In the real world, yes. However, the assumption for playability is that "known plaintext attacks" generally can be made to work using whatever systems of math people use in the future. This makes public keys inherently unsafe, and means that direct access to any computer which is performing the encryption scheme will potentially render up the encryption key.

This is what we call "movie logic" - which is that if you show something on screen, it has to be small enough to be comprehensible for the viewers. So for example, finding a weakness in the system would in the "real world" be something involving combing through millions of bytes of metadata to reverse engineer the transforms that the computer would generate. But in the game world, this involves finding the actual e-mail and comparing it to the encrypted version. Because that's much cooler looking, and easier to explain to non-mathematicians.

People who aren't good at math can still understand the logic behind a known plaintext attack. You have the input, you have the output, you do "mathematics" to find the transform in the middle. This makes it ideal as the standard for what players are attempting to be able to do, because players who have no special computer knowledge can still imagine the kinds of things that their character might do in order to get to the weaknesses of the system. The logic behind counting processor cycles and extrapolating what reference frame shifts would be generated for specific messages is something which does not make sense to a lay person; making it very bad for the game. Remember that the ultimate goal is for complete lay people to describe in action words what the hacker is doing, both from the standpoint of the gamemaster and the players.

---

Oh, and because I forgot to mention: we're still using the technomancer terminology of echoes and submersion.

-Frank

You're the guy doing the hard work on the system. But I think that most people who play complex RPGs like this are pretty darn bright and you can produce a reasonable "realistic" approach without going into the details as long as whoever writes the rules understands more or less what details they are abstracting and what they want to achieve.

My assumption is that in the future there are still going to be the following classes of people doing crap on computers:
People who don't care at all about security or equally they trust the vendor's solution. These people tend to end up with crappy encryption that you really can break in real or near-real time.

People who are worried about security but don't have someone to tell them what is an isn't a good practice and don't understand why passwords are nearly worthless, etc. These people may well well end up with crappy encryption that you can beat trivially, or may have encryption that, plus some clues about their dog's name, you can chew on a for a few weeks of machine time and break it. Or maybe not. Critically important data (money, security credentials) will be well protected. This is the vast majority of smart people and corporations.

And people who have the NSA running their communications networks and overseeing their encryption. Which you can't break without either inside knowledge or physically breaking in and setting up a compromise. You can work on their encryption until the heat death of the universe and nothing useful will come out. This is well funded militaries, intel agencies and extremely security conscious divisions of certain corps, as it's expensive and gets in the way of doing work.

So having rules that allows breaking encryption trivially is useful. The important issue is that there has to be a way allowed by the mechanics to have encryption that you simply can't break via decryption unless you have actually done something like break into the Bank of Renraku and steal the codes. This allows electronic commerce, etc.

Sorry if I didn't read through much of the posts, but I'd like to back up kzt's idea of being crappy computer systems being made due to laziness/incompetence.

Whenever somebody becomes successful, they tend to do less hard work if their later inventions will be praised regardless. So I can see some hard/software systems that are "brand new" and suck compared to the "good old days."

The problem with human error based security holes is that, while they can very realistically be expected to exist, there is no way to rationally expect that you will know what they are ahead of time. This means that the thing you do in order to exploit the hole is not predictable without seeing the system. In a single-author piece of fiction this is not a problem, because the author is "seeing it" and the character's being written about are likewise "seeing it" and the character can smoothly respond to the weaknesses and look super clever. But in a multiple author system such as a role playing game, there are inherent limitations involved: the author who sees the systemic flaws in his mind's eye is not the same person as the author who is writing the actions of the hacker - so additional levels of discussion are required that slow down play.

Let's say that the weakness is that while the encryption is super badass, the key is utilized on behalf of whoever sends in the appropriate passcode, and most of the workers in the office have their commlinks set to send that passcode when you press a button because that's incredibly convenient. That means that you break the system by recording any of the workers come on shift and then playing it back from your own comm. That sounds pretty plausible and would make a really cool scene in a movie or a book. But... in a game it's actually not cool. See what happens in a game at this point is that the player of the hacker has no idea what the weaknesses of the computer system might be, so he has to ask the gamemaster what they are. Then the gamemaster tells him (after the appropriate die rolls), and then the Hacker character does the things that the game master just said he had to do in order to break the system.

