Call Guardian

Sometimes, when I have had a load of junk cold calls on my mobile – you know the ones – had an accident recently? / claim back your PPI? / – it would be nice if it had call guardian like the landline does (but not enough to make me change phones )

Since getting a phone with Call Guardian, the cold calls went to zero, nil, zilch, none – you get the idea 🙂

An incoming call has a series of potential hurdles to surmount before the caller actually talks to me.

The first barrier is Anonymous Call Reject – like the name suggests, it is designed to reject any calls where the caller is witholding their number, they get a polite message telling them they must disclose their number to be connected.
However ACR has a few weaknesses – because it is designed to only reject calls that actively refuse to disclose callers number it is no protection to number stripping and number spoofing.
The easiest way to understand how ACR works is to imagine it as a butler receiving callers at the door and asking them for their calling card – no card, no entry; have a card, and entry is granted.

Number stripping is where the number is removed, and a blank field presented instead – it does not actively refuse to divulge the number, simply presents no number – it is a bit like giving the butler a blank piece of card, since the butler does not examine the card the butler accepts it and permits entry.
Number stripping can happen unintentionally, in certain telephone networks, where there is no direct dial number for the originating call, and as the number exits the internal network the internal extension number is dropped but no new replacement number for the switchboard substituted.

Number spoofing as the name suggests is where the originating number is exchanged for a different one – a bit like giving the butler someone elses card.
It can be done for perfectly legitimate reasons, for example to ensure any return calls are passed through a centralised call handling system eg our GP surgery, all the GPs have direct lines in their consulting rooms, but they would not want patients phoning directly at random, so the surgery switchboard number is displayed instead.

So, the call passed ACR it now arrives at my phone. It now faces the next test: Call Guardian.

Call Guardian is like an automated PA, screening all incoming calls. It runs through a few steps.

First step is: Is it a known number? ie is it on the whitelist or blacklist?

If it is a known number, and on the whitelist, then the call is put through with no further interaction from the phone.
If it is a known number, and on the blacklist, then the call is rejected and the caller informed that their call has been refused.

If it is not a known number, the next step is to identify the caller.

The caller is played a brief message asking them to identify themselves. The phone then informs me that I have an “announced call” and plays the callers message.
I now have 3 choices:
accept call – pick up the phone and talk to the caller
reject call – play the caller a message telling them their call has not been accepted
send to voicemail – direct caller to leave a message.

With the mixture of these, most cold callers and automated diallers are kept away, as they want to talk to a person not an automated response system.

Incidentally, you do not need worry about an old friend who hates machines getting locked out, the phone still records the incoming call numbers, so you can see who called, even if the phone did not ring, and ring them back / add their number to allow list

/0 Comments/by

How Anonymous Is Anonymous?

In recent years there has been a rise in awareness of the issue of online anonymity, but what does it mean and is it realistic?

In broad terms anonymity can be taken to mean the ability to have your individual identity protected.

Most tools and sites take the approach of making you look as similar in appearance to other users, hiding your personal identity behind a shared identity.  This is similar to dressing up in a chicken suit when taking part in a marathon.  If you can persuade other competitors to also dress up in chicken suits, you all appear the same and so your personal identity is concealed.  The most common way a website can detect your identity is via your web browser, as this is the means by which you interact.  Sites like Panopticlick attempt to illustrate how similar or different your settings are to other users to determine how anonymous your connection is.

There is another way of assessing anonymity and this is behavioural anonymity – do you behave like other users?  Taking the previous analogy of the chicken suit runners, you may look like the other chickens, but taken as a whole, most runners wear typical running outfits and the chickens stand out from the rest.  Sites like whoer look at the issue of anonymity from this perspective, and assess how similar you are to other internet users behaviour, hiding in plain sight in effect.

There is a debate about which method is better, supporters of the first method argue that behavioural anonymity discourages people from protecting their identity.  Supporters of the second method argue that if you make yourself identifiable by attempting to avoid detection you defeat the first objective of anonymity of being unidentifiable, and so attract more attention.

The rise of sites using detection analytics to prevent ‘anonymous’ users from using them is testimony to the fact that the battle is being fought on several fronts.

Whilst it is not impossible, the two methods are very different in their approach and so generate difficulties in reconciling them – the more you tend towards one method, the more you tend away from the other.  The reality is probably that you will never achieve perfect anonymity, so the question is
“what degree of anonymity is acceptable?” 

Every one will have a different, and personal answer to that question.

/0 Comments/by

Improve Your Searching

Search Engines are a great tool, but often they can produce an overwhelming number of results that makes it harder to work out which are the best results for you.

