David Gessel

Lufthansa Business Class

Friday, February 27, 2015 

I’ve occasionally had to buy business on poorly planned Lufthansa intra-Europe flights. While Lufthansa long-haul premium seats are possibly the best in the business, on short-haul/intra-Europe flights, LH business class seats would seam a little mean in most carrier’s coach sections.

There is no difference between coach seats and business class, none at all. In business all middle seats are blocked out, but that isn’t that hard to find in coach. It is efficient to scale business, it involves only moving a rack-mounted divider that is the only obvious differentiation in the classes.

In both the seats are substandard to the amenities one usually expects, especially on a long haul flight:

– little padding on the seats
– cramped seat pitch (worse than econ +)
– typical economy seat width
– no in seat power (not even a usb port)
– no personalized IFE

Such limitations would be cheap in economy, but in business they are, perhaps we should say “disappointing.” Neither the economy nor the business class zone is going to leave the passenger well-rested (IST-FRA is a long enough flight that rest matters); such a flight is a grim endurance test for everyone. But it is very egalitarian in shared suffering, though not particularly egalitarian in pricing.  And were LH business not priced competitively with other carrier’s business, the disparity in services wouldn’t seem quite so jarring.

LH is, of course, efficient and well organized, but every other airline I’ve flown that has a business class has far, far better business class, even those that can’t really manage the basics.

20140328_014237.jpg
Posted at 17:01:05 GMT-0700

Category: PlanesTravel

Superfish proves certs are useless for identification

Saturday, February 21, 2015 

Can we please, please stop with the stupid certificate verification warnings?

superfish logo

Dear security developers, your model is broken. It never worked. Stop warning people about certificate errors. Now. Forever.

Certificate errors serve two purposes:

  1. They make developers uncomfortable with using perfectly secure self-signed certs, and since commercial certs cost money, much of the web that could be encrypted remains unencrypted. That’s harm done to the public. Thanks.
  2. They happen so often, so relentlessly, for such trivial reasons (not even Google can keep their certs up to date) that users learn to ignore them, which makes an actual man-in-the-middle attack almost certain to succeed with most people, despite the warnings.

The Certificate Authority system is predicated on the idea that Certificate Authorities are flawless and trustworthy. They are neither. The Lenovo/Superfish problem shows another obvious flaw: hardware vendors (and actually any trusted software installer) has to be trustworthy too or client-side MITM is easy. And CA’s simply can’t verify against that.

This whole idiocy creates massive problems for something so basic as LAN administration. Even before wireless became pervasive, LAN coms should always be encrypted when passwords or any meaningful data is moving. Current security settings create a massive avalanche of useless errors for “untrustworthy certs” on one’s own network (the obvious fix is to automatically trust all certs on private networks, duh).

This is an issue that bothers me a lot. It gets in my way constantly and makes real security and encrypted communications way harder and way more complicated than it needs to be and the only beneficiaries at all are the certificate Mafiosi. This is just stupid. Superfish proves, again, how broken it is. Can we stop pretending now?

Also, this most recent of many certificate flaws comes with a bonus feature: the MITM cert Superfish uses is apparently really pathetically insecure, aside from using broken crypto, their software had their passwords in it, making it easy for crackers to develop tools to harvest additional data from the victims of the Superfish/Lenovo attack.It probably hurts more to find out your vendor hacked you, but the penalty is that the hack also destroyed the security of all of your communications. Thanks. This is why we can’t have nice things. It is also why any back door, no matter what the motive, compromises security.


 

Update: Superfish is, apparently, out of business.  While that sucks for the people at the company, who were probably very happy with their Lenovo OEM deal and instead got a big sock of coal, one might naively hope for an upside that companies considering a model based on stealing people’s data might take notice of the cautionary tale of superfish.

Unfortunately – that won’t happen, not in the current valley climate. While it is economically advantageous to hire cheap kids who have no life and will work long hours for meagre pay, they come with a downside: they are all ignorant idiots. I don’t mean they’re not smart or capable (though the smart barrel was long ago drained and the vast majority of brogrammers sauntering around SF really are stupid), rather that they are foolish as in the opposite of ‘wise.”  Wisdom comes from experience, and experience only comes with time, an immutable dimension.  This superfish debacle was only from Feb 2015, but this year’s batch of idiot brogrammers weren’t around to see it and as they gather in self-congratulatory clusters in posh, VC-funded collaborative spaces, company barrista-brewed latte in one hand and social-media-distraction feeding portable device in the other, they’ll be high-fiveing and fist-bumping the brilliance of their brand-new idea for getting around SSL so they can collect marketing data and better target advertising.  Yay.


