Your Security Sucks

I’ve grown beyond tired and frustrated with what counts for security questions in web sites lately. There are two huge problems and practically every site has one or both problems with those second chance questions they want you to answer. In order to demonstrate, I have two sets of allowed questions from two sites I actually use that I will paste below. The names will not be used, to protect the guilty.

Problem #1: The questions you are using as my secret token are in fact matters of public record. Here’s something for you web developers picking secret questions – if you know my age, you have basically a 50/50 chance of guessing the year I graduated high school. Also the town I was born in, my mother’s maiden name and many of these sorts of things don’t really stand up to life in a post-Google world. I’ve stopped talking about the town I was born in for exactly this reason. It’s ridiculous that it’s my responsibility to keep secret things that aren’t really secret because you are too lazy or incomptentent to think your password reclamation procedures through very well.

Problem #2: The questions you are using as a static fact are transitory and may be answered differently over time. An example of this was when I tried to reclaim a password from a site I knew I once used, and was faced with the question “What is the best book you ever read?” I tried 10 different ones that were plausible (less than 10, but with some alternate spellings) and I never hit it. My final analysis was that I didn’t care enough about the site to bother with it and I’ve never been back. My favorite sports figure, my favorite anything – these are not fixed points. If I come back in two years, will I remember this answer? If not then why are you asking me this? See point #1 for the laziness/incompetence issue breakdown.

Here is the hall of shame for “secret questions” from the last two sites that bugged me. I kid you not, I’m going to begin aborting the signup process when I see such things. If you can’t do this in a way that makes any sense, then perhaps you can’t be trusted with anything.

Site #1:

  • What is the last name of your favorite athlete? [Transitory]
  • What is the last name of your best friend from high school? [Known by all your high school friends]
  • What is the last name of the maid of honor at your wedding? [Known by everyone at your wedding]
  • What is your oldest child’s nickname? [Known by everyone that knows your child]
  • What is the last name of your favorite author? [Transitory]
  • What is your dream job? [Transitory]
  • What is your favorite charity? [Transitory]
  • What was the first name of your first girlfriend/boyfriend?
  • What school did you attend for sixth grade? [There was only one grade school in my town, so knowing where I lived at age 11 tells you this]
  • What is your spouse’s nickname?
  • What is the last name of your favorite historical figure? [Transitory]

Site #2

  • What was your favorite childhood pet’s name?
  • What was the name of your first school? [See above]
  • What is your all-time favorite past-time? [WTF]
  • What is your all-time favorite sports team? [Transitory]
  • What is your father’s middle name? [Public record, might even be commonly used]
  • What was your high school mascot? [Seriously? If you know I’m from Norton Kansas, game over]
  • Where did you first meet your spouse? [I’ve told this story to many people]
  • What was your best friend’s name when you were a child? [Web developers have only had one best friend across their entire childhoods?]
  • What was the name of your favorite food as a child? [You have got to be f’ing with me here]
  • In what town did you spend most of your youth? [Public record]
  • What was the name of your high school? [This again?]
  • What year did you graduate high school? [For gods sake, I’m 41. Do the math, bozo]

Return to Human

Starting Sunday mid-day I started getting the chills, which alternated with the sweats all day. It turns out that I spent basically three days lying on the couch under a blanket with a dog on my legs. It was one of those illnesses where I’d decide to turn on the TV, and then it would be 2 hours before I could actually work up the energy to roll over and pick up the remote.

I spent a little of that invalid time on the couch watching some of the older movies I had on my DVR, which included Grindhouse and two Cassavetes movies, A Woman Under the Influence and The Killing of a Chinese Bookie. Of those three, I’m somewhat surprised by how little I liked Grindhouse. I really hated the Rodriguez half, Planet Terror. Even as dumb homage to dumb movies, it didn’t work for me. It wasn’t fun, just gross and obvious and non-clever. I liked the Tarantino Death Proof a little better, but it was still pretty standard Tarantino – long tedious talky bits punctuated with brief outbursts of violence. Except, the talk bits are way longer than Pulp Fiction and the action bits less interesting. I really hated that both halves of the movie included the same “missing reel” gag. The final analysis is that I liked the fake trailers better than either movie because they didn’t have time to wear on me.