There is no simple answer to this problem, in part it is a skill that comes with practice, the more you do it, the easier it becomes.


However I was recently asked how to start on the process of being a better search engine searcher, so here are a few pointers:
I start by trying to define the search question as precisely as possible in as few words as possible, then I try to remove as many ‘superfluous ‘ words from the question to generate the keywords, these then become my search term

If I see a lot of unwanted results coming up, I exclude them by minus-ing them in the keyword list (plus means AND minus means NOT in logic operations for search engines)
example: I was fairly sure that google was now officially a verb and not just a casual expression, as in “I will google that”
initial (human) question
>> is google defined as a verb in the dictionary? <<
but search engines do not always understand sentences since they try to extract the keywords to search against so I reduced it to
>> google verb dictionary  <<
this worked, but lets assume I was getting a lot of results for google the company and google the website, to emphasise the keywords I did want and the keywords I did not want I could write the refined search as
>> google +verb +dictionary -website -company  <<
in logic terms this equates to google AND verb AND dictionary NOT website NOT company
Note: the advanced search feature on most search engines will do this for you, I just short-cut what they are doing

Sometimes you have to think laterally if your initial search is not producing the results you want
example, I was recently asked to help someone who had seen a craft bag on wheels with side pockets in a catalogue but it was out of stock, she tried searching online but was having no luck as the results kept giving the wrong sort of bags. So I looked at the picture in the catalogue, and saw it looked like the little pull-along bags I see at on my daily commute. So I searched
>> pull-handle travel bag pockets <<
and soon found a few likely candidates for her, it was a case of thinking not ‘what is it called ‘ but rather ‘what is it and what can it be used for.

/0 Comments/by

How Good Is Your Password

We are always being encouraged to set a good strong password, but what is a good password and how do you create it?

Recently, advice on passwords changed – for many years the advice had been to choose long, highly complex passwords featuring letters, numbers and special characters, and indeed many password checkers still rely on this to decide if a password is a good or bad password.  However this has been questioned recently for several inter-related reasons: namely it failed to take into consideration that people are predictable, so they either wrote the password down somewhere; or they used logical words with predictable substitutions (eg pa$$w0rd); or they simply used one of the popular passwords (eg 123456, qwerty, 1q2w3e4r, mynoob, password)

The logic behind the complex password is that it makes it harder to brute-force crack it by increasing the number of possible combinations, ie a 8 character password using just lower case characters has 208,827,064,576 possible permutations, if you include upper and lower case characters that becomes 53,459,728,531,456 possible solutions, include numbers as well and it becomes 218,340,105,584,896 possible solutions, if you were to include just the 10 symbols above the number keys it would expand to 722,204,136,308,736 possibilities.  So each time the increase in complexity adds a higher factor of possible solutions, and hence will take a computer longer to cycle through the possible solutions.

The online password tester predicted times to crack these are using a modern desktop pc:
qscfthnj (8 lowercase characters) – 9 minutes
QscFthnJ (8 upper and lowercase characters) – 2 days
Q5cFthnJ (8 upper, lowercase and numeric characters) – 6 days
Q5cFthn* (8 upper, lowercase, numeric and special characters) – 6 months

However, as I pointed out before – these predictions of password strength are slightly misleading because they work purely on the complexity of the password and not the content.  People are not computers and do not easily remember random strings, so they either use a ‘memorable’ password (such as a pet’s name, favourite team, etc) or they create one or two ‘strong’ passwords and reuse them for all their passwords (both bad ideas) – I am guilty of this too, I have created passwords based on memorable words and then used them on multiple sites. (Kl33nex is a lot easier to remember than Of7gcP6 for example)

So what is to be done?  The current suggestion is to use word strings, eg onetwothreefour as they are more easily memorable and hopefully generate longer passwords.  However this is a flawed idea, it overlooks the human tendency to still use memorable (ie predictable) words in the string, and most password cracking tools will use dictionary attacks, where they try known words in combination and with obvious substitutions first.

A better solution is to use a password manager in combination with password generator to create and store stronger, random passwords.  There are many password managers available, with different features and price-tags. Different people will opt for different solutions based on their needs and attitudes towards risk and convenience.

But what is a password manager anyway?  At its most basic it is a list of passwords and login details stored in a single location.  Ideally you would want the storage to be ‘locked’ but still reasonably accessible.  A simple, but effective enough solution would be spreadsheet or text document that is password protected, ideally without too obvious a name – eg passwords.xls might be a hint to someone looking through your files what is inside 🙂  Dedicated password managers can offer additional features, such as the ability to auto-complete website login forms, the ability to share the passwords between devices, the ability to generate secure passwords.

