Cheap secure authentication

Verisign OTP from PayPal

These things can be had from Pay­Pal for about five bucks. Or $7.50 if you’re an Aussie. Verisign will flog them off to you for $30, if you’d like, but basi­cally Pay­Pal rocks for this kinda stuff. It’s a one-time pass­word token that effec­tively enhances your authen­ti­ca­tion by a mas­sive degree. It’s cool because it works with Pay­Pal and eBay. It’s cooler (and worth­while) because you can poten­tially use it with OpenID.

Essen­tially, it’s a ran­dom num­ber seeded with a unique key that gets appended to your reg­u­lar pass­word. This defeats key­log­gers and pretty much all kinds of phish­ing cur­rently out there. These kinds of devices have been used in cor­po­rate VPN/dial-in sce­nar­ios for years now (pre­dom­i­nantly, in the sit­u­a­tions I’m aware of, with tech­nol­ogy by RSA SecureID), but this is the first I’ve seen of it from Verisign.

And, sure, it’s only as secure as phys­i­cal secu­rity or the end­points them­selves are, but it’s a mas­sive step up from “what’s your cat’s name?” two-factor auth (though, unfor­tu­nately, I think PayPal/eBay offer that as a backup).

I’ve ordered mine and will prob­a­bly be hav­ing a play with OpenID imple­men­ta­tions of it (backed by Verisign’s PIP ser­vice, but not overly tied to it because of OpenID’s identity-delegation abil­ity) once it arrives (10 busi­ness days).

Can’t help but won­der what Verisign’s rates for these things are in a stand­alone sense. Nor­mally on 5 year con­tracts, but in terms of cost-per-token. Seems like a great way to defeat the idiot users who insist on hav­ing pass­words that are bla­tantly obvi­ous (argue all you like about strength poli­cies: it’s often not fea­si­ble when bal­anced against sup­port load for resul­tant for­got­ten passwords).

Also, to those who argue Pay­Pal = evil, if you’re in Aus­tralia then please… don’t. Unlike in the US, here they’ve basi­cally got the same finan­cial report­ing oblig­a­tions as any bank does, and cus­tomer ser­vice nec­es­sar­ily to match it. All the hor­ror sto­ries from the ‘States (not that I think them uni­ver­sally untrue!) pretty much couldn’t hap­pen here or they’d be chucked out of the coun­try. And, whilst they’re so heav­ily sub­si­dis­ing (or at least obtain­ing bulk dis­counts for) this kinda tech, that’s cool with me.

# by Josh Street on February 8th, 2008 Tags: , , , , , , ,
| 1 Comment »

No Vista before SP

Appar­ently I’m not the only one think­ing this way about Vista. Though it looks awful pretty, and if I bought a PC with it installed I’d prob­a­bly have a hard time con­vinc­ing myself to buy another XP license just so I didn’t have to use Vista for a few months! On the flip side, I would def­i­nitely con­sider hold­ing off a hard­ware pur­chase that included a Vista license for a few more months, know­ing a Ser­vice Pack is imminent.

Of course, if they’d got it right from the start, I’d be run­ning Vista already… as it stands, I’m not too likely to drop $200 on some­thing that runs slower than XP, sup­ports less hard­ware, has arguably-worse power man­age­ment, and makes the occa­sion­ally excru­ci­at­ing UI mis­take (most notable is the auto­matic replace­ment of the “sleep” but­ton with “install updates and shut­down” where updates are avail­able). Really, the main rea­son I’d switch is to have con­sis­tent UI between Office 2007 and the rest of the sys­tem (instead of the presently absurd Vista-ish (but not actu­ally Vista) UI avail­able on XP), newer hard­ware (inso­far as XP isn’t avail­able), and a paid-for upgrade path… I’d rather fork out my money now and trust that another 3 ser­vice packs are com­ing, rather than pay full price for an OS and then pay full price again, and again. I acknowl­edge this is par­tially a psy­cho­log­i­cal thing stem­ming from my oppo­si­tion for pay­ing for point-releases, but even so… many of the alleged ‘upgrades’ in OS X are thor­oughly trivial.

