Cybersecurity Project - Revision history

BerkmanSysop: UTurn to 1267401600

2024-08-14T19:57:03Z

UTurn to 1267401600

Show changes

192.168.10.74: Positive Words Beginning with J

2022-04-30T06:38:09Z

Positive Words Beginning with J

Show changes

180.253.143.96 at 15:19, 9 July 2014

2014-07-09T15:19:02Z

← Older revision		Revision as of 15:19, 9 July 2014
Line 18:		Line 18:
	Cybersecurity is a huge, complicated problem, conceivably including everything from keeping the electrical grid from going down to garden-variety phishing spam. We consciously left the [http://www.sandia.gov/scada/history.htm SCADA] problem to those in government and industry, and focused on problems that face ordinary users.		Cybersecurity is a huge, complicated problem, conceivably including everything from keeping the electrical grid from going down to garden-variety phishing spam. We consciously left the [http://www.sandia.gov/scada/history.htm SCADA] problem to those in government and industry, and focused on problems that face ordinary users.

	We suggest tools that rely both on the power users who have contributed much to the internet's development as well as the ordinary users who are the overwhelming share of people online today. Bottom-up solutions seem improbable when they begin; Wikipedia and Firefox, to take just two examples, were thought to face extremely long odds. We believe that giving users the tools they need to take control of their own security can improve users' experiences on the net, as well as convincing major market players to adopt similar solutions that will help everyone, including those users who haven't taken affirmative steps to protect their security.		We suggest tools that rely both on the power users who have contributed much to the internet's development as well as the ordinary users who are the overwhelming share of people online today. Bottom-up solutions seem improbable when they begin; Wikipedia and Firefox, to take just two examples, were thought to [http://goo.gl/rsahb4 tablet] face extremely long odds. We believe that giving users the tools they need to take control of their own security can improve users' experiences on the net, as well as convincing major market players to adopt similar solutions that will help everyone, including those users who haven't taken affirmative steps to protect their security.

	===Nudging Users===		===Nudging Users===
Line 33:		Line 33:
	==Public Service Announcement==		==Public Service Announcement==

	We created a Public Service Announcement for generating public awareness for the cybersecurity problem, and showed it in class on January 19. It's online [http://vimeo.com/8937782 here] but is password-protected. Please email us if you were in the class and would like the password.		We created a Public Service Announcement for generating public awareness for the cybersecurity problem, and showed it in class on January 19. It's online [http://goo.gl/OwZVGm tv] [http://vimeo.com/8937782 here] but is password-protected. Please email us if you were in the class and would like the password.

	The upshot of the video is that we don't think a direct public awareness campaign will be very effective. We believe it would be more productive to nudge users and change their behavior by altering the way browsers and websites work, not by scolding people in 30-second TV ads.		The upshot of the video is that we don't think a direct public awareness campaign will be very effective. We believe it would be more productive to nudge users and change their behavior by altering the way browsers and websites work, not by scolding people in 30-second TV ads.

BerkmanSysop: UTurn to 1265097600

2013-11-12T20:33:10Z

UTurn to 1265097600

← Older revision		Revision as of 20:33, 12 November 2013
Line 3:		Line 3:
	Saying that cybersecurity is a "difficult problem" is like saying that reversing global warming is a difficult problem: it's true, but it doesn't quite capture how devilishly complicated and multifaceted the problem really is. There's no single reason why creating a more secure global network is so difficult; it in part has to do with the radically-distributed architecture of the Net, in part with some deep flaws computer software for both consumers and businesses, and in part from the network's sheer size and importance to our daily lives. (For more on this, see the nice [[Cybersecurity]] backgrounder.)		Saying that cybersecurity is a "difficult problem" is like saying that reversing global warming is a difficult problem: it's true, but it doesn't quite capture how devilishly complicated and multifaceted the problem really is. There's no single reason why creating a more secure global network is so difficult; it in part has to do with the radically-distributed architecture of the Net, in part with some deep flaws computer software for both consumers and businesses, and in part from the network's sheer size and importance to our daily lives. (For more on this, see the nice [[Cybersecurity]] backgrounder.)

