Quantum Cryptography pointless?

I always laugh when I see headlines like this on BBC websites:

"Unbreakable' encryption unveiled"

and even more so when I realize it is talking about "Quantum Cryptography". The idea is that you send data down a fibre optic cable and if anyone views it before you do it changes the photons used to send the data, so you can tell someone is watching. This does not really ensure confidentiality though as the data has been viewed, so you still need to encrypt the data using traditional cryptography.

So what does this really gain us? Well not much is the truth. We can share data and detect when some else sees it, but if they see it we lost already. So we encrypt the data and now we know if someone has seen the encrypted data, but again having encrypted it we should not care if it is seen. Not really that useful. Well in fact it is useful in one way, we use it to send the symmetric encryption keys to the other party. If the key is viewed we try again, if not we use it knowing no one else knows it. Wonderful a secure unbreakable way of exchanging keys.

Only we already have good ways of exchanging keys. It is called PKI, or asymetric encryption. In fact Quantum key exchange does have a slight problem in that I could perform a denial of service attack by watching every photon on the fibre. Thus a symmetric key can never be exchanged. This can be got around by using PKI, but now what is the point of doing this?

Well this has been my thinking on the subject for a while, so I was pleasently surprised to read Bruce Schneier's take on the subject today.

Alasdair

Thought provoking

Internet Privacy musings.

My friends know very well that I am the type of person who easily falls into ranting about things that annoy me (I claim it shows my passion). I to temper myself, especially on my blog. This prevents me blogging on a lot of topics. When I first learned about the UK governments plans to have a giant database storing lots of information about peoples emails, web browsing habits and so on I was really really cross. I am glad to read that the "plans" are much less sure than I originally thought.

Some of the comments made by Lord West got me thinking. He is quoted as saying:

"People must realise - and I used to say this within the Navy - there will be more people look at your Internet information than look at a postcard when you write it,"

"People tend to forget that - and [that] it is used for quite legal purposes, some of it."

I think he misses the point, the fact that ISP's and the like look at this information, is a separate issue from whether or not they should look at the data. In my view the content of an HTTP request should be read by two people. The web server, and the web browser. Anyone in between only needs to look at the TCP/IP headers. The post card analogy was the one that got me most. I think most people would agree that while a postman can read both the address and the content of a post card, he should in fact not do so. Reading it would be an invasion of privacy. The same goes for letters. While Royal Mail can open letters doing so is a last resort wen attempting to deliver mail and they do not, and cannot make money from the content.

So why do we accept it when applied to out network traffic. I think the answer is we do not understand well enough the concepts to realize what we are giving away, or allowing to occur. This needs to change. We need new metaphors for this that help people understand the privacy issues. We then need to ensure that either companies cannot make use the data they transport for monetary gain, or that opt-outs are provided.

Alasdair

Humane Meat, hmm

So I've been a little lax. I haven't been reading my comments, in my defense I don't get a huge number. This time it was from my friend Tim who recently emigrated to Canada.

In response to my decision to cease eating meat he asked "How about meat that is reared 'ethically' or humanely etc?". As I said before I stopped eating fish a long time ago and I am often asked this exact question. Recently someone said "you've got it all wrong, you should eat farmed, or line caught fish", now what he meant by this was "I like fish, I accept that fishing is ecologically bad, so I'll only eat farmed or line caught fish". This is fine (well I object to the idea that farmed fish is ecologically bad, but I'll leave that for the moment), it is his decision. My decision is that not eating fish is the correct and best solution.

So I have extended my views on fish to cover all animals. Yes, if you have to eat meat it is better not to buy the Tesco £2 chickens, and opt for organic, humanly killed 'ethically' reared meat, this is better because the chicken will taste better and almost certainly be better for you. The chicken probably had a better life too, but for me I would prefer not to end its life so I can consume it.

The decision as to whether or not to be vegetarian, vegan is a personal one and I have no interest in forcing other people to adopt my view, if people want to that is fine, if they don't that is also fine.