In short, if the cryptographic weaknesses aren't consistent, the person who designs the system ends up being the person who announces what the actions of the Hacker will be. And that's not compatible with having a cooperative stroytelling game where the Hacker character is supposed to be under the direct control of someone other than the game master. If the players don't come to the table already knowing what the weaknesses of computer systems are going to be, the Hacker becomes effectively an NPC while he is doing his job.

The thing I really don't want to happen is this:

Player: What do I have to do to get into the system?
GM: You have to fill in Star Trek style technobabble here.
Player: OK. I do that.

The player should already know what the Star Trek technobabble is or better yet be able to make up some plausible technobabble himself.

-Frank

actually, that's more or less how todays WPA2 is being cracked as of right now . . you don't even need a super-computer to do that, just a good wifi-system that can send out enough white noise to stop other clients from connection so there is a hole in which you can inject your recorded piece of code *g*

I've always expected that that would be abstracted. The PC is using the tools that the defender should be using, but isn't. So it's a die roll to see how good their electronic security. The better the EW and PS:Matrix security the more dice. The GM just needs to decide how secure the site is so how many success you need. This may include infinite or absurd numbers.

A quick spew of numbers: Assuming a guru has Int 6, Skill 6 + Skill 6, so 18 dice. Plus edge, so the maximum of success that the worlds greatest hacker can get would be say 26. I think there are some cyber/bio options that I'm missing, but you get the point.

Typical good hacker with say 15 dice gets 5 successes, which shouldn't be enough to break into the Knight Errant data network but sure should be enough to break into Joe truck driver's house wireless. Then the hacker needs the skills and program(s) to exploit the weakness he found, as determined by the GM.

There could also be some sort of test as to whether the attempt is detected, as some approaches, like brute force attacks, are easy to notice if anyone is looking. I'd have two options, passive only (for a minus on the roll) and active, with the normal dice.

Considering how cartoon-like SR combat is, we can do better than the existing approach without getting bogged down in minutia. The characters do that, not the players.

So one of the things that I'm doing is revamping the Signal table severely. It's a sad fact that even the highest signal rating in the entire basic book is incapable of reaching a satellite in LEO, let alone reaching a geosynchronous satellite of any kind. I don't really hold it against the makers of unwired that their spell checker apparently decided to repeatedly auto-correct Low Earth Orbit (LEO) as LOE; but the fact is that they went to all that discussion about how satellites beyond a certain distance caused lag failed to take into account that nothing in the basic Shadowrun rules can reach those satellites at all.

So having set myself that particular task, there comes a couple of questions. The first is whether people want characters to be able to send high density signal attacks through geosynchronous satellites at all. That is, there will be an absolute limit based on the Speed of Light for how far you can send a high density signal and have it matter when it gets to the target that will apply regardless of how many retransmitters you have. Now as it happens, a Geosynchronous Satellite is almost 36,000 km up, meaning that the time for a signal to go up ad back down the gravity well is about .24 seconds - something which is very plausibly just in or just outside of the theoretical limits. The Moon is obviously right out and the asteroid belt even more so, but it's a debatable case at that point.

The other question is how far people want ordinary commlinks to be able to roam before they are stuck switching to low density signal?

-Frank

I trust your judgment on whether commlinks should be able to reach stuff up in space, but I don't worry about the question in physical terms (even though a quarter of a second does seem like a major problem to a hacker who acts every .75, or, worse, every .6 seconds), but rather I worry about it in gameplay terms. I'd like your system to explain why a lucky hacker sitting in Michigan can't hack into Zurich Orbital. The hacker has at least rating 6 stuff, while ZOG has rating 7, maybe 8, so why doesn't it get hacked fairly regularly? Other important, related topics include why hackers go on Shadowruns instead of hacking peoples' commlinks and taking all the money from their bank accounts, why they don't hack certified credsticks (which, since they're mobile, could be taken into a jammed zone where they can't call the bank for help and then hacked to the hacker's heart's content) to give themselves huge wads of money, why they don't hack their own bank account and give themselves some money (since money is, by this point, just electronic bits of data), and why they don't hack cars and tell them to autopilot themselves to the chop shop.

