Hobson's World

Public unrest over the TSA has finally boiled over. As someone who hated the TSA long before it was fashionable, it's been nice to see the general public finally voicing some outrage. Absurd that it took naked scanners and crotch-grabbing to stir us into action, but still nice. Please, continue to be angry with the TSA, and maybe someday we'll bring that whole farcical organization down upon itself. But that's not really my job here. My job is to explain to you that there are a lot of other things to be angry about, too.

Hobson, the story goes, operated a large stable with horses available for let. One could pay to use a horse from his stable, but you were not free to select any horse you liked. You could have the horse currently up for rotation, or you could shove off. This probably worked quite well for Hobson, ensuring that his most popular horses did not become overworked. At any rate, he managed some small measure of immortality; a "Hobson's Choice" is any choice where the only options are accepting all the terms, or none at all. There's nothing inherently bad about these types of choices. But what if Hobson's stable was the only one in town? And if horses were so heavily used that access to one was no longer a luxury? And what if his rotation wasn't a fair FIFO system, but something more sinister, like giving the worst horses to those least able to complain?

Hobson, the medieval stable master, would have found himself right at home on the internet. Whether you realize it or not, every trip through cyberspace is riddled with Hobson's choices. It starts at the plug in the wall; if you want anything coming down your wires you must agree to the conditions put forward by one of a handful or fewer ISPs available to you. Then almost every website you visit has a Terms of Service (I've touched on these before). And for every service you use, even the most basic like email, you've checked off your assent to a massive User Agreement. There's almost nowhere to hang your hat that isn't fenced in with thousands of words of legalese defining exactly what you are allowed to do. You don't often think about the presence of all this contractual weight, but it's there, every time you bring up a browser.

What's really appalling about all these terms is how much they take away and how little they offer. Most ISPs, if they so chose, could give you no connection at all, for as long as they pleased, and continue to bill you for it. The provider's side of these agreements is legal ass-covering, allowing them to give as little service as they please and still be within the terms of the contract, protected from litigation.

Here's Comcast stipulating that they can install software on any device you connect to their service (i.e. your computer), and that they are not responsible for any damage they cause by doing this (emphasis mine):

Customer Equipment consists of software or services that you elect to use in connection with the Services or Comcast Equipment (the “Customer Equipment”). You agree to allow us and our agents the rights to insert cable cards and other hardware in the Customer Equipment, send software and/or “downloads” to the Customer Equipment and install, configure, maintain, inspect and upgrade the Customer Equipment and Comcast Equipment.

Comcast User Agreement, Section 5.b

Comcast has no responsibility for the operation or support, maintenance, or repair of any Customer Equipment including, but not limited to, Customer Equipment to which Comcast or a third party has sent software or “downloads.”

Comcast User Agreement, Section 6.b.1

In case that's not enough, here's Comcast indemnifying themselves against anything short of gross negligence, and claiming that even in that case you cannot be entitled to more than $500 (emphasis mine):

CUSTOMER EQUIPMENT MAY BE DAMAGED OR SUFFER SERVICE OUTAGES AS A RESULT OF THE INSTALLATION, SELF-INSTALLATION, USE, INSPECTION, MAINTENANCE, UPDATING, REPAIR, AND REMOVAL OF COMCAST EQUIPMENT, CUSTOMER EQUIPMENT AND/OR THE SERVICES. EXCEPT FOR GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, NEITHER COMCAST NOR ANY OF ITS AFFILIATES, SUPPLIERS, EMPLOYEES, AGENTS, OR CONTRACTORS SHALL HAVE ANY LIABILITY WHATSOEVER FOR ANY DAMAGE, LOSS, OR DESTRUCTION TO THE CUSTOMER EQUIPMENT. IN THE EVENT OF GROSS NEGLIGENCE OR WILLFUL MISCONDUCT BY COMCAST, SUPPLIERS, EMPLOYEES, AGENTS, OR CONTRACTORS, WE SHALL PAY AT OUR SOLE DISCRETION FOR THE REPAIR OR REPLACEMENT OF THE DAMAGED CUSTOMER EQUIPMENT UP TO A MAXIMUM OF $500. THIS SHALL BE YOUR SOLE AND EXCLUSIVE REMEDY RELATING TO SUCH ACTIVITY.

Comcast User Agreement, Section 10

Meanwhile, your side of the terms may contain any number of constrictions on what you are allowed to do. Many create licensing terms that cede everything you create to the control of the company, to use however they please. Here's Facebook:

For content that is covered by intellectual property rights, like photos and videos ("IP content")... you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook ("IP License").

Facebook ToS, Section 1

Notice that they may license your content out to others if they wish. To Facebook's credit, they no longer claim the license to be "perpetual" and "irrevocable". They briefly added those terms in 2009, and backed off after facing considerable backlash.