Alasdair

Farewell to Meat

So today I made a decision that has been a long time in coming. I am not going to eat meat anymore. So why am I making this decision?

Well I stopped eating fish a long time ago. My reasons being:

• I do not like the way fish are killed
• We do not fish in a sustanable way
• Fish farming is bad for the environment
• Fish often has high levels of heavy metal in them
• When carniverous fish are farmed we need yet more fishing to feed them (think cod farming)

but I was still eating animals. This was a little hypocrytical to be honest, but I liked meat more than fish anyway.

So during lunch yesterday we were talking about dolphin fishing in Japan. Someone said that dolphins get dragged (while still alive) from the water and along the street, screaming all the way. School children walk past oblivious to the animals plight, they are used to it. Whether this is true or not it made me feel sick. One of the other people then started describing how cows are slaughtered in some abertoires and to be honest, it was not any better.

It was at this point I realized how hypocrytical I was. I did not want to know about what went on because it was easier to pretend it did not happen and eat the meat.

So today I went to the dolphin for lunch and while queueing up to order I realized I could not face having any meat, so I did not have any. In fact I still do not think that was the moment I made the decision, I was still toying with the idea. Until this evening. I was called by some friends who invited me round for dinner. It was at that moment I made the decision.

So from today no more meat will pass my lips. Well I hope so, I have a bad memory for these things, so I might forget from time to time, and I struggle to remember that fruit pastilles and similar have gelatine in them.

My friend Joe became a vegan recently, for different reasons. He blogged about them here.

Alasdair

Should software be free (as in beer)?

Something I have been wondering about recently is should software be free (as in beer). Well perhaps not totally free, but free for non-commercial use. I think this would have several advantages. My thoughts go along the following lines:

1. People do not want to pay for software for their personal use.
2. People do not have a problem pirating software for their personal use.
3. It is not worth FAST pursuing individuals, the cost versus benefit is too low.

based on this charging for non-commercial use of software is little more than a tax on the honest. (I have to admit the first 2 is not based on research, but my gut feel based on the people I have met over the years.)

Of course this does not really matter if you are making software for profit, you need to make living, why would you give the software away. I can think of a few advantages:

1. Increase the number of people who can use your software.
2. Improved security, pirated software is often infected with viruses and malware. Since you no longer pirate software for your own use this is a much smaller problem.
3. Improved security as people do not use alternative tools from the web that have a dubious pedigree.
4. People get free use of software that helps them live their lives.

I have to admit I can see problems. Like what happens to those companies who write software aimed at the consumer, like video games, or apples iLife suite of applications. Also how can you tell the difference between commercial and non-commercial use. That said I do wonder if this would be a better model. Companies pay for the software to use and society benefits for free. Kind of the way the patent system is supposed to work.

Well that is my thought for the day.
Alasdair

Genes Reunited and password security

I am sure many people have heard of friends reunited, a site that allows you to get back into contact with people you went to school with. I think of it as a pre-cursor to facebook. A colleague of mine has an account with them and was surprised when he received an email from friends reunited that contained half his password. He queried this to discover that this useful "feature" sends the password with all but the last four character replaced by stars. So if your password is "password1" (one of the most common passwords) you would see "*****ord1". Assuming I intercept this email I can now narrow the search space. I know the password is 9 characters long and ends ord1. Not hard to put into a dictionary attack. In fact I might go for password1 on my first attempt.

So how does this relate to genes reunited you might ask? Well Genes reunited is a sister site that allows people to research their family tree. I have an id on this site (I do not have an id on friends reunited), so I thought I would see if genes reunited was the same. Well here is what I found:

1. They also send the last four characters in the email.
2. To get the password emailed all you need to do is give them your email address and they will send the password to your email address.
3. If you log in and look at your account information they display in the web page your password.
4. Their Privacy policy has the following clause:
   
   However, it remains each Member's responsibility:
   
   to keep his/her password secret.

So while it is my responsibility to keep my password safe genes reunited does the following:

• Stores my password on their systems either unencrypted or in a reversible form.
• Echo's it to my screen when I am logged on
• Emails it out on request in clear text.
• Emails half of my password, and my password length unbidden.
  

something does not quite add up.