# by Josh Street on September 15th, 2007 Tags: , , , ,
| 1 Comment »

DRM Sucks, part MMMCVII

Not like this hasn’t been said before, but I recently dis­cov­ered a par­tic­u­larly retarded instance wherein DRM broke (and not for good). In this case it was a “bonus track” on a CD that had to be down­loaded sep­a­rately (prob­lem num­ber 1) and I’d let the CD dis­ap­pear (I own the bloody thing some­where, so sue me) but still had a 320kbps VBR-encoded MP3 copy sit­ting on the file­server here. In the same folder as the MP3s was a WMA file laced with that cer­tain poi­son — and here’s what it did when Win­dows Media Player went to acquire rights automagically:

cybersquatters on media usage rights acquisition page in windows media player

And peo­ple won­der why I refuse to buy music online.

# by Josh Street on August 23rd, 2007 Tags: ,
| No Comments »

Sony Ericsson V630i PC Suite sucks — or it did

Drop­ping out con­nec­tions, etc., and gen­eral pain was the nor­mal state of PC-syncing for this par­tic­u­lar phone (prob­a­bly exac­er­bated by my his­tory with Win­dows Mobile perfection!) — so today I snapped and went look­ing for a soft­ware update.

There is one. It is so near per­fec­tion it makes me cry.

If you’ve been let down by older ver­sions of SE’s PC Suite soft­ware, give this ver­sion (2.10.38 at time of writ­ing, I was upgrad­ing from I think 1.17.x?) a try. 44MB down­load, but well worth it.

# by Josh Street on August 22nd, 2007 | 2 Comments »

Too much nostalgia for a computer

What fol­lows is writ­ten far less well than it deserves, but — iron­i­cally — I’m drown­ing in other work at present. This needed writ­ing sooner than other things did.

Michael’s pulling the plug on the server that this web­site has run on since 2003.

The ‘server’ has changed dra­mat­i­cally in con­sti­tu­tion since it all began way back when, but… wow. An aston­ish­ingly large part of my teenage years. For the longest time, it seemed as though the Inter­net had alto­gether ceased to exist every­time Dale’s con­nec­tion went out. In the early days, we were all run­ning servers on port 1200 to cir­cum­vent ISP restric­tions on port 80. phpBB was the order of the day, run­ning Apache — on a pirated copy of Win­dows 2000 (those were the days in which “legit­mate soft­ware” con­sti­tuted an oxy­moron). Oper­at­ing on an early ADSL link with 64kbps upload, forum emoti­cons were hosted on free web space pro­vided by iiNet in order to con­serve band­width. You laugh now, but the speed boost was incred­i­ble. Every time iiNet dropped out (to future read­ers: that’s what hap­pens when the inter­net goes out for a cou­ple of hours, none of this occa­sional con­nec­tion time-out rub­bish), an irate explana­tory post from mwd­meyer would emerge and life would con­tinue as nor­mal. Until par­ents dis­cov­ered the server run­ning and turned it off again, which would spark an effort to con­ceal yet another com­puter in a room crowded full of equip­ment. About halfway through 2004, they gave up searching.

These were the days (for me) of NE2000 clones pow­er­ing Smoothwall/m0n0wall routers, recy­cling hard­ware, a sub­scrip­tion to Atomic before all the other kids (I bought more geeky mag­a­zines than any­one I know – I think it was that strange meet­ing place of compters, cre­ativ­ity, and cant that I later became com­fort­able with), when GeForce 2’s and Pen­tium 4’s (the first ones with RDRAM that every­one despised) and DDR-supporting Athlons were still zippy. When frame-based redi­rects passed for domain names — .tk, anyone?

Mostly, it was about the forums… but as for per­sonal pub­lish­ing, this was no small resource. My first dynamic web­site was a blog hosted on that server — I don’t think it yet had a name — we all rolled our own web soft­ware in those days (it’s not that long ago). Some of us still do. The first domain name acquired was Dale’s, in March 2004, co-inciding (more or less) with the forums’ first birth­day. Twelve US dol­lars later (Joker.com’s prices still haven’t changed), we were all still using frame-based redi­rects — sta­tic IPs were the stuff of pipe-dreams, and Dynamic DNS, though around, was out­side of the expe­ri­ence of most of us. Steve ran a notoriously-flaky IIS server with real domains and Exchange, but paid about $150 a month for the priv­i­lege: sta­tic IPs being avail­able only on busi­ness grade inter­net connections.