As I said previously there are dozens of password managers, each with their relative strengths and weaknesses, and what one person may consider to be a strength another person may consider a weakness.  Things to consider when choosing a password manager:
How strong is the encryption on the storage?
Does it integrate with other software, eg browsers?
Will it generate passwords, and how much control do you have over this process?
Can it be used on just one device, or multiple devices?
Is it online or offline ie can you access it anywhere with an internet connection, or do you need to install it to the device first?

My preferred solution is KeePass because it is platform independent (works on just about anything – windows, linux, mac, android, ios, blackberry, etc), it is free, the app is separate to the password database, password databases can be secured by password or keyfile, auto-complete passwords can be sent in multi-pass mode (prevents keyloggers capturing the password en-route), uses AES encryption, is totally portable – can be run from a USB stick without installation on Windows systems, and is OSI certified.  NOTE: for me the fact that it is not by default an online app is a bonus (although you could upload the password databases to an online file sharing service) but others may find this a drawback, not least the fact you manually have to synch separate copies if installed to multiple devices – horses for courses.
other password managers include:
1Password
Dashlane
LastPass
LogMeOnce
Keeper
Password Boss
Roboform
Sticky Password
True Key

/0 Comments/by

Why HTTPS Is Not The Security Blanket You Think

In the past few years there has been a rise in the number of security experts advocating people actively seek sites with https / ssl certificate protection, and with reason.  However in the drive to push https, many have been guilty of unintentionally over-stating the benefits of SSL certificates.

Browser companies are just as culpable with the use of padlocks and the use of words such as ‘secure’ to give a mis-leading impression of what https means.  To be clear, all the https padlock means is that the data between your browser and the site is encrypted and can not be read in transit by a third-party.  It makes no claim as to the reliability or accuracy of either the site or the content on the site.  In the past year, over 15,000 SSL security certificates have been issued to sites known or believed to be engaged in phishing activities.  This means these sites will display the ‘secure’ padlock symbol when visitors land on their site, and many will be duped into believing the padlock means the site is safe to use, in part because of the exhortations by experts to seek sites with the hhtp padlock symbol in the address bar.

The problem lies in what and how a SSL certificate is and how it is issued.  At its most basic, a SSL certificate simply means that a third-party, the Certificate Authority (CA), confirm that the domain name is valid, and that the owner has applied for a SSL certificate.  The actual checks on the owner are minimal to non-existant for the simplest certificate (Domain) since all it checks is that the certificate being presented matches the one registered to that domain, there is no check made on who the owner is, or how reliable or otherwise they are.  Next level up from Domain is Organizational certificate, this incorporates third-party checks on the identity of the owner of the domain.  However, it is very hard to tell without actually hovering over the padlock what type of certificate (Domain or Organizational) the site is using, so the benefits can be hard to quantify.

This means that a fraudster can get a free SSL certificate, and use this apparent ‘security’ to gain a degree of trust that visitors should not be granting.  Education is obviously a critical part of the equation, teaching people to be more understanding of the technology used, and what it does and does not do (and this includes the ‘educators’ and experts – they must be more clear in explaining security principles).

Beyond that though, there is a question of should there be a better way of displaying security in the browser, starting with a consistent way of describing and rating site security – different browsers can give differing opinions and presentation on the security of a site, especially those with mixed layers of security, leading to some confusion over the safety or otherwise of sites.  Several organisations have attempted to do this, such as the Web Of Trust initiative, but that was fraught with the fact that ordinary users were rating sites, and often they were failing to understand issues they were experiencing resulting in mis-rating the wrong sites, which was compounded by near zero moderation or review of ratings granted.  Some better initiatives were the site seal by CAs issuing Organisational and Enterprise SSL certificates which attempted to reflect the higher degree of scrutiny that the owner under went to gain the certification.   However since these were unregulated, it could be hard for a visitor to tell the difference between say a Thawtes site seal and Acme site seal.

/0 Comments/by

This Crazy Thing Called Life

One of the complaints I often hear is that I am contrary, and in many ways I am.

This however is a reflection of my personality, formed over years of life experiences.  I can seem open and closed, talkative and quiet, outgoing and reserved, the list goes on.  I have developed \’coping strategies\’ over the years, and this means I react differently in different situations and how I feel about them, and even from day to day I may react differently in the same situation.

One thing that often confuses is that I have a multitude of ‘faces’ to help me deal with what is happening around me, bizarrely to many I can seem very open and sharing, and yet there is a mental disconnect – what I say does not affect what I am thinking and feeling, this can result in people thinking that they have a connection that simply does not exist.

