Schneier on the failure of two-factor authentication

/ Security

I’d not heard the term “two-factor authentication” before, but it turns out it’s just using two passwords, one you make yourself and one you get from somewhere else. The little key-fobs that give you a new password every 60 seconds is an example, as are the less technological printed list of one-use passwords that have been around for years. In the latest Crypto-Gram, Bruce Schneier argues that two-factor authentication “solves the security problems we had ten years ago, not the security problems we have today.” In particular, it does nothing to stop phishing (Man-in-the-middle) attacks or trojan horses.

I suppose solving security problems from ten years ago is better than not solving those problems, but at best it should be viewed as a stop-gap (and the cost of rolling out such measures should be weighed with that in mind).

Update 3/18/05: as a commenter pointed out, two-factor authentication isn’t really the use of two passwords so much as two authentication methods. I was basically paraphrasing the PC World article, and I should really know better.

Schneier on the failure of two-factor authentication Read More »

Pay for the news, get the fishwrap for free?

/ Media

Brad Plumer (guest-blogging at Political Animalnice point with regard to the possibility that the New York Times might go subscriber-only:

“But suppose the move is inevitable. Betsy Newmark thinks subscriber fees would ‘put a crimp in political blogging.’ Perhaps. But then again, perhaps this could all work out in a way that actually improve political blogging. What if the daily news was subscriber-only, but all the news archives were free and open to internet users everywhere? Blogging, it seems, could certainly benefit from slowing things down a bit and doing more commenting on week-old or month-old political stories. And sure, a few big bloggers and institutions would no doubt still buy subscriptions and do ‘insta-updates’ with off-the-cuff commentary, but the rest of us would have to do a bit more thoughtful analysis/research/reporting and a bit less hyperactive mouse-clicking and ‘breaking’ updates. That sounds fine to me!”

I rather like this idea, in part because I’m more a “better a day late than a dollar short” than a “shoot from the hip” kind of thinker. An interesting question is what timescale would be most appropriate — I’m thinking the times could gain by a much shorter premium-content model. If today’s newspaper really is tomorrow’s fishwrap, perhaps the Times would do best by offering the current day’s news news via subscription, micropayment or “watch this longer ad” payment and giving the rest away for “free.” Bloggers would be more likely to link to articles because they’d know they would still be around in two weeks, people might read a lot more of the history behind a current news event because the old news is more available, and the Times would get both advertising revenue and a great plug for their premium service by adding sidebar forward-links to today’s headlines related to the story being read.

Pay for the news, get the fishwrap for free? Read More »

Same-sex marriage ban struck down in CA (step one)

/ Politics

A SF Superior Court judge just ruled that California’s ban on same-sex marriage goes against the state constitution — now it goes on to the state Supreme Court. From the SF Chronicle blurb:

Rejecting California Attorney General Bill Lockyer’s argument that California is entitled to maintain the traditional definition of marriage, Kramer said the same explanation was offered for the state’s ban on interracial marriage, which was struck down by the state Supreme Court in 1948.

The judge also rejected arguments by opponents of same-sex marriage that the current law promotes procreation and child-rearing by a husband and wife. “One does not have to be married in order to procreate, nor does one have to procreate in order to marry,” Kramer said.

Update 3/18/05: updated the title to no longer mean the opposite of what I meant (by adding the word ban).

Same-sex marriage ban struck down in CA (step one) Read More »

AIM, your right to privacy and trust

/ Media Technology

It looks like Ben Stanfield started a blogstorm this weekend by pointing out a new(?) clause in AOL’s AIM terms-of-service that states “In addition, by posting Content on an AIM Product, you grant AOL, its parent, affiliates, subsidiaries, assigns, agents and licensees the irrevocable, perpetual, worldwide right to reproduce, display, perform, distribute, adapt and promote this Content in any medium. You waive any right to privacy.” AOL has been trying to stamp out the fire, and say the terms aren’t meant to apply to person-to-person instant messenger, only to posting in public chat rooms, message boards and other public forums.

I think AOL is telling the truth here, but the more I think about it the less I think that matters. In the end my privacy over AIM relies on my trusting AOL; trusting them not to change their privacy policy without my noticing, trusting them to stand up for my rights if they receive an overly-broad subpoena and trusting them to secure their networks from snoopy employees. Over the past 10 years I’ve learned to be sparing in my trust of Internet companies. Luckily, there are alternatives that don’t require that kind of trust. Time to get off my butt and finally start using that Jabber server I set up a while back, and to see how well Skype‘s encrypted IM and voice-messaging really works.

Update 3/18/05: I had thought only the Enterprise version of AIM supported encryption (and that may be AOL’s intent), but apparently you can just create your own certificate and that’ll work too. Thanks to Aleatha for the comment (and also for pointing out that the TOS has, in fact, been around for a year or so in this form).

On a related note, I also notice that iChat 3.0 (shipping with Mac OSX Tiger) will support Jabber as a standard protocol. Yay!

AIM, your right to privacy and trust Read More »

Peerflix, right of resale and the one-copy-per-song town.

