Question Technology

The Stupidity of Account Security Questions

Josh Levin has an article in Slate on the surge in bizarre security questions companies now ask for when you create accounts online.  It turns out they don't enhance security, but they cut down on customer support calls, which both we and the companies hate.  Some excerpts:

Verizon wants to know my favorite ice cream flavor, Google's got designs on my library card number, and Wachovia needs my favorite all-time entertainer. Yahoo! is asking where I met my spouse, and Bank of America wants the details of the honeymoon. Like those squiggly pictures of letters and numbers, weird personal questions have become ubiquitous totems of online security. If you tell the bank your favorite grade-school teacher or cartoon character, the thinking goes, it'll be easy to confirm your identify when you misplace your account number. This thinking is dumb. [...]

Security questions are often impossible to answer, frequently creepy (does the power company really need to know where you met your spouse?), and rarely secure—Paris Hilton's T-Mobile account was breached by hackers who guessed the answer to her secret question, "What is your favorite pet's name?" If these questions are galling to answer and don't enhance anyone's security, why are they suddenly omnipresent?

[...] just because customers value convenience over security doesn't mean banks should. Instead of coming up with ever-more-ornate questions about teachers and toys, banks and security companies should push solutions that are safe and customer-friendly. While everyone hates calling customer service, confirming your identity on the phone (an out-of-band device) is way more secure than using an online form. RSA's Gaffan told me about a phone-based authentication system used by more than a dozen of the company's clients. At sign-up time, you enter your work, home, and cell numbers. If you lose your password, simply indicate whether you're at home, at work, or on your cell. To authenticate yourself, just answer your phone and type in a number that appears on your computer screen. There's nobody asking about your honeymoon and no stuffed animal names to remember. Sounds perfect to me.

Link: Why are bank security questions so montrously stupid?

Techno Tuesday by Andy Rementer

www.technotuesday.com

Touch Interfaces and Usability

I recently started a new blog related to what I work on in my day job: usability aspects of touch interfaces.  If you have an interest in touch interface research or usability engineering I invite you to check it out: Touch Usability.

Robot Uprising: It Begins With the Dancing

This video features Daniel H. Wilson, author of How to Survive a Robot Uprising, and Keepon the dancing robot from Carnegie Mellon University.

There are high-resolution videos at blip.tv, and more info at CMU RoboU and BeatBots: Keepon.

(via New Scientist Technology Blog)

Walter Kirn on Multitasking

The Atlantic Monthly is now free online, which means you should go read Walter Kirn's November article about multitasking if you haven't already: The Autumn of the Multitaskers.  An excerpt:

It isn’t working, it never has worked, and though we’re still pushing and driving to make it work and puzzled as to why we haven’t stopped yet, which makes us think we may go on forever, the stoppage or slowdown is coming nonetheless, and when it does, we’ll be startled for a moment, and then we’ll acknowledge that, way down deep inside ourselves (a place that we almost forgot even existed), we always knew it couldn’t work.

The scientists know this too, and they think they know why. Through a variety of experiments, many using functional magnetic resonance imaging to measure brain activity, they’ve torn the mask off multitasking and revealed its true face, which is blank and pale and drawn.

Multitasking messes with the brain in several ways. At the most basic level, the mental balancing acts that it requires—the constant switching and pivoting—energize regions of the brain that specialize in visual processing and physical coordination and simultaneously appear to shortchange some of the higher areas related to memory and learning. We concentrate on the act of concentration at the expense of whatever it is that we’re supposed to be concentrating on.

What does this mean in practice? Consider a recent experiment at UCLA, where researchers asked a group of 20-somethings to sort index cards in two trials, once in silence and once while simultaneously listening for specific tones in a series of randomly presented sounds. The subjects’ brains coped with the additional task by shifting responsibility from the hippocampus—which stores and recalls information—to the striatum, which takes care of rote, repetitive activities. Thanks to this switch, the subjects managed to sort the cards just as well with the musical distraction—but they had a much harder time remembering what, exactly, they’d been sorting once the experiment was over.

Even worse, certain studies find that multitasking boosts the level of stress-related hormones such as cortisol and adrenaline and wears down our systems through biochemical friction, prematurely aging us. In the short term, the confusion, fatigue, and chaos merely hamper our ability to focus and analyze, but in the long term, they may cause it to atrophy.

See this NYT article for a story about the Atlantic's new strategy: A Venerable Magazine Energizes Its Web Site.