To be honest I am not too worried about emailing the password as someone would need to be able to snoop my emails, or get into my email account and tons of things would be broken if this were to occur.

The thing that worries me is this seems to show a lack of understanding of security. You do not display someones password, you do not send it, or any part of it, unbidden and you avoid storing the password in a reversible form at all costs (although I am sure many sites do this last part I would rather not know :) ).

So in the short term I am going to cancel my account and in the future I think I will take a little more care with who I sign up with.
Alasdair

Google Analytics

I would really like to know if anyone reads my blog (other than David Currie of course). I can think of a few ways of finding out.

1. I could ask people to post when they read. This requires people to do something.
2. Use Google Analytics (or something similar). This is a real problem for me as one of the reasons I use the NoScript firefox extension is so the google analytics javascript is not run, and if I don't run it I cannot exactly expect people to do it to view my blog.

I feel really conflicted. Part of me really wants to use google analytics, and the other part of me thinks it is a really bad idea.

Help
Alasdair.

P.S. If I do start using Google Analytics I will blog to say I have compromised myself.

The downside of Facebook

I learned today that I need to be much more careful about facebook. The problem is that I am using facebook for two things:

1. To keep in contact with friends
2. To keep in contact with work colleagues
   

The problem is that I project a different image to the two groups. When I say image, I wear the same clothes, but I act differently with each group. This is fairly normal, most people have a professional image.

One of my friends uploaded some photos to facebook that I would have preferred no one at work ever see. Today they were found. To be honest it was partly my fault that they were discovered, I accidentally let it out that there was an embarrassing photo of me at the pub today.

I realized that anyone from the first group can affect my profile in ways that the second set can see. In this case the change they make may not be something I would like to be part of my professional profile. I think this is why you need sites like linkedin and facebook to be separate.

For now I have made my profile private, but I think I will be rethinking my existence on facebook. Perhaps I will have two profiles, perhaps I will just stop using it for my work life, I do not know.

Alasdair

Thoughts about Facebook

I have been using Facebook for a few weeks now. I currently have 16 friends and the thing is I am still struggling to work out what it is for.

I guess the main issue I have is that when I talk to people about facebook the number of friends you have is important. I have never been one to have loads of friends, or at least loads of people I consider friends.

On facebook every friend is considered equal, but in reality you have different kinds of friend. You have close friends, aquantances (people you know because they are close friends of your close friends), work friends and social friends. There does not seem to be a way to sort Friends. I guess what I would like is to be able to tag friends to group them together. Otherwise I can see it easily getting to the point where you cannot see your friends from the crowd.

Alasdair

IT and Religion

As someone who is based in the UK, but is an avid Apple watcher I have been reading with much interest as much as I can about the now released iPhone. One topic of conversation on engadget has been the lack of Windows 64-bit support. The comments on the topic are very interesting. Not because they offer any useful or interesting insights into the lack of 64-bit, but because of the dynamics between the posts.

The posts can be split into two parts:

1. Pro Apple
2. Anti Apple

It has always interested me that people get very passionate about gadgets, software and the companies behind them. They almost get religious in the interactions. You just need to look at the linux vs window debate for an example.

I get caught up in it myself. I never considered getting any MP3 player other than the iPod. This must be great for the companies involved, but it often blinds us to the relative problems with the gadget in question.

Alasdair

The horror of 800 pixals wide websites

Hi,

One thing I have noticed is an increase in the number of webpages that are formatted to be 800 pixals wide, and only 800 pixals. This blog is one, facebook is another, and there are many other examples. This is awful. My screen is around 1400 pixals wide, and 1600 pixal wide screens are common. In this case you loose half the width to blank space. Meanwhile I am forced to scroll down the screen to read the copious amounts of text.

