Category: Usability

Lessons for security from "Social Networks"

There are a couple of blog posts that I’ve read lately that link together for me, and I’m still working through the reasons why. I’d love your feedback or thoughts.

A blogger by the name of Lhooqtius ov Borg has a long screed on why he doesn’t like the “Social Futilities.” Tyler Cowan has a short on “fake following.”

I think the futility of these systems involves a poor understanding of how people interact. The systems I like and use (LinkedIn, Dopplr) are very purpose specific. I really like how Dopplr doesn’t even bother with a friend concept–feel free to tell me where you’re going, I don’t have to reciprocate. It’s useful because it doesn’t try to replace a real, complex relationship (“friendship”) with a narrowly defined shadow of the world. (In this vein, Austin Hill links a great video in his Facebook in Reality post.)

In information technology, we often replace these rich, nuanced concepts with much more narrow, focused replacements which serve some business purpose. Credit granting has gone from an assessment of the person to an assessment of data about the person to an assessment of the person’s data shadow. There are some benefits to this: race is less of a factor than it was. There are also downsides, as data shadows, blurry things, get confused after fraud. (Speaking of credit scoring, BusinessWeek’s “Your lifestyle may hurt credit score” is not to be missed.)

We’ve replaced the idea of ‘identity’ with ‘account.’ (I’ll once again plug Gelfman’s Presentation of Self for one understanding of how people fluidly and easily manage their personas, and why federated identity will never take off.) Cryptographers model people as Alice and Bob, universal turing machines. But as Adi Shamir says, “If there’s one thing Alice and Bob are not, it’s universal turing machines.” Many people have stopped Understanding Privacy and talk only about identity theft, or, if we’re lucky, about fair information practices.

So the key lesson is that the world is a complex, confusing, emergent and chaotic system. Simplifications all come at a cost. Without an understanding of those costs, we risk creating more security systems as frustrating as those “social networks.”

[Update: It turns out Bruce Schneier has a closely related essay in today’s LA Times, “The TSA’s useless photo ID rules” in which he talks about the dangers of simplifying identity into intent. Had I seen it earlier, I’d have integrated it in.]

I’m Certifiably Wrong

So there’s some great discussion going on in the comments to “Certifiably Silly,” and I’d urge you to read them all. I wanted to respond to several, and I’ll start with Frank Hecker:

Could we take the cost issue out of this equation please … [Adam: I’m willing to set it aside, because the conversation has spiraled.]

The real questions as I see it are

1) Leaving aside the issue of cost, what are the pros and cons of introducing self-signed certificates into the current browser model of SSL?

2) If the advantages of introducing self-signed certificates into this model outweigh the disadvantages, what is the best approach (from a technical and user experience perspective) to introduce self-signed certificates into the current SSL model?

3) If there is a good technical/UX approach to introduce self-signed certificates into the current SSL model, what is the likelihood of such an approach being adopted on a universal basis (i.e., by all browser vendors), and how might this be made more likely?

I’d argue that these are the wrong questions: the real questions underlying our disagreement are probably “do certification authorities do what they’re purported to do, and (if we agree they don’t), what do we do about it?”

I think we do two things: One, we stop investing so much in them, and second, we investigate the heck out of the alternatives, including persistence and organizational CAs, including CAs run by groups like the American Bankers Association. These are both in direct contradiction of the CA business model, and so they’ve been stillborn.

I’m not going to claim that either will have better user experience than the current SSL model, and that’s a low bar.

So I’m wrong, the issue isn’t really self-signed certs, it’s the CA model.

There were another points raised, by both Frank and Andy Steingruebl about my bookmark model, which is that it breaks PayPal. There are two ways to read this model: One is “always use bookmarks.” the other is “never click on a link in email.” I intended the first, the second is unclear, given the prevalence of webmail. Perhaps we could address this by having merchants send transactions to PayPal, and then if I choose to login via a bookmark, I get a list of pending activity.