Best answer I have is: simplicity.

Zürich Orbital probably has the real data on computers that are stored inside a fairly massive Faraday Cage. The external computers actually talk to the outside world, and communicate with low density signal cable to the internal computers. The messages you send to the station are very simple and encoded in strong symmetric encryption that is specific to your account. They are passed through the external computers unaltered. This means that the system can be cracked in the following ways:

• You can get a hold of a commlink or credstick and hack it into authorizing Z-O to transfer all the money out of its account. Don't send the money into a traceable account if you expect there to ever be an investigation (which there probably will be, Z-O really hates fraud).
• You can hack the external computer into refusing a credit request by simply having it not get passed on to the internal computer.

But you can't hack the external computer into giving you unlimited lives because it doesn't even have records of how many lives you have, nor can you hack the internal computer without being on site (a fairly unlikely situation to begin with). You can't hack another account into thinking it is getting money without getting a hold of the credstick on the receiving end because the acknowledgment message is coming down in encrypted language specific for that account that neither you nor the external Z-O computer actually knows.

-Frank

'cause hacking your own bank account, and transfering the money to another account, claiming the money has been stolen so the bank will give you back your money, which they lost, is much more clever and actually more or less doubles the ammount of money each time you do it . . now imagine using 20 different banks and BAM you're set if you can wait a bit so to not make it look all too suspicious . .

You seem to have forgotten the satellite link, which is used to connect with satellites. Or are you interpreting the text to mean that it only has a Signal 8 transmitter, and not a satellite link?

the satellite link explicitly is a signal 8 transmitter. impressive as that is, it is not sufficient to reach LEO. as such, it is clearly unable to do it's job as a satellite link...

If you look how much power a hand held satcom phone really has, it's not enough to reach LEO. It's the honking huge antenna (like 12.5 meter x 16m) and amplifiers on the sat that help, plus the much more powerful transmitter on the sat. If I'm reading the specs right, an Iridium phone has a max power output of 0.7 watts. An average cell phone puts out about 1-2w max. A handheld FRS radio that you can buy for $50 in wallyworld is 0.5w.

"signal" in SR ignores so many critical factors that it's pretty worthless, and I'd argue, just as unsalvageable as the jammer crap. But since that would make a lot of work for Frank, I'd argue here that satcom is a special case and ignore the signal rating. It just works if you have satcom, and doesn't (no matter how powerful your radio is) if you don't.

Actually, this suggests a proglem that Frank probably wants to explicitly sweep under the rug, rather than just ignoring.
Signal range is very important for what can happen when. And particularly handwhake range is very important. Handshake range is defined, if I understand properly, as when each party can hear the other.

But, if one party has both a large transmitter and a big receiving antenna (or multiple carefully placed antennae if the frequency requires small ones, (and maybe some extra signal processing logic to filter out the noise) then it would seem that one could establish handshake from a longer distance. Imagine a guy parked on a roof with suitable plastic camouflage. He could, by this sort of thing, get handshake range on something a lot farther away than he is supposed to based on that items signal. Given that the base antenna is something small enough to hide in very small objects, there is a lot of room for this sort of game.

I am sure some sort of explanation can be crafted to keep this within bounds. So it ought to be included somehow I think.

Joel

Yes.

A Cisco engineer pointed out last week that the world record for an 802.11b wireless connection is somewhere around 140 MILES. This is versus the average 200-300 feet that you get with typical hardware. This is not using signal boosters, just really good antennas aimed VERY carefully by experts.

You can suck down people's sub-watt wireless signals from several miles away using a pringles can, when they will casually assume that the signal can't to be picked up outside the parking lot. If you use professional gear (like the NSA would) you can pick it up as long as you are in radio line-of-sight. Which is a long way from orbit.

Until I read all of your "Ends of the Matrix" house rules, I'll have to go with this. I don't play games for "realism," anyway.

The best way to represent this sort of thing with game mechanics is to have expensive reception equipment that increases the effective signal rating of the other party for purposes of determining handshake distance. If the Signal Table were left as-is and extended, a Satellite Link would need to receive a 3 Signal boost from the Satellite's receiver in order to high density signal into a LEO Satellite (effective Signal 11: range 4,000,000 meters) and low density signal into geosynchronous orbit (40,000,000 meters at effective Signal 13). That would be a minimal set of changes to existing material.

