Password masking considered harmful?

Image via Wikipedia

We've all seen it, it's ubiquitious... the little box to type your password into. The line of asterisks grows as you type the secret characters in.

We've had it drilled into us, make your password safe, use lots of different kinds of characters (some sites even require that you use 3 of the 4 types, lowercase uppercase, numeric, special characters), don't use a common dictionary word, make it long, and so on.

So there I am on some site or another that shall remain nameless, trying to enter in "RodgerD0dgerC0dger!" and all I see is a line of *********

The phone rings mid stride. What character am I on anyway? hmm.. let me count backwards... I think I got it... OK.

"wrong password". Let's try that again ... A bird chirps outside the window Hey, did I remember to make that third 0 a zero but not the first one? Ah, must be right... OK.

"wrong password". Drat... Give it another try. Almost done.... Did my hand slip when I was holding down the 1 to make the ! ? No way... OK...

"wrong password" followed by "You have entered an incorrect password three times in a row and are now locked out of the system, please call our help desk between the hours of 8 AM and 6 PM Mumbai time to get it reset"

Argh! It's happened to all of us. And it's so needless. What do those asterisks do for us anyway? Unless we are being shoulder surfed, nothing.

As reported on Out-law.com there may finally be a realisation dawning that this is needless, and mindless, security. Well known usability expert Jakob Nielsen recently wrote about this in his AlertBox of 23 June 2009, opining that it's not needful, cleartext is better, and it may actually make things less secure. For those that actually have to deal with shoulder surfing, a checkbox to make the system use asterisks in that one case (or default to that for high security sites) is the easy way to handle that.

High time this was done. Start suggesting it to the sites you frequent. I think I'll go open a Bugzilla bug for MediaWiki if there isn't one already.


Oh, and RodgerDodgerCodger isn't actually my password.

Related articles by Zemanta

• Password Masking: love it or leave it? (downloadsquad.com)
  
• Nielsen Recommends Not Masking Passwords (it.slashdot.org)
• Why you should mask passwords (omgponi.es)

This post intentionally left blank

Blank pages in a book
Image via Wikimedia CommonsSo Risker pinged me on my talk page, and like these sorts of low semantic content conversations do, it veered off into other topics, notably how posts sometimes have little content... and whether "no comment" really is "no comment" or actually more like "almost no comment"... this led to "This page intentionally left blank" ... and well... I'll repeat what I said there.

IBM is famous for making a great deal of use of these pages (back when IBM published all its manuals in hardcopy form). They would carry a footer with the manual name and the page number of the manual where they belonged. I can recall inserting them into manuals on my desk, many a time. (Periodically one would receive packets of pages in the post containing fixes to manuals, which one duly inserted into the manual binders, hopefully in the right places. Sometimes some of the new pages would be blank, to replace a page that described something that had been obsoleted, and sometimes some of the new pages would be non blank, but would replace a page that had previously been blank, as they described something new which space had been reserved for in the organization of the manual) There is an apocryphal story that there was an APAR opened against the entire publication group, requesting that all pages which said "THIS PAGE INTENTIONALLY LEFT BLANK" be replaced with pages which said "THIS PAGE INTENTIONALLY LEFT ALMOST BLANK" on the grounds that was a more accurate statement... Needless to say if there was such an APAR, it must have been rejected, as the cost of the PTF to identify, produce and print all those (thousands of different) pages (properly numbered and with proper footers, since that is how things were done), mail them out to every manual receipient, and so forth, would have been enormous. Even for IBM.

(this is not the only apocryphal story about APARs and PTFs, remind me sometime to tell the one about the APAR against IEFBR14)

Oh, and by the way, this whole post is a way for me to NOT talk about what really has me steamed right now.... perhaps I'll, in the best IBM tradition, replace this post with what I really want to say instead.

Update:

In accordance with the recommendations made by the This page intentionally left blank project, I decided that my personal site needed one of these. So I created one.

Cleveland rocks?

Except when it doesn't.

I had a bit of a fright on Thursday trying to get to the CLE airport from my client, who is somewhat to the east of the airport. Seems 480 westbound got stuck somehow and of course I was running late. So I took surface streets, counting on my GPS to steer me right, but in this case, surface was also backed up.

Cleveland, which claims to be where the traffic light was invented, hasn't quite figured out light timing... I would get a green, go the limit, and get ot the next light just after it turned red. This continuned for 10 miles, with more traffic streaming onto the surface road at every cross, until all of a sudden, it was like a cork was let out of something, and it was completely empty roadways for the last 5 miles. It was due to a light that was way too long in the other direction and too short in ours.

