Want to do security research? Want to get arrested?

In a strange twist, a researcher who has published a simple, well-known demonstration of the huge flaws in airline security screenings is now being threatened with arrest.

Congressman Ed Markey Wants Security Researcher Arrested

Congressman Edward Markey (D-Mass.) wants the federal government to arrest security researcher Christopher Soghoian for creating the Northwest Airline Boarding Pass Generator, a site which lets anyone create a facsimile of a Northwest Airlines boarding pass. Soghoian hoped to spur Congress to look closely at the nation’s aviation security policies, which he calls “security theater.”

Instead, Markey, a member of the House Homeland Security committee, wants the site shut down and Soghoian arrested.

“The Bush Administration must immediately act to investigate, apprehend those responsible, shut down the website, and warn airlines and aviation security officials to be on the look-out for fraudsters or terrorists trying to use fake boarding passes in an attempt to cheat their way through security and onto a plane,” Markey said in a statement. “There are enough loopholes at the backdoor of our passenger airplanes from not scanning cargo for bombs; we should not tolerate any new loopholes making it easier for terrorists to get into the front door of a plane.”

boarding pass

Want to do security research? Want to get arrested? Read More »

Biometric scans served up with school meals

Here is an interesting example of a biometric application, this time based on palm vein scanning.

palm veins

While biometric security systems are often criticized for their privacy implications, one of the motivations of this program was to protect students who receive meal subsidies. Instead of having to show special cards or tickets to get their free meal, they can use the biometric device like all the other kids.

Another “feature” is that the system is designed to monitor what the children eat and provide advice on the diet choices. It will be interesting to see how that feature is accepted and used or misused.

Scotsman.com News – Sci-Tech – Biometric scans served up with school meals

PUPILS at a Scots primary school have become the first in the world to pay for their lunches by having their palms scanned rather than by handing over cash.

Biometric technology which allows them to be identified through their hands’ unique vein patterns has been introduced at Todholm Primary in Paisley.

It means no more lost dinner money – and protects the identity of pupils who are entitled to free school meals.

The system identifies children with food allergies and encourages pupils to eat a balanced diet by providing a read-out of what they choose during the week.

Biometric scans served up with school meals Read More »

Evolution and intuitive thinking

This is an interesting hypothesis. The claim is that people have evolved to think intuitively, rather than purely rationally and logically. We have developed this ability because it is necessary when we do not have much information to make decisions but instead have to reason about unobservable properties. This includes thinking about the nature of objects or observations of people. Normally, this intuitive reasoning works pretty well as we live in the world, allowing us to make decisions that are often appropriate.

But, the argument goes, this same intuitive thinking also makes us susceptible to misconceptions, magical thinking, and superstitions.


Well worth reading.

 

Evolution keeps us superstitious. Now thats lucky – Britain – Times Online

Religion and other forms of magical thinking continue to thrive — despite the lack of evidence and advance of science — because people are naturally biased to accept a role for the irrational, said Bruce Hood, Professor of Experimental Psychology at the University of Bristol.

Evolution and intuitive thinking Read More »

Neuroeconomics

There is an interesting debate going on about a new field of “neuroeconomics”, which involves the study of human economic behavior using the tools of brain science. It seems that in recent studies people have been asked to make economic decisions, like making investments or placing bets or trusting strangers with money, while their brains are scanned in MRI machines.

It has long been known that people often make decisions that don’t make any sense from a purely rational, economic sense. Kahneman and Tversky showed that people, for example, often make decisions based on “loss aversion” rather than by attempting to maximize their gains. For example, people will often avoid taking a risk with a good chance of paying off if they can avoid taking even a small risk of having a loss. When people make decisions that are not ideal from a purely economic, rational sense, it is important to understand why.

The results from the brain scans are fascinating because they show that two general areas of the brain are active during these economic decisions, the “rational” prefrontal cortex and the deeper limbic system known to be involved with emotions. Moreover, sometimes the limbic activity is stronger than others, and this is when people make decisions that are not rational from an economic point of view.

A similar phenomenon occurs when people are asked to make decisions involving immediate gratification versus long-term rewards — situations like saving for retirement, or quitting smoking. Again, the brain scans show that the limbic areas of the brain show more activity when people consider the immediate gratification option rather than the long-term option. And, the more activity in the limbic system, the more likely the person is to choose immediate gratification. It seems that reason and emotion often compete in the brain, and emotion sometimes wins out, perhaps to the detriment of the person involved.

The debate begins when you consider what, if anything, should be done with these findings. A paternalistic view would suggest that people can be influenced to their detriment by emotions, and that policies should be in place for “saving people from the vagaries of their limbic regions” (Cassidy). Such policies might include changing retirement savings plans from an opt-in model to an opt-out model to encourage the long-term savings that seems to be so hard. Other practices might involve warnings on lottery ticks or cooling off periods before people make large purchases.