These are mere details. The forums them­selves con­sti­tute an amaz­ing chron­i­cle of the lives of mwd­meyer, ucosty, Sammy, i_am_a_n00bie, Smile:), smKz, n|cktangents, angelicde­ity, baibai, Sphinx^, lud­vikas, and a hand­ful of oth­ers over a fairly tumul­tuous time. There is so much not recorded explic­itly that sur­rounds the nearly 16,000 mes­sages from these eleven users alone. Some has been sup­pressed, other parts for­got­ten, but all of it inex­tri­ca­bly linked together in the momen­tum of time. There are some things about that time which will never be shared with those who weren’t around.

The forums didn’t sur­vive post-school. This shouldn’t be sur­pris­ing, given the amount of research that says this will be the case for any given rela­tion­ships faced with that man­ner of tran­si­tion, but it was still bizarre wit­ness­ing what would have been sev­eral months of time spent on a sin­gle web­site evap­o­rate into (not much). The server moved from Bal­main to Mar­ian Street, even­tu­ally find­ing its way into a rack there. This is where things get hazy for me. I think the last time I saw Michael might’ve been New Years’ Eve 2005/2006… I feel some sense of guilt about that, but recog­nise mutual busy-ness had a role such that nei­ther of us should be blamed alone. I don’t believe that a blame­less “but things changed” is ever suf­fi­cient when talk­ing about close rela­tion­ships. I’m fairly cer­tain my clos­est friend for about two years at school is some­one that I no longer have any­thing to do with, but can’t explain why. And I know that I can’t in any way blame him, because I’m so guilty of fail­ing to keep work­ing on rela­tion­ships myself.

I sup­pose the point of all this is that the com­puter for­mally known as ‘Metro’, now ‘Loki’ (I don’t know how it got that name — Loki to me is an amaz­ing con­trib­u­tor to Linux-based gam­ing, 2000 – 2002 RIP, but it could just as eas­ily have been named after the Norse trick­ster and Odin’s wily accom­plice!) isn’t just the lat­est in a series of bits of elec­tronic gear that some markup and pix­els have been piped off for a cou­ple of years. This is just one step closer to a com­plete clo­sure of a very large chap­ter of my life… and, yeah, that’s incred­i­bly sad.

Please don’t for a minute con­sider this to be my argu­ing that Loki should stay switched on — it’s about some­thing far greater and more per­sonal than a star­tlingly reli­able FreeBSD web server that just hap­pened to host a web­site for free for a long time.

There aren’t too many peo­ple you can make sit in the back of a car on their 18th birth­day, much less who will laugh along with as it happens.

This isn’t an obit­u­ary, just a poor expres­sion of remorse at the (human) dis­con­nec­tion and ‘drifted’ rela­tion­ships of that era. Michael, once all this stu­pid uni crap gets out of the way (maybe after you move again?), I owe you a fairly large drink.

Thankyou.

Slacker Radio

Slacker Radio Beta screenshot

This ser­vice rocks. It’s free, has a pretty good range of music, and is guar­an­teed to make me buy more music (on CD, because all elec­tronic music down­load ser­vices are still either ille­gal or stupid).

The Flash player kicks butt (there’s a desk­top one com­ing soon), and intel­li­gently hooks into the webpage’s markup to update the title with every new song. It’s gold. Song Title by Artist from Album Name. It says Album Name! I’m sit­ting here scrib­bling down must-acquire ‘90s music.

It uses AAC2+ appar­ently… all I really know is that it sounds great and is stu­pidly easy to use.

Bril­liant.

But pos­si­bly unsus­tain­able… none of my money is going to them. They’re launch­ing hard­ware devices, so this might just be a ploy to get peo­ple to buy them, but I’m more inter­ested in who’s doing all the work. There’s absolutely zero crowd-sourcing going on here that I can see… which means that “Related Artists” list is all pro­fes­sion­ally pro­grammed. I know the Top Sta­tions are, but the artists bit is going a lit­tle far perhaps…

Triple J Unearthed and Myspace and PureV­ol­ume, etc., all do it the other way around, which seems infi­nitely more sen­si­ble… but you need crit­i­cal mass to get there, I suppose.

One to watch. And lis­ten to.