Techno Tuesday by Andy Rementer

www.technotuesday.com

The Onion Predicts Reading's Future

Shocking news:

GREENWOOD, IN—Sitting in a quiet downtown diner, local hospital administrator Philip Meyer looks as normal and well-adjusted as can be. Yet, there's more to this 27-year-old than first meets the eye: Meyer has recently finished reading a book.

Yes, the whole thing.

"It was great," said the peculiar Indiana native, who, despite owning a television set and having an active social life, read every single page of To Kill a Mockingbird by Harper Lee.

Link: Area Eccentric Reads Entire Book (via Bookninja).

A few weeks ago the San Francisco Chronicle identified Craigslist's founder as "Craig Newmark, who reads 50 books a year" (!!).  It's in a story on Redroom.com, some sort of Web 2.0 thingy for writers: link.   

Nicholas Carr's Big Switch

Lots of folks are reviewing (and liking) Nicholas Carr's new book, The Big Switch.  Tom Slee writes:

The first half of The Big Switch is given over to convincing us that utility computing is the wave of the future, and the second half of the book explores the implications - many of them disturbing - of this switch. The good news is that both are thought-provoking and open up a lot of questions. The less good news is that to cover all this ground Carr has to skim and, at 250 pages, this short book can't delve very deeply into any of the questions.

Link: The Big Switch.

See also Andrew Orlowski in the Register: Nick Carr's Big Switch.

The Politicisation of Science

Sociologist Frank Furedi has an interesting column at Spiked Online about how scientific authority is replacing religious and moral authority.  Link: The tyranny of science (via Arts & Letters Daily).

National Research Council says Cell Phone Health Studies are Needed

From Reuters:

Researchers should study more children and pregnant women in trying to figure out if cell phones or other wireless devices could damage health, the U.S. National Research Council advised on Thursday.

A few studies have indicated a possible link between mobile telephone use and brain tumors, although far more show no connection. But because wireless devices have become almost ubiquitous, researchers wants to ensure their safety.

The Food and Drug Administration asked the National Research Council to recommend some future lines of study. The Council, which advises Congress and the federal government on scientific matters, held a meeting of experts including engineers and biologists and has now released the full report.

Most studies have looked only at short-term effects on healthy adults, the report said.

         

More study needs to be done on multiple, long-term, low-intensity radiofrequency (RF) exposure, the report said.

Link: Study children and cell phones, researchers advise (Globe & Mail/Reuters).

The NRC's press release, which links to the full report is here: Report Identifies Research to Bolster Knowledge of Any Potential Health Effects of Wireless Communication Devices.

Account Sign-Ins: Broken in So Many Ways

Usability expert Jared Spool has written a couple of articles on how companies can avoid design mistakes on their web sign-in pages.  Here is his list of common sign-in problems:

1. Having a Sign-in In The First Place
2. Requiring Sign-in Too Soon
3. Not Stating the Benefits to Registering
4. Hiding the Sign-In Button
5. Not Making "Create New Account" or "Forgot Your Password" a Button or Link
6. Not Providing Sign-in Opportunities at Key Locations
7. Asking for Too Much Information When Registering
8. Not Telling Users How You'll Use Their Information
9. Not Telling Users the Requirements for Username and Password Up Front
10. Requiring Stricter Password Requirements Than The NSA
11. Using Challenge Questions They Won't Remember In A Year
12. Not Returning Users to Their Desired Objective
13. Not Explaining If It’s The Username or Password They Got Wrong
14. Not Putting A Register Link When The Sign-In Is An Error
15. Not Giving the User A Non-email Solution To Recover Their Password
16. Requiring More Than One Element When Recovering Password

Links: Account Sign-in: 8 Mistakes to Avoid,
8 More Design Mistakes with Account Sign-in

A few more suggestions (these might be rare but are really annoying!):

• Don't limit the number of tries people get.  Okay, maybe there's some rationale for limiting it to, say, 100 to stop automated password sniffers, but limiting it to three is just silly.
• Don't use an account number as a user ID.  That makes it easy for the site to keep unique user IDs, but it forces the user to search through their e-mail every time they want to log in.  Ironically, this mistake is committed on the member site of the Usability Professionals Association.
• Don't change your system every two months.  It seems like every time I log in to some places they've got a new set of challenge questions, pictures, or some crap that just makes the whole thing slower and more frustrating.