Fortunately I had a Mazda CX7 so I was able to out accelerate all the laggards whenever there was a break in traffic.

I just made it, but next week I'm leaving earlier!

From the "read the fine print" department

If Chrysler still made this
maybe I'd buy it!
Image via WikipediaIn case anyone hasn't noticed, we in the US are now paying 4.00 USD or close to it per gallon for our gas... (yes, I know, the one European in my readership has been paying way more than that for years... we get it, we were lucky)

The US auto industry has been hit hard (and that means Michigan has been hit very hard) by this. Automakers are scrambling to compensate for the lost sales.

Seems Chrysler has come up with a gimmick to move some metal languishing on their dealer lots... 2.99 gas! The basic idea is that you buy a new car, they give you a passthrough credit card that you buy gas with, and they don't charge you more than 2.99 for it, up to a certain number of gallons per year, for 3 years.

Seems like a not too shabby gimmick, as far as gimmicks go. Until you read the fine print. This only counts for 87 octane gas. But Chrysler's own owners manuals suggest 89 for most vehicles and there are a few that require 91, no less. Chrysler will subsidise your gas, but only if you buy the kind that violates your warranty. If you want 89, that's 15 cents extra. If you want 91, it's 30 cents extra. Since the markup usually is 10 or 11 cents per grade step, that's a bit less of a deal.

No thanks. I think I'll stick with my 11 year old Stratus a bit longer.

(OK, two car posts in a row, what's up with that?)

Have you seen any silly gimmicks that make you scratch your head lately?

Related articles

• Chrysler to guarantee gas at $2.99 a gallon! For three years! [via Zemanta] Chrysler press release
  
• Chrysler's $2.99 Gas A Good Deal... For Chrysler [I Feel Gassy] [via Zemanta] a more realistic assessment
  

Alvin!

My car is a bit more silver
and has better wheels :) ... ]
but it's rustier too!
Image via WikipediaSo my 11 year old Stratus (don't laugh, it's paid for and it gets 34 mpg on the highway... keeping a car for 11 years is actually a rather green thing to do compared to buying a new one every 2 or 3) started having electrical problems... first the tach would randomly cut out, then the odometer too.

Took it to the local dealer, Grand Chrysler in Lowell, (who has been very good to us over the years) and they said it was electronics behind the dash... 500 USD to fix. Meh.

I decided I could live with a tach that cuts out, I shift by ear anyway. But last week, enroute to Holland to my client I noticed the idiot battery light on, and random other dash lights too. Fortunately the battery had a good charge, I was able to make it back to the dealer in the afternoon, just barely (by not running anything, it got hot and stuffy in there) on what the battery had in it.

They took another look, and reported... "you have a mouse problem"... apparently something had chewed the ground wire enough to make things erratic. So no circuit board replacement, yaay! When I told my wife we had mice, she laughed and said she had seen chipmunks exiting the hood area of the car several times.

So you darn chipmunks, that's the last time I say you're cute, you almost left me stranded. I'll be putting mothballs in the engine compartment, find somewhere else to stay warm.

Can you top that one? What's the strangest car repair story you've got?

The 3RR exemption

Warning, esoteric topic!
Image via Wikimedia CommonsWarning, this is an esoteric topic. Those not steeped in the lore (and lingo) of WP may have no idea what I am talking about :)

The English Wikipedia Biography of Living Persons (BLP) policy includes an exemption to the normal prohibition on edit warring beyond three reverts (3RR) stating that reversion of edits that introduce problematic material (or which interfere with attempts to correct problematic BLP articles in general) are not subject to this rule, that is, reverts can be carried out indefinitely, if it becomes necessary.

Recently, Kim Bruning, who I generally admire strongly, attempted to edit the policy page to remove this exemption. A massive discussion ensued, starting at the section in the link, and going on for many subsequent sections over many screens (and spilling into various other pages as well, including the talk pages of most of the major participants, including myself)

Reading all this is instructive, as it shows that sometimes the Bold Revert Discuss (BRD) model breaks down in the face of trying to modify policy. There were a fair number of bones of contention, among them whether the BLP policy is prescriptive (it is written to be enforced as written, and changes when there is agreement it needs to change) or descriptive (it is written and updated to reflect actual practice, and changes as practice changes). Almost all policy at Wikipedia is descriptive but there are a few exceptions. Another bone of contention was whether there was a problem that needs remediating or not, and how did we measure it.

I am not going to in this post ascribe too much, as I was involved and the discussion got rather heated. It was a rather lame discussion in some respects.

What do you think? Should the 3RR policy have a BLP exemption? If so, is it properly being used/enforced? Was how Kim went at this the proper approach? Or did he mishandle things (it was for the most part him against a fair contingent of folk saying he had things all wrong)? Was my assessment after the fact too harsh?

