Logo Fun

Daithi noticed that I'd been having some fun with the Peccavi Logo. I came across some comments about web application piracy made by the author\owner of CoolText.com , Brian Livingston, and decided to see why his application might be good enough for some scum bag to try to rip off and found that it's a hoot.

What I've been Reading

I haven't been reading much of late but I'm hoping that the new year changes that as I've got a ton of stuff that I really do want to get to. As usual my yet to start list is getting longer and I keep starting books that I don't plan to but that's half the fun.

Finished:

Bill Bryson: "Shakespeare: The World As Stage" I prefer Bryson's more serious stuff and like "The Mother Tongue" and "A Short History of Nearly Everything" this is a thoroughly enjoyable and refreshingly frank summary of what is known about Shakespeare and of his contribution to our language. It's pretty short and quite light reading but it is highly recommended.

In Flight:

Colin Tudge: "The Secret Life of Trees" One of its review blurbs describes it as "One of those books you want everyone to have already read". I wouldn't quite go that far as I think you have to have a significant tolerance in order to keep interested in a book that is more than 50% one big long list of the various types of trees. Fortunately I am one of those and I'm revelling in it - especially since he seems to think that Kapoks really are magnificent (like me). He's just slightly too flakey for my liking but I can't really hold that against him - he clearly loves his trees and it is a book that I wish I'd had when I was young enough to realise that I should have always paid more attention to the trees I came across.

Richard Dawkins: "The God Delusion" I'm a bit ashamed to say that it has taken me more than a year to get around to reading it but I had a lot on last year after all. It is every bit as good as I'd hoped - not only is it substantially better written than some of his earlier books (which are excellent ideas books but those I've read were not as well written as this) but more importantly his core argument is very compelling, well thought out and coherently presented. It's definitely a book to make you think clearly - provided you are reading it in a frame of mind willing to do so.

Yet To Start:

Cormac McCarthy: "The Road"

Robert Harris: "Imperium"

Craig Murray: "Murder in Samarkand" ( thanks to Daithi.)

Jon Ronson: "The Men Who Stare At Goats"

Oliver Sacks: "The Man Who Mistook His Wife for a Hat"

 

Is it a Security Issue?

One of the Blogging Old Guard, Dave Winer, has been complaining vociferously about what he regards as a huge security issue for Apple.

My initial reaction was that he was out of line. The computing professional in me would say that if he relies heavily on any computing resource for his livelihood then he should have [a] frequent, reliable, tested and comprehensive backups of his data and [b] Backup hardware that he can switch to on demand and [c] all of his sensitive data should be encrypted. He handed his drive over to Apple without ensuring that it was safe to do so and that means that the mistake was his.

On reflection though that attitude of mine reflects a fundamental problem with the overall approach to security that is endemic among "IT Professionals". It should be reasonable to expect that you can avail of a warranty repair or vendor supplied service without worrying about who might end up with your credit card details, e-mail account access or (as in Dave's case) proprietary source code.

You can't of course and Dave's complaint is the sort of thing that needs to happen in order to make the various vendors involved (Apple, Microsoft and the IBM, Dell and the rest).

With a little more reflection I am beginning to think that Dave doesn't go far enough. It seems to me that he just wants to get his old hard drive back so that he can dispose of it thoroughly and prevent anyone stealing something from it in the future but he's already handed control of it over to Apple so from a purist InfoSec perspective he's already lost the data and that's the bit that needs to be fixed. He should be able to give a broken hard drive to anyone who might be able to fix it for him without worrying about losing control of who gets meaningful access to the data on it.

There is an opinion that Bitlocker [style] full disk encryption is the answer but I'm not so sure it's either sufficient or necessary. I think there is a need for full disk encryption in some cases but that an "un-mounted by default" secure store for "all things sensitive" is a better approach - that would include user profiles (and cookies\passwords) for web browsers, cached credential stores for network resources\e-mail\web services... as well as the more typical sensitive documents like letters to your bank and so on. You can hack together solutions for this today that are moderately safe but for normal consumers to benefit properly it would require some OS level re-architecture work and new versions of critical applications to work with the new architectures but I see in this the foundations for a compelling approach to making "secure by default" a desirable Operating System feature for consumers and small businesses.