 

How to fix Superfish:

Install Perspectives. And support them.

Also, this bugs the crap out of me:

Overthrow the Cert Mafia!

SSL for Authentication Sucks

Unbreaking Firefox SSL Behavior

The CA System is Intractably Broken

Posted at 02:45:41 GMT-0700

Category: SecurityTechnology

Better Cabling May Fix The Internet

Sunday, February 8, 2015 

Do you find that the internet seems harsh? Do you find Facebook unclear and that it lacks dynamic contrast? Is there less detail than there should be? Do you notice a loss of energy from the Internet?

It might all come down to the network cables themselves.

AudioQuest Diamond Ethernet Cable

Well designed cables like these have perfect-surface extreme-purity silver conductors minimizing distortion caused by grain boundaries in inferior OFHC, OCC, or 8N conductors for better clarity and reduced harshness. Explanations and arguments will be both more clearly constructed and less confrontational.

Noise and other distractions are reduced by a 3-layer noise dissipation system, not just shielding your data but preventing modulation of your ground plane by noisy RFI.  Even more problematically for those doing research on the web, the untested orientation of standard network cables results in inferior data quality.

Standard network cables either don’t enforce orientation of the pairs at all (Cat 5e and below) or merely segregate pairs with a flexible spacer (Cat 6 and above). These cables use solid polyethylene insulation to ensure critical geometry is preserved to minimize phase errors. Phase errors can easily result in Doppler shifts manifest in either an unnaturally shrill tone or affected bass (sometimes manifest as “mansplaining”).

Most remarkably, the dielectric bias system puts a 72V bias on the insulation and thus organizes the molecules of the insulation to minimize energy loss which creates a surprisingly black background, more essential than ever in the wake of Ferguson.

Only $10,521 for a 12m cable. Now that the internet has become our primary source of information, understanding, and personal communication this is a tiny price to pay for clear, undistorted data.

Posted at 19:24:18 GMT-0700

Category: OddTechnology

Basra Snow Storm

Sunday, February 8, 2015 

I was feeling a little left out, reading posts by people digging out of snow storms and here I am in Basra where it gets down to 10C at night sometimes and usually hits the mid 20’s during the day.  Rough.  But the weather here came through with our own sort of snow storm.

 

Blizzard Brown-out conditions

Starting to look like a brown-out!

 

 

Snow covered yard furniture!

 

Obligatory shot of the yard furniture getting covered.

 

I've got snow on my head!

 

Kitty’s head is starting to show some accumulation.

 

Can't see more than a few hundred meters with this snow!

 

With all this blowing through you can barely see a few hundred meters!

 

starting to accumulate!

 

It’s really starting to accumulate. Where’s the snow blower?

 

Takes special cleaning to get that snow off.

 

It takes some special cleaning after playing out in it.

Posted at 06:20:38 GMT-0700

Category: CatsphotoPlacesTravelWeather

Cat Watch

Monday, February 2, 2015 

Cat Watch
Cat_Watch
The twins resting after a busy day.

 

The Twins

Posted at 17:48:24 GMT-0700

Category: CatsphotoTravel

Lizard Visit

Saturday, January 31, 2015 

A New animal visitor came by today.

Gecko Top
Just hangin’

Gecko Face

 

Posted at 14:00:58 GMT-0700

Category: GeopostMapphoto

Merry Christmas from Gaylords

Wednesday, December 24, 2014 

image

Posted at 14:47:42 GMT-0700

Category: Eventsphoto

The East Bay Hills

Tuesday, December 23, 2014 

wpid-wp-1419295116305.jpeg

Posted at 17:38:00 GMT-0700

Category: GeopostMapphotoPlaces

Sony-style Attacks and eMail Encryption

Friday, December 19, 2014 

Some of the summaries of the Sony attacks are a little despairing of the viability of internet security, for example Schneier:

This could be any of us. We have no choice but to entrust companies with our intimate conversations: on email, on Facebook, by text and so on. We have no choice but to entrust the retailers that we use with our financial details. And we have little choice but to use butt services such as iButt and Google Docs.