The final point that Andy raised is organizations with lots of web sites. A reasonable point, and one I’m not sure how to address. Part of how I’d address it is that most of us don’t see all of those brands. I would be happy to see some of the brand profusion go away, which of course, doesn’t mean it would happen. (I consulted for a bank for several years, I can’t keep track of all the brands that they present around my retirement accounts.) If I can’t keep track of them when they’re ‘not’ security critical, I surely can’t keep track when they are, and it is unreasonable to expect me to.

Silver Bullet podcast transcript

I know there’s a lot of people who prefer text to audio. You can skim text much faster. But there are also places where paper or screens are a pain (like on a bus, or while driving). So I’m excited that the Silver Bullet Podcast does both. It’s a huge investment in addressing a variety of use cases.

That all to say you can now read the text of Gary McGraw’s interview of me in PDF form: Adam Shostack on Gary McGraw’s Silver Bullet podcast.

If you missed it, the audio is available at the Silver Bullet site. (Fixed link to point to Silver Bullet.)

Jonathan Ive's Sharia Style

I was on a business commuter flight the other day, which was also the maiden voyage of my MacBook Air. I had it out before takeoff. This was an international flight and I was in bulkhead. On international flights, they’re not as strict about not having your laptop on your lap during takeoff. This flight was only an hour and ten, and if I had to wait ’til cruising altitude, I’d never get any work done.

I slid it into the middle of my Economist (manila envelopes are the only think it fits in), but other guys had their mondo Dells out, so I stopped hiding it.

One of the flight attendants saw it and came over, pouncing on me. Drat. Nabbed.

I blinked when she cooed, “Ooooooo, is that the new MacBook? Can I touch it?”, because this wasn’t what I would think of as a nerd-bird. It was Etihad from DMM to AUH, and after a few days in Al Khobar, I found the fact that the flight attendants had neither an abaya nor hijab to be a pleasant surprise.

I handed it to her. She called over another flight attendant, who also cooed over it. They passed it back and forth extolling, “It’s so light! It’s so smooth! It feels sooooo good!”

They called over a third young woman who turned up her her nose and sniffed, unimpressed, “My brother has one of those.” She thus put the others in their place for being so unsophisticated as to not be totally bored by it yet. It’s a good thing that SAFEE isn’t implemented, yet, or we’d never have gotten off the ground. If looks could kill….

Pointedly ignoring her, my pair of flight attendants marveled over the Air for a bit longer and then handed it off to me so they could play with seatbelts and oxygen masks.

After they left, the guy across the aisle turned to me and said, “My god, I never thought I’d see the day when a laptop was better at picking up girls than a Ferrari. That’s it, I’m ditching Windows.”

Visualizing Risk

I really like this picture from Jack Jones, “Communicating about risk – part 2:”


Using frequency, we can account for events that occur many times within the defined timeframe as well as those that occur fewer than once in the timeframe (e.g., .01 times per year, or once in one hundred years). Of course, this raises the question of how we determine frequency, particularly for infrequent events. In the interest of keeping this post to a reasonable length, I’ll cover that another time (soon).

And I’m looking forward to how to Jack says we should determine those frequencies.

One suggestion for improvement: state the timeframe on the chart label: “Loss Event Frequency (per year).”

Uncle Harold and Open Source


Uncle Harold (not his real name, not our real relationship, and I never even called him “Uncle”) was a cool guy who always fixed his own cars. Most of my life, Uncle Harold has been complaining. It used to be you could actually fix a car. You could put things in, take them out, adjust them, tune them, and so on. As time has gone on, cars got electronics in them, then computers, and nowadays an auto mechanic is as much a computer tech with grease under his nails as a mechanic.

I never was much into mechanics as a kid. My father wasn’t, either, and discouraged me from ever being a mechanic. If he were to read this, he’d deny discouraging me, but he did. All he did was point out that some bit of automotive fluff that caught my eye would literally be high-maintenance, and either you do that yourself or you pay someone else.