Latest on Gaming Blues

So as I reported before Christmas Dell eventually sent a technician out to fix my problem by replacing the motherboard and the NVIDIA 8400GM discrete graphics adapter.

This replacement fixed the problem that I was having perfectly. The machine no longer tanks when playing Direct X games and I've played all of the various engines that trigger my issues for a couple of hours each now so I'm definitely convinced that the problem is resolved. Specifically Unreal Tournament 3, Half Life 2 Source Engine games (Portal, TF2, HL2) are all fine and 3dMark 2003 now completes.

I was initially impressed that Vista(32) accepted the motherboard change without a hitch but it became apparent shortly afterwards that there was a very serious and fundamental problem with the OS even though there were no errors being reported. After the hardware swap I was unable to access certain system components - the Control Panel and most of its subsidiary parts (like the Display Properties dialog). I was able to access the NVIDIA screen properties dialog, the Device Manager and the Windows Event Viewer (which reported no relevant errors even though there clearly were things going badly wrong, go figure) but not Windows Update or the Add\Remove Programs dialogs. Some digging led me to this post on the NVIDIA support forums which helps resolves problems with the Software Licensing subsystem after hardware upgrades. This made some sort of sense given the hardware change and WGA's problems with that and there clearly were problems with the two Software Licensing services on the machine. I was unable to get them both running correctly so I eventually decided that I had to reinstall Vista again. I had already prepared for this before Dell arrived and had everything either running from portable storage or backed up so the decision was pretty easy.

The reinstall allowed me to completely remove the multiple backup\restore\media partitions that Dell chooses to install that I have no use for. I had also messed up the partitioning a bit early on when I'd installed Ubuntu 7.10 and allowed it to do its own thing on the drive. Fixing this was a bit of a pain as Vista's installer had lots of problems removing some of the partitions, in the end I had to restart the install about 5 times to get it to a point where I had a completely empty drive that Vista's installer was able to recognise and after that there were no particular issues with the install. Thankfully I'd kept a copy of all of the latest Dell drivers and application updates that I'd downloaded so reinstalling them was pretty painless.

I then hit Windows Update immediately to let it do it's thing and it went merrily about its job until it ran into this problem with KB929777 failing to install with error code 8000FFFF. The recommended manual uninstall and manual install worked but I was surprised that a general release hot-fix would be that poorly behaved.

Once I'd reinstalled all Windows Update encouraged me to update the NVIDIA drivers to v156.69 from the Dell supplied version 156.55. That resulted in Portal (based on HL2's Source engine) failing to launch but had no impact on anything else so I downgraded back to the Dell drivers.

Finally I went to restore my data. Now I generally keep all of my data in a "portable" directory rather than use the default Windows data structures but this time I'd opted to use the default document folders for some stuff and I used the native Vista Backup to back this stuff up. Silly me. Now I didn't lose any data in the end which is something to be grateful for but Vista's native Backup application is abysmal, take my advice and don't ever use it. I've reverted to keeping my data in a folder structure that I understand and can backup with a single Robocopy. I think I'll be keeping things that way for good.

It's turned out fine for me in the end but I can't help thinking that this has taken far too much effort to resolve.

Dell To The Rescue

Following up on my posts about the problems I had playing DirectX games on the M1330 (Gaming Blues and More Gaming Blues) I finally caved in and actually called Dell last Wednesday rather than continue to wait for the Internet based ticket issuing system to actually work. Dell requested a little more diagnostic work ( facilitated by Mr Cronin, thanks Pat ) that involved swapping the hard drive out with that in a similarly configured M1330. That pretty much proved that the problem was with the hardware and Dell eventually arranged for a technician to come and replace the motherboard and graphics card. The delay was pretty much all my own doing in the end and to be fair to Dell once they accepted that the issue required a hardware swap they had a technician out to do the job within a day.

Dismantling one of these things completely is a reasonably complicated task - all in all it took the technician just over an hour to take everything out and put it all back together again, and he really did know what he was doing. Now that I've seen it I think I'd have about a 50:50 chance of repeating the exercise but I don't think I'll ever try.