I am in some respects a “people person” in that I can engage with and socialise with people, and yet I am also a isolationist, happy with my own company.  I need people to inspire and encourage me, left to my own devices I retreat inwards, but I need space to be alone – if I can not do it physically, I do it mentally, I retreat inside my mind.

A good example of this is distant learning.  I started a web-design course a few years ago that was distant learning, and I struggled with it, I felt my tutor was not interested in my questions and not engaged with me.  Ultimately I dropped it.  By contrast, FutureLearn uses a MOOC approach, where tutors and students can interact with each other in a kind of giant virtual classroom – I study when and where I like, but can still chat with other students and ask questions – even at 1am in bed 🙂

My life is a constant, non-stop conversation – if it is not a monologue, it is a dialogue.  Conversations with multiple people regularly take place in my head.  I tell myself stories, I discuss things occurring in my life, I work out problems and issues I predict the future and revisit the past, silence is never there – probably when I am sleeping I am talking to myself.

I have possibly confused psychologist when they ask questions like “do you hear voices in your head?” because the answer is yes, I do.  and they do tell me what to do.  but that is life – people telling me what to do – sometimes I agree, and sometimes I do not.

Am I “crazy”?  possibly, but if I am crazy then it is normal for me to be crazy.  I have no plans (at the moment) to run amok, or take all my clothes off and dance to the rites of spring or build a tower to the moon

An anomaly that is in part a reflection of the way I see the world is that I do not ‘see’ things in the conventional sense, especially people.  I have impressions that form my view – as an example, I can not describe even those people closest to me, their ‘image’ is as much a series of vague intangibles rather than a specific physical attribute.  This makes me terrible at recognising people – I see similarities where others see none, and fail to spot similarities that everyone else can see.  Just don’t ask me to do a identity parade, I would no doubt accuse the Chief Inspector of being the thief that stole my wallet!  I am probably a celebrities dream, I could pass them in the street or be sat next to them in a bar and not even notice.

In short, if you think you know me – you are doing better than anyone else ever has 🙂

/0 Comments/by

Buzz Words

The thing about language is that it is constantly changing and evolving, and words and expressions come in and go out of fashion.

Often though, a new buzz word or phrase will become mis-used and the meaning corrupted.

A good example of this is the recent rise of the use of the expression “cognitive dissonance”

I often see it being used to refer to someone who is happily or unwittingly holding contradictory views, yet this is an incorrect use of the term.  Cognitive dissonance is actually described as

“anxiety that results from simultaneously holding contradictory or otherwise incompatible attitudes, beliefs, or the like”
Dictionary.com

Notice that when correctly used, cognitive dissonance introduces mental discomfort caused by the awareness that the views are incompatible with each other – so the person can not honestly be described as ‘happily holding’ or ‘unwittingly holding’ contradictory views, since this would not bring about the required dissonance.

Sadly, most people will continue to blithely mis-use words because they do not understand the true meaning, but the word or phrase has become ‘popular’ and apparently a social imperative has arisen to be seen to be using the ‘in’ words, so they continue to mis-use them and perpetuate the mis-use in doing so.

/0 Comments/by

What is… Democracy

There are certain terms that people think they understand, but when you ask more closely, you realise that people’s understanding of the meaning can vary widely.

Democracy is an example of this, if you look at what the meaning is as defined by academics, you find the meaning is more precise than some might realise

The Oxford English Dictionary defines it as:
A system of government by the whole population or all the eligible members of a state, typically through elected representatives.

The dictionary also clarifies that the usage of democracy often refers to specific methods of democracy, such as:
Control of an organization or group by the majority of its members.
The practice or principles of social equality.

However these are examples of how the idea of democracy is implemented, and not absolute definitions of democracy.

For practical reasons, it is generally inefficient to try to engage all the eligible members of a population in voting on all the issues that may affect them, hence why we see the rise of representative democracy in most societies – the population elect a smaller group to act on their behalf and represent them.

One of the problems with representative democracy is the methodology of electing the representatives, and the consequences this produces.

To understand this lets look at a fictional school, Anytown High:
lets look at a class election in a class of 20 students:
Sam receives 6 votes
Lou receives 5 votes
Jo receives 4 votes
Des receives 3 votes
2 students did not vote

Now under “First Past the Post”, as the student who received more votes than any other student, Sam would be elected, however critics would argue twice as many votes were cast for other students as for Sam, so this would not represent the view of most students.

A solution might be to have a run-off between the top 2 students, in this run-off
Sam receives 9 votes
Lou receives 8 votes
3 students did not vote\

So we will say Sam is elected as having received more votes than the other candidate, even though technically Sam received less than half of all the votes available.

