Smile

Artist: Michael Jackson, 1995 ( originally from the 1936 Charlie Chaplin film Modern Times)

Lyrics:
Smile though your heart is aching
Smile even though its breaking
When there are clouds in the sky, you'll get by
If you smile with your fear and sorrow
Smile and maybe tomorrow
You'll find that life is still worthwhile

If you just
Light up your face with gladness
Hide every trace of sadness
Although a tear may be ever so near
That's the time you must keep on trying
Smile, what's the use of crying?
You'll find that life is still worthwhile

If you just
Smile though your heart is aching
Smile even though its breaking
When there are clouds in the sky, you'll get by
If you smile through your fear and sorrow
Smile and maybe tomorrow
You'll find that life is still worthwhile
If you just smile

that's the time you must keep on trying
Smile, what's the use of crying?
You'll find that life is still worthwhile
If you just smile


"A day without a laugh is a wasted day." ~Charles Chaplin

HMAC truncation vulnerability in XML signature

This blog post nicely explains the HMAC truncation security vulnerability in XML digital signature specification. In short the specification allows to truncate the signature to any length. If this length is too small, an adversary can guess the correct truncated HMAC with a high probability and hence the security vulnerability. Specifically, this leads to authentication bypass or forging.

I am not sure if there exists any security proof about truncation (reduces to birthday attack?). Generally speaking, smaller signature provides a higher entropy and hence less information to the attacker. But at the same time, attacker has to guess only a fewer bits. In any case, the truncation should not be less than 80 bits, since below this length is considered to be vulnerable to brute force attacks with the current computational capabilities of adversaries. What if the truncated length is less than half of the length of original MAC output? Then it is succeptible to birthday attacks.

Are you as an application developer vulnerable to this attack?
If you are using an XML digital signature library that allows to set any arbitrary truncation length, you'll need to enforce a minimum safe length depending on the algorithm you are using. The good news is most of the libraries including XML security library have already provided pathes for this. If you are a library developer, you probably want to release a patch to users.

The road not taken

Two roads diverged in a yellow wood,
And sorry I could not travel both
And be one traveler, long I stood
And looked down one as far as I could
To where it bent in the undergrowth;

Then took the other, as just as fair,
And having perhaps the better claim,
Because it was grassy and wanted wear;
Though as for that the passing there
Had worn them really about the same,

And both that morning equally lay
In leaves no step had trodden black.
Oh, I kept the first for another day!
Yet knowing how way leads on to way,
I doubted if I should ever come back.

I shall be telling this with a sigh
Somewhere ages and ages hence:
Two roads diverged in a wood, and I—
I took the one less traveled by,
And that has made all the difference.
- Robert Frost

(literal interpretation, but not ironic [1])

5 simple steps to minimize insider threats

Insiders who have the trust can abuse this trust. I recently listened to an interview with one of my favorite security experts, Bruice Schneier, on this subject. Every organization can/should take the follow 5 steps to minimize/mitigate insider threats.

1. Have only a few trusted people.
By limiting the number of trusted people, you limit the possible threats.

2. Ensure that the trusted people are trustworthy.
For example, background checks, limiting to citizens, bonding employees, etc.

3. Limit (compartmentalize) the trust each person has.
For example, give the key to her cubicle only not to other cubicles, give only user passwords not root password.

4. Give overlapping sphere of trust (Make it compulsory to require two or more people to get the task (usually very sensitive and can have profound consequences) done).
For example, co-signers, secret sharing schemes, if you are a Knight Rider fan, you must have seen that to activate the self-destruction mode on KIT two people's finger prints are required.

5. Detect breach of trust and prosecute. Auditing is used for this purpose. Having an audit system in place may deter people from breaching trust as well as provide evidence if breached. Whatever system in place should be tamper resistant and provide sufficient details of user actions/behavior.

As you might have noticed, these 5 steps are nothing new, but you'll be amazed that many organizations don't have these basics right.

Some thoughts..Winning the war is only the first step to win peace

With the LTTE terrorists (Tamil tigers) being defeated militarily, Sri Lankan government still needs to take considerable actions to restore the faith in Tamil and Tamil-speaking civilians. Terrorism in any form is not acceptable. LTTE is one of the most dangerous terrorist organizations in the world [FBI 0,1,2]. They carried out many atrocities and most of the time innocent civilians have to suffer [3]. There is no question they should be defeated and wiped out of the Sri Lankan soil. The SL government has rightly done so.

