Loy

Password : a simple solution to a hard problem

2011-05-22T08:21:00.000-07:00

Being a netbook user, I like to have my all personal files encrypted. When I installed Ubuntu, I noticed it provided right away an integrated option to encrypt the /home folder with a tool called DM Crypt. "Sweet!", I thought, before I realized my administrative password would be used for the encryption.

Here is the problem:


Ubuntu Password Prompt

The problem shows instantly in the case of Ubuntu and DM Crypt. Since a lot of common tasks require the administrative privileges, the password prompt is a full part of the daily user experience. For the everyday user like me, it means that the stronger is the password, the bigger is the hassle.

Even if we remove the encryption factor, this is still a problem because Ubuntu tells me my password is "weak" during the setup, but I also don't want it to become a burden so I don't change it.

This is certainly a flaw in the security philosophy, since users shouldn't be asked to chose between comfort and security. I speak (again) as an everyday user not versed in the dark arts of Unix administration and command tools.

I have a solution that looks great on the paper and would be particularly suited for an OS password, excuse me if somebody else implemented it somewhere already:

"Enter the first four characters of your password, 3 attempts left"

All numbers are random examples, whether it'd be the number of attempts and characters required.

The point of such a system is to add some flexibility to the security design. Now I can have a very strong password, use an abbreviated version of it for my daily use, and be warned that my short password expired because somebody inputed x times the wrong one. Of course you have to enter the big one to get back to your machine.

Does this idea make sense from a technical standpoint ? I feel it would require much technical knowledge and talent to implement it the right way, if even possible. But from a user standpoint, I think it's worth the try. It would probably encourage users to pick stronger password everywhere it's implemented, and improve security and ease of use overall.

I hope to get some feedback on this.

Thoughts from my days at AOL

2011-02-11T22:42:00.000-08:00

I worked for AOL France from 1996 to 2000. I was a teenager still in high school when I joined as a volunteer "community leader", then eventually became the head of the Games channel and a bit more. To circumvent the law, I was paid in royalties and they provided me with hardware and phone bills coverage, which was awesome because my family couldn't afford either. I will share my perspective about the demise of a powerful but stubborn company.

1. What AOL got right

Despite its awful reputation, the company had a lot of things right at the beginning. By targeting people who were unfamiliar with computers, it shared the core principles that make Internet companies successful: it was easy and powerful. You could connect without messing with the network parameters in your OS. You could send and receive emails without any kind of technical knowledge. You could enter chat rooms in a single click. The buddy list existed before ICQ and was a good execution of dead simple instant messaging. Surprisingly, the Games channel was a prototype of Steam: one click and the game would download and install automatically. In France you could play multiplayer Warcraft 2 for free, which was something to be proud of.

All these things we take for granted today were definitely easier to use in the walled-garden that was AOL, they had a very good timing.

Moreover, "the Internet" wasn't so exciting in 1996. Dial-up connections, mostly static HTML pages, animated GIFs on Geocities, Yahoo was thriving in the absence of Google (it would be created two years later), Netscape Navigator wasn't free and Internet Explorer 4 (the version that started the demise of Netscape) would be released a year later. Gaming-wise, Kali was neat but far from being accessible to the non-technical user. Finally, the "freemium spirit" wasn't whole spread yet and a lot of the decent services were based on the shareware model.

We also have to remember that the general public didn't know right away how an Internet connection could be useful to them, and AOL provided an answer with accessible content and services.

For all these reasons it is safe to assume that the early AOL provided a better experience to the non-savvy user.

2. The fatal strategy of AOL

AOL, the short story (original pic from The Perry Bible Fellowship)

When we think about AOL the first thing that comes to our minds is the particularly slow and painful demise, it was spectacular. It was an endless nightmare especially for the late customers. Of course, AOL still exists but you know what I'm talking about.

It would be pointless to recap all the mistakes America Online did. The broader picture is more interesting. The short story is that AOL forgot what made it successful in the first place. As the web evolved, they lost their original status of facilitator to become the exact opposite, an obstacle and a hindrance. They forgot they were only relatively good enough and they tried to compete against the web instead of embracing it. They thought they could provide enough content so that nobody would ever feel the need to get out of their walled-garden. Pursuing this goal, the bloat of their software rose to dangerous levels of insanity (amusingly, bloatware used to be quite trendy at the time. I still remember a magazine cover praising Netscape for being "an OS into the OS"). They wanted to do it all. It was a walled-garden mentality pushed to the extreme.