I have had the worst web page sign-in experiences with medical sites.  I love that I can now access my records and communicate with my doctor online, but it's so difficult to remember how to log in and I do it so infrequently that it's a struggle every time.  Part of the reason may be the US HIPAA privacy regulations (which are certainly important, don't get me wrong).  My doctor's site has extremely strict requirements for passwords and user IDs, and the only way you can get a reminder is by snail mail (and actually they assign you a new password, so you can't sign in if you happen to remember it before the mail arrives).  So what happens to me is I'll get a phone message or email that just says "you have a message -- please log in."  I try to log in and fail, so I request a reminder.  Two weeks later I receive a new password in the mail but by that point I've already called them so I don't need to log in.  The letter with the new password gets buried (or I choose a new password and forget it) and then months later I go through the whole thing again.  Granted I'm not the most organized person in the world, but this still seems tougher than it should.

See also this article by Anna Pickard in the Guardian today: Are you suffering from password pressure?

Technology in Wartime Conference

Computer Professionals for Social Responsibility is hosting a one-day public conference on Technology in Wartime.  It will take place January 26th at Stanford University.  From the conference description:

This conference will explore how computer technology is used during war -- both for the purposes of combat/defense, as well as for human rights interventions into war-torn regions. Topics will include high tech weapons systems, cyberwarfare, autonomous aircraft, mobile robots, internet surveillance, anonymous communication, and privacy-enhancing technologies that aid human rights workers documenting conditions in war-torn countries and help soldiers communicate their experiences in blogs and e-mail.

Our goal will be to consider the ethical implications of wartime technologies and how these technologies are likely to affect civilization in years to come. Ultimately we want to engage a pressing question of our time: What should socially-responsible computer professionals do in a time of high tech warfare?

Participants will include technology experts, military professionals, policy-makers, scholars, and human rights workers. Confirmed speakers include Bruce Schneier (BT Counterpane Security), Barbara Simons (ACM), Herb Lin (NSF), Cindy Cohn (EFF), Patrick Ball (Benetech), Neil Rowe (US Naval Academy), Ronald Arkin (Georgia Tech), and Noah Shachtman (Wired magazine's war correspondent).

The proceedings will be broadcast live on the Web, and the presentations collected in book form online, released under a CC license, and made available to the public and policy makers looking for expert opinions on wartime technology issues during the election year.

Link: Technology in Wartime.

I'm planning to attend and will write something about it here afterwards.

See also this post about it by conference organizer Annalee Newitz at io9: Will We Hold Robots Accountable for War Crimes?

Louis Bayard on Lee Siegel's Against the Machine

Novelist Louis Bayard reviews Lee Siegel's new book Against the Machine at Salon: YouTube, J'Accuse.

Sounds pretty disappointing.  I was going to buy this but I think I'll wait for the library now.

Even the book's cover is getting bad reviews (see Publisher's Weekly, via BookSlut).

Nominate Your Choices for Best Tech Writing

Digital Culture Books (a project out of the University of Michigan) publishes a series called The Best of Technology Writing and is looking for nominations for the next edition, to be edited by Clive Thompson.  The first two years had a lot of excellent stuff.  You can buy them in paperback or read them for free online: Digital Culture Books. 

Nominations of your favorite pieces published in 2007 will be accepted until January 31st -- nominate here.

(via if:book)

FDA Says Cloned Food is Safe

The FDA has announced that cloned food is safe to eat, but many groups are still concerned.

The Center for Science in the Public Interest says the FDA has "satisfactorily answered the safety question" but:

Congress should hold hearings on the animal-welfare, ethical, and environmental implications of cloning. [...]

If companies begin using clones to breed food animals, they need to explain why. Will it make any food product better, safer, cheaper or more sustainable? Clear evidence of benefits must be generated if consumers are going to accept cloned animals and their products.

Link: CSPI on the FDA's Safety Assessment of Food from Cloned Animals.

The Union of Concerned Scientists says:

“Animal cloning is a controversial technology with few, if any, benefits to consumers. [...]

“The agency's risk assessment is long on assumptions and short on hard data. It fails to address ethical issues associated with cloning, including the role of animal cloning as a steppingstone to human cloning.

“Nor does the risk assessment resolve trade concerns revolving around this controversial technology. Other countries have more rigorous regulatory systems and take ethical concerns into account. We can afford the time to do additional studies.”

Link: FDA OKs Cloned Meat and Milk; USDA Keeps Moratorium in Place.

The Center for Food Safety is harsher:

"The FDA's bullheaded action today disregards the will of the public and the Senate - and opens a literal Pandora's Box," said Andrew Kimbrell, CFS Executive Director. "FDA based their decision on an incomplete and flawed review that relies on studies supplied by cloning companies that want to force cloning technology on American consumers.  FDA's action has placed the interests of a handful of biotech firms above those of the public they are charged with protecting."

Link: FDA Opens "Pandora's Box" by Approving Food from Clones for Sale.

News stories on this topic: Wired, Washington Post.