Many of these documents state that the terms may change at any time, with no warning, and that your continued use of the service will be bound by these new terms. Here's Comcast again (emphasis mine):

Subject to applicable law, we have the right to change our Services, Comcast Equipment and rates or charges, at any time with or without notice. We also may rearrange, delete, add to, or otherwise change programming or features or offerings contained in the Services, including, but not limited to, content, functionality, hours of availability, customer equipment requirements, speed, and upstream and downstream rate limitations. If we do give you notice, it may be provided on your monthly bill, as a bill insert, e-mail, in a newspaper or other communication permitted under applicable law. If you find a change in the Service(s) unacceptable, you have the right to cancel your Service(s). However, if you continue to receive Service(s) after the change, this will constitute your acceptance of the change.

Comcast User Agreement, Section 4

Then, of course, are the terms that are simply absurd. When Grinnell College rolled out their new alumni network, John Stone noticed that The Loggia Terms and Conditions disallowed, among other things:

Reproducing and storing data in a retrieval system (electronic or mechanical)

From a technical standpoint, one cannot view a webpage without storing and reproducing data locally, making it impossible to actually use the service and still be in compliance with this rule.

To do even the most mundane tasks online, you are forced to relinquish a great number of rights, but in return you receive absolutely nothing except the optimistic hope that the company will provide something to you. You are signing a contract for empty air, and if you're lucky the company will choose to bestow upon you some favors. If these are legally viable is a bit of an open question. Most notably, these agreements could be considered contracts of adhesion and may be unenforceable due to the doctrine of unconscionability. Vagaries of the law aside, it should be apparent that this type of agreement, wielded without oversight, is morally wrong.

At first blush, the TSA situation seems far removed from that inflicted on us by private companies. After all, the government is the one entity that can compel us to obey certain rules, whether we choose them or not. You don't get to opt out of the legal system, even if you want none of the benefits.

But let's examine the TSA's role. Flying is, in the end, a purely voluntary activity. You cannot be compelled to endure an unconstitutional body scan or enhanced patdown if you simply choose not to travel by airplane. Another Hobson's choice. Like many of the others, this choice is a coercive force for many of us. Some people depend on air travel to perform their jobs. Others have no other way to see relatives or friends in far away places. While it's admittedly a middle-class pursuit, air travel is nearly a necessity for many of us who can afford it.

Much of TSA's power, as it turns out, stems from this choice. There has been some bluster during the recent opt-outs about levying a civil fine for leaving the airport after the screening process has begun, but it's unlikely those threats will ever be made good on. And that's a civil fine, the only kind TSA has the authority to level. This fascinating account is written by a man who refused to submit to the new policies as a condition of being allowed through customs. The best part is when actual police offers get involved, officers who have been trained on constitutional rights.

I clarify, “Well, like I said, I’ll do whatever you say is mandatory. If you tell me that you have to touch my balls—“

“—I said no such thing. You’re putting words in my mouth.”

“OK. I apologize. If you say that a pat-down is mandatory, and that as a condition of that pat-down, I may have my genitals brushed against by your hand, even though you don’t want to, I will do that. But only if you say it is mandatory.”

“I’m not going to say that.”

The TSA has no real authority. Their power stems only from the fact that they control access to a service that is nearly ubiquitous and seriously disadvantages those who refuse the terms. So they can present a Hobson's choice, safe in the knowledge that almost everyone will submit. Sound familiar? TSA is nothing more than another abusive monopoly.

Let's take one final step back. I said earlier that a government is the one entity that can compel you to obey certain rules without any agreement on your part. Enter Hobbes (a very different and much more famous man than our titular Hobson). His most enduring idea is that government is a social contract:

I authorise and give up my right of governing myself to this man, or to this assembly of men, on this condition; that thou give up, thy right to him, and authorise all his actions in like manner.

Thomas Hobbes, Leviathan
We give up some of our rights, like the right to beat other people over the head with big sticks, for the goal of living peacefully and prosperously, safe from the constant danger of being beaten over the head with a big stick. Being governed is a voluntary act (let's ignore Hobbes' autocratic leanings for the sake of simplicity), undertaken because it's to our long-term benefit.

Of course, few of us actively take part in any kind of contractual ceremony agreeing to these terms. We fall under the government's jurisdiction by the circumstance of being born where we were born, living where we live. In fact, land ownership is the source of a government's authority. You may decide to "opt out" of the laws of a country, but you should not remain on that country's land and expect to escape punishment. Conversely, if you leave a country's land, you are no longer subject to their laws. Extradition feels like an exception to this rule, but it's merely an agreement between countries. Extradition does not work when the host country refuses to play along.