What triggered this blog post is an interview of my former CEO I saw recently. He talks about his career, and as they come to the AOL France chapter, he explains: "Our only mistake was not foreseeing the technological disruption that represented DSL and cable connections. We didn't believe it would take-off." In all fairness, I don't believe he can be blamed for it, because the real decision-makers were elsewhere. Actually, the management became so bloated and inefficient that there were probably no decision-makers anymore.

Still, the first and last mail I sent to this (French) CEO was titled something like “Why AOL is going into the wall” and it was about the strategic shifts I thought were needed to avoid it. I didn't receive any answer, instead on my next visit to the headquarters my boss called me into his office and popped out a printed version of my email: "What's this ?". The CEO turned out displeased by my initiative and forwarded it to my boss. On one side, I understood I was hijacking the hierarchy and I would have expected no answer at all. But I thought this particular way of dealing with employee feedback was one reason AOL became crap. I was in love with the company because it brought me a lot and saved me from the boredom of high school, and that's why I took the shot. I didn't want it to fail. Beside, you didn't need to be an insider nor Nostradamus to write the mail I sent. Anybody could reach the same conclusions with little knowledge and common sense. Actually, everybody in the world beside upper management had already reached those conclusions. I got angry during this interview and it was pretty much the last time I exchanged with my boss.

The end of the story is well known. Massive marketing combined with the hostage-taking of thousands of irate customers who were overcharged and couldn't cancel their subscription weren't enough to keep the company afloat. The Games Channel was basically replaced by the GameSpot.com homepage and my job was over from this point.

I don't understand how AOL executives could believe faster connections weren't the future. They were blind where everybody could see perfectly and it was too late when they realized it. What a hell of a massive fuck-up.

It is certainly very hard to grow, but you should never forget where you come from and the reasons of your initial success. After all, maybe there is a parallel universe where America Online finally embraced the web and fast connections, produced good software and capitalized on its fantastic user base to become the Facebook of its time. Right, nobody wants to live there anyway.

As for me, I can only be thankful for the formidable experience I had at AOL and the great people I met there. I know it's cliché, but my first boss was downright amazing and taught me a lot. He left too soon to fulfill a very successful career in the U.S. In a few days, I'm going to meet him again for the first time in 10 years. Wherever you go the old adage rings true and in the end, people matter most.

Winning the inverted lottery

2010-07-12T13:41:00.000-07:00

I remember the day I saved the life of my family. I was 9 years old and very excited by an experiment we did in class. Our assignment was to decorate the inside of a shoebox and to set up a tiny light bulb in it. The experiment fascinated me and I decided to push it further back home.

After dinner, I grabbed some garden wire, a pair of gloves and a couple of light bulbs. This time, the shoebox would be my room and the battery would be the power plugs (and they say video games are dangerous).

Quickly, several electrified wires invaded my floor and I had to walk carefully around them. My father came to say good night:

“- What are all these wires doing around?”, he asked with a puzzled look.
“- Hmm, I'm just trying some stuff”
He didn’t realize they were electrified:
“- Don't stay up late. Good night”.

My parents watched TV in bed. My little sister and brother went to sleep.

Then I made a mistake. A stupid one: I cut an electrified wire. The spark and the clatter that followed are still vivid memories. The blades of the scissors turned black and had a big molten hole.

The house went dark and my father rushed to my room despite the obscurity, suspecting the wires had something to do with it: “Are you okay?!". I was.

I went with him to restore the current. As soon as we hit the stairs, we noticed something was wrong.

“- It smells gas”, he said.

As we walked down the stairs, it was clear a gigantic cloud of gas had formed. We held our breath and rushed to open the windows. We turned off the gas tap and waited patiently for the cloud to dissipate. Our very old cooker was the culprit.

Given the oldness of the electrical network, it would probably have led to the “big explosion in the middle of the night” story we hear in the news. Our neighbors would have testified for us, assuring we were “decent people” and it was a “tragedy”.

It didn't happen, at least not in this dimension. My mistake was perfect. To hijack a Charlie Chaplin's quote: “I suppose that's one of the ironies of life doing the wrong thing at the right moment.”

By shutting down the electrical current in the house, an explosion was nearly impossible and it gave us a chance to notice the gas leak. It was an incredible coincidence. We had just won the inverted lottery.

Nobody seemed to care though. Winning a lot of money is definitly more exciting than not dying in an awful explosion.