I respectfully disagree with some of the nihilism here: you do not need to put your data in the butt. Butt services are “free,” but only because you’re the product.  If you think you have nothing to hide and privacy is dead and irrelevant, you are both failing to keep up with the news and extremely unimaginative. You think you have no enemies?  Nobody would do you wrong for the lulz?  Nobody who would exploit information leaks for social engineering to rip you off?

Use butt services only when the function the service provides is predicated on a network effect (like Facebook) or simply can’t be replicated with individual scale resources (Google Search).  Individuals can reduce the risk of being a collateral target by setting up their own services like an email server, web server, chat server, file server, drop-box style server, etc. on their own hardware with minimal expertise (and the internet is actually full of really good and expert help if you make an honest attempt to try), or use a local ISP instead of relying on a global giant that is a global target.

Email Can be Both Secure AND Convenient:

But there’s something this Sony attack has made even more plain: eMail security is bad.  Not every company uses the least insecure email system possible and basically invites hackers to a data smorgasborg like Sony did by using outlook (I mean seriously, they can’t afford an IT guy who’s expertise extends beyond point-n-click?  Though frankly the most disappointing deployment of outlook is by MIT’s IT staff.  WTF?).

As lame as that is, email systems in general suffer from an easily remediated flaw: email is stored on the server in plain text which means that as soon as someone gets access to the email server, which is by necessity of function always globally network accessible, all historical mail is there for the taking.

Companies institute deletion policies where exposed correspondence is minimized by auto-deleting mail after a relatively short period, typically about as short as possible while still, more or less, enabling people to do their jobs.  This forced amnesia is a somewhat pathetic and destructive solution to what is otherwise an excellent historical resource: it is as useful to the employees as to hackers to have access to historical records and forced deletion is no more than self-mutilation to become a less attractive target.

It is trivial to create a much more secure environment with no meaningful loss of utility with just a few simple steps.

Proposal to Encrypt eMail at Rest:

I wrote in detail about this recently.  I realize it is a TLDR article, but as everyone’s wound up about Sony, a summary might serve as a lead-in for the more actively procrastinating. With a few very simple fixes to email clients (which could be implemented with a plug-in) and to email servers (which can be implemented via mail scripting like procmail or amavis), email servers can be genuinely secure against data theft.  These fixes don’t exist yet, but the two critical but trivial changes are:

Step One: Server Fix

  • Your mail server will have your public key on it (which is not a security risk) and use it to encrypt every message before delivering it to your mailbox if it didn’t come in already encrypted.

This means all the mail on the sever is encrypted as soon as it arrives and if someone hacks in, the store of messages is unreadable.  Maybe a clever hacker can install a program to exfiltrate incoming messages before they get encrypted, but doing this without being detected is very difficult and time consuming.  Grabbing an .ost file off some lame Windows server is trivial. I don’t mean to engage in victim blaming, but seriously, if you don’t want to get hacked, don’t go out wearing Microsoft.

Encrypting all mail on arrival is great security, but it also means that your inbox is encrypted and as current email clients decrypt your mail for viewing, but then “forget” the decrypted contents, encrypted messages are slower to view than unencrypted ones and, most crippling of all, you can’t search your encrypted mail.  This makes encrypted mail unusable, which is why nobody uses it after decades. This unusability is a tragic and pointless design flaw that originated to mitigate what was then, apparently, a sore spot with one of Phil’s friends who’s wife had read his correspondence with another woman and divorce ensued; protecting the contents of email from client-side snooping has ever since been perceived as critical.1I remember this anecdote from an early 1990’s version of PGP.  I may be mis-remembering it as the closest reference I can find is this FAQ:

It was a well-intentioned design constraint and has become a core canon of the GPG community, but is wrong-headed on multiple counts:

