Why forcing users to change passwords doesn't solve the problem

I hate policies that say that users have to change passwords periodically because that way the system is "more secure". Bruce Schneier has discussed this a few times in Crypto-Gram. I also like this recent post on Slashdot by dangermouse:

That is the single most hare-brained bit of common security "wisdom" in the world.

Years ago, I picked a password that's random as hell and was very difficult to remember. No password cracker– dictionary *or* brute force– has broken it yet. I use this password on about ten systems.

If I changed those passwords on a regular basis, I'd have to come up with something easier to remember to make up for the decreased learning time. That would likely make my password less secure.

I keep running into admins who– by hook or by crook– make their users change passwords periodically. The result? Passwords on Post-It notes; passwords that are the names of pets or wives or firstborn children; sets of passwords that are absurdly simple and that get cycled through.

If they had just let the users keep their original passwords and run a cracker against the shadow file to turn up the overly simple ones, their systems would be a lot more secure. But somebody told them changing passwords frequently was a good idea, and by god their users are going to change passwords frequently.

What to do with all those terabytes?

Bryan Hayes has a short history of the technology of disk drives. He speculates on consumer priced multi-terabyte drives by the next decade.

But the best part is at the end when he speculates on how what we will do with room for all those bits:

I have some further questions about life in the terabyte era. Except for video, it's not clear how to get all those trillions of bytes onto a disk in the first place. No one is going to type it, or copy it from 180,000 CD-ROMs. Suppose it comes over the Internet. With a T1 connection, running steadily at top speed, it would take nearly 20 years to fill up 120 terabytes. Of course a decade from now everyone may have a link much faster than a T1 line, but such an increase in bandwidth cuts both ways. With better communication, there is less need to keep local copies of information. For the very reason that you can download anything, you don't need to.

The economic implications are also perplexing. Suppose you have identified 120 terabytes of data that you would like to have on your laptop, and you have a physical means of transferring the files. How will you pay for it all? At current prices, buying 120 million books or 40 million songs or 30,000 movies would put a strain on most family budgets. Thus the real limit on practical disk-drive capacity may have nothing to do with superparamagnetism; it may simply be the cost of content.

On the other hand, it’s also possible that the economic lever will act in the other direction. Recent controversies over intellectual property rights suggest that restricting the flow of bits by either legal or technical means is going to be very difficult in a world of abundant digital storage and bandwidth. Setting the price of information far above the cost of its physical medium is at best a metastable situation; it probably cannot last indefinitely. A musician may well resent the idea that the economic value of her work is determined by something so remote and arcane as the dimensions of bit cells on plated glass disks, but this is hardly the first time that recording and communications technologies have altered the economics of the creative arts; consider the phonograph and the radio.

Still another nagging question is how anyone will be able to organize and make sense of a personal archive amounting to 120 terabytes. Computer file systems and the human interface to them are already creaking under the strain of managing a few gigabytes; using the same tools to index the Library of Congress is unthinkable. Perhaps this is the other side of the economic equation: Information itself becomes free (or do I mean worthless?), but metadata — the means of organizing information — is priceless.

The notion that we may soon have a surplus of disk capacity is profoundly counterintuitive. A well-known corollary of Parkinson’s Law says that data, like everything else, always expands to fill the volume allotted to it. Shortage of storage space has been a constant of human history; I have never met anyone who had a hard time filling up closets or bookshelves or file cabinets. But closets and bookshelves and file cabinets don't double in size every year. Now it seems we face a curious Malthusian catastrophe of the information economy: The products of human creativity grow only arithmetically, whereas the capacity to store and distribute them increases geometrically. The human imagination can't keep up.

Or maybe it's only my imagination that can't keep up.

Digital cash and the "double-spending" problem

http://www.ex.ac.uk/~RDavies/arian/emoneyfaq.html#double

A nice summary of the issues with digital cash that arise because bits are so easy to copy (unlike physical currency). Covers topics like online vs offline systems, and identified vs anonymous systems. The latter comparison is the more interesting, because with fully

identified currency, the life of a "bill" is perfectly tracked. As the author points out:

"By the way, did you declare that $20 bill your Grandmother gave you for your birthday? You didn't? Well, you won't have to worry about forgetting those sorts of things when everybody is using fully identified e-money. As a matter of fact, you won't even have to worry about filing a tax return. The IRS will just send you a bill."