	Our group approached the problem not with the goal of inventing a panacea that would make all credit card transactions magically secure and make it impossible for hackers to. Instead, we wanted to offer suggestions with minimal implementation headaches and maximal benefit to users, from novices to experts.		Our group approached the problem not with the goal of inventing a panacea that would make all credit card transactions magically secure and make it impossible for hackers to [http://googleblog.blogspot.com/2010/01/new-approach-to-china.html compromise Gmail's security]. Instead, we wanted to offer suggestions with minimal implementation headaches and maximal benefit to users, from novices to experts.

	The final "product" of our month-long thinking on this issue begins with a reasonably short video overview of our ideas (or see below), explains some of the details of our proposal, and also has an alpha-release Firefox plugin that you can download and try out (thanks to for making the plugin possible, by the way).		The final "product" of our month-long thinking on this issue begins with a reasonably short video overview of our ideas [http://www.vimeo.com/9036735 here,] (or see below), explains some of the details of our proposal, and also has an alpha-release Firefox plugin that you can download and try out (thanks to [http://www.elance.com/ Elance] for making the plugin possible, by the way).

	~~Ps0bE0~~		=Overview=

	~~3nDp7X read~~ some ~~ppt~~ on ~~slideshar~~		We discussed this topic at length in an in-class presentation on January 19. [http://www.vimeo.com/9036735 This] 9-minute video summarizes and extends the presentation we gave that day. The details on this page elaborate on the proposals mentioned in the video.

			=Guiding Principles=

			Before turning to the specific proposals we've made to improve cybersecurity, it's helpful to discuss some of the guiding principles that have informed our work. We applaud the [http://www.whitehouse.gov/assets/documents/Cyberspace_Policy_Review_final.pdf government's] attempts to improve cybersecurity, but don't believe that a top-down, regulatory or legislative solution is a panacea.

			===Empowering Users===
			Cybersecurity is a huge, complicated problem, conceivably including everything from keeping the electrical grid from going down to garden-variety phishing spam. We consciously left the [http://www.sandia.gov/scada/history.htm SCADA] problem to those in government and industry, and focused on problems that face ordinary users.

			We suggest tools that rely both on the power users who have contributed much to the internet's development as well as the ordinary users who are the overwhelming share of people online today. Bottom-up solutions seem improbable when they begin; Wikipedia and Firefox, to take just two examples, were thought to face extremely long odds. We believe that giving users the tools they need to take control of their own security can improve users' experiences on the net, as well as convincing major market players to adopt similar solutions that will help everyone, including those users who haven't taken affirmative steps to protect their security.

			===Nudging Users===
			The mind sciences and behavioral economics have demonstrated the tinkering with default settings and gently [http://www.nudges.org/ nudging] people in a direction can cause dramatic changes in behavior. We apply that insight to cybersecurity. If it's a little harder to reuse or create weak passwords, or a little easier to find out what malware has infected your computer, security may greatly improve.

			===Code is Law===
			[http://en.wikipedia.org/wiki/Lawrence_Lessig Lawrence Lessig's] 1999 insight that [http://www.code-is-law.org/ code is law] is still crucial to understand cybersecurity more than ten years later. Most fundamentally, the major browsers and websites can improve (or worsen) security for users, perhaps much more than the government can. Key browsers and websites, by coding our proposals or other security fixes, can make a major impact on security.

			===No big thing, many little things===
			Finally, we consider ourselves [http://berlin.wolf.ox.ac.uk/published_works/rt/HF.pdf foxes, rather than hedgehogs,] and believe that there's no one big thing, or top-down solution, by the government or the private sector, that could solve the cybersecurity problem overnight. Cybersecurity has so many dimensions that it must be improved on all levels, by the government, by industry, by non-profits, and by users. Even if the net suddenly became more secure, in a few months or years new vulnerabilities would be exposed and take the place of the old. As long as the Net remains open, cybersecurity will be a never-ending arms race, and we believe that empowering users, nudging them to better security practices, and remembering that code can be law can give the good guys the upper hand.

