Category Archives: Security

Security

Phone Gadgets for Security

Leave a comment

Someone just pointed me to a couple cute new security-related toys for mobile phones.

One converts text to speech, using the camera, and the other provides an image-based second-factor authentication mechanism.

Iansyst CEO Tim Sutton told silicon.com: “It takes a standard HTC TyTN smart phone and turns the inbuilt camera into a scanner but a scanner which can be taken anywhere and used anytime”.”

Exciting stuff. Seems extreme, but if someone is blocked from downloading data, they might be able to do a screen record and send the data to a remote audio output. In fact, imagine if someone could redirect the audio of this gadget. Could a “transcribing” attack vector become more relevant? Also wonder what would happen if you just left the scanner on as you walked around town — could the resolution handle billboards, or even street signs? Transcription via highly-mobile scanners presents a new frontier.

The other gadget is less of a tangent:

Users create a pattern by choosing four squares on a grid (pictured) and it is this pattern which is then used to authenticate purchases or passwords, instead of a fixed PIN or password.

The grid is filled with random numbers every time a password or PIN is required. Therefore, a unique number is entered and not the same four-digit code.

The amusing thing to me about this is that the grid is made up of numbers instead of images. Why? Are people expected to be more comfortable with numbers? Maybe it’s just easier to implement and less offensive. Seems backwards and upside down to me. Might be a good idea to reconsider the possibilities of allowing people to enter “something they know” on “something they have”, when that thing they have is a high resolution color screen.

Don’t get me wrong. I think it’s clever that the phone assigns random numbers to a keypad that has nothing to do with numbers (just color and position are meant to be remembered), but why use numbers?

Security

Giant Ofcom fine for GMTV over consumer trust

Leave a comment

The BBC reports:

For four years, finalists were chosen before lines closed – meaning those who rang later wasted up to £1.80 a call.

Money for nothing, apparently. That did not go over so well with the regulators, who protect consumer interests.

Ofcom said the breaches “constituted a substantial breakdown in the fundamental relationship of trust between a public service broadcaster and its viewers”.

[…]

The problems began in January 2003 and lasted until March 2007, when they were uncovered by the BBC’s Panorama programme.

During this period, GMTV’s revenues amounted to more than £63 million.

It claimed viewers lost £10m a year, as up to half of all callers never had a chance of winning.

The “never had a chance of winning” is a very strange-sounding phrase. I suppose it is this measure of certainty that made it such an open and shut case. In contrast, things like environmental harm might have greater consequences but industry leaders and government cronies (e.g. the Bush administration) are almost always able to find someone who will try and challenge the notion of certainty.

This process of intentional obfuscation and uncertainty can then lead to trust (i.e. snakeoil) ironically and unfortunately. It seems as though GMTV was unable to obfuscate the fact that they had closed the system and thus took in subsequent money on false pretense.

History, Security

“…America is not in any sense founded on the Christian Religion…”

Leave a comment

Talk to Action has a lengthy review of a treaty that is meant to help debunk Christian revisionists who claim the US was founded on a single faith:

One of the most often used arguments that the United States was not founded as a Christian nation is Article 11 of the 1797 Treaty of Peace and Friendship between the United States and the Bey and Subjects of Tripoli of Barbary. This is a pretty good argument, considering that the first sentence of that article begins with the words, “As the government of the United States of America is not in any sense founded on the Christian Religion…” Because the authors of the religious right version of American history can’t deny that these words are there, they attempt to dismiss them, usually using one, or a combination of, several popular arguments.

The first argument is really just a diversion, created by pointing out a mistake sometimes made by those who bring up this treaty.

[…]

The second is an out of context sentence from a letter written by John Adams. Religious right authors who claim that there are many such secularist misquotes need to use both of these because they just can’t find any other examples, although David Barton implies that he has found a third.

The really sad part, of course, is that by ignoring the truth of history the revisionists are far more likely to repeat the nasty and obvious mistakes again and again.

I occasionally run into something similar when executives or even mangers tell me that they have no security incidents in their company. The funny thing is that if they had no incidents, they actually would say “although we have had some incidents, none turned out to be security related”. A simple review or sample of their incident notes would confirm this. However, if they say they have had no incidents at all, then it is very likely they have in fact had many and are completely unaware of how many are security related. Easy to repeat mistakes if you have no idea when they are being made. Even easier to repeat mistakes when written proof, or evidence, is dismissed with diversions and false context.

Food, Security

Would you prefer cheap or efficient wine with your meal?

Leave a comment

I will never forget a review I read in the Sunday paper one sunny day in Paris, when I lived there as a student. Each week an overall top wine recommendation was made, as well as a top wine recommendation for under $7 a bottle. On this particular day, the inexpensive bottle was the overall top recommendation.

Two things struck me after reading this review. First, wine obviously did not need to be expensive to be fine. Second, if the top Paris critics knew this and wrote about it openly in the paper, prices for wine had to be based on something other than rational thinking.

Today I just read a similar story in the NYT.

HOW much do you want to spend on a bottle of wine? The intuitive answer, of course, is as little as possible. That stands to reason, except that the way people buy wine is anything but reasonable.

Substitute the word wine with security technology, and this story gets even more amusing.

For most consumers, wine-buying is an emotional issue. The restaurant industry has a longstanding belief that the lowest-priced wine on the list will never sell. Nobody wants to be seen as cheap. But the second-lowest-priced wine, that’s the one people will gobble up.

All buying is an emotional issue, no? We might tell ourselves we are making a highly informed decision, but information integrity is never perfect, and we never have unlimited time to decide. A waiter standing over the table, guests with thirsty stares, or executives impatiently waiting to report to the board, we usually rely on some kind of emotional compass to pull the trigger.

I don’t usually think of American wines as great values. Too often the producers try to imitate expensive wines using artifice — mediocre cabernet sauvignon flavored with oak chips, for example — rather than making more honest wines from lesser grapes.

That seems a bit emotional to me, but I suppose they have a point to their critique. It tells me to look for wines from smaller boutiques as they are more likely to work towards a higher standard (their own good taste, rather than an abstract notion of marketing). And, for what it’s worth, that is often also the best way to look for security vendors. If you want overpriced and only marginally palatable vintages, go with the big names. You won’t be disappointed, but you also won’t be impressed, and in many cases (pun not intended) with the big names you might not even be able to get the job done.