How Magic Might Finally Fix Your Computer

[Fnord]

Here's an interesting article on computer security, in which our beloved James Randi makes an appearance.

http://redtape.msnbc.com/2008/07/cambridge-mass.html#posts

(Hint: The Title is somewhat misleading.)

 

[ddt]

Here's an interesting article on computer security, in which our beloved James Randi makes an appearance.

Nice read indeed. Renowned security experts as Bruce Schneier (mentioned in the article) already knew of course that social factors play a large role in insecurity. The famed case of Kevin Mitnick^WP showed this too.

I especially like the idea of a "security drill":

Imagine, for example, if once each month or so your company's IT department send a legitimate-looking e-mail with a faux virus attached. Employees who "fall" for the e-mail would get a slightly embarrassing reminder not to click on unexpected e-mail attachments.

You cannot drive this home to people often enough. It's a sad fact of life that many people click on any attachment they get, or fall for obvious phishing mails. The last phishing mail I got (imposting for my bank) already sent red alerts to me with the greeting, which was an obvious mistranslation of the English "Valued customer". But seeing it got to the 8 o'clock news, that wasn't so obvious for the populace at large.

 

[Wudang]

Yep, "social engineering" is one term.
http://www.theregister.co.uk/2003/04/18/office_workers_give_away_passwords/
http://www.theregister.co.uk/2004/04/20/password_surveys/

 

[Prometheus]

I liked the point about computers being too user friendly. I've been saying basically the same thing for years. The more user friendly computers become, the less average understanding of computers exists among the pool of computer users. Computers are powerful tools; rendering them foolproof is truly foolhardy.

 

[Fnord]

I liked the point about computers being too user friendly. I've been saying basically the same thing for years. The more user friendly computers become, the less average understanding of computers exists among the pool of computer users. Computers are powerful tools; rendering them foolproof is truly foolhardy.

Mosta you younguns probably don't remember when using a computer meant typing in a command at an on-screen prompt. For instance, to copy a binary file from one drive to another, and then verifying that the copy was correct meant typing:

C:\> COPY A:\filename.ext /B C:\subdir\filename.ext /B /V​

I always set the prompt in red and the characters in green - on a black background, of course. This meant having the following command in my Autoexec batch file (ESC stands for ASCII character 027 / &h1B):​

PROMPT ESC[40;31m;$p;ESC[40;32m;$g​

And having the following command in my Config file:​

Device=C:\Sysfiles\ANSI.SYS​

Back in the day, any person with access to IBM's PC/XT library, and who had memorized enough of the DOS commands was a special person. If he/she had also memorized the I/O and memory maps and knew which jumpers to set on which peripheral adaptor board, then he or she had their coworker's respect, with the added bonus that once he/she had set up the PC/XT, it retained that exact configuration because most users were actually afraid of doing something wrong to their machines.​

A really smart sysadmin could set up all of his/her coworkers' computers to operate from the same menu, and lock out users from the systems' DOS prompt.​

(I think I got that PROMPT command right ... it's been a while since I've even seen a DOS-based machine.)​

 

[ddt]

I always set the prompt in red and the characters in green - on a black background, of course.​

Colour? You had colour? When I was young, we just had amber screens.



(and let's now just wait for the ones who are old enough to have started with a teletype, or with punch cards)​

 

[Prometheus]

Mosta you younguns probably don't remember when using a computer meant typing in a command at an on-screen prompt. For instance, to copy a binary file from one drive to another, and then verifying that the copy was correct meant typing:

C:\> COPY A:\filename.ext /B C:\subdir\filename.ext /B /V​

I always set the prompt in red and the characters in green - on a black background, of course. This meant having the following command in my Autoexec batch file (ESC stands for ASCII character 027 / &h1B):​

PROMPT ESC[40;31m;$p;ESC[40;32m;$g​

And having the following command in my Config file:​

Device=C:\Sysfiles\ANSI.SYS​

Back in the day, any person with access to IBM's PC/XT library, and who had memorized enough of the DOS commands was a special person. If he/she had also memorized the I/O and memory maps and knew which jumpers to set on which peripheral adaptor board, then he or she had their coworker's respect, with the added bonus that once he/she had set up the PC/XT, it retained that exact configuration because most users were actually afraid of doing something wrong to their machines.​

A really smart sysadmin could set up all of his/her coworkers' computers to operate from the same menu, and lock out users from the systems' DOS prompt.​

(I think I got that PROMPT command right ... it's been a while since I've even seen a DOS-based machine.)​

You mean you had a COLOR monitor?! Mine was orange monochrome.

 

[Ixion]

I remember the solid green and the solid amber screens. Not old enough for punch cards though.

 

[Fnord]

You mean you had a COLOR monitor?! Mine was orange monochrome.