I eventually did buy a pre-1968 bit of automotive loveliness as part of a quarter-life (okay, third-life) adjustment. The 1968 date is important because that’s when the US started requiring pollution controls, safety equipment, and so on that caused the transit of the gloria of Uncle Harold’s mundi.

For a technologist, a pre-’68 car is utterly amazing because of sublime lack of technology in it. It needs petrol to burn, water to cool, oil to lubricate, and enough electricity to drive the spark plugs. That’s it.

The first time I tuned a pair of SU carbs, it was amazing fun. I could really understand Uncle Harold’s irritation. The tenth time it was far less fun, partially because I’d gotten good at it. It was just a chore. I could really understand my father’s point of view even better. Eventually, the antique bit of fluff got sold and I got a modern fun car that has computers that run everything from engine to brakes.

It’s really sort of sad that I can’t tune the carbs (which of course I don’t have; it’s all fuel-injected). It’s even amusing that if you pull the power from the car, the computers lose their state and they they have to re-tune the ignition system, over the next few miles you drive — in a wtf sort of way. I mean, haven’t these people heard of flash? How much space does it take to store ignition settings and radio presets? (Yes, Uncle Harold, a real radio stores its presets mechanically. Thanks.)

But it’s really wonderful that I don’t have to tune the carbs. There are reasons why those wonderful old systems were replaced. The new ones really are better. Uncle Harold thinks the world has gone to hell in a hand basket. I see the merit in what he says, but when it comes right down to it, I prefer my present hell to Uncle Harold’s heaven.

The brilliant Ivan Krstić has recently written about the transit of his own personal gloria, the OLPC project. In part of his essay, he shows clearly about how some open source people, in particular RMS, have become Uncle Harold, insisting that if you can’t tune those metaphorical carbs, it’s like forcing people to be crack addicts. (And this is paraphrasing, not misquoting RMS.)

Krstić also talks about the same Haroldisms. He says:

About eight months ago, when I caught myself fighting yet another battle with suspend/resume on my Linux-running laptop, I got so furious that I went to the nearest Apple store and bought a MacBook. After 12 years of almost exclusive use of free software, I switched to Mac OS X. And you know, shitty power management and many other hassles aren’t Linux’s fault. The fault lies with needlessly secretive vendors not releasing documentation that would make it possible for Linux to play well with their hardware. But until the day comes when hardware vendors and free software developers find themselves holding hands and spontaneously bursting into one giant orgiastic Kumbaya, that’s the world we live in. So in the meantime, I switched to OS X and find it to be an overwhelmingly more enjoyable computing experience. I still have my free software UNIX shell, my free software programming language, my free software ports system, my free software editor, and I run a bunch of free software Linux virtual machines. The vast, near-total majority of computer users aren’t programmers. Of the programmers, a vast, near-total majority don’t dare in the Land o’ Kernel tread. As one of the people who actually can hack my kernel to suit, I find that I don’t miss the ability in the least. There, I said it. Hang me for treason.

My theory is that technical people, especially when younger, get a particular thrill out of dicking around with their software. Much like case modders, these folks see it as a badge of honor that they spent countless hours compiling and configuring their software to oblivion. Hey, I was there too. And the older I get, the more I want things to work out of the box. Ubuntu is getting better at delivering that experience for novice users. Serious power users seem to find that OS X is unrivaled at it.

I used to think that there was something wrong with me for thinking this. Then I started looking at the mail headers on mailing lists where I hang out, curious about what other folks I respect were using. It looks like most of the luminaries in the security community, one of the most hardcore technical communities on the planet, use OS X.

