Sunday, June 12, 2005

You've seen it before, over and over and over again: PowerPoint presentations that contain practically every word pouring out of the presenter's mouth, slides that digitally drone on and on and on and...

PowerPoint, when used well, can be a useful, powerful (hmmm) and productive tool. But more often than not, it's a bane of our existence, putting us to sleep with completely forgettable blocks of useless text and gratuitous effects.

I have seen PowerPoint used as that proverbial, metaphorical screwdriver, where the proper tool would instead be a hammer. I've seen attempts at web-site designs done in PowerPoint (by the way - that still doesn't work people). I've seen it used over and over - by a wide variety of people trying desperately (and with good intentions, I am sure) to create something outside their area of expertise - using it to do things for which it simply was never intended.

But even when PowerPoint is used what is was meant for - creating slides for presentations - it can be painful to see how people use it. It's a software tool and requires some level of technical understanding to be sure, but technical expertise in using the program is not the most important part of the job.

PowerPoint has become a crutch, and more often than not it's damaging the patient. It's the loaded gun in the hands of the untrained shooter. It's the '79 Cadillac being driven by the nine-year-old who learned by watching mommy.

Kathy Sierra gets this. She understands, and she wrote about it to try (I assume) to make a difference in how it's used in the world. If you use PowerPoint, regardless of your expertise of years of experience you should read her post and take it to heart.

I've also been reading Cliff Atkinson's new book, "Beyond Bullet Points," and it's a great book for learning how to put together effective presentations "that inform, motivate and inspire." Recommended.

PowerPoint's a great program, to be sure. But it's only a good tool when put in the hands of someone who knows how and when to apply it. Kathy's post should be mandatory training. We license drivers... Maybe we should come up with a test and a license for PowerPoint users?



Add/Read: Comments [1]
Random Stuff | Tech | Things that Suck
Sunday, June 12, 2005 12:51:24 PM (Pacific Standard Time, UTC-08:00)
#  

Million-slide1

Marshall Brain, creator of How Stuff Works and other successful ventures, presented to a group of college students recently on the topic "How to Make a Million Dollars." He received a number of requests to provide the presentation afterward, so he published the slides and typed up the presentation online.

And it's quite good. He distills the options down to the stuff that matters, and as usual his style helps to carry the message. Click the image to get his presentation.

[via Jeremy Zawodny]



Add/Read: Comments [0]
Sunday, June 12, 2005 5:55:29 AM (Pacific Standard Time, UTC-08:00)
#  
 Saturday, June 11, 2005

More and more as time goes on I am asked about how to securely configure and use computing systems, whether they be Internet sites, online financial services, wireless networks, home and business computers, physical homes and businesses, or what have you. Since my role in that area has not changed too much, I have to assume the uptick in questions comes as a result of a desire by people to get more secure, which is a good thing.

Someone named Jim wrote me the other day and asked about my philosophy on passwords. I get this specific question often enough, I thought I would write about it here:

Hi Greg,
I posted a question on the PCWorld forum and your name came up regarding my question.  My issue was regarding passwords.  I am a Realtor and our main access to the MLS is starting to require password changes monthly.  This is not that difficult but along with all the other passwords I have to use each day it is getting to be a bit of a headache and I think it's time that I get my act together once and for all and get passwords under control.  I asked for opinions on software and also philosophy.  I'd like to hear your opinion.  Thanks and I'm looking forward to reading your response.

Preamble

My name is Greg, and I am an IT and security professional. It's been more than six months since I last created a traditional password. They say it's a disease, and so I am here to share my experience, strength and hope so that you, too might recover from the ravages of insecure computing and inadequate safeguarding of information.

Or something like that. Ok, now let's get serious. I'll share what I do as well as one computer program that I have found can help.

Philosophy

My password philosophy varies based on the system in question, to be perfectly honest. I use passphrases as much as possible, meaning passwords in the form of natural sentences or phrases including things like spaces, normal capitalization and punctuation. That makes them easy to remember, yet tends to keep them complex enough to meet stringent security requirements.

As a general rule, passwords or passphrases should be at least 8 characters in length, preferably longer (I tend to go with 13 or more characters, and you're going to see how easy that can be in a minute). They should also always include at least three of the following four characteristics:

  • Upper-case alpha characters (A-Z)
  • Lower-case alpha characters (a-z)
  • Numeric characters (0-9)
  • Punctuation or other special characters (!@#$%&(*?>< etc.)

