The cialis discount National Psoriasis Foundation notes that doctors may also advise people cipro from canada to stop taking any immunosuppressant medication. If a doctor suspects order viagra from canada someone has PsA, they may refer the person to a buy glucophage without prescription rheumatologist, a doctor specializing in arthritis. Starch, or amylum, is cialis free sample a complex carbohydrate that exists in many foods, including grains, discount celebrex vegetables, and fruits. Anyone who has constipation regularly or notices cheapest colchicine blood in their stools should speak with their doctor. For buy cipro without prescription more severe pain, a doctor may prescribe stronger pain medications buy cialis without prescription or hormonal contraceptives to regulate a person's menstrual cycle and aldactone generic order alleviate pain. The National Institute of Neurological Disorders and Stroke free tizanidine (NINDS) describes it as a neurological disorder that affects a xalatan prescription person's brain, making it difficult to control sleep-wake cycles. We cannot.

Excellent book (really a collection of Bruce Schneier’s columns over the past half-decade or so). It’s repetitive in places, and the format (most pieces are a page or two in length) makes it hard to get into the depth of anything. But there are some wonderful facts and anecdotes about security of all kinds, not just cybersecurity. Two of my favorites:

1. Airlines generally resist security measures, because they are costly, reduce ridership, and in the grand scheme of things don’t repay their costs since air terrorism is so rare. But they welcomed the practice of checking IDs to make sure the passenger flying is the one whose name is on the boarding pass. (Yes, there was a time when you could get on an airplane with just a ticket.) Why was this initiative welcomed? Because airlines didn’t like the aftermarket in discount coupons. They would send selected passengers a coupon good for a reduced price flight or a companion ticket, and people would sell them. Can’t do that now, since the TSA checks the boarding pass against a government issued ID. (Actually, you can do it, though I don’t recommend it. It’s not hard to produce a bogus boarding pass that matches your drivers license so you can get past security, and then use a different, valid boarding pass in someone else’s name to board the plane.)
2. Campaigns urging ordinary people to speak up when they see or hear anything suspicious are a bad idea. They produce far too many false positives, which are disruptive and costly — once something is reported, the authorities have to respond. (We had a perfect example of this in Boston a few days ago, when a Muslim family was forced to leave an airplane, delaying the flight for everyone, when someone heard them discussing whether it was safer to be seated in the back of the plane or over the wings.)

A few months ago, my local Stop and Shop added three more self-service checkout lines, thereby reducing the number of lines that had supermarket employees doing the scanning and bagging for you. I was annoyed, because I don’t like the self-service lines — not because I need to have someone else do the work for me, but because only in the staffed lines can I avoid the privacy tax without disclosing my identity. In Massachusetts, if you say to the clerk, “Please use your card,” they’ll give you the loyalty card discount. No way to do that at the self-checkout counters.

It wasn’t so bad, because the lines weren’t that bad, and there always seemed to be enough people in the self-service line who didn’t know English words such as “avocado” that they tended to slow down those lines anyway. And those lines have terrible interfaces, because the technology is cobbled together: the monitor for the scanner (where you have to punch in the item numbers for un-bar-coded items such as avocados) is separate from the credit card interface, which is separate from the signature pad, which is separate from the place where the receipt gets printed.

When I went in on New Year’s Day, there was a further innovation: hand-held scanners. You get one by — guess what — scanning your loyalty card and agreeing to several screensful of unreadable terms (which basically say you won’t steal the scanner and you understand that your purchases may be checked before you leave). You grab a supply of bags if you didn’t bring your own. Then you wander the aisles, scanning purchases as you bag them. You can cancel an item if you change your mind.

You can check prices, so if you are alert, you are less likely to be overcharged by mistake. Every so often, a cash register ring tone alerts you to the fact that the handheld scanner is displaying a discount coupon for another item in the neighborhood of one you recently selected.

Of course there is no reason to worry about those loyalty card discounts — you couldn’t have gotten the scanner in the first place without scanning your card, so you get the discount automatically. At the cashier (in either kind of line), you scan a bar code at the console, return the scanner, and pay the bill.

