Bob Kerns: Thinking

The Computer History Pantheon

[This is a post I made to Livescribe's forum on 2008-06-01. Livescribe is no more; the closest equivalent are some tablet apps.]

I was listening to the start of Jim Marggraff's podcast this evening, and he made mention of Vannevar Bush's Memex idea.

It occurred to me that probably most people don't really know the origins of the ideas behind all this fancy hyperlinked multimedia technology we're coming to take for granted these days. And this site needs a link...

Vannevar Bush was an MIT professor, Vice President and Dean of Engineering from 1932-1938. His idea originated during this period, but was put on hold during the war period, while he (among other things) ran the Manhatten Project and advised Presidents Roosevelt and Truman.

But after the war, he dusted off the idea, and published it as an article in the Atlantic Monthly. This single article, in July of 1945, over 9 years before I was even born -- this ancient article, is the true root of all our modern idea of Internet, and of the World Wide Web.

A number of years ago, Atlantic Monthly put this article up. If I recall correctly, they continued to make it free even while they experimented with paid web access.

The article is entitled As We May Think. I highly recommend anyone who has not read it before, and is interested in the direction and possibilities take a little time out to read this article. It is written from the perspective of microfilm technology, which younger readers won't even have heard of, and yet it anticipates technologies that weren't developed for another 50 years, and which still have not been applied to the extent outlined in this article.

I know of no visionary article, on any topic, at any time, which has had the impact, the long-lived influence, and the amazing degree of fidelity into the future as this article.

It has inspired all of the major players in the evolution of what we do with computers: Douglas Englebart (inventor of the mouse and much more), Ted Nelson, who, in his 1974 book, Computer Lib/Dream Machines, coined the term "hypertext". This book tried to be a prototype of what it advocated -- extremely non-linear in form, leading you on a journey from point to point throughout the book. I sure wish I still had my copy....

And let's not forget J. C. R. Licklider, whose 1963 memo, Memorandum For Members and Affiliates of the Intergalactic Computer Network led directly (and quickly) to the creation of the Internet. Nine years later, when I came to MIT and Project Mac, the lab he founded and later directed at MIT, the internet (then called ARPAnet) was already up, running, and developing its own culture.

There are two projects which, combined, start to come close to what Vannevar Bush envisioned 70 years ago.

The first is Wikipedia itself. (There is a reason I chose Wikipedia articles for my earlier links!).

The second is Gorden Bell, best known for being VP in charge of Engineering at Digital Equipment Corporation (DEC). He is now capturing his entire life digitally, in the MyLifeBits Project.

Against this historical backdrop and vision of capturing, integrating and communicating our daily human experience, the pen stands out as a holdout, the last important mode of human communication to integrate.

I myself, have shunned the pen in preference to the computer for these 36 years, precisely because of this lack of integration.

This is why it is so interesting, and exciting, for me personally, to see Livescribe focus on a platform for re-integrating the pen. It's not about capturing handwriting. It's not about capturing audio.

It's all about the integration. Pen with audio with location with events with phone with network with ideas captured with ideas borrowed with ideas shared.

Vannevar Bush's vision was constrained by the technologies he had at hand -- largely mechanical and photograhic. Yet look how far he saw.

When you look at what the Pulse Smartpen can do today, don't look at it as being about capturing writing done in the old way. Try to look ahead at what writing could become for you, once integrated with the rest of your Life Bits. How would you use writing differently?

You, too, can be a pioneer.

In this historical canvas, Lifescribe is just a small yet-unpainted corner. But I'd argue it is important (if it succeeds) precisely because they occupy that last unpainted section, that last unmet need.

That last blank space, where will be writ, by Livescribe and others -- by all of us, the final signature, of the end of the Age of Paper, and the true beginning of the Digital Millennium.

Addendum:

It just occurred to me, I should add one more project to the list that are completing Vannevar Bush's Memex vision:

Brewster Kahle's Internet Archives captures the history of the internet. If you're looking for something that used to be there, then you need only go to the archives, and check the Wayback Machine. If it was there long enough, the Internet Archives will have one or more snapshots of it. It is also other film & video, and audio, text, and other digital artifacts.