So! The government controls access to a desirable resource (land). This allows them to require adherence to a stringent set of rules from anyone wishing to gain access. Even if the rules seem unfair, a choice between that or nothing at all leads almost everyone to obey. Hopefully by this point you're drawing your own parallels. That's right, I see governments as nothing more or less than the biggest corporation around, one whose services we all consume. We pay a subscription fee. We reap tangible benefits. All the elements of a contractual agreement are there.

And yet, there's one thing the government offers us that no consumer relationships do: the ability to negotiate. The system is horribly inefficient, riddled with bureaucracy, and easily derailed. But in the end, we the people do get a say in the rules that are applied to us. More importantly, we see the idea of a government that answers to the people as obvious and absolutely necessary. So why don't we apply this same expectation to corporations? Why do we insist that corporations are accountable only to their shareholders, instead of to the collective public whose lives they so deeply affect?

Looking to the future, I don't think the government will be the one to relieve us of our freedoms. Sure, there will be battles. But the Bill of Rights has survived two centuries more or less intact, and I expect it will keep on truckin'. We won't lose our rights at gunpoint. We'll lose them in bits and pieces, so slowly as to be nearly imperceptible. We'll sign them away one after another in the name of new services or free beer or just following the crowd. Technically, they won't be gone, but a right that we are not free to exercise in the most frequented arenas of public discourse isn't much of a right at all.

Epilogue

My slow blogging habits caught up to me once again. I hadn't even started putting this post into words before the furor over the TSA scanners had been totally eclipsed by the Wikileaks controversy. It's a complex affair, and I could write an incredible volume on the details of the various events surrounding Cablegate, but I think I'll leave that to others, and draw two small connections instead.

The intentions of the government towards Wikileaks, as far as we can divine them, are rather serious, and in some ways conflict with what I just said. The organization, of which our government was at least tolerant — perhaps even fond — when it was dishing out leaks from third worlds and no particular friends of ours, has become a thorn in the side of some very powerful interests. The Obama administration seems intent on finding a way to declare Wikileaks' actions illegal, though there seems to be no law that fits. There's no attack on Wikileaks as a whole that isn't a dangerous attack on free speech, and it's being perpetuated by our own government. If this comes to pass, it will be one of the battles I predicted, perhaps a very important one.

In other ways, however, the assault on Wikileaks has made plain for the first time how much power corporations wield over our speech. The threatened legal action has not materialized, and may never come to pass if those in power can't find a good story to tell about why silencing Wikileaks is no cause for concern. In the meantime, however, direct and damaging action has been flowing in from the private sector. In the space of a few days, Wikileaks experienced cutoffs by hosting services, domain name services, and at least four financial services. All of these cited vague "terms of service violations", but there's little reason to doubt that these shutdowns were incited and choreographed by political interests. As Richard Stallman opines, "It is as if we all lived in rented rooms and landlords could evict anyone at a moment's notice."

It remains to be seen whether the government's feud will be derailed by legal protections we have put in place, but there's reason to be optimistic. In the private sector, though, it's been made clear just how great of a blow can be dealt to our freedoms when they become inconvenient to the powerful. We shouldn't need a "use case" for retaining our basic freedoms. For me, idealist notions about the value of freedom for freedom's sake are enough to compel resistance to these Hobson's choices. But if you're of a more pragmatic mindset, I can't think of a better spectre than government and corporations cooperating to stifle political dissent.

Movies I Hate: Legally Blonde & Pearl Harbor

I've been badly missing my pathetically modest posting target of once a month, so it's time yet again to break out the filler.

I have only one "Top Ten List" on Netflix, and it is titled Movies I Hate. The description reads, "Not just movies I strongly dislike. Movies I wouldn't piss on to put out a fire." Here are two more from that list. Enjoy.

Legally Blonde

0.5 out of 5 stars

96 minutes of my life. 96 minutes which I will never get back. 96 minutes gone forever. That's a debt I won't quickly forget, Robert Luketic. I honestly don't remember most of what happens because I think I slipped into a coma about twenty-five minutes in. Somehow we're supposed to empathize with the protagonist, a total ditz, because she's actually smart and thoughtful on the inside. Ha. Hahahaha. Yeah, good one. Some stuff happens, nobody cares, maybe some more stuff happens, I really don't know. All I know is that I suffered from recurring nosebleeds for two weeks afterward, and I am holding each and every member of the cast and crew personally responsible.

