (correct or not) as the original LL would have only a 1/256 chance of actually matching the first residue (unless the faker were the same person as the first-time tester, or had access to the first-time tester's data, etc.). So this scenario is at even longer odds than I thought earlier.

Richard "cheesehead" Woods (on vacation)

[garo]

Yes, but if someone has access to your network traffic they can see those hidden digits as well.

[Damian]

I thought that the redundant bits send to the server (against mail errors) served also for this purpose. Maybe as some kind of hash or signed as with in public key criptography, and not only as CRC. Isn't that the case?

Originally Posted by garo

Yes, but if someone has access to your network traffic they can see those hidden digits as well.

[garo]

As far as I can remember the message is sent as binary so it is not as bad as clear text. But a determined hacker could find the hidden digits. I don't think there is any encryption, only CRC.