Designing for Security
Interesting article on security-aware consumer items.
I especially liked the chair design with a place to hang a purse. Seems like a better idea than the “Chelsea clip.”
Comments
sehlat • August 14, 2007 3:25 PM
The chair design reminds me of the old joke about the young lady who kept her cash stash tucked into her thigh-high stockings. A man robbed her, and he was taken to court for it. When the judge asked why she hadn’t said anything when he reached between her legs, she replied, “I didn’t think he was after the money, your honor.”
Overblown • August 14, 2007 3:38 PM
@derf
What micromanagement?
MS operating systems: set Automatic updates to “ON”. Done.
Toys: Return for refund. Or toss. Done.
monopole • August 14, 2007 3:40 PM
The Chelsea Clip is rather dimwitted in that razoring the strap will easily defeat it . I do like the chair design (l keep a Corduroy wallet in my front pocket for similar reasons).
Of course if this comes into common usage expect to have thieves spilling things into peoples laps and then robbing the mark during cleanups.
My favorite purse defense was the decoy purse from the anime “You’re under arrest!! Mini-specials” which contained a GPS tracker, beartrap like opening, remote controlled teargas grenade, taser, and speaker which were activated in sequence after the purse was snatched.
The problem with the chair is “out of sight, out of mind”. You get up, push the chair in and walk out, forgetting you even put the bag there to begin with.
A self locking bicycle isn’t much use if it can be picked up and easily thrown into the trunk of a car. You still have to lock it to something, which defeats the purpose (unless you’re in Japan).
Linker • August 14, 2007 4:06 PM
Have a look at the referenced “Design Against Crime Research Center” site: http://www.designagainstcrime.com/index.html
derf • August 14, 2007 4:36 PM
@Overblown
Do you know what all of the updates will do? Will they break your existing software? Will they break the OS itself? Will they enable new functionality that you don’t need or want (WGA comes to mind)? Will they further slow your PC? Will they fill up the OS partition?
If you don’t know the answer to these questions, why would you suggest a fire and forget solution like that for a device that people rely on for their personal data, much less their businesses?
In addition to the usual automotive recalls, laptop batteries, spinach, pet food, toothpaste, toys, and cell phone batteries have been recalled due to safety hazards, just to name a few recent examples. This appears to be an increasing problem. I’d rather not have to surf all of the websites for all of the manufacturers whose products I own just to make sure my cell phone won’t explode and take off my leg or that serving the spinach I just got at the grocery store won’t be a fatal mistake. I’d also rather not find out about it when I wake up in the hospital after my leg was amputated.
Maybe we need a consumer item that keeps track of security and safety problems with consumer items?
Peter E Retep • August 14, 2007 4:54 PM
On Related Security Theatre:
Going a few clicks through the story, I encountered a BBC report, presumably accurate: “Small magnets
“The other toys recalled contain small, powerful magnets.
“The CPSC said that there had been 400 reports of magnets coming loose since Mattel recalled 2.4 million magnetic play sets in November 2006.
“It is concerned that “if more than one magnet is swallowed, the magnets can attract each other and cause intestinal perforation or blockage, which can be fatal.”
“The CPSC said that before the initial recall, three children required surgery after swallowing more than one magnet.
Mattel is recalling 18.2 million magnetic toys worldwide, 1.9 million of which were sold in the UK.”
This action is driven by legal liability fears, real and potential claims of law suits, and the fear of the company to be seen in other than a child-safe light. None of which are anti-terrorist concerns. All are probably not discerned as different from movie plot threats.
This conditions the public to expect a large organization to now treat an item [small magnets] as an object Too Dangerous To Be Present.
Will the TSA now outlaw ‘small magnets?’ How about nanobots?
I recall a California measuree that outlawed “any measurable quantity” of a certain chemical element in water because it could be a “carcinogen.”.
When that law was passed, the Least Amount Detectable [therefore publicly perceivable] was an amount about 100 times smaller than the Minimum Lethal Dose, so it made a sort of sense.
Technological advances in a few years made it possible to detect quantities a billion times smaller in size.
But “the law [was] the Law” so it was a Big Deal to be reworded, and several political careers were ended on charges of being ‘pro-pollution’ .
In fact the law outlawed nature itself. It’s like the city that outlawed that dangerous DiHydroMonoxide stuff getting into the hands of kids.
Oh, but that’s illegal to bring into an airport now, in any usable quantity, right?
Overblown • August 14, 2007 5:55 PM
@derf
“Do you know what all of the updates will do?”
Yes, they close security holes.
“Will they break your existing software?”
If your existing software is insecure (relative to what the patch fixes), they might, yes. No extra charge for pointing out 3rd-party sec vulns you didn’t even know you had.