In addition, the rotation period for expiring passwords in a secure environment should be no less than every 60 days, and preferably less. Using too frequent of a rotation tends to result in self-defeating problems with the whole process: People who have to change their passwords every 15 or 30 days, for example, have a tendency to write them down and stick them in their wallets, or to use less-than-secure passwords. That's bad.

Another common problem is passwords expiring at inopportune times. I expire passwords in intervals of 7 days. Why? Simple - If you set passwords to expire say every 42 days, someone whose password expires on a Monday will always expire on a Monday, which avoids the problems of expirations falling on weekends or other difficulty days.

I think you'll find that most experts will agree with the above recommendations.

Maintaining passwords and passphrases securely - helpful software

Switching gears to management and storage of multiple passwords for various systems, one simple rule that should be obvious is often set aside, but should always be followed: Do not use the same password in multiple places or systems unless the system is built to support doing so for you. Great, you think... How am I supposed to manage that many passwords, especially if I am always moving around and use more than one computer, or if I use a laptop? Well there are several tools and methodologies that can help.

RoboForm is a software passkey management program that's grown up quite a bit over the past few years. It not only secures and stores passwords, it even fills out logon forms for you. Last year they created and started testing a version that installs on a USB key called RoboForm Portable, or Pass2Go. It's surprisingly not well-known, but it works pretty well. Your passwords are secured on a USB key with Triple-DES encryption. So for most all purposes (maybe not national security secrets, but hey you know what I mean) it's quite secure, and you can install it right on the USB key/drive and run it from there (you can even put the portable version of Firefox on there if you want and tie them together). Using the USB drive to run the RoboForm Portable program means nothing has to be installed on the client computer. If you lose it, it's encrypted and locked with your master password. Note, too, that there are RoboForm add-on's not just for USB keys, but also for Palm and Windows Mobile devices. So you get to choose, and all of the beat the proverbial Post-It note for security and convenience.

But none of that matters if you can't solve the real problem

But the real problem with passwords is that people forget them all the time, so they do things like use the same password everywhere, or they write them down somewhere and don't secure them, not to mention the fact they can't remember them. You end up with either an insecure system or a help desk that's dying just trying to unlock accounts and administratively change passwords. That's no good.

The fact of the matter is that the simplest way to remember passwords is to use ones that you can naturally relate to. Just as important, they need to be complex and secret enough to be sufficiently secure. This can be done. For example, I have a cat named Cleo. So, I might think about using passwords and passphrases like:

Cle0IsMyKat!
Cleo is my Cat!
cleoizmykittykat
Cleo get off the freaking furniture darnit!

You get the idea. Now, since these passwords and passphrases are often set to expire frequently and I don't want to forget them, I always try to think seasonally - incorporating things that are happening in my life at the time. When creating a new passphrase, I don't ask myself "What can I type that I will remember in ten minutes?" Instead, I think "What's happening in my life between now and the end of next month?" For example, if I had to create or change a passphrase or password right now, I might do something like:

Fireworks on July 4th are so cool...
Woah dude like check out the freakin fireworks dude!
FireworksOnJuly4thAreSoCool...
Woahdudethosefirew0rkzaresokool*
Pow bang boom! Oh wow did you see that?

Of course, I won't actually use anything like those, now that I have posted them here (hey trust me - people have done much stupider things). But by making a passphrase meaningful during it's lifetime, I can remember it quite easily (Well, usually anyhow - it can take a little getting used to). By the time the next password-change rotation comes around, I'll just think of something else I can remind myself of for the next 30 or 45 days.

You're probably starting to get the idea of how passphrases work from the examples, and it's also probably becoming clear that I am a proponent of them. They're easy to remember and - this is important - easier to type than munged up words where you replace letters with numbers and convert everything to hacker-speak. They are also quite long and more complex. And more complex means more difficult to guess or randomly replicate, which means more secure. And on top of that, you can actually remember and accurately type it. Not a bad deal, really.

There's no perect answer - some unthinking person with no concern for security will throw in a wrench

Note that not all systems where you can create passwords will let you use spaces in the password field, and some will even limit how many characters you can use.** So, sometimes you have to adjust the way you create your passwords and passphrases to work within arbitrary limits set by arbitrary (non-security-oriented) decision makers.

** Note to security departments everywhere: Get more involved in the app and interface design phases. Just because a DBA somewhere says my online banking password needs to be truncated at 8 characters to save disk drive space doesn't mean they're right. Security reviews need to happen at design time, and then as a part of every step along the way.