OpenID again

I’ve men­tioned OpenID here and here before (the first only in pass­ing), in the con­text of frag­ment­ing social net­works and Live­Jour­nal. By the way, check out the sec­ond of those posts… for meta-writing/meta-blogging, it’s (IMO) sur­pris­ingly good! I was pleased.

Any­way — OpenID is still around 10 months later (though the spec was last updated around the time I last wrote on the mat­ter), WordPress.com have announced they are now an IdP for it, and it seems every­one wants to be a provider, not a con­sumer (in OID spec par­lance, con­sumer means the web­site request­ing ver­i­fi­ca­tion of an Iden­tity — “end user” is the term given to an actual human user).

In fact, Ma.gnolia.com is the only OpenID con­sum­ing site of con­se­quence that I’ve encoun­tered thus far in my trav­els. Which is, to say the least, slightly perplexing.

I’m aware the whole point of OpenID is that it’s a vastly decen­tralised spec that enables myr­iad providers to exist, but it seems some­what redun­dant (in the sense in which that means “point­less, with­out pur­pose”, not failover-type redun­dancy) if there does not exist a sin­gle con­sumer of consequence!

And, let’s face it, why should being a con­sumer be attrac­tive? You know less about your cus­tomers, they can bail on you more quickly, and… all of a sud­den, adver­tis­ing is the only way of mon­etis­ing a web­site. Jan­Rain oper­ate “MyOpenID: Your first (and last) iden­tity provider”, as well as a cou­ple of ser­vices that use OpenID, and have (to my eyes, at least) no con­ceiv­able way of gen­er­at­ing rev­enue at present.

Which is poten­tially fine, but com­pletely stu­pid if that’s hap­pen­ing on a wider scale. As a con­cept, OpenID has much to offer — I just wouldn’t use it in CYIADA. I might con­sider it for smaller projects (com­mer­cial clients), but, really, I think it’d have a bet­ter chance if Myspace were an OpenID provider. And we all know what they’re like when it comes to web stan­dards (and gen­eral usabil­ity issues)!

Plus, of course, there’s the issue of the pop­u­lar­ity of up-stream providers if you want to ver­ify against some­thing other than OpenID (like, for exam­ple, someone’s Google account — which you can do quite eas­ily using var­i­ous API tools they pro­vide). With any­thing youth tar­geted, there’s a spe­cial impe­tus that we don’t really see in other places. I read this absolutely hilar­i­ous com­ment on a great analy­sis of an arti­cle about Myspace:

It’s easy to imag­ine teenagers as a pack of wilde­beests on a grassy plain, sim­ply run­ning with wild abandon.

Why yes, yes it is. They’re not (arti­cle has more on this), but the bot­tom line is if you’re using exter­nal ver­i­fi­ca­tion ser­vices, you’re depen­dent on the exis­tence and longevity of these ser­vices for the exis­tence and longevity of your ser­vices, not the least in user pro­fil­ing and build­ing up mean­ing­ful mar­ket data so you can adjust your mix to a known audience.

OpenID feels like a won­der­ful tech­nol­ogy in a chicken-egg sit­u­a­tion. It’s still just too bloody geeky for your aver­age LJ user to get on board with. And they’ve got it easy. For any­one else, it’s com­pletely impossible.

Here in Syd­ney, we could prob­a­bly get away set­ting up ver­i­fi­ca­tion against Win­dows Live sim­ply because that’s what peo­ple use here, as I have noted before (about halfway down the post linked). But devel­op­ing dif­fer­ent autho­ri­sa­tion schemes as a mat­ter of local­i­sa­tion is most def­i­nitely not in my book of best prac­tices (if I were ever to write one :P) — so, instead, frag­mented Inter­net iden­ti­ties persist.

That bugs me.

If you have any answers or thoughts… let me know. Blog about it and send a pingback/trackback. That’s one of the few open stan­dards that’s worked well on the web, albeit with plenty of spam abuse, but there’s of course the prob­lem that not enough peo­ple are socially blog­ging aside from soft­ware devel­op­ers and design geeks and… what­ever cat­e­gory I fit into (“web strate­gist” is still what I’m call­ing myself… we’ll see how much longer that sticks) — so, of course, there’s no instinct to reply in this manner.

In the same way, devel­oper and busi­ness instinct is to build your own authen­ti­ca­tion and pro­fil­ing plat­form. Is it worth resisting?