Now they seem to have closed more of the staffed lines, and the few remaining staffed lines seem to be really long. Gentle pressure to stop fighting for my privacy. And, of course, if the Stop and Shop can get me to do the work they used to have to hire people to do, they save money. I had gotten to know one of the baggers, a developmentally challenged woman in her 30s. I didn’t see her on my last trip to the store; I wonder if she now has employment challenges as well.

I am quoted in Men’s Health magazine on how men can buff up their social networking profiles to become more successful at picking up women.

As Hal pointed out to me privately, this makes me an heir to the tradition of George Antheil, for reasons explained in Chapter 8 of Blown to Bits.

A new law in Georgia requires that registered sexual offenders give their usernames and passwords to the state so that authorities can read their email. The objective is to protect children. Is this reasonable?

Perhaps anyone convicted of a sexual crime can be considered to have sacrificed his right to privacy. But the category is actually fairly squishy. Recall the way UK censors labeled a ’70s LP album cover as “child pornography,” and the fact that until yesterday a woman could be arrested in Massachusetts for indecent exposure or lewd conduct — with a requirement that she register as a sexual offender — if she breast-fed her baby in public.

And if sexual offenders are a real risk of using email to harm children, surely corrupt stockbrokers are a risk of using email to scam customers, etc., etc. Why not make a general rule that if anyone is convicted of a crime, the state gets to monitor all their communications?

Is that the direction we want to go in the name of protecting ourselves?

When you browse to a Web page, there’s sometimes a little padlock in the corner of the window.¬† The padlock is supposed to indicate security: that the Web connection is encrypted and the server at the other end of the connection is authentic, not an impostor.¬† That’s why you’re supposed to feel secure in sending your credit card number or your bank account information across the Web.¬† On December 30, we learned¬† that this padlock isn’t so trustworthy after all, when a group of cryptography researchers announced that they have been able to create a forged digital certificate.

Digital certificates, as we explained in Blown to Bits, are the basic mechanism that browsers use to validate the integrity of Web connections.  A message is authenticated by means of a mark called a digital signature (see B2B chapter 5) operating on a compressed version of the message called the message digest. The signature itself is signed in turn by an organization certification authority; a signed signature is called a certificate.. When you browse to the web site for Bank of America, for example, the BofA site presents its certificate, your browser checks the signature, if the signature checks out, then your browser turns on the padlock to let you know that the remote Web site really is the one for BofA and you can proceed in safety — supposedly. The researchers were able to constructed the bogus certificate so that it to appeared to have been signed by one of the certification authorities whose certificates are automatically trusted by almost all browsers.

A single forged certificate on the Web might not seem like such a big deal, but that certificate could be used to sign other certificates, which would also be trusted, and those certificates used to create new bogus trusted certificated, and so on, potentially flooding the Web with bogus certificates. Until now, if evil Eve creates a Web site that masquerades as Bank of America and tricks people into visiting it (that’s a fraud called phishing), careful users would know to check that the connection is secure and the padlock is showing before entering sensitive information. But, now, if Eve gets hold of one of the forgeries, she can create a message claiming whatever she likes, sign this using the forgery, and have her fake site present the result as the “Bank of America” certificate. When browsers connect to the fake site, the certificate is checked, the padlock appears, and even careful users will be fooled into thinking they are talking to the authentic bank site.

The reality isn’t actually that bad.¬† The researchers who made the announcement are top cryptographers, and although they’ve published a great explanation here), of how they accomplished the forgery, they don’t give all the details. Also, to forestall damage if their certificate falls into wrong hands, they constructed it so that appears to have already expired.

The forgery was accomplished by exploiting a weakness in the method of producing message digests, which uses an algorithm called MD5.¬† Tuesday’s announcement wasn’t a big surprise to anyone in the cryptographic community, because the theoretical basis for the exploit was described at a cryptography conference in 2004.¬† We mention this in chapter 5, along with 2004 recommendation that Web product vendors stop using MD5 and switch to a stronger method called SHA.