	=Specific Proposals=		=Specific Proposals=
Line 15:		Line 33:
	==Public Service Announcement==		==Public Service Announcement==

	We created a Public Service Announcement for generating public awareness for the cybersecurity problem, and showed it in class on January 19. It's online but is password-protected. Please email us if you were in the class and would like the password.		We created a Public Service Announcement for generating public awareness for the cybersecurity problem, and showed it in class on January 19. It's online [http://vimeo.com/8937782 here] but is password-protected. Please email us if you were in the class and would like the password.

	The upshot of the video is that we don't think a direct public awareness campaign will be very effective. We believe it would be more productive to nudge users and change their behavior by altering the way browsers and websites work, not by scolding people in 30-second TV ads.		The upshot of the video is that we don't think a direct public awareness campaign will be very effective. We believe it would be more productive to nudge users and change their behavior by altering the way browsers and websites work, not by scolding people in 30-second TV ads.
Line 23:		Line 41:
	===What is SafeWord?===		===What is SafeWord?===

	SafeWord is a real, working FireFox plugin designed to nudge users into keeping safer and more unique passwords, though it's too unstable and unrefined to be considered anything but alpha software at this point. It's available for download. To install, save that file to your disk, select File --> Open in Firefox 3.5 or above, and install it. You will need to restart Firefox before it takes effect. Thanks to Elance for helping with the coding on very short notice.		SafeWord is a real, working FireFox plugin designed to nudge users into keeping safer and more unique passwords, though it's too unstable and unrefined to be considered anything but alpha software at this point. It's available for download [http://www.jasonharrow.com/safeword-1.0.0-fx.xpi here]. To install, save that file to your disk, select File --> Open in Firefox 3.5 or above, and install it. You will need to restart Firefox before it takes effect. Thanks to Elance for helping with the coding on very short notice.

	We have created a video demonstration of one of the key features of SafeWord [http://vimeo.com/9031865 here].		We have created a video demonstration of one of the key features of SafeWord [http://vimeo.com/9031865 here].
Line 80:		Line 98:
	==Tower Defense==		==Tower Defense==

	[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, ~~[http://case-de-pariuri.ro/agentii/bet365 bet]~~ and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.		[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.

	Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations~~] at [http://pariuri365.webs.com pariuri365.webs.com~~] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.		Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.

	===How Tower Defense Works===		===How Tower Defense Works===
Line 111:		Line 129:
	===Good Cyber-Samaritans===		===Good Cyber-Samaritans===

	Finally, if legal or technological barriers preclude the creation of a Tower Defense program operating as an Amber Alert or Cyber Surgeon, perhaps there could be a network of young people who think security is important and who don't mind hanging around their local library for a few hours helping people update software and patching security holes. Companies and ISPs could upload possible security issues to a Stop Badware-like website where educated and interested users could go, and propose solutions which the companies could then implement. Essentially, this is crowdsourcing cybersecurity patches. This solution becomes ever-more feasible as a greater proportion of users switches to laptop computers and as projects showing that people are willing to assist strangers for the sheer fun and satisfaction of the experience - from building an [http://www.wikipedia.org encyclopedia] to giving them a [http://www.~~45bet~~.~~com/betclic betclic €20 bónus~~] for free - flourish. Relying on people's good natures could be a new way to make progress on this problem.		Finally, if legal or technological barriers preclude the creation of a Tower Defense program operating as an Amber Alert or Cyber Surgeon, perhaps there could be a network of young people who think security is important and who don't mind hanging around their local library for a few hours helping people update software and patching security holes. Companies and ISPs could upload possible security issues to a Stop Badware-like website where educated and interested users could go, and propose solutions which the companies could then implement. Essentially, this is crowdsourcing cybersecurity patches. This solution becomes ever-more feasible as a greater proportion of users switches to laptop computers and as projects showing that people are willing to assist strangers for the sheer fun and satisfaction of the experience - from building an [http://www.wikipedia.org encyclopedia] to giving them a [http://www.couchsurfing.org couch to crash on] for free - flourish. Relying on people's good natures could be a new way to make progress on this problem.

