turbodingo

Forget passwords

Sun, 11 Mar 2012 21:03:00 -0700

It starts off with one or two

Before the internet took off in the late 90s, I had one password. It got me into my desktop computer and my email - those were the only things that needed passwords. Now there are more than 100 different services that I use and each of them wants a way for me to prove my identity to it.

This is challenge. I want an approach that requires me to remember only a few things, yet protects my most valuable data properly.

Clever compartmentalization

Around ten years ago, I came up with a system to share passwords among web sites according to a security progression. All sites in the same level share the same password, and in this way I could remember a handful of passwords instead of a hundred.

Unnecessary password
Why do I want a password for Pandora? My account there has no private or valuable information, so it might as well be unlocked. Who cares if someone sees or messes with my “INXS Radio” station?
A password to protect public information that is not sensitive
Twitter and Facebook started out as places to post public information. Because it was public information, I didn’t expect it to become important to protect. However, that situation changed when these networks gained the ambition to become the “one login to connect all online services” which included access to private information.
Password to protect moderate financial vulnerability
Amazon, eBay, Paypal etc. like to store your credit card to make it easier to buy things online. Generally, there is recourse if someone else impersonates you and makes fraudulent charges with your credit card. It’s a waste of time, but it’s not critical.
Password to protect significant financial information
Bank accounts allow people to transfer big chunks of their savings to other places. This is what I worry about when I think about passwords getting compromised.
Email, the ultimate password
When passwords get lost or need to be reset, the process always involves receiving an email to your online account. Therefore, anyone who can access my gmail account has a skeleton key that grants access to just about everything else I have online.

But this approach had its failings. Five passwords were possible to remember, but impossible to change over time. If one was stolen or compromised, it would still create a big headache for me to fix. This approach fell short in the following ways:

Fresh is best
don’t keep using the same password forever
Inconsistent password requirements among services
minimum/maximum length
including numbers or capital letters or symbols
excluding symbols
not allowing re-use of previous passwords
Evolution of online services
yesterday’s trivial service grows to become tomorrow’s universal identity

So what should be done to replace the above scheme? Two options come to mind:

One service to bind them all?

Facebook Connect allows you to use a single (Facebook) identity all over the web. OpenID is a similar federated approach that enables authentication sharing among services. When using these you put all of your eggs in one basket, and so it’s wise to make sure that basket is tight. “Tight” means the password better be strong, and better be changed frequently. You should avoid typing it on unknown/uncontrolled hardware that might be surreptitiously running a key logging program that would intercept your password.

But I don’t like that idea. I don’t trust Facebook or any of the other services enough to put them in charge of access to all of my online data. And even though many sites support Facebook Connect and OpenID, it’s not universally available so there would still be sites that require a password.

Inspiration from the inventor of the Internet: a lockbox

Bruce Schneier (not Al Gore) writes an excellent blog about computer security. His thoughtful analysis and advice, as well as the ideas offered in the comments from readers pointed me in the direction of using password management software. At first I was reluctant to add another layer of complexity, but after seeing it in use at work it seemed less daunting. After a few days of use, it actually makes my life easier - no more “which password did I use for this site? Which variation on the password? Dammit!”

KeePass is the option I’m using now. All of my important passwords are managed by the KeePass application, which means they are encrypted, all protected by a single strong password, and backed up to a location online. There are versions of KeePass that run on all major desktop operating systems, as well as Android mobile phones.

Using it is easy; it takes a single keystroke to automatically fill in the correct username and password for any website you’ve set up. This makes it simple to use very strong and unique passwords for each individual service that requires a password. As long as the single password to the lockbox can be remembered, all of the passwords it holds inside can be safely forgotten — they can be completely unknown by the human!

Email still the backdoor

This takes care of all but one of the shortcomings and caveats mentioned earlier. Email remains the lone weak point. If any person gains control of my email address, the passwords to virtually all of the other services can be reset. Gmail has an optional two-factor authentication setting which requires occasional use of a person’s mobile phone to prove the person’s identity is true. It’s not perfect; it’s still possible to impersonate a person for some time; and it becomes more difficult to re-establish one’s identity if one’s mobile phone gets stolen.

What could be better?

Looking for inspiration in the real world, here are some ideas for things that could work better than passwords. These aren’t ready (easy) to implement online, but may point out some different approaches.