And yet, as B2B describes has been so common throughout the history of cryptography, the vendors didn’t stop, at least not right away.¬†¬† And so Tuesday”s announcement was followed yesterday by a predictable “it’s not our fault” scramble.

Microsoft released a security advisory pointing out that “this is not a vulnerability in a Microsoft product”.¬† Ahem … it’s just a vulnerability in a related product that Microsoft relies on in order to function.¬† It’s like when the construction company involved in the Boston Big Dig tunnel ceiling panel collapse protested they didn’t make the glue, they only glued in the panels.¬† Microsoft did point out, however, that it had stopped using MD5 in its own products.

Microsoft’s advisory also pointed out that “the techniques to perform these attacks and the underlying cryptography that facilitate them were not released by the researchers. Attacks would be very unlikely to be implemented at this point in time.”¬†¬† The technical term for that approach is: denial.

As for what Windows users should do, Microsoft’s answer is that there’s pretty much nothing to do, except to install the latest Windows updates, which are unrelated to this issue.

Mozilla’s response was even more lame, pointing out that “this is not an attack on a Mozilla product” and advising users to “exercise caution when interacting with sites that require sensitive information.”

Neither Microsoft nor Mozilla said they would provide some actual protection, for example — as recommended by the researchers — patching their browsers to signal a warning when a certificate uses MD5, or even to reject such certificates outright, thereby forcing the certification authorities to immediately produce alternatives to MD5 signatures.

As for those certification authorities, the only one I noticed a response from was Verisign, whose RapidSSL brand of certificate was the one forged, and which is apparently the largest supplier of MD5 certificates.  Verisign issued a quick response saying that they had been planning to eliminate MD5 certificates by the end of January anyway, and they were on track to do this.  (Where were they in 2004?) They also offered to replace any MD5 certificates free of charge.  (But notice that it is the user who relies on the certificate, not the firm presenting the certificate, who is at risk here.) As the researchers write in their report:

And what none of the responses consider is that if these four researchers were able to pull of this exploit, then someone else, less benign and better funded, may have already done it.  A suspicious person might wonder whether the Internet is already polluted with bogus certificates.

Overall, this was a tour de force of cryptographic skill, but it was not a proud moment for an industry supplying an infrastructure that’s becoming increasingly critical to the entire world and that has been telling us for years how importantly it takes security.¬†¬† As the researchers write,

It was quite surprising that so many so many CAs are still using MD5, considering that MD5 has been known to be insecure since … 2004. Since these CAs had ignored all previous warnings by the cryptographic community, we felt that it would be appropriate to attempt a practical attack to demonstrate the risk they present to everybody using a web browser that includes their root CA certificates.

The eighteenth century-diplomatic officers, who kept on using substitution ciphers 800 years after that method had been broken (see B2B), would have felt right at home here.

Then again, if these past months have taught us anything, it’s that you don’t need Web spoofing to commit financial fraud on a massive scale.¬† Merely subverting Internet security seems downright petty-anty in comparison.

A local high school football coach seems to have gotten more than a bit carried away with his relationship to a fifteen-year-old student at the school. He is now up on statutory rape charges, his wife is divorcing him, etc.

The “bits” angle here is that he sent the girl more than 500 text messages in a single month. Now that’s less than 20 per day, which between 15-year-olds wouldn’t necessarily be a huge number. But from a 44 year old man who must have known at some level that what he was doing was inappropriate, it’s hard to imagine that he didn’t realize that he was leaving tracks every time.

I suppose that once he got started, he may have figured that a few more messages wouldn’t make matters any worse.

Apparently her father just picked up her cell phone and saw the messages.

The Governor of Oregon says his state needs to wake up to the downside of high-efficiency automobile engines. With cars getting more MPG, they won’t use as much gas. You thought that was a good thing? Not if you rely on gas taxes to pay the bills.

So instead the idea is to go to a mileage tax. As explained in a Corvallis newspaper, the system would work like this. Cars would have global positioning systems, which would be used not to track their locations but to log their mileage. At the gas station, the mileage would get uploaded and (during the transition period) you’d get a rebate on the gas tax.¬†Eventually the system would become universal, and automakers would build the GPS into the car.