Of the two Cassavetes films, I think that A Woman Under the Influence might be my least favorite Cassavetes so far. Admittedly, that’s still better than most director’s high points. It was unusually slow and not that compelling. As much as I love Peter Falk, I found much of the movie meandering and kind of pointless, sort of like a repetitive SNL sketch that keeps repeating the same catchwords. I really liked The Killing of a Chinese Bookie though, which might be the favorite of the Cassavetes films I’ve seen. I deeply cared about Ben Gazarra as Cosmo Vitelli, a guy with aspirations beyond his abilities but a big, warm heart. One thing I’ve noticed as a commonality is that the male leads of all these Cassavetes movies have serious control issues. Was that a little of the auteur leaking out into his characters?

Final analysis: When you have a fever that is making life impossible, Grindhouse is not a great film. Go with the Cassavetes.

Fleetwood Mac Historical Controversy

Soundstage on PBS has recently shown a 2 part concert from Stevie Nicks. For no apparent reason this started me thinking about old Stevie songs and old Fleetwood Mac and reading about some of their history. I ran across a bit about the controversy on the Rumours album, where Stevie Nicks really wanted the song “Silver Springs” on the album but it was long, so it was cut in favor of “I Don’t Want to Know.”

I just sat down and listened to both songs, and I’d have to agree with Ms. Nicks. As good an album Rumours is, in the alternate world where they made the decision differently it would have been an even better album. Although they put it on the CD reissue 20+ years later, I would argue that if “Silver Springs” had been on the original album it would have been my favorite song on there. In fact, I’ll go on a limb and argue it as the single strongest Stevie Nicks composition I’ve ever heard.

There is not really any importance to refighting 33 year old arguments, but I’d say from my perspective time has proven Nicks right.

The Wire on Super Sale

I’ve never seen even a single episode of The Wire even though I know many people say it is the best TV series ever. I was a huge fan of Homicide: Life on the Streets also by David Simon, which I think is the best series I’ve ever watched. Well now, you can purchase all 5 seasons from Amazon for $82, which includes free shipping. I did a back of the envelope calculation that at $4 a disk from Blockbuster this series would cost $92 to rent, so if you are interested this seems like a deal that can’t be passed up. I’m about to buy it myself. It seems like the thing to do.

Kick Off Your Carnival with 3canal

I listened to the most recent episode of Caribbean Free Radio last weekend. There are precious few new episodes so I cherish every one I get. In this, she was talking with her friends in 3canal and they discussed their current album and the interesting promotion they are engaged in. For the time being, their newest album Joy + Fire is available as a free and legal download at Trinidad Tunes. From what they said on CFR, this downloadable album is being sponsored by Flow Trinidad in an interesting fashion. The band is getting paid from these downloads as if Trinidad Tunes had sold the same records, it’s just that Flow is footing the bill. Apparently, how long this album remains freely downloadable depends on Flow. They are sponsoring up to a dollar value, and when that is reached the promotion is over. That means, if you are at all interested, get on it sooner rather than later.

I’ve listened to the album and I believe it is my favorite of all the 3canal music I’ve heard. I’ll admit that in rap hybrid styles, I think in general there is too much rap and not enough of the other things. I love 60’s and 70’s classic style reggae but never much liked modern dancehall, for example. On Joy + Fire, I think the rapso mix of rap and calypso is just right for my taste. Try a track or two, and if you like them you can get the whole album. I dig it quite a bit, and I thank 3canal and Flow Trinidad for this experiment. From my perspective as a random white guy in America who has never been near Trinidad, I appreciate this greatly. If you want to get a little of that Carnival spirit, go check out Trinidad Tunes.

Sterling Gets on the Wattage Train for our Energy Future

Bruce Sterling blogs about Stewart Brand’s notes from the Long Now Foundation about a similar Saul Griffith presentation to that I referenced a few weeks ago. Brand’s post includes the specifics that I didn’t transcribe from the audio.

Two terawatts of photovoltaic would require installing 100 square meters of 15-percent-efficient solar cells every second, second after second, for the next 25 years. (That’s about 1,200 square miles of solar cells a year, times 25 equals 30,000 square miles of photovoltaic cells.) Two terawatts of solar thermal? If it’s 30 percent efficient all told, we’ll need 50 square meters of highly reflective mirrors every second. (Some 600 square miles a year, times 25.) Half a terawatt of biofuels? Something like one Olympic swimming pools of genetically engineered algae, installed every second. (About 15,250 square miles a year, times 25.) Two terawatts of wind? That’s a 300-foot-diameter wind turbine every 5 minutes. (Install 105,000 turbines a year in good wind locations, times 25.) Two terawatts of geothermal? Build 3 100-megawatt steam turbines every day-1,095 a year, times 25. Three terawatts of new nuclear? That’s a 3-reactor, 3-gigawatt plant every week-52 a year, times 25.