Intimate knowledge test
JPMorgan asks people to choose from a set of options that only they should remember when resetting a password. They gave me a set of options for information they got from my credit report: historic addresses, loan holders, cars I’ve owned. They limit the time available for answering to 60 seconds or so, and always provide a “none of the above” option. A similar test is put before candidates during the search for the next incarnation of the Dalai Lama, for example, choosing the object (like a hair brush) owned among an array of similar options.
The challenge here is that the information needs to be discoverable by the tester, but not the general public. It needs to be relatively benign; “which of these recent credit card charges or email titles is yours?” is probably too sensitive.
Vouching for others
Asking someone else to verify assertions is so common that it can be referred to a the practice of “fact checking.” Another manifestation of this practice is the statement sounding like “I’ve known Joe for 15 years, you can take my word for it that he makes his payments on time.”
This method involves interrupting others, an indirect cost that would need to be minimized.
Information context and style
There are things about how each person is that can add up to evidence that the person is who they claim to be. Instead of looking at just a password, look at the other information and meta-information available to see if it fits with the person’s past behavior. For example: How fast do you type? What words do you use together? What is your browser’s useragent string? Your IP geolocation? These are the kinds of clues that get used in credit card fraud detection.

3

Sat, 28 Jan 2012 12:26:38 -0800

There are only 3 things that are valuable to a person

time
respect
thrill

The things people often regard as valuable (money, food, community, security) are valuable because they provide some portion of these 3 essentials.

Next June 23-24

Sat, 12 Nov 2011 16:35:16 -0800

Plan A: Western States

Plan B: Homme d’Fer

everyday

Tue, 07 Jun 2011 15:31:25 -0700

That crusty intellectual rag Harper’s magazine once printed an exchange between a retired English teacher and the marketing department of Coca-Cola about their slogan for Dasani water, which confused the word “everyday” with the two words “every day”. The company’s response was pretty funny and luckily someone else scanned it in: http://www.laurajmackay.com/everyday.pdf

Lately I’ve been working on changing my behavior, and that’s brought me around to seeing Coca-Cola’s point. It’s easy to list some ideas for ways to take care of oneself: flossing teeth, getting more exercise, stretching, going to bed earlier. But it’s hard to follow through and actually adopt those behaviors and persist with them, as many people who make New Year’s resolutions discover. Recently I’ve had some better success, and I think the words “everyday” and “every day” can explain why.

Let’s take flossing teeth. At first I tried to floss about 3 times per week, but this lasted for only about 2 weeks before I stopped. By failing to floss up to my goal, I thought of myself as someone who just couldn’t stick with it, flossing wasn’t for me. Flossing was too hard to remember and too easy to put off until tomorrow - why get up out of bed to deal with such a small matter? A few months later I decided to try again, but with a target of every day flossing. This worked, and I’ve been flossing (almost) every day since. Why? It doesn’t make sense that a more ambitious goal would work, when seen through a lens involving the tradeoff between cost and a benefit with diminishing returns. But this isn’t a matter of selling a benefit for the price of a cost; it’s a matter of identity: I started with the attitude that one is a “daily flosser” and then just did it; no excuses were acceptable, I did it every day. To use Coca-Cola’s word, flossing is now everyday, and that’s the only way that works for me.

Rediscovering Libraries

Fri, 20 May 2011 10:45:07 -0700

With all the attention taken by Kindles, iPads, blogs, twitter, RSS and other electronic reading options, it’s fair to ask: who cares about libraries? Haven’t we moved on to better things, “recontextualized for the Information Superhighway”?

It’s true, these new ways to read have much to offer. I love Amazon.com for books: its giant selection, reasonable prices, helpful reviews, and convenient shipping make it one of my favorite Internet places.

But wouldn’t it be better if reading books and movies was free? And still very convenient? If you could walk a few blocks from your front door to get the books you want instead of waiting for delivery? If this sounds good to you, then it’s time for you to catch up with your local public library.

But how can a little library compete with Amazon’s selection? When you search the library’s catalog online, you’re searching across the entire library system, and when you find that book you can have it sent to your local branch. When it arrives there, you’ll receive an email alert to tell you when it’s ready to pick up. Free! Instead of putting an item in my Amazon cart, I now request it be delivered to my local branch to be picked up next time I’m running errands around town.