Supposedly this kludge protects privacy, but of course it doesn’t — the state would know the exact dates, times, and locations of every fill-up. And how long do you think it would take before law enforcement, the insurance industry, or Homeland Security would find it “essential” to collect and upload just a bit more information about vehicular movements?

In any case, why not just have motor vehicle inspection stations report the odometer reading when cars are inspected? In Massachusetts that happens annually, and the odometer reading is one of the data that is taken down. This plan sounds very fishy to me.

Bella English has a good piece in the Globe today about JuicyCampus, the gossip site for all manner of cruel and mean-spirited postings about college students. She’s got the story pretty much right — what JuicyCampus is doing is appalling and, under CDA section 230, legal. An interesting detail she notes is that two states’ Attorneys General are investigating JuicyCampus for not enforcing its own rules against fraud. In the aftermath of the Lori Drew conviction, such charges may not be over-reaching.

As the article notes, there are mechanisms for at least trying to identify who posts a message if it’s truly defamatory (which requires showing actual damage, not mere cruelty). It’s onerous to bring a libel charge (thanks to the First Amendment), but I’m a bit surprised it hasn’t been attempted — the article, at least, mentions the possibility but not any actual cases where it’s been done. (Though JuicyCampus has turned over IP addresses in other cases where violent crimes seemed to be in the offing.)

The book business has been affected by the digital explosion almost as much as the news business, but in a different way. People buy new books over the Internet, since the prices are low and the selection is large. So local bookstores are closing, and even major chains are threatened. And the aftermarket has gotten incredibly efficient — it is so easy and cheap to buy used copies that no one is buying new copies of the classics.

David Streitfeld takes us through the economics and ethics of all this in the New York Times today. He quotes the editor of a literary review thus: “With the Internet, nothing is ever lost. That’s the good news, and that’s the bad news.” So true. I buy more used books now — if I don’t need something right away, I’ll sometimes buy some 50 or 75 year old book rather than retrieving it from the Harvard depository.

Blown to Bits is part of the new book economy. We’ve posted the whole book for download for noncommercial purposes, and our publisher has priced it so low that (we hope) people will buy it anyway rather than print it or try to read hundreds of pages off the screen. We shall see. And it will also be interesting to see what it’s like to negotiate a book contract in the new economy. Even though we signed Blown to Bits less than two years ago, I have a feeling the experience is going to be different next time.

The UK “Culture Secretary” is planning a “crackdown on offensive and harmful online activity,” according to the Telegraph. This would include a rating system like that now in place for movies. The Secretary, Andy Burnham, says,

There is content that should just not be available to be viewed. That is my view. Absolutely categorical. This is not a campaign against free speech, far from it; it is simply there is a wider public interest at stake when it involves harm to other people. We have got to get better at defining where the public interest lies and being clear about it.

As examples of successful rating systems he cites the systems for broadcast television (limiting what can be shown before 9pm) and video games.

I’ve already gone on a bit about Australian Internet censorship plans, and their failings. Such ideas are plainly catching on as legitimate.

But the particular way this is put shows that it emerges out of a metaphor failure. The Internet is no more like a movie theater than it is like a library. No more like a video game than it is like an encyclopedia. No more like a TV screen than it is like the postal service. Try to control one aspect of the Internet and you’ll fail. Try to control the core of the Internet and you’ll break it.

And here is a chilling passage in the Telegraph story:

Mr Burnham admits that his plans may be interpreted by some as “heavy-handed” but says the new standards drive is “utterly crucial”. Mr Burnham also believes that the inauguration of Barack Obama, the President-Elect, presents an opportunity to implement the major changes necessary for the web.

“The change of administration is a big moment. We have got a real opportunity to make common cause,” he says. “The more we seek international solutions to this stuff – the UK and the US working together – the more that an international norm will set an industry norm.”

Aux armes, cityoens! Stop these assaults. Mr. Obama, tell our British friends to leave the U.S. out of their plans.