Anyway the good news is that the swap has (so far) completely eliminated the problem so I can now happily waste hours playing TF2, Portal, HL2 and UT3.

The other good news is that the network adapter that I was disappointed to discover is only a 100Mbps part is a very easily replaceable (and upgradable ) part and the WLAN antenna cabling is kitted out to support 802.11n. So two of my (minor) beefs with the machine are fairly easily fixable should I choose to do so.

Edit: Just adding a link to my final update on this here.

PayPal's Single Use Virtual Credit Cards

I was delighted this morning when I found this press release from Orbiscom and read that PayPal had finally opened up their Orbiscom derived PayPal Plug-In single use Credit Card system to their entire user base.

Anyone with a PayPal account can now download and install the Plug In however it appears to be preventing me from activating the one time Credit Card feature unless I can provide it with a personal credit card with a US billing address. I suspect that when this press release talks about "entire user base" they really mean just the US users which is a pity.

I'd be delighted to find out that I'm making some mistake here though as I really miss the security of the old O-Card that I used to have from Orbiscom since my bank discontinued the service last year.

New Moves in Authentication

I noticed that Barclays are starting to deploy a two factor \ one time password authentication mechanism for online banking called PINSentry. It's an interesting step that should make it pretty hard to launch brute force attacks against consumer banking accounts but it is no better at defeating man in the middle attacks than any of their previous mechanisms. I've made the point before and will make it again - without full mutual authentication using very strong authentication protocols the whole online banking and payment system remains fragile.

This is significantly better than Verified by Visa for example which still leaves me scratching my head as to its usefulness to me (as a card holder). When paying using VbV you first enter all of your card details onto the vendors website - they now can take as much out of your account as they please and if they are stupid ( like these people ) they will not protect those details so that criminals can steal them and use them to steal from you at a later date. After the vendor has been given all of the sensitive data that you might like to protect they then ask Visa to authorize payment and at that point Visa force you to go through an entirely unnecessary (for you) authentication mechanism. This authentication step protects the transaction between the Vendor and Visa so both of those parties benefit from getting you to do this but since you have already given the vendor all of your details you remain exposed to the risk of fraud. In fact as far as I can tell the only difference that VbV makes to a card holder is that it will be very difficult to challenge a payment that has been authorized through VbV - bear that in mind when you choose a password for it.

To be fair to Visa and Barclays though they are making some attempts to move forward and it is very,very hard to implement change in the area of consumer payment schemes.

All is not bleak however. A couple of us in Intel had a patent idea declined last year that was almost identical to this juicy bit of news. F-Secure's recent report from the Information Security Forum's 2007 conference in Cape Town discussed a demonstration by Jolyon Clulow from Deloitte of a new class of banking card that includes an embedded keypad so that the user authentication process can occur within the (user) controlled card's physical enclosure.

It's not clear yet whether this new card will be part of the foundation of a properly mutually authenticated system where individual transactions get the sort of unique authentication that I believe we need in order to make these systems sufficiently robust but it definitely takes one of the steps that must happen before we get there. If nothing else cards of this type can dramatically reduce the risk of card skimming type attacks, well they will provided certain back ward compatibility risks are managed effectively by the banks. It's no good implementing chip and pin here in Ireland if a skimmed copy of my cards magnetic strip or card number can be used by a thief in Bali without being challenged (for example).

The end state that I want to see will need card readers for this type of card present in all types of device where we wish to carry out online authorization's. This sort of thing is not limited to banking either but at least with banking there is a good commercial reason to do it now, once it's in place the banks can start to earn some less grubby revenue by selling trust services to consumers.

All of these things could deftly link into the OpenID, InfoCard or CardSpace structures that are being built out at the moment. OpenID's big gap is that it still relies on passwords in almost all its implementations. CardSpace's big problem is that it is locked into the core Windows OS architecture(s), although that does give it some significant anti-tampering strength, and the other InfoCards suffer because they are pure software only credential stores sitting on effectively untrustworthy hardware and operating systems. All of these systems could benefit hugely from being able to delegate interactive user authentication to a compact hardware token that is extremely hard to compromise.