“Will they break the OS itself?”
No.
“Will they enable new functionality that you don’t need or want (WGA comes to mind)?”
Nobody needed or wanted email 25 years ago. Now you can’t go a day without it.
“Will they further slow your PC?”
Not if it’s not already loaded with crapware.
“Will they fill up the OS partition?”
Is this really a problem for you? Hard drives are 25 cents per GB now. Give me your address, I’ll send you a quarter and you’ll be set for the next decade for space used by MS updates.
“I’d rather not have to surf all of the websites for all of the manufacturers whose products I own…”
So don’t. Accept the risk like an adult, and quit complaining about having to exert responsibility for your own health and safety.
When you put toothpaste or spinach in your mouth or push a mobile phone against your ear, you better have educated yourself about what those chemicals are, who’s doing your harvesting, and how electronics work, or you’ll be stuck letting someone else do your thinking for you.
If the thinking involved is too tough on you, put your wallet back in your pocket, and DON’T BUY.
If that’s too much to ask, realize that the producers of this world have neither the time, nor the inclination to spoonfeed someone who rises and sleeps under the blanket of the market economy which they provide for him, and then questions the manner in which they provide it. They would rather he just say thank you, and be on his way. Either way, they don’t give a Nader’s Uncle what you’d rather or rather not find out because you’re too lazy to sign up for email alerts.
Pat Cahalan • August 14, 2007 7:11 PM
@ Overblown
When you put toothpaste or spinach in your mouth or push a mobile phone against
your ear, you better have educated yourself about what those chemicals are, who’s
doing your harvesting, and how electronics work, or you’ll be stuck letting someone else
do your thinking for you.
What about if you’re taken to an emergency room and given a drug about which you’ve done no research, which happens to have a bad reaction to your individual body chemistry? What if a security vulnerability in a software package you don’t use and don’t care about leads to a successful attack against a computer maintained by your employer that has your financial information in resident memory? Are you seriously suggesting that if you hire a contractor to do work on your house you need to research the vendor for his copper piping to ensure you don’t get piping laced with some trace metal that is going to cause you cancer?
I highly doubt it is even possible to trace the source of every product even a discerning, aware, reasonably careful shopper may buy.
It’s certainly not possible for you to check the source for every product that is included in every product that you buy, or every product that may be used or deployed by someone else that you may be forced, directly or indirectly, to rely upon.
If you cannot establish some baseline level of trust in a society, you can’t have a market economy or any reasonably complex level of civilization.
Overblown • August 14, 2007 7:30 PM
@ Pat Cahalan
“What about if you’re taken to an emergency room and given a drug about which you’ve done no research, which happens to have a bad reaction to your individual body chemistry?”
If you have a condition, wear a Life-Alert bracelet. My wife does.
“What if a security vulnerability in a software package you don’t use and don’t care about leads to a successful attack against a computer maintained by your employer that has your financial information in resident memory?”
Don’t use your emmployer’s computer to do your own finances (read: No Ebay at work.)
“I highly doubt it is even possible to trace the source of every product even a discerning, aware, reasonably careful shopper may buy.”
As I said, so don’t buy the ones you didn’t research.
“It’s certainly not possible for you to check the source for every product that is included in every product that you buy, or every product that may be used or deployed by someone else that you may be forced, directly or indirectly, to rely upon.”
Name one product that you’re “FORCED” to use.
“If you cannot establish some baseline level of trust in a society, you can’t have a market economy or any reasonably complex level of civilization.”
I agree. That’s precisely why you need to do your own “establishing”, because you know best how comfortable you feel with a given level of trust.
But when the trust you’ve extended is violated, don’t complain that the world owes you an ice cream cone to make you feel better. Sever the relationship with that manufacturer/retailer, if you judge it appropriate, take responsibility for your error in extending as much trust as you extended, and reassess the situation, now with more experience.
“Are you seriously suggesting that if you hire a contractor to do work on your house you need to research the vendor for his copper piping to ensure you don’t get piping laced with some trace metal that is going to cause you cancer?”
If you want to place trust in others to make judgments concerning your health and well-being, go right ahead. But be mature enough to realize this: the incentive THEY have to make sure your interests are best served, is never as clear as the incentive YOU have, for one reason: it’s YOUR life, not theirs.
The chair kind of reminds me of the time I went to sleep on the floor of an airport in Brussels during something like a 12-hour layover. I was paranoid so I wrapped the straps of my bags around my legs.
columbus • August 15, 2007 1:50 AM
I was just wondering: Does anyone know of any digital cameras that produce digitally signed photographs? I know someone who sometimes needs to use photos as evidence and film cameras are now becoming obsolete.