Yes Virginia, there realy is a (hospital in) Kalamazoo

Bronson campus, Kalamazoo
Image via Wikimedia CommonsWest Michigan has a bit of a complex about Detroit, and the southeastern part of Michigan in general. There's a perception that "they" get "more than their fair share" of ... well, of everything. More revenue, more media attention, better roads, etc. More of everything, especially if it's provided by government. (There's a reason for that, it has to do with the relative longevity of southeast Michigan legislators in office, among other things).

Going along with that there is also a bit of "we're actually better than them" that goes on. You'll find it to be fairly pervasive, wherever in W MI you go, people will explain why that is... less reliance on the Auto industry, better government, better quality of life, and so forth (despite the fact that we don't have a good road S to Indiana :) )

We had occasion to visit Bronson Methodist Hospital, in Kalamazoo Michigan, this weekend. A fine facility and very competent at what they do. But I was rather amused to find that while we WMers all share a common chip on our shoulder about Detroit et al, that it turns out that Grand Rapids sometimes is the villain in these little set pieces.

See their spring magazine (a pdf). It's just a little puff piece about how generally wonderful the hospital is, and in amongst the other articles is one about a bariatric surgery candidate. Tucked in the copy was this little dig:

Balkema drove to Grand Rapids to meet with doctors to investigate his options and discuss bariatric surgery.

“I wasn’t thrilled with my experience there,” says Balkema.

So that shows that sometimes Detroit isn't the villain. Moral of the story? There isn't one. I just found it funny.

What about you? Do you have any local rivalries in your area that you find amusing?

Tulip time!

Tulips in Holland
Image via WikipediaThe Holland, Michigan Tuliptime Festival, going on this week, celebrates the Dutch ways that run strong in the west Michigan area, in Holland and Zeeland in particular, but the influence extends to Grand Rapids as well. (Our local grocery chain was started by Fred Meijer, and you can buy a car from Van Andel and Flikkema, or from one of the DeVos family, just to pick a few examples)

Every third business you see, it seems, in Holland or Zeeland, is owned by Van Someoneoranother, and Holland certainly embraces its heritage. The city owns Windmill Island Gardens, which has a (what else?) windmill, iconic of the Netherlands.

De Zwann Windmill
Image by jschneid via FlickrFrom the tourist blurbage at the city's site:

A beautiful oasis within the city of Holland, Windmill Island features a 240 year old working Dutch windmill "De Zwaan" (meaning graceful bird). The windmill towers over 36 acres of manicured gardens, dikes, canals and picnic areas.

And of course, tulips are everywhere in town, especially this time of year. They feature in the flowerbeds, in shop window decorations, as architectural motifs, even in some of the food you can get at the festival.

A big part of the festival are the klompen (wooden shoe) dancers. They are out in force during the festival, performing in parades, in the street cleaning (yes, the festival features street cleaning with brooms and buckets and the whole 9 yards, it is traditional that the Governor of Michigan comes out for it, steps into a pair of shoes, and gets cleaning... our governor Jennifer Granholm missed out this year since she just had surgery, and we had to make do with Miss America instead ) and just roaming around being part of things.
Klompen Dancers
Image by Mr. Mcgladdery via Flicker
What I found most interesting about them (and darn you, Zemanta, the image at right was the closest I could come to what I wanted to show) was not the shoes themselves (painful as those might be, you can see some here), but that so many of the dancers were girls. Even the boys. The dance itself was apparently traditionally performed by men and women. But it must be that Holland MICHIGAN men are too cool, because a lot of the "boys" dancing (in button vests and cloth caps instead of dresses) are girls, or more properly middle aged soccer moms 51 weeks of the year... and Klompen Dancers for one.

I found it amusing. And maybe telling, that us guys are too cool to dance. Or too cool to dance in uncomfortable wooden shoes.

What about you? (if you're a boy...) Are you too cool to dance? Or just too cool to dance in the streets of a small midwestern town in horribly uncomfortable shoes wearing odd costumes?

Britannica free access... gotcha?

EB building name plate with thistle
Image by Robert Brook via FlickrPreviously, I wrote about Encyclopaedia Britannica's free access offer. I may have more to say later but I thought I'd update you a bit with a couple of things I ran into

First, it seems I can't edit my previous post! I'm very used to just going into already published posts and tweaking them (I always find typos after I publish them! Why is that???, er, don't answer....).