Pearl Harbor

0.5 out of 5 stars

Yeah. One of the most dramatic events of the past century, and we spend an hour watching a pilot hit on his dead buddy's girlfriend. This movie has everything: distortion of historical fact, subtly racist structure, mind-numbing romantic subplot, one-dimensional characters... what's not to like? It's like Top Gun without as much entertaining homoeroticism. It's like Titanic without a guy falling onto a giant propeller. It's like flicking the back of your leg in the same spot for two hours straight. Not incredibly painful, but don't you have something better to do with your time?

Avatar and Fetishizing The Other

Fair warning: This post may contain spoilers. However, I also feel I must point out that the foreshadowing in Avatar is so clumsy that the first half of the movie contains spoilers for the second half. So really, how much damage am I going to do?

So, James Cameron spends a decade working on his opus, and here it is. Truth and beauty in dazzling 3D, right? Wrong. I think this film is rubbish. Worse, I think this film is insidious rubbish that is a pro-establishment screed dressed in sheep's clothing of weak Iraq war metaphor. I think that continued success of rubbish like this adversely affects any hope of achieving a truly tolerant and egalitarian society.

It has already been pointed out that Avatar is another take on the classic white guilt fantasy. But the sci-fi setting gives it a weird undercurrent that I find more even more unsettling. By setting his non-whites as aliens, Cameron accidentally distills all the assumptions Hollywood makes about race, and then forces them into the cold light of day by pursuing an interspecies romance.

The Na'vi are a mish-mash of characteristics from just about every well-known "primitive" culture - feathers like Native Americans, Maori skin markings, African accessorizing (all African people are one big homogeneous tribe, if you didn't know), the hunting habits of Amazon tribes, and so on. This provides the framework for a bland allegory about evil white people - it's like indigenous peoples Malt-O-Meal. In the creation of this hunter-gatherer everyman, Cameron has provided a glimpse into the machinations of ignorant white men's minds.

Neytiri's introduction is as a howling dervish who shoots arrows mid-leap. She embodies the exotic, the mysterious, the untamed. When perturbed, she hisses like a feline (displaying her sharp, animal-like teeth). She views animals as kindred spirits. And see, what makes this a problem is that us white people have this really obnoxious habit of dressing dark-skinned models in animal prints and posing them with animals. We like to portray them as exotic, mysterious, and untamed. When we control the image, they are the Other.




Let's talk about Otherness. The idea started with Hegel, who said that consciousness cannot become self-conscious until it meets another consciousness and learns to define itself as separate from that other. Since then this idea has cropped up time and time again, because it seems to accurately describe a component of our psychology; humans have a tendency to define ourselves in opposition to other humans. Nationalism, racism, sports fans; we love to forge our identities by labeling Them and Us. It's not enough to have just an Us - if we find ourselves in a situation where there is no Them, we will quickly manufacture one.

Now, usually we take the straightforward route and just vilify the Other. Simply bicker over the prophet's cousin, or riot over those immigrants daring to live in "your" country, and get to fighting. But there's another method of oppression at which Americans in particular are becoming very adept. You declare your tolerance for the Other and talk about how much you like Others and how you have all sorts of Other friends. Meanwhile, you continue to marginalize the Other, but you make it subtle. You appropriate bits of their culture, but be sure place them in a one-dimensional box that leaves no room for growth. You pay lip service to equality but don't make any sacrifices of your own. In this way the Other can find no adversary to combat, and you can convince yourself that their failure to better themselves is due to some innate cultural deficiency. This is how we end up with black models dressed in leopard print.

What Cameron has created is the authoritative example of being ignorant and white. Not only is the appearance of the Na'vi built out of superficial elements of human ethnicities, but their entire culture is a slurry of half-baked ideas, the kind an ignorant white guy gets from paging through a National Geographic without bothering to read the articles (they are kinda long, after all). He's actually come up with some ludicrous explanation about neurons in plant matter to take the idea that "native peoples are really in touch with nature" to an extreme that has them literally talking to their ancestors through the trees or something.

There's neotribalism, and then there's this. This is not just yearning for simpler times or showing appreciation for low-impact lifestyles. This is fetishizing the Other. The Na'vi as a people are presented as strange, unknowable, yet utterly desirable. And creepily, Jake Sully plays out in concrete terms the fantasy that Cameron is playing out in the abstract. Sully is so enchanted by the Na'vi that he seeks to know, to possess, to dominate, and he consummates this quest by exerting his mastery over the natural world, hijacking control of the tribe, and having alien sex with Neytiri. And he is the protagonist because this is how ignorant white men understand desire.

We've been analyzing the movie in terms of the racial Other, but in fact the most famous application of Hegel was by Simone de Beauvoir, who applied the concept of the Other in The Second Sex, her book on the status of women:

Thus humanity is male and man defines woman not in herself but as relative to him; she is not regarded as an autonomous being... She is defined and differentiated with reference to man and not he with reference to her; she is the incidental, the inessential as opposed to the essential. He is the Subject, he is the Absolute – she is the Other.