Military solution alone will not solve the problem we are currently facing; a political solution should be implemented to correct the issues including the root cause of this whole issue. IMHO, the language is the root cause. 1956 Sinhala only act was a key contributor for Tamils and Tamil-speaking civilians to feel discriminated. This was corrected later; after 1987, India-Sri Lanka accord, Tamil language was accorded the same official status as Sinhala language. Even after 20 years making both Sinhala and Tamil as official languages, we don't seem to have got it right. It is natural to feel that you are not one of them if you don't speak their language or if they don't speak your language; or you feel neglected; language divide people. I have a lot of personal experience to back up this fact. Perhaps, the issue is more visible to me as I speak both languages. So, what should be the way forward? The government has to genuinely commit itself to bridge this language gap and we, as citizens, have the responsibility to do our parts. (There have been already some measures to make both Tamil and Sinhala languages compulsory for public service positions and to add to the school curriculum; but that is not sufficient.)

It is time we, citizens, take every possible action to heal the wounds that have been around for decades. Sometimes, I feel offended by the arguments made by both parties [1]; "Sri Lanka is the homeland of Sinhalese", "(Some parts of) Sri Lanka is the homeland of Tamils". Unless we get ourselves rid of such mentality, we will continue to have divisions. Sri Lanka is the homeland of all ethnicities. One ethnicity is not superior or inferior to another. We will have the real peace in our country on the day we start to treat everyone equally and with dignity. I sincerely hope that this day is not far away.

We, as educated people, can use our ability to bridge the language gap and improve the trust between differnet ethnicities. I don't think it is too much to ask from my fellow Sinhala-speaking friends/readers to learn the basics of Tamil and my fellow Tamil-speaking friends/readers to learn the basics of Sinhalese. There's a lot in common between these two languages.

I studied in Sinhala medium, speak in Tamil at home and stared learning to write in Tamil on my own with some help from my mother a few years ago. I am glad I did that. Now, I have more reasons to polish up my writing skills. Believe me, it is not that hard and you will enjoy the feeling of getting to know/being able to understand another language - a language that is spoken by fellow Sri Lankans!

Hi-tech Exam Cheats

With technology, we naturally tend to think that there will be better ways to detect/find exam cheats and this in a way deter those who try to cheat in exams, right? But the facts seem to be otherwise [1, 2, 3, 4, 5]; recent incidents show that students are increasingly utilizing technology to their advantage to cheat.

This is similar to the current virus/malicious software development market; bad people keep on finding new ways to attack while good people (anti-virus software companies) try to defend those attacks. Another is software piracy market. (Is it OK to download copyrighted stuff from P2P file sharing networks? If so, is it OK to steal money from a book author?)

It again highlights the fact that technology alone cannot solve issues we are facing today. Further, even legal enforcements won't be able to. IMHO, this vicious cycle is never going end (in fact is going to get worse) unless we address non-technical issues such as ethical behaviors, moral issues, etc. How many of those who cheat think that cheating is a bad thing? How many think that their cheating is justified?


Some more thoughts..
Does high competition (few opportunities) lead to cheating? If so, is competition a bad thing?
When students are under pressure to perform, is it a reason for them to cheat? If so, who should be blamed for its happening?

Expectation of Privacy

In USA, to take legal actions, the concept of "expectation of privacy" matters. The fourth amendment (1967 I think) lays out criteria for this in order for a plaintiff to demand legal privacy protection:

1. She needs to show that she exhibited an actual "expectation" of privacy. (For example, if she leaves the data in plaintext in some public storage, she obviously has little expectation of privacy. On the other hand, if the data is encrypted, there is some level of expectation of privacy.)
2. The expectation should be one that the society is prepared to recognize as "reasonable". (This reasonableness is a subjective measure. For example, we, as a society, expect our emails to be private. However, this notion of privacy could be used by bad people for their malicious intents. For example, for terrorists to organize an attack. When there is an imminent threat, we need to give priority to societal security over personal privacy. In the interest of national security, one can argue that it is not reasonable to expect our emails are private.)

For example, Facebook (also other social networks) business model involve selling (anonymized) personal information and using it to target advertisements.

An excerpt from the Facebook privacy policy:
"Facebook may use information in your profile without identifying you as an individual to third parties. We do this for purposes such as aggregating how many people in a network like a band or movie and personalizing advertisements and promotions so that we can provide you Facebook. We believe this benefits you. You can know more about the world around you and, where there are advertisements, they're more likely to be interesting to you. For example, if you put a favorite movie in your profile, we might serve you an advertisement highlighting a screening of a similar one in your town. But we don't tell the movie company who you are."

With such statements in their privacy policies, it is questionable if a user can defend the above "expectation of privacy" as we agree to all these policies (with or without knowingly) when we sign up for the service. I am not saying social networks are bad, in fact, I do have a Facebook account and it's a great tool to connect with old colleagues and friends, and stay in touch with them. But, do we need to change our expectation of privacy to that of our service providers (Facebook in this case)? In other words, how can we show (legally) that we demonstrate sufficient expectation of privacy in case it is breached?

Here, you'll find some interesting thoughts by Bruce Schneier on this topic and he argues that "expecation of privacy" is a flawed test.