So that would create the basic set of Receivers that increase the effective signal of the other handshaker by 1, 2 (more expensive), or 3 (very expensive). This would automatically allow you to communicate very much farther away with cell towers because they could be expected to have Rating 3 Receivers (or even higher, because they are static infrastructure and don't have to fly around in space). Note that this technology would allow you to get handshake distance on a naked human brain from farther away. Even a Rating 1 Receiver would allow you to handshake a metahuman from 40 meters - which is as far as LOS is likely to go in a city or secure facility in any case.

There could also be the ability to set up longer distance fixed target transmissions with Electronic Warfare and specialty equipment - which would be how they get low density signal to the Luna and Mars stations. But that wouldn't extend the maximum distance of high density signal, which could very plausibly be at Signal 11 distances (4 million meters, or .0133 light seconds).

But that comes up to the second question: what kind of Receiver Rating should the satellite link have with its pocket dish? My inclination is that that would be a Rating 1 Receiver because it only costs 500Â¥.

-Frank

Like I said, that's only true if you only read the part about having a Signal 8. The very first sentence of the description is "This allows the user to uplink to communication satellites in low-Earth orbit, connecting to the Matrix from places where no local wireless networks exist." I'd like to point out that it doesn't say that this is by virtue of its Signal rating.

I imagine the device is used to provide coverage to a wide area on the ground, and usually has its Signal throttled back when shadowrunners use it.

The rules as written do not support you in this statement. Not even a little bit.

-Frank

Except where tehy state that it can reach satelites in LEO. The Signal 8 is probably referencing the effective area it can transmit to on the ground. Satelite Up-links are not Omni-directional "Look at me casting around to find a sattelite" they are directional, requiring you to at least know APPROXIMATELY where teh saellite is. The Uplink system most likely automates this whole process, while it can transmit around it up to Signal 8 radius. I mean..this is a GAME, its not rocket science. If the description says the thing can connect to satellite in LEO, then it can connect to satellites in LEO, and thus, the rules say it can. Not EVERYTHING needs to be statted out.

The rules very solidly support him on the first paragraph he wrote. The question is how the second sentence in the description of sattelite dishes can be read to make sense. And you loose nothing if you change the beginning of that sentence to "Used as a networking antenna, ...".

Yeah, that's what I meant. Like a non-profit arm of NeoNET welding one to the top of a tall-ish building in Redmond as a charitable effort to bring Matrix access to the disadvantaged, or a Desert Wars company command post using it to keep its squads in contact.

Including up grades to receivers would make data jacks almost mandatory for DNI. Trodes with a signal of 1 or more are completely unexceptionable to most users, especially in light of you take on crypto. I could see that kind of flashy 'clubbing' trodes as almost an open challenge to other hackers.

I'd suggest that this just be done to intercept signals via EW. Unless both sides have the mod you are not extending your handshake distance, you are just able to hear their transmission. This can be very useful indeed, but it doesn't allow you to communicate to them or fry their brain. Now if both sides have it then you can communicate directly to some guy on the moon via your comlinks and the little tripod mounted amplifier/pointer/directional antenna dohickies that you paid a bazilion for.

If you have a huge antenna and a huge honking transmitter you can do it like a satcom system does, but that isn't going to be manpackable or cheap. Given that this allows you to fly over a city and black hammer everyone from 12,000 feet I'd suggest this might be something best omitted.

The two go hand in hand (so to speak). If you can hear their transmission and you have enough power on your signal that they can hear yours - you're in handshake range.



Pretty much, yeah. Anyone really serious about their secrets would need to invest in a datajack, an internal commlink. or a copper foil hat.

-Frank

True. My point is that it's much easier to hear their transmission. You avoid all the elements associated with a massive power boost on your side so they can hear you, but it allows you to do things like listen to their PAN.

Faraday hats and headjammers. The hat would be something anyone can get at any store and headjammers just became infinitely more useful and ubiquitous. That is if hacking allows mind control and something as cheap as ¥20 can prevent for the hat or 1500 for a rating 6 headjammer.

Er ... if you buy a "Faraday hat," how are you going to get all-around coverage?