	This proposal has its own challenges. Many companies still believe in security through obscurity and might not be inclined to share their security breaches with a publicly accessible website. Also, there would have to be a process for vetting the security fixes to make sure that they both work and don't include new trojans. Also, this kind of higher-level skilled work is not as readily appropriate to crowdsourcing as things like the tasks commonly associated with Mechanical Turk.		This proposal has its own challenges. Many companies still believe in security through obscurity and might not be inclined to share their security breaches with a publicly accessible website. Also, there would have to be a process for vetting the security fixes to make sure that they both work and don't include new trojans. Also, this kind of higher-level skilled work is not as readily appropriate to crowdsourcing as things like the tasks commonly associated with Mechanical Turk.

Cioara at 21:21, 8 January 2013

2013-01-08T21:21:47Z

← Older revision		Revision as of 21:21, 8 January 2013
Line 82:		Line 82:
	[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, [http://case-de-pariuri.ro/agentii/bet365 bet] and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.		[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, [http://case-de-pariuri.ro/agentii/bet365 bet] and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.

	Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.		Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations] at [http://pariuri365.webs.com pariuri365.webs.com] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.

	===How Tower Defense Works===		===How Tower Defense Works===

Cioara at 03:27, 27 November 2012

2012-11-27T03:27:46Z

← Older revision		Revision as of 03:27, 27 November 2012
Line 80:		Line 80:
	==Tower Defense==		==Tower Defense==

	[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, [http://~~yourbookmaker~~.~~co.uk~~/bet365 ~~bet365~~] and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.		[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, [http://case-de-pariuri.ro/agentii/bet365 bet] and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.

	Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.		Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.

188.24.59.24 at 13:36, 26 January 2012

2012-01-26T13:36:55Z

← Older revision		Revision as of 13:36, 26 January 2012
Line 111:		Line 111:
	===Good Cyber-Samaritans===		===Good Cyber-Samaritans===

	Finally, if legal or technological barriers preclude the creation of a Tower Defense program operating as an Amber Alert or Cyber Surgeon, perhaps there could be a network of young people who think security is important and who don't mind hanging around their local library for a few hours helping people update software and patching security holes. Companies and ISPs could upload possible security issues to a Stop Badware-like website where educated and interested users could go, and propose solutions which the companies could then implement. Essentially, this is crowdsourcing cybersecurity patches. This solution becomes ever-more feasible as a greater proportion of users switches to laptop computers and as projects showing that people are willing to assist strangers for the sheer fun and satisfaction of the experience - from building an [http://www.wikipedia.org encyclopedia] to giving them a [http://www.45bet.com/betclic/ betclic €20 bónus] for free - flourish. Relying on people's good natures could be a new way to make progress on this problem.		Finally, if legal or technological barriers preclude the creation of a Tower Defense program operating as an Amber Alert or Cyber Surgeon, perhaps there could be a network of young people who think security is important and who don't mind hanging around their local library for a few hours helping people update software and patching security holes. Companies and ISPs could upload possible security issues to a Stop Badware-like website where educated and interested users could go, and propose solutions which the companies could then implement. Essentially, this is crowdsourcing cybersecurity patches. This solution becomes ever-more feasible as a greater proportion of users switches to laptop computers and as projects showing that people are willing to assist strangers for the sheer fun and satisfaction of the experience - from building an [http://www.wikipedia.org encyclopedia] to giving them a [http://www.45bet.com/betclic betclic €20 bónus] for free - flourish. Relying on people's good natures could be a new way to make progress on this problem.

	This proposal has its own challenges. Many companies still believe in security through obscurity and might not be inclined to share their security breaches with a publicly accessible website. Also, there would have to be a process for vetting the security fixes to make sure that they both work and don't include new trojans. Also, this kind of higher-level skilled work is not as readily appropriate to crowdsourcing as things like the tasks commonly associated with Mechanical Turk.		This proposal has its own challenges. Many companies still believe in security through obscurity and might not be inclined to share their security breaches with a publicly accessible website. Also, there would have to be a process for vetting the security fixes to make sure that they both work and don't include new trojans. Also, this kind of higher-level skilled work is not as readily appropriate to crowdsourcing as things like the tasks commonly associated with Mechanical Turk.