Yosi • August 15, 2007 2:06 AM
@ Overblown
Sorry to disappoint you, but your little “research” worth near to nothing, and in best case bring you false sense of security.
Are you suddenly become specialist in microwave electronics, organic chemistry, drug application, construction standards, etcetera? Here’s a news – you are not.
So, you’ve read “cell phone emit microwave” – and you call this “research”?! You have no idea about what “emit” is, what “microwave” is, how power is measured and so on. Same apply to toothpaste, drinking water, car safety, you name it.
Martin • August 15, 2007 3:00 AM
@columbus:
The Nikon D2XS, D2HS, D2X and D200 digital SLRs support “Image Authentication” with optional extra software. I’m not sure about the technical details, but I assume that they use digital signatures:
http://nikonimaging.com/global/products/software/img_auth/index.htm
Several other manufacturers also support image authentication, probably by putting a signed hash of the image in the EXIF data.
This list of links (“Admissibility of Still, Digital Photographs (images) in Criminal Trials”) might also be relevant:
Colossal Squid • August 15, 2007 3:59 AM
“The CHELSEA CLIP is a unique deterrent which has a proven track record, providing a feeling of security for the public.”
Says it all really.
Particular Random Guy • August 15, 2007 5:06 AM
The Chelsea clip states that it is indestructable under normal use.
I wonder whether theft is part of “normal use” …
anon • August 15, 2007 7:27 AM
I question if purse security measures are a worthwhile use of resources vs. simply shooting the thieves.
Gunning down every feral child in the UK would be a lot cheaper than retrofiting every establishment to make it slightly harder to steal things.
Signe • August 15, 2007 9:51 AM
The trouble with the chair is that it will only hold a purse with a certain type and length of strap. The clip looks like it will accomodate various purse handles (including thick ones made of solid plastic or wood) and if a strap is long, the purse will just hang lower– a chair seat is usually just 18 inches from the ground which limits use with longer straps or larger bags.
Signe • August 15, 2007 9:53 AM
The trouble with the chair is that it will only hold a purse with a certain type and length of strap. The clip looks like it will accomodate various purse handles (including thick ones made of solid plastic or wood) and if a strap is long, the purse will just hang lower– a chair seat is usually just 18 inches from the ground which limits use with longer straps or larger bags.
Also, note that the clip puts the bag right in front of the customer, making it hard for someone to cut the strap and take the bag undetected.
Signe • August 15, 2007 9:53 AM
The trouble with the chair is that it will only hold a purse with a certain type and length of strap. The clip looks like it will accomodate various purse handles (including thick ones made of solid plastic or wood) and if a strap is long, the purse will just hang lower– a chair seat is usually just 18 inches from the ground which limits use with longer straps or larger bags.
Also, note that the clip puts the bag right in front of the customer, making it hard for someone to cut the strap and take the bag undetected.
markm • August 15, 2007 2:49 PM
Overblown: Have you ever read the Microsoft software license? Notice how it says they aren’t responsible if it trashes your system and deletes your data? (That’s what it means when it says their warranty doesn’t cover “incidental and consequential damages”.) Notice how it even relieves them of responsibility for Windows working at all?
“Do you know what all of the updates will do?”
Yes, they close security holes.
How do you know that? And does it make you feel good that they’ve patched thousands of security holes and have no idea how many more there are?“Will they break your existing software?”
If your existing software is insecure
(relative to what the patch fixes), they
might, yes. No extra charge for pointing
out 3rd-party sec vulns you didn’t even
know you had.
It’s not just security issues. There are all sorts of subtle interactions under the hood. A lot of us have to use rather specialized software that isn’t available from many sources, and frankly, a lot of it isn’t very well written – but it’s critical to the particular jobs we do.“Will they break the OS itself?”
No.
It’s happened several times.“Will they enable new functionality
that you don’t need or want (WGA
comes to mind)?”
Nobody needed or wanted email 25
years ago.
And the way Microsoft enabled it added thousands more gaping security holes. Are you going to count on them not adding something equally poorly thought-out, and turning it on by default?
It might be necessary to let MS download patches to your machine without understanding what they do, but anyone who is happy about letting a company that feels the need for that much legal coverage mess around with the computers running his business is either insanely optimistic or just plain ignorant.
Andrew • August 16, 2007 2:01 PM
The chair design is brilliant. My girlfriend recently had her purse lifted in a resturant. This is so simple – yet so brilliant.
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
derf • August 14, 2007 3:06 PM
Does this mean we’ll have even more products requiring “critical” security updates like:
http://www.microsoft.com/technet/security/bulletin/ms07-aug.mspx
or being recalled because they’re unsafe like:
http://www.mattel.com/safety/us/
I just don’t have time to micromanage any more of my consumer items’ security problems.