Category Archives: Security

Vote for your king?

I find it odd that Americans would think it normal to elect a king and queen by ballot. That’s just wrong. But if you play along with it, how can anyone then get upset when a woman is elected King?

Let’s face it, if you are going to have elections, then you are allowing people to vote for their preferred candidate. Them’s the rules of democracy.

Now, if monarchies are really preferred, let’s dispense with the whole “popularity” competition nonsense from the start. MSNBC reports:

Hood College is reviewing its homecoming rules after a lesbian was crowned king, a college official says. […] Donald Miller, Hood’s student activities director, said all homecoming events will be reviewed and possibly changed. “We will look at what students want Hood’s homecoming to be,” he said.

Well, they voted didn’t they? How will you find out what they, the student body, want homecoming to be now? Go to the campus supreme court and demand a recount? Ho ho ho.

The College should acknowledge a vote, recognize that they are holding an election for a costumed and fanciful position of flair, and announce that if people care enough about this they should vote next year. Then they should celebrate the absurdity of voting for kings and queens and get on with things, not deteriorate into introspection and unenlightened devisiveness.

Incidentally, the MSNBC poll at this time shows 58% of 23973 responses say “a woman is a woman…let her run for queen”. Only 17% voted for “who cares” and there was no button to vote for “no one should be allowed to vote for kings or queens, period”.

Behavior-ling

Rafi Ron, former Israeli airports security chief, has some interesting things to say in the latest CSO magazine about the failure of profiling in security. He refers to a better system as behavior pattern recognition (BPR):

My experience at Ben Gurion Airport in Tel Aviv has led me to the conclusion that racial profiling is not effective. The major attacks at Ben Gurion Airport were carried out by Japanese terrorists in 1972 and Germans in the 1980s. [They] did not belong to any expected ethnic group. Richard Reid [known as the shoe bomber] did not fit a racial profile. Professionally as well as legally, I oppose the idea of racial profiling. So we are left with behavior, because behavior is probably the Achilles’ heel of the terrorist.

Excellent insights from someone with extensive experience on the subject. It’s just too bad he didn’t use the term “behavior-ling”. :)

Browser Wars and Statistics

I think it was Groucho Marx who quipped “Statistics are like a bikini. What they reveal is interesting, but what they conceal…that is vital!”

Techweb has posted a news story that Symantec is changing the way they calculate vulnerabilities per year per browser. They have adopted the rather obvious position that they will now count all the publically known vulnerabilities for a browser, not just the ones published after a delay by a vendor (who might also bunch separate vulnerabilities together into a single confirmation, etc.):

But the new counting methodology, which Friedrichs said was the “more accurate” of the two, combines all vulnerabilities, including those made public but not necessarily confirmed by the vendor.

In that count, IE comes out second-best: In the same six months, Firefox suffered from 17 total vulnerabilities, while IE had 24.

“The vendor- and non-vendor-confirmed numbers are the ones I’d recommend using,” said Friedrichs. “For one thing, it removes the delay that can effect numbers because of long patch times by commercial vendors.”

Symantec, said Friedrichs, won’t make claims that one of the two leading browsers is more secure than the other. “We just stick to the facts,” he said. “But the number of vulnerabilities are legitimate, so we can say that Firefox has fewer vulnerabilities.”

Microsoft Fingerprint Reader Exposed

BlackHat had a fairly technical presentation on weaknesses of the Microsoft fingerprint reader, but it boils down to the old problem that someone can potentially capture the fingerprint data and replay it instead of needing a finger.

Techweb has a nice write-up of the different perspectives on the BlackHat presentation.

I have been testing one of the readers myself for some time now and just stopped using it because of a number of inconveniences (ironically it’s billed a “convenience only” device). This news puts the nail in the coffin, at least until a new revision comes out.