The issue under debate is whether such paternalistic responses are appropriate, or rather they are fundamentally against the principle of free will. Is it really “coercion to force people to do or refrain from something against their will for their own good” (Wilkinson). Wilkinson argues that a distinction between rational and emotional decision making is far too simple, and that thought processes are far more complex than that. Further, he argues that the economic ideals that are used to define “rational” behavior are a “mathematical fiction” that should not be used as a standard for human behavior. He counters that people should be considered to be the best judge of their own behavior, and it is not the role of government to get involved in personal judgments and decisions.

This is an interesting debate on the role of human nature in complex decision making and the implications for individuals and society.

To read more, have a look at:

Mind games: What neuroeconomics tells us about money and the brain.
by John Cassidy, The New Yorker, 2006-09-18. http://www.newyorker.com/fact/content/articles/060918fa_fact

Neuro wine in old bottles.
By Will Wilkinson, TCS Daily, 27 Sep 2006.
http://www.tcsdaily.com/article.aspx?id=092706A

Neuroeconomics Read More »

Is Hysteria Real? Brain Images Say Yes

An interesting article on advances in brain science.

Hysteria is a 4,000-year-old diagnosis that has been applied to no mean parade of witches, saints and, of course, Anna O.But over the last 50 years, the word has been spoken less and less. The disappearance of hysteria has been heralded at least since the 1960’s. What had been a Victorian catch-all splintered into many different diagnoses. Hysteria seemed to be a vanished 19th-century extravagance useful for literary analysis but surely out of place in the serious reaches of contemporary science.

Functional neuroimaging technologies like single photon emission computerized tomography, or SPECT, and positron emission tomography, or PET, now enable scientists to monitor changes in brain activity. And although the brain mechanisms behind hysterical illness are still not fully understood, new studies have started to bring the mind back into the body, by identifying the physical evidence of one of the most elusive, controversial and enduring illnesses.


http://www.nytimes.com/2006/09/26/science/26hysteria.html?ei=5088&en=8f2f95356581c38c&ex=1316923200&adxnnl=0&partner=rssnyt&emc=rss&adxnnlx=1159282015-vc5Oku88MCGdEvCOVlUmwg&pagewanted=all

Is Hysteria Real? Brain Images Say Yes Read More »

Schneier on Security: What is a Hacker?

An interesting article by Bruce Schneier on the definition of a "hacker"… 

Schneier on Security: What is a Hacker?

A hacker is someone who thinks outside the box. Its someone who discards conventional wisdom, and does something else instead. Its someone who looks at the edge and wonders whats beyond. Its someone who sees a set of rules and wonders what happens if you dont follow them. A hacker is someone who experiments with the limitations of systems for intellectual curiosity.

Schneier on Security: What is a Hacker? Read More »

Dark Reading – Host security – Social Engineering, the USB Way – Security

Here is an interesting variation on social engineeing attacks, this one relying on our human nature to be attracted to free, interesting things… USB Drive

Dark Reading – Host security – Social Engineering, the USB Way – Security

… We gathered all the worthless vendor giveaway thumb drives collected over the years and imprinted them with our own special piece of software. I had one of my guys write a Trojan that, when run, would collect passwords, logins and machine-specific information from the user’s computer, and then email the findings back to us.

Dark Reading – Host security – Social Engineering, the USB Way – Security Read More »

The Eternal Value of Privacy

An important rant by Bruce Schneier from Wired:

Wired News: The Eternal Value of Privacy

The most common retort against privacy advocates — by those in favor of ID checks, cameras, databases, data mining and other wholesale surveillance measures — is this line: “If you aren’t doing anything wrong, what do you have to hide?”

Some clever answers: “If I’m not doing anything wrong, then you have no cause to watch me.” “Because the government gets to define what’s wrong, and they keep changing the definition.” “Because you might do something wrong with my information.” My problem with quips like these — as right as they are — is that they accept the premise that privacy is about hiding a wrong. It’s not. Privacy is an inherent human right, and a requirement for maintaining the human condition with dignity and respect.

The Eternal Value of Privacy Read More »

Security Absurdity; The Complete, Unquestionable, And Total Failure of Information Security.

An alarming article on the terrible state of information security systems.

Security Absurdity.com > Security Absurdity; The Complete, Unquestionable, And Total Failure of Information Security.

It is time to admit what many security professionals already know: We, as security professionals, are drastically failing ourselves, our community and the people we are meant to protect. Too many of our security layers of defense are broken. Security professionals are enjoying a surge in business and growing salaries and that is why we tolerate the dismal situation we are facing. Yet it is our mandate, first and foremost, to protect.

The ramifications of our failure are immense. The success of the Internet and the global economy relies on trust and security. Billions of dollars of ecommerce opportunities are being lost due to inadequate security. A recent survey of U.S. adults revealed that three times the number of respondents believed they were more likely to be victimized in an online attack than a physical crime. A recent Gartner survey that indicated that 14% of those who had banked online had stopped because of security concerns, and 30% had altered their usage. People are simply losing trust in the Internet.

The security community is not just failing in one specific way, it is failing across multiple categories. It is being out innovated.

It is losing the digital battle over cyberspace.

Security Absurdity; The Complete, Unquestionable, And Total Failure of Information Security. Read More »