This is highly challenging stuff but the part that really inspires me and gets me excited is not the enormity of the challenge (and it is enormous) but how achievable it is. We, the USA and the world, can do this. The other thing is that while it will be expensive, it will be expensive in the best possible way, by leaving behind infrastructure that will strengthen our economy and make the world a better place. Contrast that with the $1 trillion we will have spent in Iraq. Other than lining the pockets of Halliburton and Blackwater executives, what is left behind that will strengthen our future? Nothing. This “energy Apollo mission” can restore what is missing in this country, give us a common initiative, put people to work and oh by the way, possibly save civilization on the planet. Let’s go for it.

I Don’t Know

Apparently my previous post keeps showing up in Google Reader over and over. I don’t know why either. Apologies to those who are getting bugged by it. I’m hoping making a new one will clear out whatever oddness is making this happen. If it keeps happening, time to give the exorcist a call.

Update: I had this exchange on FriendFeed about this issue, where I had noticed the numerical GUID in that post. Yesterday I updated the database directly to change it away from that number and to the URI for that post. It seems to have changed back. This post seems to implicate Podpress as the culprit. I disabled it temporarily and will be moving over to the Podcasting plugin. Podpress hasn’t been updated in over a year and is drifting further and further from the core WordPress code anyway. It’s all kind of a drag, though.

An Escrow System for WordPress Plugins

Over on Grand Strand Bloggers, I want to try out this plugin that automatically makes digest posts. That is perfect for what we want to do. However, the plugin I”m trying to use is really half-baked and appears abandoned. I’d think about adding to this with our needs at GSB if there was a way to do so.

That plugin also uses the WordPress cron functionality. I have installed on several blogs the WP-Crontrol plugin to give better access to this system. However, it seems like WP has had API drift that makes it no longer work right. I can see the cron jobs but no longer edit them or execute them like I used to be able to. I’d also be willing to work on that one too.

Is there a formal process for taking over abandoned WP plugins? Suppose I have a patch to submit and the original developer is no longer involved or completely incommunicado. Can someone from eventually give me access to SVN or commit patches for me? Or do I have to take their code, fork it and just work from there? It would probably be nicer to do it down the path of the original plugin, so that everyone’s automatic updaters allow them to get the newer versions. Still, anything is better than nothing.

Travels and Bummers and Will Eisner

I’m in Atlanta at the moment, doing travel for the day job. I would have liked to have met up with friends and done stuff but the evening plans were such that I wasn’t sure if I was free. I ended up opting to just go for ease this time through. Sorry ATL friends, I do still love you.

Part of our obligations took us to Atlantic Station, which was a giant hole in the ground when I left Atlanta in 2003. While there, I saw banners for the Atlanta Jewish Film Festival. You might wonder why a goy like me would care. Well,  I found out from Creative Loafing one of the films being exhibited is a documentary I wanted to see, Will Eisner: Portrait of a Sequential Artist. I’d like to see that to balance out the relative suckiness of the Spirit movie. Of course, when does the film festival start? Not the last two nights when I could have gone, but tonight when we’ll be back home. Ain’t that the way it always goes?

In the upside, I did break off from the pack Monday night and drove to Oxford Comics with my want list in hand. One fo those was the new Spirit series issue 10 which for some reason no comic shop I’ve visited in the last year had, but Oxford did so my Will Eisnerish content for the trip was met. Still, I’d love to see that documentary and even more would like to see it in a theater with an audience. Maybe next year.

Evil Genius Chronicles Podcast for January 4, 2009 – “The Start of Something Good”

Here is the direct MP3 download for the EGC clambake for January 4, 2009. I play a song from the Jody Grind; I talk about the new year, about being too fat and deciding where to spend my time; I talk about how I am getting back to collecting comic books; I talk a little about Saul Griffith and lifestyle wattage; I play a song by John Cameron Mitchell and then drag race out of town.

You can subscribe to this podcast feed via RSS. To sponsor the show, contact BackBeat Media. Don’t forget, you can fly your EGC flag by buying the stuff package. This show as a whole is Creative Commons licensed Attribution-NonCommercial 2.5. Bandwidth for this episode is provided by Cachefly.

