Passdoodle

This video from Mozilla on UI concepts for a mobile Firefox made me think of the possibilities of using a touch screen for authentication.

Given iPhone and derivatives, I was expecting this might be a hot area of research, but a search of 'touch screen authentication' found only an MIT 2004 project called 'distinctive touch'.

The project surrounded building a system called distinctive touch for enabling lightweight authentication using gestures on touchscreen displays. Using this system, users were identified by their passdoodle, a gestural equivalent of a username and password, which consisted of one or more strokes that they drew on the screen with their finger within a short duration of time.

I'd venture that an 'easily memorable' touch screen gesture would manifest as 'obscene'. Or a puppy's face.

In addition to authenticating through gestures, you could use them to perform other identity operations.

LOA Song

To the tune of the Rolling Stones 'You Can't Always Get What You Want'

You can't always get what you want
You can't always get what you want
You can't always get what you want
But if you try sometimes you might find
You get what you need

Continentism

By some arbitrary (and clearly non-Pangeaic) ruling, Canada has been deemed to be 'not part of Europe', and so excluded from participating in Euro 2008. An obvious strategy to eliminate a sure tournament favourite.

Alas, Denmark has no such excuse.

Game On

My ex-Entrust colleague Ranjeet Vidwans is blogging. Ranjeet terrified me when we went to conferences together because his idea of a night out has it starting when my idea of the same has it ending.

Looking at his early posts (I assume he is still experimenting somewhat because of their haphazard & confused nature), it appears Ranjeet is trying to merge wry musings about family life, the world of security & identity, sardonic stories of business travel, and pointless graphics.

An interesting mix I guess, if you like that sort of thing.

I may not live in New York, I don't drink martinis, and I may have performed poorly on tests he excelled at, but no one, I repeat no one, is going to out sarcasm me.

Bring it my sharp-dressed friend.

p.s. Jeez, could you not leave me physics? Is that too much to ask?

Phishing Hole

You can get an 'anonymous' OpenID at http://www.jkg.in/openid (is it a coincidence that the URL almost spells out 'joking'?)

When you use such an OpenID at an RP, after providing the URI, you'll see only a flicker of web redirection before arriving back at the RP. No explicit authentication step, no consent step, no hassle.

Were this OP to fill in the PAPE blanks, which of the pre-canned policy identifiers should it use?

The PAPE definition for 'phishing resistant' is

An authentication mechanism where the End User does not provide a shared secret to a party potentially under the control of the Relying Party.

I assert/claim that as there is no shared secret, the End User surely can't provide it to a phisher, and so the above OP can claim 'phishing resistant'.

Authentication tain't authorization

The DIDW conference uses LinkedIn for a 'who else is attending' mechanism.


When taken to LinkedIn, I get this


Instead of asking me to authenticate, and then grant DIDW the desired permissions for my network, LinkedIn saves me precious time by conflating the two operations.

I saved even more time by choosing to not participate.

Gloved or non-gloved?

I confess that we did not anticipate the need to describe an authentication event in which the user made no claim to a particular identity.

the right to travel without showing ID--providing that passengers are willing to be subject to a pat down and a bit of probing:

The SAML TC would be remiss if we did not define a new 'probing' class post-haste.

I expect that it will be in dealing with the many and subtle variations of probing that we will face our challenges.

For instance, should 'orifice' be an element or an attribute?

What of lubing?

And should we constrain the location of the probing to a pre-defined list of 'probeable' cavities?

Or should we give the authorities the ability to determine just what cavities are probeable and what aren't - this by leaving the schema open?.

I think I speak for the members of the TC when I say that we would make no claims to authority on this topic, and we definitely wouldn't want to artificially constrain the inventiveness of customs & security officers around the world.

Get a room why don't you

Andre engages in some self-love (of a sort).

Hey Mr CEO, some free advice. When a customer says

we’re interested in a more strategic, long-term alignment with you, not just a customer and vendor relationship.

the translation is "we want a cut on price".

Historical Precedent

for the '10 OPs to every RP' phenemenon

Our Celestial Empire possesses all things in prolific abundance and lacks no product within its own borders. There was therefore no need to import the manufactures of outside barbarians in exchange for our own produce. But as the tea, silk and porcelain which the Celestial Empire produces, are absolute necessities to European nations and to yourselves, we have permitted, as a signal mark of favour, that foreign hongs should be established at Canton, so that you wants might be supplied and your country thus participate in our beneficence.
- Emperor Qian Long's letter to King George III, 1793

Superficial difference

1) humans are 99.9% genetically the same
2) the small differences in the genome that do exist determine the interface between the individual and the environment, eg. skin colour, body shape, eye folds, disease resistance, etc
3) while the body's APIs may have adjusted to different environmental forces, the underlying processes and systems are the same

Good taste prevents me from drawing an analogy between the ability of different human communities to interbreed and attempts to reconcile the interface incompatibilities of identity systems.

NSFW (Not Secure for Work)

As yet, I have nothing to follow up the title with, I just wanted to guarantee myself primacy of the meme.

Some ideas do spring to mind.

Brigham Young's Online Calendar

Purpose & Forwarding Policy

From BoingBoing

Notwithstanding that this is a bad privacy policy, it is indeed a privacy policy, and is exactly the sort of information that the Liberty Alliance's Privacy Constraints are designed to express.

A NEW paradigm

prompted by Axel, I installed the Operator Firefox extension, and I have to say I am blown away by the power of micro-formats and the Semantic Web.

The idea is (and it may take a while for you to grasp this because it is a NEW PARADIGM) that the contents of a page are 'marked up' with 'tags' that describe the data they contain.

I'll give you a bit to digest this.
.
.
.
Then, and this is the incredible NEW PARADIGM part, the browser, based on those tags, renders the information for you to read! Yes, you heard me, you can actually VIEW the contents of the tagged up data in your browser!

What's more, you can export the tagged up data from the browser, or even have the browser remember it!

I may be stretching what is possible, but I can even imagine people putting online whole books, classifieds, perhaps even advertisements. The mind boggles at the possibilities.

Reduce, reuse and recycle

Axel's bias peaks out

Axel would have us believe that we need steel toes for serious phish-kicking action at all times.



Secure yes, but hot in the summer.

XRI? Alas we hardly knew you.

Is there a comparable program to this for recycling standards? Our landfills are filling up fast.

Connectid recommends against XKMS

If the W3C's stated criteria for judging the relevance of XRIs were converted into a general principle of

We are not satisfied that X provide functionality not readily available from Y

I wonder how some W3C specifications would fare?

Work/home

If I need to tell you, well then shame on you.

First Contact

Do not even think of it, I have already sent out the invites to these social network virgins.

The black and red dyes covering their bodies are made from crushed seeds and are believed to signal aggression, native-rights experts say.

Ah yes, they furiously painted themselves up when they heard the drone of the engines.

I look forward to acting as their guide to the subtleties of Web 2.0.

I do anticipate some trouble justifying Twitter.

So, you mean, people actually care ...

Some things are universal.

Microcosm

I have 4 laptops and 2 desktops in the house.


(Linux EEE PC not shown)

A not insignificant amount of my time is spent moving stuff (e.g. movies, pics, songs, address books, docs, erotica, etc) from one machine to the other.

Forget the Web, I need a metasystem at home.

I'll Have To Say I Love You In A Song

or it seems Jeff does at least.