Comments for Ben Gross, PhD http://bengross.com Identity Management - Security - User Experience Wed, 12 Oct 2011 14:30:44 +0000 hourly 1 http://wordpress.org/?v=3.4-beta3-20582 Comment on The State of User Tracking and the Impossibility of Anonymizing Data by Tracking, Geolocation and Digital Exhaust : Ben Gross, PhD http://bengross.com/the-state-of-user-tracking-and-the-impossibility-of-anonymizing-data/#comment-6673 Tracking, Geolocation and Digital Exhaust : Ben Gross, PhD Wed, 12 Oct 2011 14:30:44 +0000 http://bengross.com/?p=430#comment-6673 [...] in social network analysis, traffic analysis, fingerprinting, profiling, de-anonymization/re-identification, and behavioral modeling techniques have all contributed to better tracking capabilities. In [...] [...] in social network analysis, traffic analysis, fingerprinting, profiling, de-anonymization/re-identification, and behavioral modeling techniques have all contributed to better tracking capabilities. In [...]

]]> Comment on How and Why to Sniff Smartphone Network Traffic by stevegingercat http://bengross.com/how-and-why-to-sniff-smartphone-network-traffic/#comment-537 stevegingercat Wed, 24 Nov 2010 01:23:31 +0000 http://bengross.com/?p=593#comment-537 Ben like the article! Thought I'd mention some of the filters etc in Wireshark are great for keeping an eye on phone related traffic, also you may want to look at Ntop to get a general idea of what's going on - In addition have a look at this device - I believe it is possible to turn this into a network tap (at 100 Mb speeds) which could be very useful for say keeping an eye on the average networks traffic. http://www.yawarra.com.au/product.php?productCode=HW-AX23 Ben like the article! Thought I’d mention some of the filters etc in Wireshark are great for keeping an eye on phone related traffic, also you may want to look at Ntop to get a general idea of what’s going on – In addition have a look at this device – I believe it is possible to turn this into a network tap (at 100 Mb speeds) which could be very useful for say keeping an eye on the average networks traffic.
http://www.yawarra.com.au/product.php?productCode=HW-AX23

]]> Comment on No Frills SSL Certificates are Inexpensive and Useful by Kyle H http://bengross.com/no-frills-ssl-certificates-are-inexpensive-and-useful/#comment-94 Kyle H Sun, 05 Sep 2010 05:43:00 +0000 http://bengross.com/?p=525#comment-94 You can get a free TLS certificate from http://www.startssl.com/, which is the Certifying Authority operated by StartCom (which also manages the StartCom Enterprise Linux distribution). I've been working on a means to use the already-written X.509/PKIX certificate parsing code to provide services that meet the needs of c2c and b2c communications, as an incremental step over trying to say "you need strong identity" without explaining how it can provide a compelling use case. (Mapping everything to a single non-cryptographically-generated string that is supposed to be globally unique makes very little sense. The key *is* the nym, and there's no need for any individual, company, or government employer to know about the entire set of keys and nyms that are associated with the same natural person.) You can get a free TLS certificate from http://www.startssl.com/, which is the Certifying Authority operated by StartCom (which also manages the StartCom Enterprise Linux distribution).

I’ve been working on a means to use the already-written X.509/PKIX certificate parsing code to provide services that meet the needs of c2c and b2c communications, as an incremental step over trying to say “you need strong identity” without explaining how it can provide a compelling use case. (Mapping everything to a single non-cryptographically-generated string that is supposed to be globally unique makes very little sense. The key *is* the nym, and there’s no need for any individual, company, or government employer to know about the entire set of keys and nyms that are associated with the same natural person.)

]]> Comment on Federal Digital Identity Proposal Lacking in Usability by Ben Gross http://bengross.com/federal-digital-identity-proposal-lacking-in-usability/#comment-40 Ben Gross Wed, 04 Aug 2010 03:44:12 +0000 http://bengross.com/?p=209#comment-40 Hi Jim. I agree with you. Usability (ease of use in the document) is listed as a priority in the NSTIC proposal, but it is not seriously discussed, leading me to think that the authors do not really consider it important. I hope I am wrong and that the final version includes substantive consideration of usability, overall user experience, and accessibility. More to your point, the proposal should take into account that the usability considerations for low assurance credentials for low value transactions will likely be very different from high assurance credentials for high value transactions. Hi Jim. I agree with you. Usability (ease of use in the document) is listed as a priority in the NSTIC proposal, but it is not seriously discussed, leading me to think that the authors do not really consider it important. I hope I am wrong and that the final version includes substantive consideration of usability, overall user experience, and accessibility.

More to your point, the proposal should take into account that the usability considerations for low assurance credentials for low value transactions will likely be very different from high assurance credentials for high value transactions.

]]> Comment on Federal Digital Identity Proposal Lacking in Usability by Jim Fenton http://bengross.com/federal-digital-identity-proposal-lacking-in-usability/#comment-39 Jim Fenton Tue, 03 Aug 2010 23:51:19 +0000 http://bengross.com/?p=209#comment-39 The Government tends to focus on high-assurance use cases, because they tend to deal with those sorts of applications: large amounts of money, access to sensitive information, or entry to a sensitive facility. What I think they're not paying attention to is the many low-value transactions that take place, like buying a [license to a] song on iTunes or similar service. Low-value transactions are much more frequent, and more subject to abandonment if the system isn't easy to use. This is the whole premise behind one-click ordering: the participants in the transaction have determined that the potential for loss due to fraud is less than the potential for lost business due to friction, and are willing to trade off security for ease of use. NSTIC needs to accommodate that. To put it another way, I don't mind if the authentication required to refinance my house is onerous, but I'm going to do that very rarely. It's the common transactions for which ease of use is most important. The Government tends to focus on high-assurance use cases, because they tend to deal with those sorts of applications: large amounts of money, access to sensitive information, or entry to a sensitive facility. What I think they’re not paying attention to is the many low-value transactions that take place, like buying a [license to a] song on iTunes or similar service.

Low-value transactions are much more frequent, and more subject to abandonment if the system isn’t easy to use. This is the whole premise behind one-click ordering: the participants in the transaction have determined that the potential for loss due to fraud is less than the potential for lost business due to friction, and are willing to trade off security for ease of use. NSTIC needs to accommodate that.

To put it another way, I don’t mind if the authentication required to refinance my house is onerous, but I’m going to do that very rarely. It’s the common transactions for which ease of use is most important.

]]> Comment on Rebooting My Blog by Karl Fogel http://bengross.com/reboot/#comment-3 Karl Fogel Sat, 05 Jun 2010 19:55:43 +0000 http://bengross.com/?p=5#comment-3 Hooray! Many of us have been looking forward to this :-). A WordPress plugin that I wish existed (maybe it does?) is one that would take a mailing list thread -- delivered in mbox format or whatever -- as input and convert that to a blog post with comments. Obviously you'd want to check with the thread participants for privacy concerns and such, but really a lot of the emails you write could be blog posts as they stand, and in most cases the followups do not have anything confidential in them. Hooray! Many of us have been looking forward to this :-) .

A WordPress plugin that I wish existed (maybe it does?) is one that would take a mailing list thread — delivered in mbox format or whatever — as input and convert that to a blog post with comments. Obviously you’d want to check with the thread participants for privacy concerns and such, but really a lot of the emails you write could be blog posts as they stand, and in most cases the followups do not have anything confidential in them.

]]>