Do you read obscure books? If it’s in a public library or university library in California, chances are you can have it sent to your local branch, too. They’ve built a combined catalog spanning many institutions that’s searchable, and then they’ve got a distribution system to move the books around to where you want them. Free!

Movies on DVDs? Netflix is $8 per month, but the library charges zero!

And a playground for kids? Wow, it’s as cool as a McDonald’s! Also free!

So what’s the catch? As always, you have to return the materials after a few weeks. And the library isn’t open at all hours of day and night. When you go, sometimes there are people coughing. If you can deal with that, get your card and get cracking.

Nigeria Rising

Tue, 17 May 2011 13:13:48 -0700

From the UN, via The Economist:

What if the world population looked like this in 2100? It’s safe to say that much would have changed between now and then. Assuming this is an accurate forecast (unlikely, due to notoriously inadequate understanding of fertility trends), which of these countries would you want to live in come 2100? The US trend appears to my eye the best among these. China would have a huge set of problems in this scenario, especially a huge number of retired people in relation to the working population. Could India and (parts of) Africa become the next “workshops of the world”? Would it be appropriate for the UN security council to include only 2 of the 10 most populous countries? How gracefully might Russia and Japan fade from view?

Unwillful neglect

Tue, 23 Nov 2010 20:05:00 -0800

Tonight I saw a PBS newshour segment on end-of-life care. It is a wrenching experience, full of strong emotions that are uncomfortable. Who wants to feel responsible for deciding when to end someone else’s life? It’s an awful position. But how many people prepare for this situation and do what’s needed to prevent putting their relatives through it? Beyond the impact on a person’s friends and family, this lack of planning shifts a huge amount of medical resources into end-of-life treatment which produce little benefit to anyone - not to the patient, and not to the family. Of course, no one wants a “federal death panel” but that’s not the only option. We can force people to take responsibility for themselves:

Require all citizens to have a living will.

Make it part of the process of getting and/or renewing a driver’s license (which is already considered risky enough to require insurance) and any federal entitlement program. Have a few standardized examples that people could choose if they don’t want to spend much time personalizing their own. Show the expected cost of each option based on recent spending and healthcare outcomes.

Delayed reaction to the "instant" phenomenon

Fri, 12 Nov 2010 08:56:20 -0800

A few months ago, Google’s “Instant” search interface launched and got great press coverage. People were very excited - they claimed we would save 1 or 2 seconds every time we searched the web with it! pooh-pooh, I thought. Now I finally understand why it’s so great…

But it’s not about making web searches faster.

It’s about making Google better for browsing.

The way I see it, there are two modes of navigating information: searching and browsing (I wrote about this before when talking about music player interfaces). When someone knows what they want but doesnt know where to find it, they need a search interface. When someone doesnt know what they want and would like some help seeing what their options are, they need a browse interface. These two modes were very different, and led to very different ideas about how products should behave. For example, Yahoo was browse-centric with all kinds of information and links on their home page; Google was search-centric with a simple keyword entry box on their home page.

Instant search is a new middle ground between search mode and browse mode. It’s not a compromise, no! It’s better than either of the old modes: it’s faster and easier than search. And it’s faster and more relevant than browsing. Yes, it’s faster — but the other two advantages (easy, relevant) are more useful. It lets you explore a huge range of options and then narrow your focus to what interests you. You start from the most broad idea of what direction you want, and then can explore different avenues quickly, and then back up and try different direction. As I’ve used it, I’ve noticed that my original search terms would not take me down the right path, so I made a quick adjustment and found what I needed. Or I was able to see different items that were helpful but not exactly what I intended to find.

I think it should have been called Google Zoom. This fits its wide range of focus between broad and narrow. And yes it’s fast, too.

(And for those interested, here’s a simple music interface that can do instant search : muss)

"one’s prestige at PayPal was measured by how few people could stop you from proceeding with a..."

Tue, 02 Nov 2010 12:16:10 -0700

“one’s prestige at PayPal was measured by how few people could stop you from proceeding with a new idea.”

- http://www.quora.com/What-strong-beliefs-on-culture-for-entrepreneurialism-did-Peter-Max-David-have-at-PayPal

Gigantes!

Sun, 31 Oct 2010 23:38:06 -0700

Gigantes!