-- Simone de Beauvoir, The Second Sex

I'd like to argue that the Na'vi are not only racial Others, but collectively they represent the sexual Other, Beauvoir's female.

It's no accident that Neytiri is the only prominent Na'vi in the film. Sure, Tsu'tey is the chief warrior, but he is practically eating out of Sully's hand by the end of the film, despite having spent the entire movie being cuckolded by Sully. He is the weak, ineffectual man next to Sully's raging pillar of testosterone. Neytiri is the only character to display any depth at all, and she is the only one who sees a considerable amount of screentime.

The support of life became for man an activity and a project through the invention of the tool; but in maternity woman remained closely bound to her body, like an animal.

-- Simone de Beauvoir, The Second Sex

Neytiri is fierce and capable, yet she displays no volition of her own. There are some weak attempts at connecting her to her land and her people, but she seems to have no personal desires, no ambition or selfishness. She spends the film at the mercy of events around her, captive to her emotions. Her involvement with Sully only further strips her of will - by the climax, she is a Harley babe riding bitch on the gigantic symbol of virility, Toruk, clutched between Sully's manly thighs (but it's okay, she's helping the war effort by cheering).

Sully definitely has the largest... dragon.

Oh sure, she turns Colonel Quaritch into a pincushion at the end. But to what end is his death? The battle is already over; the Na'vi have clearly won. So even the vague desires that Neytiri has expressed for herself - preserving her land and people - are not at stake. The only threat Quaritch poses is to Sully, who he is happily trying to murder. Her sole motivation for killing Quaritch is to save her man, and in fact, this display of devotion is the only real thing Neytiri accomplishes all film. She has cemented her own subjugation.

Now, I'm not saying Cameron tried to make a movie that was obliquely racist and anti-feminist. But he did, and he is as guilty as anyone. His crime is intellectual indolence; using superficial fairy tales instead of seeking any true understanding. Our crime is that we keep throwing money at bullshit like this instead of exploring anything that we might find difficult or uncomfortable. A movie that grosses $77 million in the first weekend is part of our culture, whether we like it or not. And if we can't even stop producing this shit, how are we ever going to flush it out of our system? Why ask ourselves tough questions about equality in this country when we can indulge our white male guilt with useless tripe? It's useless tripe, but in 3D!





Bonus: Now that I've spoiled this movie, allow me to spoil the plot of Avatar 2 as well. The humans come back. This time they just drop the bombs from space. All the Na'vi die. The humans congratulate each other and wonder why they didn't think of that sooner. The End.

Worse than Nothing

Want to get phished? Don't worry, it won't hurt.

If you have an account with Vanguard, the investment firm, you can experience it for yourself right here (works on IE7, IE8, or FF3). If not, you can watch a quick screencast of me phishing myself. Note that this is clearly not the Vanguard site, and yet after I enter my username, I'm shown my personal image (mine's a canoe! what's yours?). I didn't answer any security questions, and yet that's my personal image that only my bank and I are supposed to know. And here it is on some scammer's site. That's the unique part of my attack, and the most dangerous.

By the way, that screen at the end is where the scammer has just obtained your password and is happily emptying your bank account (since I'm nice, I just display a hash and don't save it).

I don't mean to pick on Vanguard, I just happened to have an account with them. A similar attack should be quite possible on Bank of America, HSA Bank, or anyone else who uses the SiteKey system. SiteKey is a scheme banks came up with in response to the large and largely-intractable problem posed by phishing. It's sometimes labeled as a "multi-factor authentication" system, but I think that's incorrect - it's more of a "mutual authentication" system. The site proves that they are legitimate by showing you a picture that you selected when you sign up. Since no one else could know what picture you have set, this proves that the site is who you think it is. At least, that's the theory.

My attack is simple. The first page is just a static page that looks exactly like Vanguard's home page - standard phishing fare. When you submit the form with your username, I build a page with an iframe pointing to the Vanguard site, passing it the username. As long as you've logged in from this computer before, the Vanguard site happily shows your personal image. Then I create a form outside of the iframe with a password field and a submit button, and float those elements over the iframe. So while you're seeing the Vanguard site in the background, you're entering your password into a form I control, and the submit button you click submits to my page. And just like that, I have your password.

I have your password. I did this with a freakin' Bachelor of Arts degree. It took me about three hours of messing around to get the basics set up, and another few hours to spit and polish. It's a couple of dumb HTML pages with a few snippets of PHP, and a pinch of Javascript thrown in. There is nothing sophisticated here. I don't think this even qualifies as a "hack." I think you should be concerned. This attack has been possible as long as SiteKey has been in existence, and I see no reason why I would be the only person to think this up. In all likelihood, some smart phisher out there is already doing this.

