The stupidity of the Secret Question and the death of passwords

Schneier on Security: The Curse of the Secret Question

I'm going to take some credit for this post by Schneier, the god of modern security. I wrote him a few weeks ago asking him to address the use of these inane "secret questions". Here he's done it, and in fine form. The stupidity behind these "secret questions" is breathtaking, but Schneier correctly points out (hey, it was in my email to him!) that this is yet another sign that passwords have passed their prime.

It's happened to all of us: We sign up for some online account, choose a difficult-to-remember and hard-to-guess password, and are then presented with a 'secret question' to answer. Twenty years ago, there was just one secret question: 'What's your mother's maiden name?' Today, there are more: 'What street did you grow up on?' 'What's the name of your first pet?' 'What's your favorite color?' And so on.

The point of all these questions is the same: a backup password. If you forget your password, the secret question can verify your identity so you can choose another password or have the site e-mail your current password to you. It's a great idea from a customer service perspective -- a user is less likely to forget his first pet's name than some random password -- but terrible for security. The answer to the secret question is much easier to guess than a good password, and the information is much more public. (I'll bet the name of my family's first pet is in some database somewhere.) And even worse, everybody seems to use the same series of secret questions.

The result is the normal security protocol (passwords) falls back to a much less secure protocol (secret questions). And the security of the entire system suffers.

What can one do? My usual technique is to type a completely random answer -- I madly slap at my keyboard for a few seconds -- and then forget about it. This ensures that some attacker can't bypass my password and try to guess the answer to my secret question, but is pretty unpleasant if I forget my password. The one time this happened to me, I had to call the company to get my password and question reset. (Honestly, I don't remember how I authenticated myself to the customer service rep at the other end of the phone line.)

Which is maybe what should have happened in the first place. I like to think that if I forget my password, it should be really hard to gain access to my account. I want it to be so hard that an attacker can't possibly do it. I know this is a customer service issue, but it's a security issue too. And if the password is controlling access to something important -- like my bank account -- then the bypass mechanism should be harder, not easier.

Passwords have reached the end of their useful life. Today, they only work for low-security applications. The secret question is just one manifestation of that fact.

In my case I wrote Schneier when a corporate system asked me for both my password and my secret question. Of course I knew the password (I use my generic ultra-low-security password for unimportant internal systems), but my "secret answer", like Schneier's, was a string of flailing keystrokes. I had to spend some days fighting with a mailbot to get both the secret answer and password reset. (BTW, corporate systems are usually far less service oriented than public systems, after all, the users have no power and no choice. Senior execs have power of course, but their admins deal with the software.)

CIA rebels not done yet

The New York Times > Washington > '01 Memo to Rice Warned of Qaeda and Offered Plan

We've known for some time that Clarke gave Condoleeza Rice specific warnings about al Qaeda -- which she ignored (she thought China and Russia were our big threats). The interesting news here is the role of the CIA in releasing a document:

A strategy document outlining proposals for eliminating the threat from Al Qaeda, given to Condoleezza Rice as she assumed the post of national security adviser in January 2001, warned that the terror network had cells in the United States and 40 other countries and sought unconventional weapons, according to a declassified version of the document.

The 13-page proposal presented to Dr. Rice by her top counterterrorism adviser, Richard A. Clarke, laid out ways to step up the fight against Al Qaeda, focusing on Osama bin Laden's headquarters in Afghanistan...

... The proposal and an accompanying three-page memorandum given to Dr. Rice by Mr. Clarke on Jan. 25, 2001, were discussed and quoted in brief by the independent commission studying the Sept. 11 attacks and in news reports and books last year. They were obtained by the private National Security Archive, which published the full versions, with minor deletions at the request of the Central Intelligence Agency, on its Web site late Thursday.

This is old news, but it's interesting that the CIA surrendered the document. These days it's generally pretty easy to refuse such requests. I wonder if the director of the CIA (a Bush loyalist) knew of this release.

Trash company, earn $42 million

The New York Times > Business > Fiorina Exiting Hewlett-Packard With More Than $42 Million

This wouldn't be so bad if she were getting the $42 million from Dell. But to get it from her own employers?

Can someone please sue the HP board?

Microsoft rot?

ABC News: Silicon Insider: R.I.P. Microsoft?

A Silicon Valley guy prophesies hard times for Microsoft:

Great, healthy companies not only dominate the market, but share of mind. Look at Apple these days. But when was the last time you thought about Microsoft, except in frustration or anger? The company just announced a powerful new search engine, designed to take on Google -- but did anybody notice? Meanwhile, open systems world -- created largely in response to Microsoft's heavy-handed hegemony -- is slowly carving away market share from Gates & Co.: Linux and Firefox hold the world's imagination these days, not Windows and Explorer. The only thing Microsoft seems busy at these days is patching and plugging holes...

