Could Hollywood improve cyber security?

The digerati know that vehicles using Chrysler's Uconnect can be compromised remotely. You can read more in the Wired Article (Hackers Remotely Kill Jeep). The problem is that the general public, nor their elected representatives know or care much about it. If they did, they might understand how this is a threat to both our nation's economy and security.

Q: How do you raise awareness?
A: Motion Pictures.

The basic idea: Standard fare action adventure movie. Someone pretending to be a valet at a car park slaps a device into the OBD port of the target's car. They drive away and are remotely executed in what looks like a plausible car crash.

Now you need a few reviewers to point out that this is not fiction, and possible today. With that you might generate some justified public concern. Make the movie target an elected representative and you might get some actual movement in our laws.

Senators Markey and Blumenthal have introduced a bill which addresses these issues. (http://www.markey.senate.gov/news/press-releases/sens-markey-blumenthal-introduce-legislation-to-protect-drivers-from-auto-security-privacy-risks-with-standards-and-cyber-dashboard-rating-system, http://www.markey.senate.gov/imo/media/doc/SPY%20Car%20legislation.pdf). It is a great start, but it misses one point. It should not simply say "such as penetration testing". It should require "penetration testing by multiple independent third parties".

Well, I seemed to have gotten a little off topic here, but I do think it would make a great plot element in a film. I'm claiming copyright on that idea. I won't require much in residuals.

Online banking password fun

Security teams that do not test UI flows deserve a special place in hell....

• I bank with Chase.
• My current password is long enough and not made of any known words, but it has no digits in it.
• www.chase.com recognizes machines you sign in from (cookie or browser fingerprint, I do not know).
• When I use a new machine or browser installation, they redirect to a page where I can get a verification code sent to me via text or email.
• When I click Send, they direct me to a page where I must enter the access code and my current password.

Nothing that special so far, simple 2-factor authorization. But wait for it.......

When I enter my access code and password, it rejects the password in browser side code because it does not have a number in it. They have implemented the new password policy in the UI, without making sure the customers have complied with the new policy. I can certainly work around this, but they are going to have some unhappy people over the next few months.
​

Bubble Wrap Day

Baseball teams have traditionally had give-away nights a few times a season. From childhood, we all know of bat day (which, surprisingly, does not seem to cause more trauma than usual: http://www.ncbi.nlm.nih.gov/pubmed/8135433), and cap day. Over the years they have added BBQ aprons, bobbleheads, gym bags, sunglasses, jerseys, beer cups, pins, and some sorry gift cards.

Toss it all in the dumpster. I want Bubble Wrap Day^TM.

Every attendee gets a square yard of bubble wrap. The organist pumps up the music. We all pop it in unison. Or... taunt the opposing pitcher. I challenge anyone to keep their composure with 15,000 people popping bubbles at them.

Let's here it for taxpayer supported rule of law.

My daughter's pocket was picked the other day. It turns out you can get your driver's license replaced for free if you file a police report. We asked if she was going to do that and she said "That depends on how much it costs."

Huh?

"Well, yeah. It depends on how much it costs to file a report with the police."

"What do you mean? It's free."

After a bit of back and forth, we realized that she spent some college summers in the Dominican Republic and Tanzania. There, it seems, the police serve only those who can afford them. If you want service, you pay directly.

We might have some issues with who the police serve in the USA, but I am happy to live in a country where the presumption is that anyone who is wronged has a chance at justice.

Performance Sheets

Last week, we purchased a Sleep Number mattress. It was grotesquely expensive, but I'm willing to try it so that my wife and I can have different softnesses on our respective sides. Marriage is a lifetime of compromises, but one person sacrificing sleep for the other is not a sustainable situation.

The sales person (unsuccessfully) tried to sell us their "Performance Sheets" -  at roughly $300 a set. I cut my losses there. Performance Sheets. Really? I've been sleeping every day of my life for years, but I'm not sure I have advanced beyond amateur status. I have had some critical acclaim in the non-sleeping arena, but still, performance sounds too theatrical. Miles Monroe said it best "Uh, uh, I don't think I'm up to a performance, but I'll rehearse with you, if you like."

For humanity's sake, let us stop using RFC 822 format dates for time stamps

Human readable dates have no place in internet protocols. Even more so when you have a date which is hard to parse and can have invalid values (e.g. A string which says "Thu" for a date which can not possibly be a Thursday). The only timestamp you need is seconds[.milliseconds] from an epoch (bikeshed about the epoch all you want) in GMT. Optionally, you might want to know the offset from GMT of the entity that caused the event.

What Humanity Aspires to - In One Frame

http://www.theimaginaryworld.com/comic062804.jpg

There is a man (well, a bread) who is totally at peace with himself. When all you can ask for is ice cream and a balloon you are experiencing life correctly.