Not only did I have the first EGA adaptor and monitor in my department, but I also had an 8087 chip and a 1200-baud modem that connected directly to the phone line!

 

[luchog]

Mosta you younguns probably don't remember when using a computer meant typing in a command at an on-screen prompt. For instance, to copy a binary file from one drive to another, and then verifying that the copy was correct meant typing:

C:\> COPY A:\filename.ext /B C:\subdir\filename.ext /B /V​

(I think I got that PROMPT command right ... it's been a while since I've even seen a DOS-based machine.)​

Bah, you poncy DOS users with your recognizable commands and paths. We didn't have all those intuitive, full-word commands and easily understood paths. We had to make do with two-character abbreviations followed seemingly-random flags, and "devices" and "mount points". And, of course, w don't get all those nifty extensions telling us what a file is, we have hope someone actually specified the file type in the file name, and rely on cryptic file attributes to know whether it's something to read , something to execute, or something that can't be read, but will stuff-up the whole sytem if we accidentally 'rm' it.

cp -pv /usr/local/home/username/filename /user/local/differentusername/filename

We might even have gotten colours, up to 8 different ones to play with, if we were lucky enough get one o' them new-fangled ANSI terminals, instead of our old VT100s. 'Course, there was X, with all the nifty graphics, if you were a guru enough to make it work and courd afford the hardware to run it. And even that didn't come with all those fancy menu bars and toolbars you whiny kids can't do without. We had to page through everything by hand, through using non-intuitive keyboard/mouse combinations, and we liked it that way!

 

[geni]

Mosta you younguns probably don't remember when using a computer meant typing in a command at an on-screen prompt.

Eh even in the 3.11 era DOS games were still fairly standard.

 

[geni]

We had to page through everything by hand, through using non-intuitive keyboard/mouse combinations, and we liked it that way!

mouse?

 

[geni]

I liked the point about computers being too user friendly. I've been saying basically the same thing for years. The more user friendly computers become, the less average understanding of computers exists among the pool of computer users. Computers are powerful tools; rendering them foolproof is truly foolhardy.

If you are relying on the computer user to provide security you have kinda failed. Although probably not as much as anyone still useing passwords for serious security.

 

[The Man]

Well, as the workings of a computer seems as magic to a lot of people, fixing it by magic might not be that disconcerting for them. Sadly, Arthur C. Clarke accurately described our current schism in technical understanding.

Arthur C. Clarke
“Any sufficiently advanced technology is indistinguishable from magic.”

 

[Prometheus]

If you are relying on the computer user to provide security you have kinda failed. Although probably not as much as anyone still useing passwords for serious security.

I don't rely on anyone or anything to provide security. I assume that there is no security and I try to avoid doing anything that requires it.

 

[The Man]

I don't rely on anyone or anything to provide security. I assume that there is no security and I try to avoid doing anything that requires it.

I forget who it was or how it actually went but from what I do remember from an article in a computer technology magazine back in the 80’s, it went something like this…

Even a computer turned off, sealed in concrete and buried underground, is not secure.

And that was from some NSA source (if I remember correctly).

 

[ddt]

Even a computer turned off, sealed in concrete and buried underground, is not secure.

And that was from some NSA source (if I remember correctly).

Isn't that a bit over the top? I mean, Windows NT got its C2 security rating, but only after they yanked out the network card and the floppy drive from the computer it ran on. Which goes to show where the biggest technical security flaws are.

Of course, an admin who enforces a password policy that you have to change it every month and the last 10 cannot be reused, will only prompt that the monitors will be full of yellow notes.

(and before people turn this one into a Windows-vs-Unix: until very recently, only specially adapted Unices like Secure Solaris even tried to get such a security rating).

 

[six7s]

...yanked out the network card and the floppy drive from the computer it ran on. Which goes to show where the biggest technical security flaws are

Indeed

In all large corporations, there is a pervasive fear that someone, somewhere is having fun with a computer on company time.

Networks help alleviate that fear.
John C. Dvorak

 

[The Man]

Isn't that a bit over the top? I mean, Windows NT got its C2 security rating, but only after they yanked out the network card and the floppy drive from the computer it ran on. Which goes to show where the biggest technical security flaws are.

Exactly, over the top, as I am sure both the source and the writer intended. I wish I could access that article for reference and although I have kept some of the magazines with important information, from that time (Scientific American and Science News), I am quite certain that particular article is no longer in my reference library. I doubt even an internet search would avail anything, as (though it might be in some online archive) I can not remember sufficient specifics to make such a search worthwhile. The key issue that was being expressed and that I have always taken with me, is that given sufficient resources and determination all security is breach able, particularly computers (unfortunately, as you assert, it is as true now as it was 25 years ago).

 

[geni]

I don't rely on anyone or anything to provide security. I assume that there is no security and I try to avoid doing anything that requires it.

You mean you've been dead so long you've entirly decomposed?