No, DDOS Attacks Do Not Steal Facebook Passwords

The idea that a DDOS attack, FB requiring you to log in, and password theft are linked goes around periodically. It's time to lay it to rest. There are a number of misconceptions here, and misunderstanding how passwords can be stolen leaves you more vulnerable, not less.

A typical warning (relayed by people who care!) looks like this:

So let's work through this. First:

What is a DDOS attack, anyway?

A DDOS attack (Distributed Denial of Service attack) is simply an attack on a system (usually a network server) that prevents it from operating correctly, and thus denies the user the intended service.

The "Distributed" part means it's a beefed-up version of a vanilla DOS attack, where the target is attacked over the network from multiple systems at once. The attackers can range from 2 systems to over a half million! The approach is to take some action simultaneously that forces the target to do some work, and thus overload it.

So what does this have to do with my password?

Nothing at all. In the usual case, you, your account, your computer, your network connection, aren't involved at all—other than not being able to communicate with the server, that is.

In the less common case, where your system is the target, the only difference is you won't be able to talk to anyone. If your system is directly connected to the internet (for all that is good and sane in the world, do not do that!), you might not be able to use your system until you disconnect it from the network. But if you are properly connected behind a router, whether at home, or via a cell network, or even (generally) a public WiFi, it will be the router that takes the hit.

So an attack looks like this. Or, at worst, they are attacking your router.

The thing to remember here is—they cannot see you. That blue line, going through your router to the servers? That's encrypted. Even if they have a way to spy on your traffic, they cannot see what that traffic is.

But the claim is, Facebook logs you off in this case!

That's the claim. But it has no connection to reality. What does it mean to be "logged in" to Facebook?

First, let's look at how the web works. The browser makes a series of requests to a server. The server answers them. In the old days, each request was a separate network connection. That was inefficient, and now network connections are managed differently. But unlike, say, Zoom or Skype or a telephone call, a connection is not how you stay logged in.

A DDOS attack may cause you to lose your connection—but that happens anyway, whenever you sit idle.

What does being logged in mean?

Simply put, being logged in is an arrangement between your browser and Facebook, so that Facebook knows the requests are coming from the same session as when you authenticated. Authentication is the process of "logging in", that is, proving to Facebook that you are who you are. You provide your name and password. Facebook combines that password with a number specific to you, and performs a very large number of cryptographic hashes on the combination. It then compares the result with a stored result. (This means—Facebook does not store your password!)

The purpose of the "large number of hashes" part is to make it very slow and expensive to try to guess passwords. The "number specific to you" part is so that if someone stole Facebook's password database, they could not compare your hashed password with anyone else's.

Once your password has been authenticated, Facebook may then require you to enter a second factor, perhaps from a text message.

Once Facebook is satisfied that you are, indeed, you, Facebook gives you a special token. A string of letters and digits long enough to not be guessable, that represents your logged-in status.

As long as your browser has this token, and includes it in every request, and Facebook does not decide to invalidate it, you are logged in.

Facebook probably replaces these tokens frequently, so a token stolen from your hard drive can not be used indefinitely. But we're getting ahead of ourselves.

These tokens are cookies. Cookies are just small pieces of information that a website has asked to be sent back along with requests. They're the glue that allows the web to be more than a collection of linked pages.

But it says Facebook logs me out after a DDOS!

Yes, it says that. It's one of many things wrong with that claim. Why would Facebook log you out after a DDOS? It has nothing at all to do with you! It has nothing to do with your password!

Facebook may log you out if they think that login cookie has been compromised, or is too old, or if you've changed your password on another device. Yes, this logs you out, but a DDOS attack is not one of the reasons.

But how are people stealing accounts?

I don't know, not really. I can only tell you where it's possible and where it's not.

Once your traffic goes out over that blue line, your password is safe. So let's look at the other options.

Maybe Facebook let them!

Wait, what? Well, a couple of things.

• Somebody on the inside changed it for someone.
• Someone went through the "forgot my password" path.

We can ignore the first one. Facebook is very, very careful about this. More careful than you could ever be about your own computer.

But the password reset path—that could be your fault. Is your email compromised?  Could someone have intercepted a password reset email, changed your password, and deleted the email? How would you even know?