The number of people not voting can often be cited as cause to not accept a result, especially if a relatively high number of votes are not cast.

Now lets look at what happens when all the class representatives meet, we will assume there are 6 classes, and each class had 2 ‘parties’ – Woozle Party and Neezle Party
Class 1:
Woozle 9 votes
Neezle 8 votes
Class 2:
Neezle 14 votes
Woozle 6 votes
Class 3:
Woozle 13 votes
Neezle 6 votes
Class 4:
Neezle 14 votes
Woozle 5 votes
Class 5:
Woozle 12 votes
Neezle 8 votes

Woozle won 3 classes and Neezle won 2 classes, so there are more Woozle members than Neezle, however if you look at total votes cast within the classes, there were 45 votes for Woozle and 50 votes for Neezle.

This is where we often get complaints about the representative democracy system, where even if the individual representatives received a majority of votes in their individual election, when collated as a whole, the grouping may have received less than half the votes cast. This is a fundamental problem with the representative system, when scaled up you still get the same criticisms of lack of proportionality and accountability as you do at the lower levels, but short of electing our governing bodies directly, this is a problem we will not be able to get around – the mechanics of the system generates the possibility of differences in the individual elections being not represented in the wider body. Most of the time, this incongruity is accepted as the price of the efficiency of the election process, but inevitably there will be some who seize on these differences to make the case that the system is “un-democratic”

/0 Comments/by

Lies, Damned Lies, and Statistics

I recently came across a disingenuous use of statistics to support an argument, but sadly it is one that I see on an increasingly frequent basis.

A poll was held with 2 options A or B

Option A was the most popular response, but the author supported option B

Therefore, in order to validate why Option B was the ‘right’ answer, they sub-divided the responses to A into A1, A2, A3, A4.  Having created these sub-options, they then argued that option B had more support than any of the sub-option A responses, and therefore should be regarded as the valid result.

They ignored the fact that option B could equally have been divided into sub-options, and consequently these new sub-options would have not been able to attract a majority opinion either.

However, this is not a new tactic, political parties and pressure groups have been using this re-interpretation and re-classification of results to generate a mis-leading view of the statistics for many years.  Even when they use apparently valid terminology like “weighting”, “re-sampling”, “corrected” this often hides the primary motive to present the data in a way that fits their agenda or pre-conceptions.

What is a cause for concern is that as people become more and more attuned to a sound-bite, easily digestible, news flash style of information presentation, they become less and less inclined to check the information being presented, or validate the claims being made – it is easier to click ‘share’ on facebook than it is to check the source for accuracy.  This leads to an over-reliance on other people to supply their information, and leaves the recipient vulnerable to bias.  Indeed, often when I have challenged people about the reliability of information they have shared, they expressed no idea of how to verify or check the facts for themselves – they just blindly trust that the information is right.

We are living in a world where the ability to check facts is more easy than it was say 10 years ago, yet people are showing less and less critical  analysis of information being presented, and this could well lead to a new underclass of the research-poor, where the only information and knowledge they have is that which others choose to share with them, and so far more easily manipulated.  Whilst many people are aware in some degree of bias in the print media, they are totally unaware of bias in digital media, assuming it is mysteriously free from the bias that they appreciate exists in more traditional forms of media.

Maybe the solution is to introduce courses in digital literacy, including how to research and fact-check information presented online.  I accept that some people will for a variety of reasons opt to not avail themselves of such opportunities, but as they say “you can lead a horse to water, but you can not make it drink”.  Education, of all ages and groups of society is a key to social improvement – we have campaigned to see access to education and opportunities extended to minorities over the last century, and the challenge is not done – we must continue to push for ongoing education to prevent segments of society being left behind.

/0 Comments/by

Perfecting imperfect decisions

“If you have a choice between being right, and being kind, choose being kind”

This piece of advice was given recently, and it has a lot of value, but what if you have a choice where being ‘kind’ to one person means being ‘cruel’ to another?

Many years ago when I was starting my adult journey, I received a great piece of advice when trying to make a decision that would have long-term consequences potentially.
Never be afraid to make a hard decision; and once made, do not waste time rehashing the past or regretting your decisions – what is done is done, learn from the past and move on to the future.

There are decisions I have made that possibly I would have handled differently with the benefit of hindsight, but I made the decision that seemed right to me at the time.  I attempt to learn from the errors in how I handled the decision and try to not repeat them in the future.

We may not always make decisions that are easy, and sometimes the decisions we make will cause upset to someone else.  Never rush these decisions if you have time to reflect a while longer.  Taking the time to consider the decision, the options and the consequences will help you both make a better decision, and be better prepared to handle the out-working of the decision

/0 Comments/by