Improving Hashes Doesn’t Improve Passwords

Yesterday, an effort to produce a new Password Hashing Algorithm was announced.  Dennis Fisher describes the initiative in his 2013-02-15 Kaspersky threatpost article, “Cryptographers Aim to Find New Password Hashing Algorithm.”  Here’s my comment.

First, the article suggests that the NIST competition to choose a new cryptographic hash algorithm to be standardized as SHA-3 has not concluded.  NIST selected KECCAK as the basis for SHA-3 last year.   KECCAK has many applications and it will be a while before the its application in an SHA-3 will be standardized (in an anticipated FIPS 180-5).  See the 2013-02-06 presentation, “Keccak and the SHA-3 standardization.”

There’s also a remark concerning the ability to attack PBKDF2 easily.  PBKDF2 is an iterative, salted key-transformation procedure that can be based on a chosen PRF for the transformation.  It is typical for PBKDF2  to conduct a large number of HMAC-SHA1 iterations.  Other MACs can be used.  The idea is to raise the work factor to make brute force attack on the password infeasible.  The problem with PBKDF2-derived hashes as a password authentication approach is not the ease of attack but the imposition of that work factor on server-side authentication procedures.

So long as the password-based authentication procedure is required to be efficient and economical, the problem is not the hash.  The problem  is the password choice and the poor security that allows the hash to become known.   Once the hash is disclosed, adversaries have the same efficiency advantage, and all the time and resources they need, to discover the password.    Improving the hash does little to mitigate this serious problem.   New password protocols are required.

I’ve gathered my considerations on what is required to confine the consequences of hash disclosure.  The particular framework for minimizing password discovery is not important, it is the considerations that I believe apply to any such effort: “AuthzN Password-Independent Keys.”

All Your SD-Card Belong to Us

After attending a Geek Dinner last night, I wanted to import the photos from my SD Card into my Windows photo folders for editing and posting to Flickr.  Naturally, there were some cat pictures accumulated on my camera also.

Unfortunately, Windows 7 claimed that the SD Card needed to be formatted.

I didn’t do that.  I put the SD Card back in my Nikon D80 and the 15 pictures were there.

And Windows 7 still declared that the SD Card needed to be formatted.

I fired up Quadro, my Windows XP SP3 Tablet Computer, and used its SD Card slot.  No problem.  There I used Windows Live Photo Gallery to extract the photos from the SD Card, transfer them to my photo collection on Windows Home Server, and delete the images from the SD Card.  It was all fine.

Just for laughs, I put the emptied SD Card in the slot on my Windows 7 desktop system.  It was all fine and Windows Live Photo Gallery opened up automatically and offered to import any pictures from the SD Card. 

Now, the only other thing that I had done before that last step was to upgrade Skype 6.0 to Skype 6.1, the one being promoted as the integrated replacement for Windows Messenger (previously removed, though).

Any sufficiently-advanced technology, when broken, is indistinguishable from infection by poltergeists.

The Great Social Security Scare-Off: Why?

This arrived in my postal mail a few days ago:

Today, 36 percent of the federal budget is consumed by Social Security and Medicare, a growing cost shouldered by the shrinking population of younger Americans.”

There were other numbers being bandied about.  I bet readers of this, having heard repeated statements about the cost of “entitlements” and the proportion of older Americans accept this without challenge.

What I find most discouraging about the above statement, completely lacking in any description of its basis and terminology, is that it is made by AARP Bulletin editor Jim Toedtman in his “The Magic of the Fountain of Youth” opinion piece.  There is no such “budget.”

It is amazing how much belief has been captured on the road from “Social Security will not be there for you” to “Entitlements [Social Security] are killing the economy and drowning us in debt” or words to that effect.  No matter that Social Security and Medicare have nothing to do with the deficit, their urgent reduction/elimination is to be traded against increased revenues by taxation.

Members of Congress, including card-carrying liberals, also fall for this, lumping Social Security and Medicare disbursements as if they are part of a single overall budget.  It is apparently too difficult, or inconvenient, to emphasize that contributions to those funds, and their disbursements, are by different arrangements.   Such is the power of this cloak of fear and anger on the conventional wisdom.

It is time to find a heavy dose of Bill Clinton’s remedy: arithmetic.