/ Intellectual Property

The Menlo Park startup Peerflix has been getting some ink the past couple days. They’re like NetFlix, only instead of renting a DVD for an indefinite time you trade DVDs with other members. Peerflix has no inventory, they provide the matchmaking service, mailing labels and points system that works like barter cash, all for a 99-cent per trade fee. You own the DVD you trade for, free and clear — and legal.

It’s models like this that bring home for me again why it was so important for the music distribution cartel to crush MP3.com’s Beam-It service and, more directly, why they’re sure to fight any possible emergence of a used digital-music market.

The Berkeman Center’s white paper on iTunes has a good discussion of the Digital First Sale doctrine (starting around page 51), and concludes people probably don’t have the right to resell used digital media (just the bits) like they do tangible things like books or CDs. But imagine for a moment that we did, and that things like the DMCA, draconian EULAs, and the RIAA shock troops didn’t get in the way. Now imagine a frictionless Peerflix, (or better yet a Peertunes) and that it’s hooked into your music player, so when you click on a song it automatically sells the song to you (locking anyone else out from playing it), plays it, and three minutes later it gets sold back to the digital lending library again. A whole town could share a single music collection; the less-popular music could be shared by a whole country. And it’d all be legal.

I can already hear all the usual clamoring from the cartel about how this sort of thing would bring down the music industry, destroy artist incentives, yadda yadda. The funny thing is, I don’t think it would — those are the exact same things that copyright owners whined about when faced with the creation of the library, used bookstores and the VCR.

Peerflix, right of resale and the one-copy-per-song town. Read More »

Mitch Kapor on Groove

/ Media Technology

Mitch Kapor has two posts about Microsoft’s purchase of Groove Networks. Mitch was founder of Lotus and more recently the Open Source Foundation and was also the first outside investor in Groove, so he has several good insights into the software and how / whether Groove would be as Open Source if it were done today. The quote that got my attention the most was this one though:

With the prospect of open source-based server capabilities of all kinds becoming more like the electrical power and distribution system, universally available on demand in whatever amount is needed, a whole class of objections to client-server architectures such as dependence on non-local, unreliable and inconvenient infrastructure diminishes. Groove’s peer-to-peer architecture performs uniquely well in areas where the telecom infrastructure is weak, such as conflict-ridden areas of the Middle East and Asia where both military and humanitarian aid groups have deployed it successfully, but this alone is a niche application.

I like peer-to-peer technology for a whole host of reasons, but I think he’s right that the infrastructure arguments for P2P are (and always have been, IMO) weak except in niche applications (bandwidth saving via BitTorrent being the notable exception). But the driver for P2P technology hasn’t been about limiting the effects of technical infrastructure failure — it’s been about limiting active efforts by an adversary to stop communications. The adversary might be an opposing army, an oppressive government or the RIAA, but the goal is the same — and that’s a need hasn’t changed in the past 10 years.

Mitch Kapor on Groove Read More »

Better Bad News on Google Autolink

/ Media Technology

The folks at Better Bad News have done a wonderful remixed video mash-up of a bunch of blogsphere commentary on the Google Autolink feature. These guys are great:

Unbalanced and Half-true News Opinion and Commentary What would people be talking about if you controlled the newsroom teleprompters? Choose a professional talking head to speak for you on a freewheeling moderated panel discussion by accessing our dedicated web connected teleprompters.

I love this sort of remixing art. I wonder if I could make a toolbar that could make their talking heads read all my blognews?

Better Bad News on Google Autolink Read More »

“Bumping” lock-picking paper

/ Security

Bruce Schneier links to a paper on refinements to bumping, a lockpicking technique for pin-and-tumbler locks where you insert a specially filed-down key and give it a quick whack to bounce the top pins out of the way. The principle is the same as a lockpick gun, though the authors claim it works better.

I haven’t played with lockpicks since my undergrad days, but I’ll probably play around with their method and see how well it works. The biggest question I have is how much wear and tear this method causes to the lock vs. other methods — the paper suggests some ways to limit damage to the lock but it still seems like it’d be worse than the lockpick gun since the driving force is side-long (into the lock) rather than straight up. Still, it’s got to be better than raking the lock. (I remember back when I was an undergrad at MIT there was one door in particular that needed its locks replaced every couple years due to the number of people raking it — most of the better pickers didn’t rake for just that reason.)

“Bumping” lock-picking paper Read More »

Device fingerprinting using clock skew

/ Security

This is a cute hack — these guys are able to “fingerprint” a networked device just by looking at how quickly its clock loses or gains time compared to the true time (its clock skew).

Example applications include: computer forensics; tracking, with some probability, a physical device as it connects to the Internet from different public access points; counting the number of devices behind a NAT even when the devices use constant or random IP IDs; remotely probing a block of addresses to determine if the addresses correspond to virtual hosts, e.g., as part of a virtual honeynet; and unanonymizing anonymized network traces.

Link by way of Mitch Kapor, who unlike me isn’t so enamored by the elegance of their technique to ignore the obvious security and privacy implications.

Device fingerprinting using clock skew Read More »