EFF has several articles on digital cash. I reccommend the double_spending.articles because it's a nice mix of overiew plus some details and some math so that it doesn't seem like a bunch of hand-waving.

Are we just biological "machines"?

Some people argue that we are very complex "machines". From this starting point, you could argue that someday we will be able to invent "machines" that are intelligent and conscious (eg. AI) just like we are. This makes many people uncomfortable, and those people claim that you could never make such a "machine". In those cases, an interesting question to ask is, "How do you know that you are not a machine?". The following is written by Marvin Minsky, in an afterword to Vernor Vinge's novella "True Names":

"Ridiculous," most people say, at first: "I certainly don't feel like a machine!".

But what makes us so sure of that? How could one claim to know how something feels, until one has experienced it? Consider that either you are a machine or you're not. Then, if, as you say, you aren't a machine, you are scarcely in any position of authority to say how it feels to be a machine.

A solution to online auction sniping?

Auction "sniping" is the practice of waiting until the very last second in an online auction before placing the winning bid. By waiting until the last possible second, nobody else can get in and increase your bid.

Here's an interesting solution to the "problem", sent in by a reader of David Coursey's anchordesk column.

For every minute you maintain the high bid, you get a point. The bidder with the most points at the end of the auction is the "Auction Leader," and has the right to match the "winning bid" after the close of auction and to purchase the item.

The auction item would reach its final sale price earlier in the auction process, giving each bidder a better understanding of how other bidders value the object. This should on average increase the sale price of the item. Additionally, the seller would know how well his auction is doing before it ends. A bidder would know early on in the auction what his odds of winning are."

Unintended consequences: three years under the DMCA

http://www.eff.org/IP/DMCA/20020503_dmca_consequences.pdf

An excellent paper on the chilling effects of the 1999 Digital Millennium Copyright Act. I've excerpted the executive summary below:

Since they were enacted in 1998, the "anti-circumvention" provisions of the Digital Millennium Copyright Act ("DMCA"), codified in section 1201 of the Copyright Act, have not been used as Congress envisioned. Congress meant to stop copyright pirates from defeating anti-piracy protections added to copyrighted works, and to ban "black box" devices intended for that purpose.

In practice, the anti-circumvention provisions have been used to stifle a wide array of legitimate activities, rather than to stop copyright piracy. As a result, the DMCA has developed into a serious threat to three important public policy priorities:

Section 1201 Chills Free Expression and Scientific Research.

Experience with section 1201 demonstrates that it is being used to stifle free speech and scientific research. The lawsuit against 2600 magazine, threats against Princeton Professor Edward Felten’s team of researchers, and prosecution of Russian programmer Dmitry Sklyarov have chilled the legitimate activities of journalists, publishers, scientists, students, programmers, and members of the public.

Section 1201 Jeopardizes Fair Use.

By banning all acts of circumvention, and all technologies and tools that can be used for circumvention, section 1201 grants to copyright owners the power to unilaterally eliminate the public’s fair use rights. Already, the music industry has begun deploying "copy-protected CDs" that promise to curtail consumers’ ability to make legitimate, personal copies of music they have purchased.

Section 1201 Impedes Competition and Innovation.

Rather than focusing on pirates, many copyright owners have chosen to use the DMCA to hinder their legitimate competitors. For example, Sony has invoked section 1201 to protect their monopoly on Playstation country from playing games legitimately purchased in another.

This document collects a number of reported cases where the anti-circumvention provisions of the DMCA have been invoked not against pirates, but against consumers, scientists, and legitimate competitors. It will be updated from time to time as additional cases come to light. The latest version can always be obtained at www.eff.org.

Article on augmented reality

I've been wondering when augmented reality technology would start showing up as more than a curiosity.

To date most articles about these kinds of interactive real-time heads-up display systems have been of the "gee-whiz" variety. This article discusses the likely impacts when it does become available.

My only quibble is the 10-year timeline. I think that some of the ideas in the article are a bit more than 10 years away. Certainly the computers we will be able to wear will be small enough, but issues of power supply, display technology, and general integration do not follow the 18-month Moore's law