For whatever reason, an attempt to edit that post blanks it out. I'm not sure if this is a glitch at my end or what (further testing is needed) but the only think that is different about that post is the widget I embedded. If in fact I can't edit posts that have those widgets that's a strong disincentive to embed them. Hopefully just a glitch that will be sorted out.

A somewhat more serious matter was blogged about by the author of Pattern Recognition, who sat down and analyzed the Terms and Conditions of use. It seems that the T&C has that dreaded "non commercial use" clause... (I was going to put a link to it about here, but Jason Griffey is a better searcher than I am, I can't find the page that has the Ts and Cs!... silly me...)

Now, on my blog, if you look over to the left, and if you look between every second posting, you're going to find ads... so far I think I've raked in a total of 24 cents or so from them but it's commercial use, technically. So if you come back one day and find that first posting gone and any and all links to Britannica content gone, that's why...

For now, though, I'm going to assume they don't really mean exactly what they seem to say by that, since (thanks again, Jason) their next paragraph says:

If you want to post, publish, or use content from (or contained within) the Services on your Web site or in any other Internet activity, you will need permission from Britannica, even though your Web site or Internet activity is free of charge.

Well hmm... wasn't that what I just signed up for the ability to link to EB articles? Color me confused I guess.

What do you think? Does EB really mean that?

Getting off Hivemind

If you're on Hivemind (the site, not the Hivemind OS software) and you want to get off, all you have to do is publish your real name on your Wikipedia page... simple right?

Except my real name's been there all along. Very first edit to the page, in fact.

But I got added to Hivemind recently. No. I'm not giving you the link to Hivemind, it gets enough inbound links as it is. Trying to ask Brandt why gets zero reply.

Maybe it's more like you have to also not annoy Daniel Brandt by calling him a weenie (or worse, see this blog post). Or maybe you have to get behind whatever his latest hobby horse is... delete whatever he is hot about, sign whatever petition he is keen on, etc. Or maybe ??? Who knows?

Point is, if you want to be seen as acting on principle, as Brandt claims to be doing, you have to actually act on principle, and not act based on personal grudges.

That's what I try to stick to, and "acting on principle" is precisely what I was arguing in defending the redirect deletions... the principle of deleting them was correct even if Daniel Brandt himself was not a nice person.

Else, if you consistently don't act on principle, you're just a bully. As Moulton pointed out, Brandt's actions fit the description.

Kato justified Brandt's tactics here. I suspect that there is some validity to the claim that you have to fight unfairly if you have been treated unfairly. But on the other hand, is attacking those who most want to help the most reasonable way to effect change?

I don't think so. Do you?

Ok, seriously... are you TRYING to make Wikidefender's work easier???

Let me get this straight...

Privatemusings has been having podcasts. He's had Danny Wool, he's had Sue Gardner, Wikimedia Foundation Executive Director, he's had Michael Snow, he's had Featured Article director Raul654. He solicits guests and whoever turns up, turns up. He's not afraid of controversial subjects and the casts (despite his tendency to go on a bit instead of letting his guests talk... hmm... who do I know like that!) have been well received, considered interesting and fun.

Number 6 features some folk not known for their high regard for Wikipedia as it stands.

The podcasts themselves are hosted on Commons.

So NonvocalScream decides that to put the page describing podcast number 6 up for deletion at Miscellany for Deletion. Rationale? "banned users are not permitted to edit" as given here. The fact that the files themselves are hosted on commons, and that this is one of a series, seems lost on some... but aside from a few folk, this is almost a snowball keep. It's got the usual folk saying the usual things but it strikes me as a huge waste of time, sorry...

For those that don't get the title reference, Wikidefender runs a blog that many consider to be a bit of a pastiche of the stuff trotted out by those who think everything with Wikipedia is perfect, and may or may not have been the person behind this funny edit to my talk page. Not that he singled me out, NewYorkBrad got one too...

Is it just me or is this sort of nomination actually playing into the hands of those that say that some editors can't help but do silly things?

Cheating

When I started this blog I had set myself a goal of doing a post every day. Well guess what, I blew that little self imposed deadline... yesterday went by and I didn't do a post. (too much other drama I guess)

What's that, you say: "I can see darn well that there was one yesterday, Wednesday March 19th... just look at the date"... er wait, that's this post isn't it? Yep!

Blogger lets you cheat. On the post options screen, you can set the post date and time to any value you like. So I did. I backdated this post to yesterday. It means I'm still behind for today, but the day is young yet, I may catch up.

So do you hate me for cheating? Hate me for revealing the secret? Think I'm lame that I did a meta post and it still counts against my average? Or not care a whit?

First Post!

Well duh.

I'm not sure anyone actually has any interest in what I have to say but hey, all the cool kids seem to have blogs so what the heck.