And lest you think this is some kind of Apple-paid rant, I’ll mention Mitch Bradley. Have you read the story of Mel, the “real” programmer? Mitch is that guy, in 2008. Firmware superhacker, author of the IEEE Open Firmware standard, wrote the firmware that Sun shipped on its machines for a good couple of decades, and in general one of the few people I’ve ever had the pleasure of working with whose technical competence so inordinately exceeds mine that I feel I wouldn’t even know how to start catching up. Mitch’s primary laptop runs Windows.

I know exactly what he means. Once, long ago, I’d fire up my GosMacs session in the morning and close it down when I’d go home. I and my colleagues had so customized our editors (which we lived in) the we said that using someone else’s emacs was like using someone else’s toothbrush. It’s just not done.

When the Story of Mel came out, one of my coding buddies read it and it really creeped her out. She sent out an email to all of us that said, “Oh, my God, that’s my *DAD*!”

I once patched a running CVAX just to watch it fly. I admit that I did it because of the smart remark in Dungeon. And I’ve changed my unices so many times I don’t know what I look like.

Like me, Ivan’s stopped being Uncle Harold with computers. I like being able to get grungy, but I also hate having to. The last remnant of my Uncle Haroldism is my main server that’s running FreeBSD. I am especially glad this week that I listened to Ben and didn’t put Ubuntu on it. I’m even chafing at that system and asking myself why I don’t just outsource the whole damned thing. I’d tell you, but then you’d see my tinfoil hat. (Oh, all right. If you run your own mail server, they can’t NSL your sysadmin. I know what you’re going to say. I’ve said it myself. Hush.)

Nonetheless, the Uncle Harolds of the world have a point. It’s nice to be able to change your kernel. It’s nice to be able to recompile everything. It’s just a drag to have to. When Open Source realizes that, it will make great strides to getting back people as non-technical as Ivan. And yeah, Ubuntu’s getting close, I know that. I actually do love puttering around, but another prop has occupied my time.

Photo courtesy of Light Collector.

Context, please!

Chess masters will sometimes play chess against a dozen or more competitors at once, walking from board to board and making a move. The way they do this isn’t to remember the games, but to look at the board, and make a decent (to a master) move each time. They look at the board, get all the information they need, and act. Remember that as context as you read the rest of this post.

So over the past few months, I’ve been noticing more and more people cutting the context out of their email, and replying in a way which can be read on a single screen. This is nice. Concise replies are often good. But where’s the context? Why are you removing all the conversation which happened before? I get and send a lot of email. I send roughly 15-20 messages a day from my personal account, and probably 30-50 a day at work. How many I get is a little hard to count because of all the spam, but it’s probably around the same into my inboxes.

The context of a conversation helps me remember what’s being said, and why. (This, incidentally, is why top-posting is good for short conversations that stay short, and bad for long ones.)

For example, I’m trying to set up an appointment to talk to a former co-worker about some stuff. I haven’t added him to my IM address book, and in his response agreeing on a time, he cut that information. Not only that, there was effort involved in cutting it. Maybe it’s only 1 or 2 clicks, or 10-15 characters of typing to find the rest of the conversation, but that’s still more work than having it all right there.

So please, think about context when you send email. Just like chess masters can see the board, let your co-respondent see what you’re responding to.

If you do, you’ll get more complete and useful responses faster. It’s in your best interest. That’s not just with me. Think about the usability of what you send to people–it pays off.

Working on the Traveling Band

traveling-band.jpgIf you travel a lot, you’re used to dealing with many network difficulties. For a while now, I’ve been traveling with an Airport Express, which has made life a lot easier. I set it up to use DHCP, plug it into the hotel Ethernet, and go. At the very least, it means I can work from the bed, rather than from a desk that is inevitably at the wrong height.

Even more so, I now travel with at least three devices that have WiFi — my laptop, my phone, and my iPod. I travel about half the time with my SO, who also has a laptop and an iPod with a network. I said “at least” because I also have a Nokia slate, which is a specialized device (I lug it along when I don’t want to lug a laptop, for example).