By the way, to go off on a bit of a tangent - Jim's original question illustrates exactly why a well-secured and well-designed unified authentication systems can be so valuable, where it makes sense. For consumers, that means something akin to Passport or one of the unified authentication systems out there. In a business computing environment it more often means using something like a Windows domain or Novell directory to have a single set of credentials that you can protect, but which will allow you to access multiple systems. To provide additional security, you don't necessarily want to break an authentication system up and require multiple passwords, because then you're defeating the whole purpose of the unified system. Instead, you might start adding additional factors of authentication to those specific systems where you need extra authentication or authorization protection (RSA SecureID is one great example of how to add another strong factor of strong authentication in an environment where security is very closely managed).

But Dr. Johansson's the one who's really got it covered...

For more information in the philosophy department, I'd point you at Jesper M. Johansson's work on passwords vs. passphrases:

The Great Debate: Pass Phrases vs. Passwords

  • Part One - covers the fundamentals of passwords and pass phrases, how they are stored, and so on
  • Part Two - discusses the relative strength of each type of password, and use some mathematical approaches for illustration
  • Part Three - offers some conclusions and guidance on how to choose passwords and configure a password policy

I've rambled a bit, but I hope that helps. I have a lot more to write on the subject of authentication security, but that will have to wait for another time.



Add/Read: Comments [0]
IT Security | Safe Computing | Tech
Saturday, June 11, 2005 9:56:24 AM (Pacific Standard Time, UTC-08:00)
#  
 Friday, June 10, 2005

A new beta version of Technorati - the web-based service that "brings you what’s happening on the web right now" - is available at http://beta.technorati.com/, and it looks darn nice. I like the new look and user interface (the search "options" feature is great for new users), and it seems to work quite well. You can learn what's new on the Technorati beta weblog.

Support for tags, more search options, personalization and watchlists are some of the new functionality in the beta version.

Technorati is currently tracking 11.1 million sites and 1.1 billion links. That's a lot. Tons of information to be had, and not it's easier than ever to do.



Add/Read: Comments [0]
Blogging
Friday, June 10, 2005 4:43:25 PM (Pacific Standard Time, UTC-08:00)
#  

An email list I am subscribed to had a quick thread that pointed to a conversation about FeedDemon and the fact that a user didn't want to use IE as the default embedded browser inside of FeedDemon. That's fine, but the problem is that someone suggested he actually abandon his favorite RSS reader (meaning FeedDemon) and try another one.

The recommendation was (in my opinion) premature. Why? Because FeedDemon can in fact use the Mozilla engine as it's embedded web browser, and you can find out how here.

And by the way - if there's something you wish was in FeedDemon for the future, Nick listens. Go to the FeedDemon forums and just ask.



Add/Read: Comments [0]
RSS Stuff | Tech
Friday, June 10, 2005 1:19:15 PM (Pacific Standard Time, UTC-08:00)
#  

There is an interesting post describing the exploit of a weakness in MD5 via collisions, with a reproducible real-world example. The authors computationally found the collisions and were able to reliably and predictably produce two completely different postscript documents with the identical MD5 checksum. Their use-case story revolves around maliciously capturing a digital signature and using it for something other than it was intended. In the story, the MD5 checksum is relied upon to validate the authenticity of a document. The researchers wanted to show how this flaw could possibly be used in the real world.

"Recently, the world of cryptographic hash functions has turned into a mess. A lot of researchers announced algorithms ("attacks") to find collisions for common hash functions such as MD5 and SHA-1 (see [B+, WFLY, WY, WYY-a, WYY-b]). For cryptographers, these results are exciting - but many so-called "practitioners" turned them down as "practically irrelevant". The point is that while it is possible to find colliding messages M and M', these messages appear to be more or less random - or rather, contain a random string of some fixed length (e.g., 1024 bit in the case of MD5). If you cannot exercise control over colliding messages, these collisions are theoretically interesting but harmless, right? In the past few weeks, we have met quite a few people who thought so.

"With this page, we want to demonstrate how badly wrong this kind of reasoning is! We hope to provide convincing evidence even for people without much technical or cryptographical background."

Once again, security by obscurity defeated. Interesting read and might make you think. If anyone has comments on their test or process. I'd be interested to hear.



Add/Read: Comments [0]
IT Security | Tech
Friday, June 10, 2005 5:51:03 AM (Pacific Standard Time, UTC-08:00)
#