Links mentioned in this episode:

Oh San Francisco

There was a time I thought I wanted to live in San Francisco. That time is long passed. We go there for AGU most years, and while I like a few days there, that is now plenty for me. There is a permeating hipster douchebag air that I just can’t shake from when I land at SFO until I leave. Even if the cost of living was identical to where I am (I’m sure my current house is many times what I could afford if it was in SF), I just no longer have a desire to be there. I feel more out of place there than anywhere. In the immortal words of Will Ferrell from Zoolander, when I’m there “I feel like I’m taking crazy pills.” The things that pass for sanity there boggle my mind.

I’m glad some of you love it. You are welcome to it. There’s another dream down the tubes.

Google Calendar, CalDav and iCal

A month ago, I set up iCal syncing with my Google Calendar via these instructions. Thus far, it has rocked the serious rock. I’ve given in to the borg and set up Google as my central hub for mail, for calendars, contacts, etc. They already know everything about me anyway. I used to be scared of it, then I decided to go whole hog on this path and bought some of their stock to make me a shareholder. If I can’t fight the tiger, maybe I can ride it.

I made an appointment to give blood from my day job workstation. They gave me an outlook VCS file for it, which I imported into my google calendar. At lunch, I hooked up to wifi at a Starbucks. Without thinking about it, I checked something else on my calendar and saw this appointment. I didn’t think about it, it was just there. Things are starting to get good here. Maybe the chaos that is my disorganized life will get a little underpinning to keep it from spinning out of control. There is always hope while there is breath.

Fat Times

My friend Derek Coward posted over the holidays a wakeup call he had about how fat he has become. I’m in a similar boat. I was working out at the gym over the summer, and at some point had my routine broken and stopped going. There was not a week between August and December that I didn’t think about going to the gym or talk about going or even think “I’m going tomorrow.” It just never happened.

On January 2nd, I went back. I weighed myself and got my own wakeup call. I was 249 pounds, which is 4 pounds more than the heaviest I’ve ever weighed myself at. Besides, I have decided that size 38 is the fattest pants I will own. I refuse to buy size 40 because I feel that’s the point at which I have given up. This is my fire break, the point beyond which things must not progress.

I worked out on Friday and Saturday, and then again yesterday and today. I’m 4 for 5 in the new year. I have my routine set of doing long amounts of cardio on one day, lifting weights (via machine) one day, and swimming the third. I’ll do that routine six times through in a week if it happens, but I won’t be sad if it happens at least 3 times. It is the nature of my personality that it is easier for me to exercise a lot than a little. If I do it every day, it is a part of my daily life and routine. If I do it every other day, then it is always a question of whether today is the day or not, when is the day, what do I do? I’m not good at moderation, so easier for me to go all the way than dip a toe in.

I took a photo of me in all my 249 pound glory on Saturday. Conceivably I might post photos of my progress as a way of forcing my hand publicly to keep at it. At the least, I plan on blogging once a week with my progress. I find working these things out in public to be helpful for keeping the self-pressure on. I don’t know about the photos. Even for the intarwebs, it might be too much horrible in one place.

As a point in time, I weighted 247 today. If I have a fault in this, I weight too often. I’m an engineer, I want data. I know better than to over-interpret it. Drink a 32 ounce water and you’ve gained 2 pounds. Pee, and you’ve lost it back. If I can maintain a steady pound or two a week over the long haul, I’ll be quite happy. I’d like to get back to the 200 pounds I was at shortly after grad school. If I get there, I’ll think about going for the 165 that was me at graduation from my undergraduate program. Send encouragement and/or brick bats. Just don’t send candy.

Streaming Podcasting

Partly because I think it is fun when the guys at Good Clean Fun do it, I’ve started experimenting with streaming it live when I’m recording episodes of my podcast. Thus far, I’ve only done it once. As I type this, I’m about to do it again. You can see it at my very own Ustream channel. Come and check me out and see what an actual train wreck the recording of this thing actually is.

What is the Wattage of Your Lifestyle?

Last week I blogged about the Saul Griffith presentation on energy literacy. In it, he calculated the wattage of his lifestyle. For those of you that would like to purse a similar metric, there is an online tool to help you calculate and track your lifestyle. It is called WattzOn. I just created a profile and according to it my lifestyle is 6.1 KW. That’s pretty high for what Griffith was shooting for (I think 2 KW was his target) but not terrible compared to the average American. That I don’t fly very much helped out there.

I do notice that in their forums there is a gadfly from the @Saul account, who seems to spent a lot of time urging them to make the tool better. What are the odds that is Saul Griffith? Pretty good, I’d say.