Also, for some reason the better the hotel you stay in, the more they charge you for Internet access. Sleep in a cheap hotel, and the network is free. Stay in an expensive one, and they charge you $10 to $15 a night. Stay in the UK, and you can face £18 a day for your net.

This is changing. Ramada and Radisson, are doing a lot of free Internet. Fairmont gives free Internet to their President’s Club members (no better reason to join, for me). However, this still means that you have to figure out how to share your one obscenely expensive net connection with the coalition of devices in your room.

However, another way that this is changing is that there’s more and more wireless going into hotel rooms, and less wired. For us, wired is good, because you just plug a basestation into the net and you go. But with wireless, you need a basestation that listens on a wireless connection while re-broadcasting another.

For quite some time, I’ve been complaining that the appropriate router doesn’t exist. A few weeks ago, however, a friend told me about the D-Link DWL-G730AP, which purports to do what I want. I also found on my own research the Linksys WTR54-GS. They appear on the surface to be mostly equivalent. The Linksys comes in a compact package that has an AC plug bundled into the unit. The D-Link has a separate transformer, but can also be powered from USB.
I ended up getting the Linksys. The deciding factor was that both units have manuals on the web, and the D-Link manual is a high-level installation guide that describes several possible configurations, but the one I want is missing. The Linksys has a detailed manual that tells how to set it up from its internal web server, do MAC address spoofing, port mapping and redirection, and so on. A manual that told how to set up what I want was the clincher. I bought it right before a trip to the UK, and wanted to avoid buying wireless access.
There are a couple of annoying things about the Linksys. It cannot be a client onto a secured network, which meant that I didn’t set it up before I left. I would have taken time I didn’t have to pull the “security” off of my my G network to experiment. (It’s just WEP, hence the quotes around “security.” I consider it a no-tresspassing sign.) Once in a hotel, I have not yet figured out how to put a password on the network it broadcasts. Each of my attempts resulted in having to hard-reset the device. It has a nice, convenient hard-reset button. On the other hand, I’ve been busy and in various stages of sleep-deprived brain damage, so I don’t know that it’s their fault that I haven’t figured it out. I settled for hiding the SSID. I don’t actually care if someone mooches on my hotel wireless, if they leave enough bandwidth for me.
If the D-Link will work as a wireless-to-wireless router, it has an advantage over the Linksys in being USB-powered. That means you can easily plug it in to your laptop while using paid wireless, and rebroadcast for your phone or iPod or SO. I just don’t know that you can. If someone has a definitive answer, place a comment below. If you’re from D-Link and reading this, make a note that you lost a sale solely because your manual confused me.

How to Blog a Talk

Blogging about your own presentations is tough. Some people post their slides, but slides are not essays, and often make little sense without the speaker.

I really like what Chris Hoff did in his blog post, “Security and Disruptive Innovation Part I: The Setup.”


I did something similar after “Security Breaches Are Good for You: My Shmoocon talk.” I posted a PDF of the slides. I think the PDF is less effective, because you can’t skim it, search it, or excerpt it as easily as with Hoff’s HTML version.

Nice work, Chris!

Ceremony Design and Analysis

Carl Ellison has been doing some really interesting work on what he calls Ceremonies:

The concept of ceremony is introduced as an extension of the concept of network protocol, with human nodes alongside computer nodes and with communication links that include UI, human-to-human communication and transfers of physical objects that carry data. What is out-of-band to a protocol is in-band to a ceremony, and therefore subject to design and analysis using variants of the same mature techniques used for the design and analysis of protocols. Ceremonies include all protocols, as well as all applications with a user interface, all workflow and all provisioning scenarios. A secure ceremony is secure against both normal attacks and social engineering. However, some secure protocols imply ceremonies that cannot be made secure.

He’s talked about it in public a little before, and now has a paper available from the IACR eprint service, “Ceremony Design and Analysis.”

If you design network protocols, or think about the intersection of security and usability, this is very much worth reading.