... Microsoft has always had trouble with stand-alone applications, but in its core business it has been as relentless as the Borg. Now the company seems to have trouble executing even the one task that should take precedence over everything else: getting "Longhorn," its Windows replacement, to market. Longhorn is now two years late. That would be disastrous for a beloved product like the Macintosh, but for a product that is universally reviled as a necessary, but foul-tasting, medicine, this verges on criminal insanity. Or, more likely, organizational paralysis.

... And do college kids still dream of going to work at MS? Five years ago it was a source of pride to go to work for the Evil Empire -- now, who cares? It's just Motorola with wetter winters.

Of course, you say, he would say that. The death of Microsoft is dear to the heart of the Valley. This guy gets a bit of credibility though; he claims he also rang the bell for Carly/HP and for Silicon Graphics. (He doesn't mention the other 55 companies he said were going down ... :-)

On the other hand, the usual rules of capitalism don't apply to monopolies. And then there's the patent weapon. Microsoft hasn't even begun their scorched earth patent attack. They can't "go nuclear" until the EU accepts software patents, but that will probably happen within a month or so. Yet even then Microsoft must worry that India and China might rebel. Microsoft has an incredible weapon at hand, but like all doomsday weapons it can also destroy its master.

And even the monopoly isn't a perfect weapon. Microsoft bought the Bush administration, but the Bushies prize loyalty above all else -- and they suspect that deep down Gates despises them. The Bushies won't stay bought, and the EU is an even tougher case.

Beyond monopoly and patents, what does Microsoft have? Incredible numbers of brilliant people yes, but many of their best innovations are likely disruptive threats to Microsoft's cash stream (Office, XP). Their "nasty" innovations can further the monopoly; but that risks the delicate game Microsoft pays with corrupt governments. (Ok, so they also have more wealth than most nations and they can specify cash flow on demand -- but they're addicted to that cash flow.)

The fear of cash flow disruption, or of losing control of key governments, mean Microsoft's biggest innovations rarely get to market. Meanwhile Longhorn, a festering mass of complexity, recedes into the future, while historic legacies and worldwide dislike breed an endless horde of software attacks.

Years ago a judge who wouldn't be bought decided to split up Microsoft. He was overruled. Gates decided the empire must stay whole, and he made his Faustian deal with the Bushies. That might have been the right decision for a company that can mint money, but I suspect if Microsoft had been broken up its component parts wouldn't be in any way paralyzed today. Instead Microsoft is turning into the pre-breakup AT&T of the 21st century.

Advanced warning of 9/11 -- by about 25 years

In October of 2001 I wrote

Over the past century technology has increased destructive power more than it has increased defensive capabilities. Technology, including communication networks and knowledge distribution, has brought to individuals and small groups (micro-powers) the capabilities once limited to nation states; the cost of acquiring and deploying nuclear and particularly biological weapons has decreased substantially. It has increased the harm potential of individuals and small groups. I sometimes call this the AIM problem, a pseudo-acronym for Affordable, Anonymous Instruments of Mass Murder. Our technologies are lowering the cost of the havoc, and the new weapons can be deployed anonymously. Anonymity means invulnerability. We cannot be anonymous, so we are are at an enormous disadvantage -- eventually contending against an invulnerable opponent with irresistible weapons.

In 1978, at a Berlin conference, Brain Michael James of the RAND Corporation said

We are approaching an age in which national governments may no longer monopolize the instruments of major destruction. The instruments of warfare once possessed only by armies will be available to gangs...

1978. Fallows, writing in the Jan 05 Atlantic (paywall), says James first wrote about this even a few years earlier, in 1975.

The Fallows article is essential reading. When will we start to talk about this new world like adults? I see no sign that we're ready to begin.

How fast could YOU spend 25 billion dollars?

PBS | I, Cringely . Archived Column

Why is it only Robert X Cringely ever writes about this stuff? It would be less peculiar if he were usually wrong, but he's most often right. Cringely says the VCs are going to spend some change fast ...

In 1999-2000 -- at the very peak of the dot-com boom -- venture capital firms were not only taking companies public at a furious pace, they were just as furiously raising new venture funds -- funds that will shortly be coming to the end of their lives. Throughout the fixed lifespan of these funds venture capitalists are typically paid 1-2 percent of the total fund per year as a management fee. If a VC raises $100 million for a fund with a six-year life, they'll take $2 million every year as a management fee, whether the money is actually invested or not. Any money that remains uninvested at the end of the fund must be returned to the investors ALONG WITH THE ASSOCIATED MANAGEMENT FEE.