A good place to start is your own (or any hypothetical) “tax receipt”.  The White House provides an on-line calculator determining the separate contributions to Social Security, Medicare, and Income Tax.  It is your income taxes that go into anything resembling revenues that are apportionment among government expenditures.  Social Security and Medicare deductions do not go into that pot.  Since the government is currently spending more than it receives, it is not clear how much of the apportionment is from debt, not revenues.

The available tax receipt is for 2011; 2012 should not be much different.  The only way that Medicare and Social Security can show up in those expenditures is if it is necessary for the government to cover a shortfall beyond what those programs have available for their disbursements.  That has not happened for Social Security.  It is unclear what the Medicare portion is in the 2011 “tax receipt.”

That does not mean there is no cause for concern.  I’ve read that 2012 is the first year that payments from the Social Security trust fund exceeded new contributions to the fund.  Social Security is not directly funded by annual receipts.  It is backed by a trust fund that is only now beginning to be reduced by the discrepancy between payments and new contributions.   The expiration of reduced payments on December 31 may improve matters for 2013.  But it is the case that the trust fund could be depleted sometime after 2030 if no remedies are put in place.  

There are various remedies for preserving the health of Social Security that do not involve surrender to the ideological desire to eliminate it.  One appraisal is in Samir S. Soneji’s New York Times  opinion piece.   Go past the scary title to the available numbers and the prospective remedies. 

Medicare is more complicated, because the rate of increase of medical-care costs is overwhelming the ability of the program to cope.   There is a separate trust fund that banks contributions against future need.  There are measures for short-term relief, including provisions in ObamaCare, but the rate of increase in costs is daunting.

For both of these programs, it is important to look at the long term and be clear-headed about the opportunities for preserving the promise of these important social programs.  Clarity starts with looking at the actual numbers and the factual state of affairs. 

Related articles

• Ronald Reagan’s Message for the GOP, ‘Social Security has nothing to do with the deficit.’ (politicususa.com)

RSS: Blogs as Publishing

I much prefer full-content blog feeds.  I want to be able to use my feed reader to see what the article is.  I can then delete it, flag it, or simply let it sit there until my attention comes back to where the feed sits in my blog collection.   I also know that I can use full-text searching in my feed collection when I am looking for something I remember having noticed in the past.

I treat blogs as feeds into a compilation of clipped blog articles that is at my fingertips and with organization at my whim.

It takes very special circumstances (such as a blog on security issues) to have me willingly subscribe to a feed that has only titles and, at best, short summaries.

Blog pages, especially aggregation blogs, often defeat my quest for a full-content feed of an individual contributor whose topics align with my interests.  The browser button that indicates a feed is available rarely provides the full-content feed that I am interested in, sometimes providing an empty feed.  I have to search the page for other feed sources.

What I failed to notice is that, at least since Internet Explorer 8, the feed-presence button is a pull-down, and there are feeds available for matters that I had never noticed before (such as Bing search-result pages).  

I have now found that (based on a very small sample), Atom feeds are more likely to provide full content than genuine RSS feeds, and when both are available, what is delivered can be different.  I don’t know if this is a quiet agreement or happenstance.  I certainly feel served, now that I know there may be more options than I thought.

It was particularly satisfying to discover this on encountering a blog that is about publishing and the world of digital publishing, including blogging.  I was finding it ironic that the blog itself lacked a full-content feed.  I’m delighted to learn that I simply didn’t know to seek further.

[I’ve promised myself to begin blogging regularly, perhaps daily.  I find this level is an aid to unlocking my writing.  Today though, I find I have been subscribing to blog feeds like crazy, not exactly a move in the right direction.  I’m not clear why that just happened.  It put me at 892 feeds being monitored with 3,892 unread articles.  I think I may be in need of an intervention.]

Mobile Payment Systems Arriving–Ready or Not?

Michael Brush’s 2012-12-28 article, “The next big battle for your wallet,” caught my eye on this morning’s MSN Money page.

There are a number of converging factors that suggest 2013 will see a flurry of mobile payment offerings supported by merchants of all kinds.  Without going into the parameters of the battle, some interesting technology issues will matter:

