Monday, June 29, 2009
What the novels teach you - everything
Wednesday, June 24, 2009
Mummy Mummy I've grown a tummy
Sunday, June 21, 2009
How secret is your secret?
“Whoever wishes to keep a secret must hide the fact that he possesses one.”
Life has become so unreliable and so are the people. The curiosity to illegally peep into others’ possession has grown. I was appalled when I received an sms from a friend of mine who[just relieved from a state of shock] mocked me with a tone of both satire and surprise on seeing a sensual display picture on my orkut profile. The other information on my profile had also been monkeyed and modified to suit the display picture. No sooner did I start cursing the hacker than I realised the fact that my password was untouched. I uttered a great sigh of relief and said to my self ‘Thank God!! for the bad (wo)man had been good enough to leave the password undisturbed.’
But not all are fortuitous enough as I had been because Brian Green's experience with not-so-secret questions began when he logged on to his World of Warcraft account in March of this year and found all of his characters in their underwear. LOL!!! Someone had stolen the account and sold off all of his virtual equipment. He then involved himself in a great amount of research and finally came to a conclusion. "My 'secret question' has an all-too-common answer . . . This wasn't something I considered when I filled it out."
The incident bears similarities to the high-profile case involving Alaska governor and former vice-presidential candidate Sarah Palin. In September 2008, hackers used the name of the location where Palin and her husband met to gain access to her Yahoo e-mail account via the "secret question" password-recovery mechanism.
It has been shown by the researchers from Microsoft and Carnegie Mellon University that the secret questions used to secure the password-reset functions of a variety of websites are woefully insecure. In a study involving 130 people, the researchers found that 28 percent of the people who knew and were trusted by the study's participants could guess the correct answers to the participant's secret questions. Even people not trusted by the participant still had a 17 percent chance of guessing the correct answer to a secret question.
"Secret questions alone are not as secure as we would like our backup authentication to be," says Stuart Schechter, a researcher with software giant Microsoft and one of the authors of the paper. "Nor are they reliable enough that their use alone is sufficient to ensure users can recover their accounts when they forget their passwords."
The least-secure questions are simple ones whose answers can be guessed with no existing knowledge of the subject, the researchers say. For example, the answers to the questions "What is your favorite town?" and "What is your favorite sports team?" were relatively easy for participants to guess. All told, 30 percent and 57 percent of the correct answers, respectively, appeared in the top-five list of guesses.
But answers that require only a little personal knowledge to guess should also be considered unsafe, the researchers warn. Of people that participants would not trust with their password, 45 percent could still answer a question about where they were born, and 40 percent could correctly give their pet's name, the researchers found.
Schechter agreed that researchers will have to find a completely different mechanism for backup authentication--secret questions just don't cut it. "We would eventually like to see these questions go away," he says. "Unfortunately, since we didn't find many questions that were conclusively good, it's hard to recommend simply changing questions."
So what is the way out????????
I might blindly[because the feasibility is a haunting issue] suggest that the desktops and laptops henceforth produced should all be installed with some form of biometric recognition system that can be suitably linked with the networks over the internet so that any site that requires back-up authentication can provide biometric sensing as another option apart from the endangered password authentication. This, according to me is a foolproof mechanism until the attackers/hackers turn out to be as rude as the ones in Angels and Demons.