Right now, there is in the U.S. venture capital community about $25 billion that remains uninvested from funds that will end their lifespans in the next 12-18 months. If the VCs return those funds to investors they'll also have to return $3 billion in already-spent management fees. Alternately, they can invest the money -- even if they invest it in bad deals -- and NOT have to cough-up that $3 billion. So the VCs have to find in the next few months places to throw that $25 billion. They waited this long in hopes that the economy would improve and that technical trends would become clear so they could do their typical lemming-like jump off the same investment cliff as all the other VCs. Well, we're at the edge of the cliff, so get ready for the most furious venture investing cycle in history.

The national identification card and database

Slashdot | House Approves Electronic ID Cards

The US House has approved a de facto national indentification card and database that will aggregate data across all citizens.

Ten years ago this would have caused a great fuss. Now the comments on Slashdot (ok, so Slashdot is pretty vapid these days) are tepid and confused.

Resistance is indeed futile. Let's get our chips implanted and get this over with.

Google's vector maps and Safari

as simple as possible, but no simpler: Mapping Google

There've been many posts on Google's maps, but few capture how much radical innovation is involved. This page gives an extensive overview, Jon Udell's post also links to a Slashdot discussion. To the cognoscenti Google Maps and Gmail are signs of a rich world of web applications that few had anticipated. I do wonder what Google will do with their browser project. GBrowser may make Netscape's old Constellation project seem humble.

The resolution and zoom range of the maps comes from their vector nature; they are not the bitmaps we are all to familiar with. We've been waiting 10 years for someone to deliver vector maps to the masses, now we'll never tolerated raster maps again. PDF, Flash and SVG maps have been done before, but not on this scale.

Some posters claim Google is using VML. That's unlikely as Firefox does not support VML. Nor are they using SVG. They appear to be using some internal XML vector representation and doing something called an XSLT transform (magic to me). Unfortunately OS X Safari is missing the XSLT transform capability. It may appear in Tiger.

This is the first application that's made me consider leaving Safari for Firefox. Apple needs to wakeup.

Potemkin Comments are real now

Faughnan's Notes: Faughnan's Notes: Potemkin Comments

I've updated the template for this blog and tested comments, they now work as expected. I don't have the time to fight comment spam, so commenting requires authentication by Blogger (you have to sign up with Blogger to comment).

Kim Il Sung - burning books and documents

Gallery One - Kim Il Sung - Pg. 42

Also via Boing-Boing -- they're firing on all cylinders today. This is one in a series of propaganda portraits mythologizing an infamous tyrant.

But what of the expression of the girl in the first row of soldiers, third from the left? She does not look pleased at the sight of all those burning books.

I wonder if Kim Il Sung noticed? If so the artist would not have long survived.

Later in the series the tyrant starts to look both pudgy and ridiculous. At the end, the artist seems to have crossed into frank parody, or into madness.

The forgotten 1960s

afri-cola.../charles wilp nonnen commercial

via boing-boing. I'm not quite sure what this German web site was about, but this link features an alleged 1968 commercial that has to be seen to be believed. It's sufficiently unusual that I wonder if the entire site is some diabolical experiment in art and gullibility.

It does remind me of something that attracts little comment. There were a lot of magazines and books in the 1960s that basically reflected the interests of 19 year old male libertines. I admit I read a few myself, though I was a child then. Within 10 years those books and magazines became quite hard to find -- even in used bookstores. It's as though they were erased.

I've always found this quite curious, but little is made of it. Instead the popular convention is that the decadent left celebrates the 1960s. Indeed there are some who celebrate a sort of synthetic memory that has some vague resemblance to the 1960s, but only fragments of the cultural artifacts of the 1960s survive. Or maybe I'm just looking in the wrong places?

Visiting this page, I wonder if someone is going to start trying to reconstruct that lost popular culture. If so, we may learn that some things are best left in dark and dusty corners ...

Fidonet lives?!

Boing Boing: FidoNET Web-interface

FidoNET, astoundingly, lives on. Allegedly there's a niche for the underlying technology in some parts of the world. From Boing-Boing:

...Back in the paleolithic era, I was hooked on Tom Jennings' amazing FidoNET system for linking message boards across dial-up BBSes...FidoNET was optimized for linking up conversations at a distance in places where long-distance calls cost a lot and didn't work so well, and that makes it ideally suited to the less-developed world, where FIDONet is still in use.

Now Jon describes the system he's built to bridge the Web into FidoNET, which you can access here...

