Month: February 2003

Security: Time-Constrained Login

This is an informal description of a possibly but unlikely new technique for secure authentication, designed to be combined with other technique such as passwords or smartcards to limit risk without additional cost other than possible inconvenience.

Identity authentication techniques may be divided into one of three categories:

  1. something you know (password, pass phrase, PIN)
  2. something you have (smartcard, hardware token)
  3. something inherent to you (i.e. biometric)

Time-constrained login technique falls into the first category: valid login time and duration is something you know.  This technique is different from other knowledge-based techniques in that the required knowledge may be changed more frequently, possibly each time.  This is because, while people can't remember daily changing passwords, they can easily remember appointments.

With time-constrained login, authentication succeeds only at certain time.  A specialized form of time-constrained login is Time Capsule since it can only be opened after certain amount of time has passed.  Another example that is more appropriate for day to day use is CVS login restricted to 10-11am and 6-7pm.

Absolute time-constrained login uses specific time such as 1:35pm GMT or 7:12am PST.  Relative time-constrained login uses relative time such as 5 hours and 12 minutes from one or more event such as 'now' or 'after receiving SMS message containing the word 'Hollywood' from me'.  Time constraint can be specified by random, by schedule, or by combination (hours by schedule and minutes randomly).  Duration can be determined according to the need.  Specifying relative time constraint as one logs off may be useful to protect your workstation while going to a meeting or lunch.

This is all I have so far.  If you know of a similar techniques or have suggestions, please let me know.  If not — unlikely but possible – I may file an anti-patent if there are any patent lawyers interested in doing some pro bono work.  <g>

Religion

I am not religious.  My wife is a Catholic, goes to church every Sunday morning and attends Bible studies with her friends.  For selfish reasons, I like that about her.  I tried going to church with her, but when I am inside a church, I sense a presence of sort that gives me goosebumps.  Instead of feeling awed, I feel as if I am inside someone's house without permission.  Brrr.  I get goosebumps just thinking about it.

At Zen Buddist temples, I feel comforted if I am alone.  I avoid meeting monks because they feel like drug addicts to me, a drug called tranquility.  I was addicted to tranquility when I was younger, but life wasn't much fun like eating a bowl of rice without any side dishes.  So I am now floating down the river called life, enjoying every wave, up and down.  Besides, my head looks ugly when shaved.

Google’s Big Brother potential

While I am not sure if all the claims made in "Google deserves your nomination for Big Brother of the Year", are true, but Google's popularity is a concern like a volcano growing in your backyard.  I mean wouldn't it be really stupid for NSA, FBI, and CIA, if they didn't ask Google for co-operation?  What can Google management say?  Sorry, we can't notify authorities when someone googles 'How to destroy America in 21days' because we think profit is more important than national security?  If those government agencies are doing their job properly, then Google will be in compromising position soon or later, if not already.

Ads in Blogspace II

After the initial post on the subject, I found BlogAds.com.  They sell ads on blogs. They don't appear to be doing good business though.  Here are some observations:

Money – blogers using BlogAds.com service supposedly make $20 per month on the average and as much as $150 per month.  This is just not enough to be attractive.  At this level, its better to offer gift certificates.  Receiving a $100 gift certificate for Sharper Image (for guys) or Crate & Barrel (for gals) every few months would be more attractive than measly $20 per month.  Receiving small amounts of cash every month could encourage pathetic pleas asking for readers to click on ads.  Not good.

Style – not all ads will work for blogs.  They need to be done tastefully.  When was the last time you saw animation in blogspace?  No color clashes also.  Ads for blogs must blend in with predictable position and size.  Each blogger must be able to decide the what kind of ads they are is willing to display.

Effortless – most importantly, it must be effortless with no big change to the blogging routine.  Approving an ad request should take only a single click.

All this requires a lot of work for the blogad service and deep integration with blogging tools.  But one can't expect all the blogging tools to support ads and do it consistently.  Also, one reader noted that MT blogs can't have ads because ads will violate the non-commercial license.  Solution seems to be free ad-enabled blogging tools and services that compete with existing crop of blogging tools and services.  Why pay for it when you can get it for free and receive occasional rewards as well?

Ads in Blogspace

I wonder why most blogs have no ads?  We are not shy about recommending things, places, and products on our posts, so why not have ads for the recommended things, places, and products on our blogs?  If it can be done easily and without losing control, bloggers can make money without selling out.

Lets see how this can be done.  A blog crawler can scan the blogspace for recent blog posts containing certain names like "Diet Coke" and "Nokia 7650".  When one is found, an ad-space offer is made to the blogger by e-mail, feedback, or web services.  If the blogger agrees, then the blogging tool inserts the ad automatically.  Expired ads are removed when the time limit ends.

Next problem is how to handle the abusers who posts bogus news containing product names and nothing else.  Use a combination of Google's approach, Bayesian filters, and other statistical abnomally detection techniques.

Last major problem is what to do about RSS feeds and news aggregators.  Links to ads can be included in RSS feeds and news aggregators should allocate areas to display required or optional ads.  Detecting new feed clients that do not display mandatory ads will be difficult but manageable.

Thoughts on Clay Shirky’s Power Laws

I have been thinking about Clay Shirky's Power Laws post and my conclusion is that the power law does apply to weblogs as well as the web and life in general.  But I believe the power law erode in the face of fast chaotic changes.  Weblog technology is still at its infancy and evolving fast into a form we have yet to see.  Applying the power law at this time would be as foolish as pinpoin the position of my underwear inside a running washer.

Anti-American Sentiments in Korea

North Korea, as a whole, is clearly anti-American.  South Korea is less clear.  Older South Koreans are pro-America as expected, but younger generation seems to be leaning toward anti-American sentiments.  Focus of anti-American sentiments in South Korea is not based on differences in idealism, but apparent imbalances in the relationship between American and South Korea.  Whether justified or not, young South Koreans are proud of their country and America threatens that pride.

There are Korean kids who maintain detailed list of all the incidents caused by American soldiers such as rapes, beatings, and how the guilty escaped justice thanks to the mighty America.  Passed through several people, these stories gets bloated and turn real ugly.  Result is kids thinking South Korea is under the occupation of America.  Bush's actions and words nudge that kind of thoughts further along their paths.

I am not saying we'll see freedom fighters in the streets of Seoul anytime soon.  But I am concerned about the trend because there seems to be no significant counterforces.  Generation-gaps dilute influences by the older generations.  Internet actually makes the problem worse because most South Korean kids shun non-Korean sites and communicate almost exclusively among themselves, thus amplifying negative feelings.

Time for some serious poker

Looks like I am in for a private winner-take-all poker tournament early March.  I am pretty good at the table, but never done a tournament before, not even a small and friendly one like this one, so I'll get something out of it even if I don't win.

Berkman Center’s smart money

Berkman Center folks sure made a good investment when they granted Dave Winer a fellowship.  He is making news, experimenting, and rousing people (see Dan Bricklin's pictures of Dave's first Harvard weblogger meeting).  He is not only infecting smart people with the blog meme, but pulling them into close enough proximity, both physically and virtually, to make things happen.

When you catch a meme, you are pregnent with a mixture of the original meme and your interpretation of the meme.  Over the incubation period, you feed your lifespan of thoughts and experiences into it.  Someday, these people will crack open and start infecting others with their own variation of the original meme.  So the faces in Dan's pictures are carriers.  Scary, huh?