I learned retroactively that this technique is called UI Redressing, more commonly referred to as Clickjacking. It's behind a number of attacks, of which perhaps the most publicly visible (although not the most dangerous) was the Twitter "Don't Click" infection. Even worse, since my attack requires no clicking on the actual hidden elements, even NoScript's vaunted ClearClick technology doesn't detect it (NoScript does offer an opt-in to disable iframe content, which sounds like it should stop the attack, but it didn't work for me).

SiteKey was weak to begin with. It's bad enough that a vast majority of site users don't notice if the image is missing. And a weaker man-in-the-middle attack that involved asking security questions was demonstrated 3 years ago[pdf]. But this is worse. A malicious site that shows you your own handpicked image will lull you into a false sense of security. Who would think twice about providing personal information when that mountain stream or étouffée or whatever you picked is staring you right in the face? The banks have worked hard to train users to look for that image, and that very training can be turned against them to make phishing attacks even more successful than before. SiteKey is not just useless - it's worse than nothing at all.

I have been in contact with RSA Security, the vendors of SiteKey, about this attack. To their credit, they were very professional about the whole thing. They treated the matter seriously (I was surprised to get a response at all), and did not try to bullshit or bully me. So they get points for understanding how to make the vulnerability reporting process a productive one. They told me they have notified their clients about the problem and suggested corrective action. I imagine this action will consist of frame-busting Javascript and a proprietary IE8 header. I can only speculate because as of this posting, neither Vanguard nor HSA Bank have done anything to prevent the attack, even though it has been two months since I reported it. These changes will help, but the headers are opt-in and only work on newer browsers, and the Javascript isn't necessarily immune to circumvention. Besides, recall what I said about my qualifications as a security researcher. If I came up with this in a few hours of spare time, don't try to tell me there aren't similar attacks that could be discovered by a motivated person - say, someone who makes a living managing a phishing operation.

There's another reason I think SiteKey is worse than nothing. It's not just users who get a false sense of security from it - banks are biting on these supposed panaceas instead of facing up to the very difficult problem of performing real security. It's all too easy for companies to set arcane password rules and shell out money for "solutions" like SiteKey, and convince themselves that they've tried hard enough. Wrong. SiteKey is like a Mickey Mouse band aid on the wrong knee. Maybe it gets the three year old to stop crying, but it's not actually doing any good.

Epilogue

I know, I know, I'm such a negative person. Always bringing other people down. Complaining about what exists without offering any suggestions of my own. What would I propose to guard against phishing? Huh, tough guy?

I have to be honest - I don't see a silver bullet. Phishing is a serious threat, and one that preys on our inescapably human failings - inattention, belief that our perceptions are accurate, and willingness to adapt our actions to what we are presented with. I don't see it going anywhere any time soon. However, I think the Firefox address bar is a great start:

If we have to train users to look for something, it should be this. Benefits:

• It's client-side. No man-in-the-middle. No UI redressing. Short of a serious Firefox exploit or SSL vulnerability, there's no faking this part of the address bar.
• It comes (I assume) from the SSL certificate, which is a pretty okay security measure, and one that any respectable site dealing with sensitive information already uses.
• It's friendly and distinctive - it's big and green and it tells you the name of the company.
• It's right next to the address bar, which encourages one to also check the URL. This is the original best security measure, and one that eBay and others have been advocating for years. I should point out that the pretty little Locationbar² plugin is helping here as well by highlighting the domain name so it stands out against the rest of the URL.

Still, this only works if you think to look. The danger of phishing is that you get caught at the end of a long day, or when you're in a hurry, or when fucking PayPal actually has deactivated your account three times in the past and you're so annoyed by the prospect of a fourth that you get careless and don't check.

I've got another suggestion, but this one is a lot further from reality. This is what I think could be, if we would spend less time on fake security and more time on real security.

Imagine, if you will, a world where PGP is commonplace. That's right, I'm evangelizing again. Imagine every email you receive is signed, and you have an extensive trust network. When you open an account at a new bank, the rep hands you a piece of paper with instructions on downloading the bank's public key and a fingerprint to verify it. Because PGP is so common, your email client actually throws up a big red warning saying "Hey! This signature is untrusted!" whenever you get email from someone whose key you haven't imported. Suddenly you have a proactive warning on every phishing email that comes through. Nobody is going to click through a message from their bank that is labeled as "untrusted." You could teach your grandparents that.

Is this a pipe dream? For now, yeah. But it's a good one - it's a world where email phishing is essentially solved.

Until then, keep checking your address bar.