I am so ancient I remember the pre-FIDONet era. In the really old days, when only universities were permitted net access, a handful of dial-up BBS services ruled the vastlands. Even at night it was costly to phone them, but real nerds (this was before geeks) paid for unused nighttime bandwidth on the pre-Internet packet switching networks. I think there were three such, I believe I used something called Telenet (It's still around. I'd dial in to a local Telenet node, then connect via Telenet's network to another node, then I think that node dialed a local BBS. It was all very geeky.

Once Fidonet (I don't remember it being written as FidoNET) caught on Telenet was no longer worthwhile. Many of the great BBS of the day were eclipsed by lots of small BBSs, each acting as a Fidonet node and each being a local call. I lived in Escanaba then, a small and lovely town in Michigan's upper penninsula. At first my Fidonet node was a low cost long distance call, then a local BBS took over. Fidonet had a pretty steep barrier to entrance, so the community was pretty strong -- albeit favoring technical issues. In those days I was quite keen on OS/2, so I followed that community fairly closely.

Then came the net. My MCI email address acquired an ampersand: 4867991@mcimail.com. The BBS dinosaurs dwindled and disappeared.

Or so I thought.

But it's not so. Fidonet lives on, albeit a shadow of its former self.

Who knows ... perhaps one day when the Internet becomes completely closed, and all interactions require Microsoft's networking and authentication layer, Fidonet may rise again. Stranger things have surely happened (I think).

Where can Bush find a secretary of the treasury? Slate and Salon have an answer.

Salon.com Technology | End of a hatchet woman

Slate and Salon have both covered Carly Fiorina "transition" (The word "termination" doesn't fit with a 23 million dollar severance package). I thought Slate was harsh (but fair) until I read Salon's (arguably fair) hatchet job on the "hatchet woman".

Interestingly both articles came to same conclusion. Carly, a loyal Republican and, one presumes, a major donor, will be offered the Secretary of the Treasury post in the new Bush administration:

As the Fortune article makes clear, Carly's numbers didn't work because they couldn't work, which is of course what folks like Walter Hewlett were saying three years ago. And so a once great company is a shadow of its former self, and Fiorina is out of a job. But don't cry for Carly. Given her way with numbers, there's surely a spot for her in the Bush administration. Secretary of the treasury, perhaps.

Wow. What a perfect fit. Bush can't sink much lower.

The power of the netMind: Outing another GOP fake

Salon.com News | Fake news, fake reporter

A couple of years ago a Rumsfeld project was leaked and then (supposedly) shut down. The project was to facilitate US military efforts by planting fake news stories. Of course anyone who thought it was really shut down was terminally naive. Instead the program evidently mushroomed, and, of course, became a part of a US focused initiative to advance GWB's agenda and reelection.

The silliness of the Talon/Gannon plant suggests the limitations of using pawns and exposes the fundamental philosophies of this administration:

1. The ends justify the means.
2. The public are sheep that must be guided by the wise.

The way this fraud was exposed, however, says something more interesting about the NetMind:

Gannon's star turn quickly piqued the interest of many online commentators, who wondered how an obvious Republican operative had been granted access to daily White House press briefings normally reserved for accredited journalists. Two weeks later, a swarming investigation inside the blogosphere into Gannon and Talon News had produced all sorts of damning revelations about how Talon is connected at the hip to a right-wing activist organization called GOPUSA, how its "news" staff consists largely of volunteer Republican activists with no journalism experience, how Gannon often simply rewrote GOP press releases when filing his Talon dispatches. It also uncovered embarrassing information about Gannon's past as well as his fake identity. When Gannon himself this week confirmed to the Washington Post that his name was a pseudonym, it only added to the sense of a bizarre hoax waiting to be exposed.

I first saw this type of emergent thinking when a group of interested persons working together rapidly exposed an international credit card fraud. That was before blogging, but the combination of a summary document (web) and email/usenet already allowed small slices of many disparate minds to collaborate in solving a problem.

Emergent problem solving through distributed mindslices linked by low bandwidth connections. Hmm. Reminds me of the SETI distributed processing effort, but running on wetware rather than hardware.

This is not new of course. It's as old as newspapers, but it really caught on in the early days of usenet. Web pages moved it up a level. Where will it end up?

Faughnan's Notes: Potemkin Comments

Faughnan's Notes

This blog has had a comments link for some time. I haven''t actually gotten any comments, but that was fine with me. Today, however, I received an email pointing out that the comment link doesn't actually work. Thanks Steve!

I suspect the problem is that I use an old template for this blog, so old it predates Blogger's comments infrastructure. So they've probably never worked. I ought to have tested them myself.

I'll have to change templates to get the comments working; I'll probably get to that in the next week or two. Sorry!

Update 2/10/05: I've updated the template and the comments seem to be working properly.