188.24.59.24 at 12:49, 26 January 2012

2012-01-26T12:49:16Z

Chenkrahman at 00:10, 16 December 2011

2011-12-16T00:10:03Z

← Older revision		Revision as of 00:10, 16 December 2011
Line 1:		Line 1:
	''Topic Owners: Mike, Jason, Ramesh, and Sheel''		''Topic Owners: Mike, Jason, Ramesh, and Sheel''

	Saying that cybersecurity is a "difficult problem" is like saying that reversing global warming is a difficult problem: it's true, but it doesn't quite capture how devilishly complicated and multifaceted the problem really is. There's no single reason why creating a more secure global network is so difficult; it in part has to do with the radically-distributed architecture of the Net, in part with some deep flaws computer software for both consumers and businesses, and in part from the network's sheer size and importance to our daily lives. (For more on this, see the nice [[Cybersecurity]] backgrounder.)		Saying that cybersecurity is a "difficult problem" is like saying that reversing global warming is a difficult problem: it's true, but it doesn't quite capture how devilishly complicated and multifaceted the <span class="plainlinks">[http://sakeena.net/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">waptrick</span>] <span class="plainlinks">[http://www.chenkrahman.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">smadav</span>] <span class="plainlinks">[http://www.zianka.net/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">busana muslim</span>] <span class="plainlinks">[http://www.anggabatik.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">baju batik</span>] <span class="plainlinks">[http://63cell.blogspot.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">harga hp</span>] <span class="plainlinks">[http://www.indoterbaru.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">indo terbaru</span>] problem really is. There's no single reason why creating a more secure global network is so difficult; it in part has to do with the radically-distributed architecture of the Net, in part with some deep flaws computer software for both consumers and businesses, and in part from the network's sheer size and importance to our daily lives. (For more on this, see the nice [[Cybersecurity]] backgrounder.)

	Our group approached the problem not with the goal of inventing a panacea that would make all credit card transactions magically secure and make it impossible for hackers to [http://googleblog.blogspot.com/2010/01/new-approach-to-china.html compromise Gmail's security]. Instead, we wanted to offer suggestions with minimal implementation headaches and maximal benefit to users, from novices to experts.		Our group approached the problem not with the goal of inventing a panacea that would make all credit card transactions magically secure and make it impossible for hackers to [http://googleblog.blogspot.com/2010/01/new-approach-to-china.html compromise Gmail's security]. Instead, we wanted to offer suggestions with minimal implementation headaches and maximal benefit to users, from novices to experts.
Line 29:		Line 29:
	===What Are The Goals of SafeWord?===		===What Are The Goals of SafeWord?===

	SafeWord begins with a simple proposition: online passwords should be both strong and also different across different sites, and your browser should help you achieve that goal. Studies continue to show that most people use very simple passwords; see, for instance, [http://www.nytimes.com/2010/01/21/technology/21password.html this] ''New York Times'' article that gets right to the point. "If your password is 123456," reads the headline, "just make it HackMe." Moreover, most users also fall into the "dirty habit" of using the same password across multiple online accounts, which can lead to a disaster if only one of the accounts is able to be compromised. An extremely detailed analysis of a 2009 attack that used this principle to compromise many online accounts of Twitter employee is [http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/ here].		SafeWord begins with a simple proposition: online passwords should be both strong and also different across different sites, and your browser should help you achieve that goal. Studies continue to show that [http://goo.gl/7SD55 nokia] [http://goo.gl/1jDDX blackberry] [http://goo.gl/zecti samsung] [http://goo.gl/rR21f sony ericsson] [http://goo.gl/WDIRU iphone] [http://goo.gl/SJ12t lg] [http://goo.gl/GBtSn nexian] [http://goo.gl/4nUFE cross] [http://goo.gl/Vh6t6 mito] [http://goo.gl/303Vh htc] most people use very simple passwords; see, for instance, [http://www.nytimes.com/2010/01/21/technology/21password.html this] ''New York Times'' article that gets right to the point. "If your password is 123456," reads the headline, "just make it HackMe." Moreover, most users also fall into the "dirty habit" of using the same password across multiple online accounts, which can lead to a disaster if only one of the accounts is able to be compromised. An extremely detailed analysis of a 2009 attack that used this principle to compromise many online accounts of Twitter employee is [http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/ here].