• Use of near-field communication (NFC) in mobile wallets will depend on technology-ready smartphones and may be a factor for consumers anticipating an upgrade in 2013-2014.
• There is a round of seller terminal upgrades coming along to satisfy Europay, Mastercard, and Visa security-system requirements by 2015.  The shift to mobile wallets could accompany that upgrade cycle.
• The emergence of competing smartphone applications will raise new security and safety concerns.  Reputation and availability of wallets may be a factor in the choice of phone upgrades.  Consumer confidence in the security of the platform may be a greater consideration.
• Users of mobile payment systems may have multiple wallets or single wallets that accommodate multiple mobile payment arrangements.  This matters with regard to the fee structure between sellers and the systems.  There will be many factors to consider, including where funds have to be available to be usable in a given wallet, the fees that a consumer experiences, etc.   Part of the competitive offering of these services will involve removal of friction and complexity and also the preferences of merchants for particular wallet systems.   The ability of sellers to make targeted offers to customers is a critical factor.
• Identity for personal and inter-personal transfers seems to be at the current lowest-common denominator: verified e-mail addresses and verified mobile-phone numbers with PINs, user names and passwords.  There’s going to be some turmoil here.
• From an user (and developer) perspective, it appears that we’re looking toward the wild-West stage at this point, and it is unclear how it will stabilize.  Meanwhile, eyes are on Google, eBay PayPal, LevelUp, credit-card services, and major retail chains such as Wal-Mart. 

I did not know about American Express Serve until I read this article.  I know banks such as Chase are providing mobile applications.  It is interesting to me that those two and others are not picking winners, each providing apps for at least three smartphone-platform contenders.  PayPal is also interesting from the standpoint of its on-line ubiquity.

I am going to be experimenting using some Apps available for Windows Phone.  I don’t expect to be doing much beyond observing the evolution of features and assessing usability.  I’m curious about security arrangements and protection of the smartphone.  I’m not familiar enough with the underlying platforms to be able to formulate an independent analysis though.

First impression: We’re in very early-adopter stage at this point.

Getting some Delicious (again, maybe)

It seems that the use of a DLL and plug-in is no longer the preferred way to connect to delicious.com for capturing bookmarks on that service.    With the plug-in, I did have trouble losing my cookie and needing to log in again.  This was exacerbated by the fact that the log-in pop-up wouldn’t let me use clipboard paste to bring the password over from my password safe.  I don’t know what the passwords are and they are terrible to type directly.  So I endured having to go to the delicious.com site to log in there and refresh my cookie for again capturing bookmarks. 

When I “upgraded” to Internet Explorer 10 Release Preview on my Windows 7 system, I couldn’t close the browser without it crashing.  On failing to roll-back to Internet Explorer 9, I restored IE 10 and tracked down the crasher. It was the de.licio.us DLL.  So I shut that down.

That was frustrating because I use de.licio.us to make useful notes to myself, enhanced by the fact that I also subscribe to the RSS feed of those bookmarks and their notes.

To compensate, I found I could still use the “Blog this in Windows Live Writer” to capture clippings and post to a blog of mine (and use its RSS feed in the same way).

Fortunately, my next inspiration was to actually go to Delicious.com tools and see whether there were later versions of the plug-in.  No, there is no mention of a plug-in any more.  But there is a bookmarklet.  I went through that drill:

The bookmarklet is a button you add to your browser’s Bookmarks Toolbar so you can easily save links to Delicious.

Installing the bookmarklet is easy:

1. First, make sure your browser’s bookmark toolbar is visible. On internet explorer, go to “View” on your browser menu, select Tool bar, then Favorites Bar.
2. Next, drag the bookmarklet button to the right to your Bookmarks Toolbar. … Make sure to select the “Favorite’s Bar” which will save the Bookmarklet on your Favorite’s toolbar.
3. That’s it! Now, to save a webpage to Delicious, just click on your bookmarklet to open the save window. Add notes, tags, images or highlight text on the page to add it to your comments.

There is also information, there, about putting delicious buttons on blog pages.  That’s a task for the future.  First, I want this bookmarklet to work and IE10 not to crash (well, at least not for this reason).

Narrating the Work; Narrating the Numbers

Why Nate Silver and not other numbers guys?

Because Nate is a blogger. Really. Others put data out there as well (see links at the bottom). Nice graphs and charts and tables. Great numbers, essentially the same as Nate’s. But they don’t tell a story about the data. He does. He’s been doing it for years. He has regular readership. He has a recognizable voice. He has earned trust not just by the strength of his predictions, but also by the strength of his writing, his personality that shines in his blog posts, his transparency about his thinking and about his methodology.

People focus on Nate and trust Nate because he is an expert, but more importantly because he is an expert who can tell the story. An expert who can explain stuff in ways that people understand. He narrates his work and his numbers.

Nate Silver and the Ascendance of Expertise | A Blog Around The Clock, Scientific American Blog Network