Or not put their information on a Matrix-accessible place/equipment. That will probably be the last thing that the security hacker expects; secret government documents that exist only in physical form, guarded in a bank vault in a security deposit box.

The dedicated paranoid will have a cyberskull with armor+insulation add-on. Faraday-cage for the brain.

I dunno. The eye sockets and jaw aperture is large enough to negate the ... er ... negation.

Man will have to fix Natures oversight.

ANY bit of eyeware can have a smartlink system, My adept has smartlink on his glasses along with some other visual modifications. A smartlink system isn't just a bit of software like a hacking program its a complex calculator and command system for optimum gun control and then relay that to what ever imaging device and gun. In short a smartgun system is its own device, comlinks are designed for Matrix access and interface, they aren't designed to interface with the real world like a smartlink system. This is also why a sim module is an accessory and not a program because on comlink can't do those kind of conversions.

Techomancers don't need comlinks or sim modules they interface with the matrix and the real world as if both realities were equal so its a simple process for them to duplicate the programing in a smartlink and operate it on their brains. However just like hackers, technomacners have a limit to how many complex forms they can have running at the same time.

As my knowledge about GPS and Satellites stands.

1. As said Frank LEO is not LOE.
2. As matter of technology, the problem is noise rather than power. Actually GPS doesn't consume too much energy due to algorithms and other applications that Increases the Signal/Noise ratio. I assume in 62 years of development it's quite possible to improve pretty much turning communication between earth surface and satellites very easy. I'd Rather don't make difference between LEO andHEO (geostationary satellites are part of High Earth Orbit) because a good constellation of satellites in LEO is as good as a geostationary one (turning sat connection to a mesh connection rather one satellite).

Although that, and for a more playable situation. I'll establish the need of a Satcom device in order to do that (just to exclude everybody from runners and making satellites more available). It can be argue that mana weather disruptions tend to make communications difficult and these effects are difficult to correct (just some flavor for the need ofsatcom). About lag, I'll apply a -1 Response and keep it going.

Then talking about unwired:

I've finished it today. And i think a subjective review of the book is always necessary. At least in this post.

I have to say that until page 85 i loved the book ( at least i got a better idea about the matrix).
Beyond that most for the information of hacker's handbook was unnecessary, being botnets the worst of them (stealing the pride of a hacker, turning hacking in a matter of numbers rather than quality).

The software chapter adds too much complexity to the game (i think program designing and software bundles were the good points of the chapter and i find them too short or low worked). Programs options are interesting, the new programs weren't really necessary (some were like program you need once in a life, and nuke,blackhammer and blackout could be made as an attack program with options). Tacnet is not necessary (while fighting like crazy, i have to believe in 3 seconds you are able understand pop ups in AR ).

Technomancer disappoints me as there are only 15 pages about them and everything is resolved by echoes (I was expecting some way a technomancer can spend his money in empowering his abilities, like foci and alike, but as it seems technomancers only advance with Karma, as echoes and submersion is another Karma Hole).

Sprites chapter is not bad although the linking system was a swift kick in the nuts (another time Karma ¿256 days?).

Luckily, matrix phenomena improved a little showing a better description of AI and the design of UV nodes (although green, yellow, red nodes classification is now dead).

Simsense and skillware, well , they weren't bad.

In conclusion: It's a book good for GM but it's really poor for PC, as improves complications of situations, steals importance to hackers and leave technomancers only a door to submersion and karma expenditures.

Turning into how matrix can be improved (at least what I'll do in my games).

-Agents are bound to the node in witch they are created (turning them into IC only, let the hackers reclaim their land)

-Take out stealth as a program (when a node with system 6 (quite secure node, let's say Lone star) arrives a technomancer with Stealth 12 (some threading and one sprite) it's like a swat team trying to enter in a shelter [were is the dangerous hacking here?], now i understand why people in emergence freak out of technomancers).

-Simplify a little bit programs (too much for specific uses and technomancers are eager to turn into complex forms, although programs suites were kind of interesting.)
I think I'll try something like third with cyberdecks but in program suites, putting rating to a group of programs and hackers may modify them lowering and raising the ones they like.

Only thing I'm not happy about is the fact my book is'nt in my hands yet!