So why is this? I think the main reason is that some of the cool effects (like rounded corners) rely on images of a certain width. I think I am going to rebel and redo my blogs look so that it can increase in size. I still want my header image though, which limits the width, so I am going to go with the following:

1. Have three sizes 800 pixels wide, 1024 pixels wide and 1280 pixels wide and then use javascript to decide which to render to.
2. Use a larger image, but only show some subset based on the width.

Both are not ideal, but I do not want to force people to view my blog at a fixed width loosing the benefits of their screen real estate.

Alasdair

P.S. I now have six friends on facebook.

Is the UK changing into a Police State?

I have a few friends who think that the UK is a police state. In the past I have always argued that the UK is not a police state, but now I am concerned that labour's new proposal to grant the police the power to stop and question anyone with no justification really scares me.

I do not understand what they expect to achieve with this except for pissing everyone off. The bbc news article says that this is part of new anti-terror laws, but I do not see how this would help. William Hague says that they will support them if they really are being introduced, to prevent terrorism, but no one has said how it will prevent terrorism.

The bbc article implies that this is a response to the disappearance of terrorism suspects, but I do not see how randomly questioning innocent members of the public will help. If people are suspects of terrorism already then these powers are not required, and if they are not we would be better off improving our intellegence than randomly stopping people in the street. I doubt very much that terrorists would be tripped up by random questioning in the street.

Tony Blair seems to think that civil liberties are getting in the way of our ability to fight terrorism, but if we destroy what makes this country great what are we really protecting? Our grandparents generation fought two world wars to protect our freedom and to have it destroyed by the party of the working man just goes to show how much Labour has changed.

Alasdair

Next the movie

I went to the movies for the first time in a while last weekend. I have been suffering from a little back pain during the last few weeks and being reminded how uncomfortable movie theatre seats in the UK are was not that expected, and this was quite a new theatre.

In any case I do not intend on complaining about the seating, but comment on the movie. The movie was Next. Deciding to see it was a spur of the moment thing, and I did not expect much. To be honest looking at the poster I thought it was going to be another disappointment like minority report, but it was that or watching blades of glory, and I would rather watch paint dry than watch another Will Ferrell movie.

I do not want to spoil the movie, but the basic premise is that the main character can see two minutes into his future, and having seen it can then make changes based on what he sees.

The trailer is here. If anyone is looking for a decent movie to see I would definatly give this the thumb up.

Alasdair

Student arrested for writing an essay

There are some things in this world I will never understand. For instance arresting a 6 year old for having a tantrum. But this is a new one on me.

An 18 year old straight A student writes an essay that disturbs his teacher and gets arrested and charged with Disorderly conduct. The teacher even ecouraged them to express their emotions through writing. What happend to free speech? And why have they done this? Well it seems like it has something to do with the Virginia Tech shooting. Even assuming this kid was in some way mentally disturbed and could run out at shoot people how is arresting him going to help exactly? 30 days in gaol and a $1500 fine isn't exactly going to do anything to help. If this kid is likely to do something crazy then sending him to a shrink would be a much better solution to the problem. A professional is much better able to help in this case.

Alasdair

Global Warming

In the UK last week a report was released on the cost of global warming. This report is called the Stern Report, there is a summary on the bbc website. I'm not going to comment on the report itself as I have not read it and one of the risks of blogging is the blog entry is uninformed and therefore incorrect (you just need to read a majority of the slashdot comments you get these days, to see what I mean).

Listening to the commentary on Radio 4 there were quite a few people talking about how global warming is a global issue that must be tackled by global action, and while I agree there is a certain risk in this attitude. The problem is that while action must be taken by global action, it also needs the individual to take responsibility for their part in global warming.

Confucius once said "A journey of a thousand miles begins with a single step." and that very much applies to global warming. Everyone must take responsibility, not just governments. I am not about to claim that I am perfect, or even very good, but I am trying to improve the way I live. In any case I would like to challenge the UK to convert ourselves into a low carbon economy. OK, it will not make a huge impact on a global scale, but if we can prove that we can build a successful low carbon economy then it will show other countries that it is possible. Actions speak louder than words, and are more convincing to the sceptical public.

Alasdair Nottingham