Update (12/03/09): Looks like at some point in the past few months, Vanguard updated their site with some frame-busting Javascript, and now hides the pages if Javascript is disabled (bad news for accessibility, but arguably more secure). However, let me reiterate: the fact that they have stuck their finger in this leak doesn't mean there aren't other holes in the dike.

Another update: I sent this article to Jim Youll, the author of the original paper on SiteKey vulnerabilities. He emailed me back, and in his response was a remark that stuck with me: "they always say that the undisclosed back-end systems are the fail-safe for the front-end attacks. I don't think they're lying." At some point, it hit me: what if SiteKey is nothing more than security theater? Maybe they do know that it's useless. Maybe they don't expect it to stop anything. Maybe whatever fee they're shelling out isn't coming from the security budget, but from the marketing budget. If this is the case, I just hope the marketing spiel isn't working on the people who need to be doing the real security.

Movies I Hate: I, Robot and S.W.A.T

I have only one "Top Ten List" on Netflix, and it is titled Movies I Hate. The description reads, "Not just movies I strongly dislike. Movies I wouldn't piss on to put out a fire." Here are two more from that list. Enjoy.

S.W.A.T.

0.5 out of 5 stars

I'm actually not entirely sure I've seen this movie. It's hard to tell if I was somehow strapped down and forced to watch it, or if I just ate a bad chicken salad sandwich, went catatonic for a couple hours, and woke up to a preview showing on TV. I'm pretty sure the two experiences are comparable, right down to the taste of expired chicken left in my mouth by the end. All that I can come up with is vague recollections of explosions, shooting, and guns. I assume there were some protagonists and antagonists involved, but they were so forgettable the movie would likely have gone up in quality without them. Sometimes I worry that it's not normal to be missing such a large chunk of time from my memory like this. But mostly I just worry that I actually got tricked into watching this movie. Given the choice, I think I'd take food poisoning.

I, Robot

0.5 out of 5 stars

Well, here it is. The stinkiest stinker. The crappiest crapfest. The travesty of all travesties. If movies were animals, this would be the tapeworm. How not to make a successful movie: First, take the work of a greatly respected science fiction author. Next, spew vomit all over it. Now, feed that mess to your dog and hire some two-bit hack to make up a script that is, in fact, a disgrace not only to Isaac Asimov's collection of short stories, but to all writers everywhere. Finally, to add insult to injury, plaster blatant product placement everywhere, just to make clear exactly how little you respect the moviegoers who have made the unfortunate mistake of wandering into your film. And there you have it! I, Robot. If there is a convincing argument for why humanity will not survive another millenium, this is it. And that's not because we will design killer robots that will turn on us, it's because a society that actually condones sewage like this is in moral decline. Heck, the robots would be doing us a favor. Look for an exciting matchup sometime later this year, as I, Robot's right to the title of "worst movie ever" is challenged by a newcomer, I Am Legend, also starring who else but Will Smith.

Radio Sucks

Radio programming is just that!

-- Saul Williams, "Penny for a Thought"

Radio sucks! The same fucking songs over and over again! All the weak ones, all that disposable crap that isn't gonna matter in 3 months, it's just shit!

-- Matt Pinfield, Significant Other hidden track

Turn on the radio, nah, fuck it, turn it off!

-- Rage Against the Machine, "Vietnow"

When I posted my analysis of The Current's playlist a while back, I mused about how it might stack up against a station run by the mainstream corporate borg that is ClearChannel. The problem is that no other stations make their full playlists publicly available, so I had no data to work from. Most of them offer the 10 most recent songs played, and that's it.

I dropped the idea for a while, but when I got myself a cheapo hosting plan, suddenly I had an always-on box that could, say, run a cron every ten minutes, perhaps a cron that scraped some radio sites for their recent songs. And even better, since every ClearChannel subsidiary uses the same template, I only had to build one scraper and I could collect data on half the music stations in the Twin Cities. Score! A little later, I discovered Yes.com, a cool service that even provides an API, and worked out a way to scrape the other major stations in Minneapolis.

The code is available here. The data you see below is the averages for the period of 3/22/09-5/22/09. If you'd like more discussion of my analysis techniques, check out my original post. Don't worry, this post will not contain any sad kitten pictures. Without further ado, the results:

I went into this expecting KDWB (Today's Best Music) to suck, and they did not disappoint. They come out swinging with an absolutely abysmal level of uniqueness per week - which only gets worse when we measure over a month. However, they're facing some heavy competition from KS95 (Variety...80's, 90's and Today!). Those people seem to be rather confused about what constitutes "variety." Apparently the 80s, 90s, and today just didn't have that much to offer.