Running advice

Sun, 24 Oct 2010 19:03:31 -0700

If I had a time machine, I would travel back and tell my past self these things about running.

Why run? Running regularly is a great way to be ready for all kinds of activities that stress the heart and lungs, like bicycling, hiking, skiing, etc. With a base of running fitness, it will be easier to do these other things. Eventually running itself will start to feel good, but that will take some time.

It would be nice to be fast, but you’re not. You do not have world class running potential, nor national class, college class, or even high school varsity class. So to make running fun, you’ll need to set up your goals that make sense for you and keep you interested.

It would be nice to be able to run everyday, but you can’t. Your legs can’t take that much use and will break down.

Rest days are more important than training days. Your body must recover from the damage done in training in order to get stronger. Try not to run on consecutive days.

Find some other activities that you can enjoy, especially while you allow your body to recover from running. Swimming is the best for you.

Find other people and run with them.

Find scenic trails and run on them.

Find interesting events and sign up for them. This will keep you give you a reason to go outside for a run instead of doing something less productive.

Running helps keep you healthy. Consider it an investment in yourself.

To be fit, consistency in training is more important than intensity or duration. Three quick and easy runs per week can be enough.

Plan your training runs based on duration, not distance or speed.

Don’t get sick. Getting enough sleep seems to be the most important way to avoid illness.

It’s fine to run in the rain, being wet is OK as long as you stay warm.

Get “real” running socks, they’re worth it.

Run with a smile, most of the time.

Quitting TV again

Tue, 12 Oct 2010 16:58:06 -0700

Yesterday I unplugged my TV for maybe the 4th time in a year. This is harder than I thought - I must really be addicted to that thing. It’s tougher right now because I just watched two good movies on it. So long, Hitachi, no more of your time wasting!

California high speed rail

Thu, 07 Oct 2010 13:20:14 -0700

California high speed rail

Nerds R Us

Sat, 25 Sep 2010 18:51:01 -0700

Nerds R Us

Some things that I missed while travelling

Fri, 24 Sep 2010 00:00:00 -0700

Some things that I missed while travelling

Sundial at the Sorbonne: “Our days pass like the...

Sun, 19 Sep 2010 00:00:00 -0700

Sundial at the Sorbonne: “Our days pass like the shadows”

Yeah, and it looks like we’re about two hours behind where we should be.

Nic's open house

Sun, 19 Sep 2010 00:00:00 -0700

Once a year, this guy I know named Nic has an open house and invites everyone to come by and check out his place. It’s a big draw and the line is huge. Even with my connections I spent 4 hours watching the sun rise and shuffling slowly with the crowd. Here’s the last ~90 minutes’ worth of the queue of Nic’s friends.

Finally we got to the garden entrance and baggage scan. They were checking for hidden hamburgers and soft drinks, as this was strictly croissant and coffee territory. During the queue we saw cops dutifully munching on them.

Behind that gate was certainly the largest private garden and security detail in the city.

At the moment, Nic is seeing someone new named Carla. This is her office, which looks out on the garden. The book on the top of her desk is called “Work Hard, Be Nice.” It’s about inner city charter schools and Amazon reviewers said it was “inspiring” but “needs a little more meat” - two criticism that would be familiar to its reader.

Their dining room takes up an entire wing of the building, and it is fantastic. The room is so grand that it changes your perspective; either you feel very grand, too, or you feel very small - depending on whether you expect to eat like this ever again. I left before dinner, but the table setting looked delicious.

Nic’s office is upstairs. He prefers a crappy wicker chair (1900’s era Aeron precursor). In terms of technology, he uses lots of telephones and a TV, which was tuned to channel 154, aka “Tele Melody” specializing in 60s/70s/80s music videos. Lots of fancy fountain pens and inks. A table full of medals and swords. No sign of a computer or laptop anywhere, not even a power cable.

Navy HQ

Sat, 18 Sep 2010 00:00:00 -0700

Navy HQ

Amazing Afghan hospitality (The singer is 2 years old)

Sat, 18 Sep 2010 00:00:00 -0700

Amazing Afghan hospitality (The singer is 2 years old)

Step 1. Admit you have a problem

Thu, 16 Sep 2010 13:57:17 -0700

Step 1. Admit you have a problem