  1. An intimate partner is unlikely to need the contents of the messages to reach sufficient confidence in distrust: the presence of encrypted messages from a suspected paramour would be more than sufficient cause for a confrontation.
  2. It breaks far more frequent use such as business correspondence where operational efficiency is entirely predicated on content search which doesn’t work when the contents are encrypted.
  3. Most email compromises happen at the server, not at the client.
  4. Everyone seems to trust butt companies to keep their affairs private, much to the never-ending lulz of such companies.
  5. Substantive classes of client compromises, particularly targeted ones, capture keystrokes from the client, meaning if the legitimate user has access to the content of the messages, so too does the hacker, so the inconvenience of locally encrypted mail stores gains almost nothing.
  6. Server attacks are invisible to most users and most users can’t do anything about them.  Users, like Sony’s employees, are passive victims of sysadmin failures. Client security failures are the user’s own damn fault and the user can do something about them like encrypting the local storage of their device which protects their email and all their other sensitive and critical selfies, sexts, purchase records, and business correspondence at the same time.
  7. If you’re personally targeted at the client side, that some of your messages are encrypted provides very little additional security: the attacker will merely force you to reveal the keys.

Step Two: Client Fix

  • Your mail clients will decrypt your mail automatically and create local stores of unencrypted messages on your local devices.

If you’ve used GPG, you probably can’t access any mail you got more than a few days ago; it is dead to you because it is encrypted.  I’ve said before this makes it as useless as an ephemeral key encrypted chat but without the security of an ephemeral key in the event somebody is willing to force you to reveal your key and is interested enough to go through your encrypted data looking for something.  They’ll get it if they want it that bad, but you won’t be bothered.

But by storing mail decrypted locally and by decrypting mail as it is downloaded from the server, the user gets the benefit of “end-to-end encryption” without any of the hassles.

GPG-encrypted mail would work a lot more like an OTR encrypted chat.  You don’t get a message from OTR that reads “This chat message is encrypted, do you want to decrypt it?  Enter your password” every time you get a new chat, nor does the thread get re-encrypted as soon as you type something, requiring you to reenter your key to review any previous chat message.  That’d be idiotic.  But that’s what email does now.

Adoption Matters

These two simple changes would mean that server-side mail stores are secure, but just as easy to use and as accessible to clients as they are now.  Your local device security, as it is now, would be up to you.  You should encrypt your hard disk and use strong passwords because sooner or later your personal device will be lost or stolen and you don’t want all that stuff published all over the internet, whether it comes from your mail folder or your DCIM folder.

It doesn’t solve a targeted attack against your local device, but you’ll always be vulnerable to that and pretending that storing your encrypted email on your encrypted device in an encrypted form adds security is false security that has the unfortunate side effect of reducing usability and thus retarding adoption of real security.

If we did this, all of our email will be encrypted, which means there’s no additional hassle to getting mail that was encrypted with your GPG key by the sender (rather than on the server).  The way it works now, GPG is annoying enough to warrant asking people not to send encrypted mail unless they have to, which tags that mail as worth encrypting to anyone who cares.  By eliminating the disincentive, universally end-to-end encrypted email would become possible.

A few other minor enhancements that would help to really make end-to-end, universally encrypted email the norm include:

  • Update mail clients to prompt for key generation along with any new account (the only required option would be a password, which should be different from the server-log-in password since a hash of that has to be on the server and a hash crack of the account password would then permit decryption of the mail there, so UX programmers take note!)
  • Update address books, vcard, and LDAP servers so they expect a public key for each correspondent and complain if one isn’t provided or can’t be found.  An email address without a corresponding key should be flagged as problematic.
  • Corporate and hierarchical organizations should use a certificate authority-based key certification system, everyone else should use web-of-trust/perspectives style key verification, which can be easily automated to significantly reduce the risk of MitM attacks.

This is easy. It should have been done a long time ago.

 

Footnotes

Footnotes
1 I remember this anecdote from an early 1990’s version of PGP.  I may be mis-remembering it as the closest reference I can find is this FAQ:
Posted at 16:21:29 GMT-0700

Category: FreeBSDPrivacySecurityTechnology

Family Feud Basra Style

Saturday, December 13, 2014 

Gunfire is pretty common here, perhaps even more common than in Oakland though usually for the same reasons: celebrating holidays, sports victories, weddings, that sort of stuff.  It is kind of fun to listen to and watch tracers and stuff, but usually the villa is also celebrating in an obvious way; when you hear gunfire you also hear cheers, at least at night.

This evening the house was quiet, but the gunfire sure wasn’t.  The guys tell me it was a tribal feud in the neighborhood, quite close from the sound of it.  This is a low-fi recording from my phone.

Posted at 17:13:13 GMT-0700

Category: AudioPlacesTravel