Most of the other stations muddle along between 0.2 and 0.3 - not as bad as they could be, but if you've spent any significant amount of time listening to Cities 97, you'll know that's still bad enough to drive a person to murder.

There are a couple notable standouts at the week level - KQRS and Love 105 (the latest owners of what was once Rev105's signal) do respectably. And Jack FM, who brags constantly that they are Playing what we want!, actually beats the Current for uniqueness at the week level. All these stations suffer significantly in the month-long measurements. To me, it looks like these stations have fairly large playlists, but simply rotate the same playlist over and over again. This isn't entirely a bad trait, especially for KQRS (Minnesota's Classic Rock), who doesn't have a growing field to work with.

Still, this demonstrates to me the importance of not only playing good songs, but playing different songs. Sure, it's fun to sing along with "Dirty Deeds" once and a while. But we've been singing along with it for decades now. And yeah, it's quirky when JackFM plays The Bangles right after Linkin Park, but it's a quirkyness that's manufactured by CBS Radio and shipped out to countless identically-named stations nationwide, and I don't think I'm the only one who starts to notice the cracks in the veneer after a while. So, hooray for The Current! Hooray for quirkyness that's actually just Mary Lucia being wacky and saying whatever goes through her head. Yes, Mary, I was listening that one day when you suggested that Mark Wheat take up cocaine.

Interesting. You'll notice The Current is definitely not ahead in this race. Jack FM, KQRS, and Love 105 again all put up very impressive numbers, and KOOL 108 isn't bad either. It makes a fair amount of sense - these are the stations that are drawing from several decades of music and shying away from new releases. So they're not under pressure to spin the latest single that some manufactured star just released. Good for them.

The Current, of course, is still a long, long way from the real offenders here. KS95 again manages to compress three decades of music into playing one song almost 50 times per week. And B96 pulls out a surprise win over KDWB here, playing the top song for a given week roughly 85 times in that week. I just threw up a little in my mouth.

Radio sucks, people. It sucks, sucks, sucks. Some stations suck more than others, but I can't lionize anyone here. The best we can ask for in playlist variety, it seems, is mediocrity. Listen to WLTE, who's completely unremarkable in every degree. Or, listen to Rage. Turn it off. There is no guerilla radio. The war was lost to the strains of Howie Day's simpering falsetto.

Epilogue

I've got one last graph for you all because, well, I still have an agenda. Here's the uniqueness graph again, but with one new data point: values from The Current for the same two-month period in 2006 as opposed to 2009.

This is what I had hoped to see in the earlier charts. It's completely dwarfing the other stations. The scale is all off. It's not even worth debating how one conglomerate scores compared to the others, because The Current is embarrassing all of them. That's what it looks like when one station is single-handedly saving radio. That's where I want us to be.

Movies I Hate: War of the Worlds & Gone in 60 Seconds

Hooray, filler! I only have one "Top Ten List" on Netflix, and it is titled Movies I Hate. Here are two of the members of that list. Enjoy.

War of the Worlds

0.5 out of 5 stars

Never before have I sat in a movie theater and actually wished that a scene would turn out to all just be a dream. But as I sat through the transcendentally bad denouement of this movie, I realized that if Tom Cruise woke up, and it was just a dream, and he was really dying of pneumonia, I would forgive everything this movie had put me through. I would forgive the fact that our so-called protagonist is a lousy father and totally unsympathetic character. I would forgive the fact that tanks and helicopters can't take down a Strider, but apparently Tom Cruise with a couple grenades can. I would forgive the fact that each time Dakota Fanning screamed, I involuntarily squirted a little bit of urine into my pants from the horror.

It was not to be, and unless I blacked out momentarily from the sheer idiocy, the scene was not, in fact, a dream. If I end up an alcoholic five years from now, this movie is at least a little bit to blame.

Gone In 60 Seconds

0.5 out of 5 stars

What is the one reason we tolerate all the horrible plots, awful dialogue, and wooden acting in movies revolving around cars? Why, it's because we get to watch cars run into each other! So if you're going to make one of these movies, which element should you NOT remove? I'm no expert, but I would go with 'cars running into each other.'

To this day I am at a loss for why anyone thought it was a good idea to give this movie a plot stipulating that none of the sexy cars the characters drive can be smashed to smithereens. That was all it had going for it. Instead all we get to see is some police cars hitting scenery, and everyone one of those is followed immediately with a shot of the bumbling policeman appearing from the wreckage unscathed. Because, y'know, if someone got hurt, Nick Cage might be morally responsible (gasp), and how could we root for a washed-up felon then?

This movie also subjected me to the worst scene involving dirty talk and car parts I have ever witnessed. Really just one of the worst scenes of any type. It's been about five years, and I'm still angry.