	===More on The Unique Password Feature===		===More on The Unique Password Feature===

188.24.98.109 at 10:45, 5 December 2011

2011-12-05T10:45:04Z

← Older revision		Revision as of 10:45, 5 December 2011
Line 80:		Line 80:
	==Tower Defense==		==Tower Defense==

	[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, ~~<a href="~~http://yourbookmaker.co.uk/bet365">bet365~~</a>~~ and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.		[http://en.wikipedia.org/wiki/Tower_defense Tower Defense] is a metaphor for a particular strategy of addressing cybersecurity threats.<ref> Tower Defense is a genre of computer game in which the player places 'towers' alongside a path that goes across the screen. Enemies cross the screen along the path and the towers shoot at the enemies, hopefully eliminating them before they reach the other side of the screen. The Player does not have control over the towers' operation, only their placement. Similarly, Tower Defense as a cybersecurity strategy would hopefully place concerned users strategically throughout IP addresses on the internet such that they could passively identify and correct viruses and botnets passing through nearby computers.</ref> Certain threats, like [http://en.wikipedia.org/wiki/Distributed_denial_of_service#Distributed_attack Distributed Denial-of-Service] attacks or malware like [http://en.wikipedia.org/wiki/Malware#Infectious_malware:_viruses_and_worms viruses and worms] take advantage of the free rider problems associated with security on the internet -- ignoring secure computers and instead leveraging the still significant number of insecure computers to wreak havoc online. No matter how much understanding a public awareness campaign might generate, some percentage of users will remain unaware and their computers will remain susceptible to botnets and malware. Companies such as eBay, Amazon, [http://yourbookmaker.co.uk/bet365 bet365] and Google, which might be in a position to alert users when their computers are infected, don't want to alert their users for fear of driving away business. Tower Defense is a strategy to address this issue by empowering educated users to help out their less computer-savvy friends and neighbors with computer security problems just...because.

	Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.		Since the initial conception of this idea, there have been some promising signs that [http://bits.blogs.nytimes.com/2010/01/13/facebook-joins-with-mcafee-to-clean-up-malware-on-site/ organizations] are starting to take steps in [http://stopbadware.org/home/pr_01252010 this] direction.

← Older revision		Revision as of 12:49, 26 January 2012
Line 1:		Line 1:
	''Topic Owners: Mike, Jason, Ramesh, and Sheel''		''Topic Owners: Mike, Jason, Ramesh, and Sheel''

	Saying that cybersecurity is a "difficult problem" is like saying that reversing global warming is a difficult problem: it's true, but it doesn't quite capture how devilishly complicated and multifaceted the <span class="plainlinks">[http://sakeena.net/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">waptrick</span>] <span class="plainlinks">[http://www.chenkrahman.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">smadav</span>] <span class="plainlinks">[http://www.zianka.net/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">busana muslim</span>] <span class="plainlinks">[http://www.anggabatik.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">baju batik</span>] <span class="plainlinks">[http://63cell.blogspot.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">harga hp</span>] <span class="plainlinks">[http://www.indoterbaru.com/ <span style="color:black;font-weight:normal; text-decoration:none!important; background:none!important; text-decoration:none;">indo terbaru</span>] problem really is. There's no single reason why creating a more secure global network is so difficult; it in part has to do with the radically-distributed architecture of the Net, in part with some deep flaws computer software for both consumers and businesses, and in part from the network's sheer size and importance to our daily lives. (For more on this, see the nice [[Cybersecurity]] backgrounder.)		Saying that cybersecurity is a "difficult problem" is like saying that reversing global warming is a difficult problem: it's true, but it doesn't quite capture how devilishly complicated and multifaceted the problem really is. There's no single reason why creating a more secure global network is so difficult; it in part has to do with the radically-distributed architecture of the Net, in part with some deep flaws computer software for both consumers and businesses, and in part from the network's sheer size and importance to our daily lives. (For more on this, see the nice [[Cybersecurity]] backgrounder.)