If you suspect your account has been stolen (not just that you're logged out, but that your old password no longer works), you should probably change your email password before changing your Facebook password.

Maybe you told someone your password!

Don't ever do that. Not for anyone. I make it a point to not know my wife's passwords, nor my kids'. If nobody but you knows the password, it makes figuring out what happened a lot easier, because it eliminates that entire set of possibilities.

This includes, by the way, writing down your password somewhere that someone might someday discover it. All my thousands of passwords are stored encrypted, not all in one place, not all protected by the same password. They do not appear in plaintext anywhere, especially not on scraps of paper!

Maybe your password was too easy!

Yeah, about that. The rules usually given about "uppercase, lowercase, digit, special character" are bogus—historical baggage that unfortunately lives on, despite updated NIST standards.

There are two things behind a secure password:

1. It is long. The narrower the set of symbols involved, the longer it needs to be, but the key must be long. A long passphrase with some misspelling or unlikely word combinations is good.
2. You can remember it—or how to get it.

The former prevents guessing.

The second removes the temptation for you to write it down somewhere it can be discovered.

No, my password is secure! It has to be something else!

Well...

You didn't reuse your password somewhere else, did you?

Not every site is careful with your password. Some don't do the full hashing I described above. Some do not do it at all and store it as plaintext.

I know this, because sometimes a site will send me an email with my plaintext password! That is beyond irresponsible—it is a danger to the community. A memorable case was the local high school's parent site a few years back.

No, I wouldn't do that!

OK, great. Let's look at what remains!

You—typing your password.

Remember, the original claim was that the DDOS attack was logging you out, to get you to do just that!

Well—now we're coming to a nugget of truth. Let's meet three villains.

Villain #1: Keyloggers

Let's say someone has the ability to watch your every keystroke. Stealing your password just means finding it in your typing stream while you are being monitored. Hold that thought a moment: we're going to look at how that can happen.

• You type on a keyboard. Your keyboard could be compromised.
• You type over USB. Your USB cable could be compromised. Yes, you can buy USB cables that allow just that!
• Your computer has a keylogger installed. Maybe a trojan program you downloaded. Perhaps a browse bug allowed a drive-by installation. Maybe your USB cable installed software when it connected!
• Maybe your browser has a keylogger installed, perhaps by a trojan, or maybe a rogue browser extension...

By far, the most likely case is a trojan.

Villain #2: Cross-site scripting (XSS)

Cross-site scripting refers to various ways scripts on one site can illegitimately cause action or spy on activity on unrelated sites.

Browsers are supposed to block them. Bugs are possible.

If you open a new tab and start up Facebook, no other site has a chance to be involved.  But if you find a link that behaves strangely, taking you back to Facebook, beware. I can't suggest what to look for exactly—usually, it happens behind the scenes, and is exploiting a bug. Just remember, if you're suspicious, you can always start fresh.

Villain #3: Fake Facebook

An attacker may show you a page that looks like Facebook—but isn't. The strategy here is to look like Facebook—except you aren't logged in. Your first login attempt will likely fail—and then they'll send you to the real Facebook. But now they have your password.

Watch your browser bar. Make sure it really says it's Facebook, with the proper lock icon.

If you click a link and it asks you to log in, don't.

So what ties these villains together?

They all are ways to get you to type your password in an environment they control.

The solution is: If Facebook asks you to log in, make sure it is really Facebook, and that nobody human or otherwise is watching over your shoulder.

So that's the nugget of truth here—ploys to get you to reveal your password by typing it are real.

So what about the "change your password" advice?

Well...if they're watching you type your password, they now have your old and new passwords. Maybe the old password is good somewhere else, too?

If you think you need to change your password, you should understand why first, and be sure you're not walking into a trap!

Then, when you've done your malware scan, opened a fresh tab, etc., go ahead and change your password. Definitely change it if you think it has been stolen. Just be careful it's not stolen again.

But what do I do if I get a warning like this?

Is it a link to the support site for the service in question?

If not, delete it. Check the official site for any warnings, and warn others not to forward rumors.

Some, like this one I think, are well-intentioned confusion. Others are deliberate disinformation.

Either way, you don't want to be part of the chain!

Thank you!