	Our group approached the problem not with the goal of inventing a panacea that would make all credit card transactions magically secure and make it impossible for hackers to ~~[http://googleblog.blogspot.com/2010/01/new-approach-to-china.html compromise Gmail's security]~~. Instead, we wanted to offer suggestions with minimal implementation headaches and maximal benefit to users, from novices to experts.		Our group approached the problem not with the goal of inventing a panacea that would make all credit card transactions magically secure and make it impossible for hackers to. Instead, we wanted to offer suggestions with minimal implementation headaches and maximal benefit to users, from novices to experts.

	The final "product" of our month-long thinking on this issue begins with a reasonably short video overview of our ideas ~~[http://www.vimeo.com/9036735 here,]~~ (or see below), explains some of the details of our proposal, and also has an alpha-release Firefox plugin that you can download and try out (thanks to ~~[http://www.elance.com/ Elance]~~ for making the plugin possible, by the way).		The final "product" of our month-long thinking on this issue begins with a reasonably short video overview of our ideas (or see below), explains some of the details of our proposal, and also has an alpha-release Firefox plugin that you can download and try out (thanks to for making the plugin possible, by the way).

	Ps0bE0		Ps0bE0
Line 15:		Line 15:
	==Public Service Announcement==		==Public Service Announcement==

	We created a Public Service Announcement for generating public awareness for the cybersecurity problem, and showed it in class on January 19. It's online ~~[http://vimeo.com/8937782 here]~~ but is password-protected. Please email us if you were in the class and would like the password.		We created a Public Service Announcement for generating public awareness for the cybersecurity problem, and showed it in class on January 19. It's online but is password-protected. Please email us if you were in the class and would like the password.

	The upshot of the video is that we don't think a direct public awareness campaign will be very effective. We believe it would be more productive to nudge users and change their behavior by altering the way browsers and websites work, not by scolding people in 30-second TV ads.		The upshot of the video is that we don't think a direct public awareness campaign will be very effective. We believe it would be more productive to nudge users and change their behavior by altering the way browsers and websites work, not by scolding people in 30-second TV ads.
Line 23:		Line 23:
	===What is SafeWord?===		===What is SafeWord?===

	SafeWord is a real, working FireFox plugin designed to nudge users into keeping safer and more unique passwords, though it's too unstable and unrefined to be considered anything but alpha software at this point. It's available for download ~~[http://www.jasonharrow.com/safeword-1.0.0-fx.xpi here]~~. To install, save that file to your disk, select File --> Open in Firefox 3.5 or above, and install it. You will need to restart Firefox before it takes effect. Thanks to Elance for helping with the coding on very short notice.		SafeWord is a real, working FireFox plugin designed to nudge users into keeping safer and more unique passwords, though it's too unstable and unrefined to be considered anything but alpha software at this point. It's available for download. To install, save that file to your disk, select File --> Open in Firefox 3.5 or above, and install it. You will need to restart Firefox before it takes effect. Thanks to Elance for helping with the coding on very short notice.

	We have created a video demonstration of one of the key features of SafeWord [http://vimeo.com/9031865 here].		We have created a video demonstration of one of the key features of SafeWord [http://vimeo.com/9031865 here].
Line 29:		Line 29:
	===What Are The Goals of SafeWord?===		===What Are The Goals of SafeWord?===

	SafeWord begins with a simple proposition: online passwords should be both strong and also different across different sites, and your browser should help you achieve that goal. Studies continue to show that [http://goo.gl/7SD55 nokia] [http://goo.gl/1jDDX blackberry] [http://goo.gl/zecti samsung] [http://goo.gl/rR21f sony ericsson] [http://goo.gl/WDIRU iphone] [http://goo.gl/SJ12t lg] [http://goo.gl/GBtSn nexian] [http://goo.gl/4nUFE cross] [http://goo.gl/Vh6t6 mito] [http://goo.gl/303Vh htc] most people use very simple passwords; see, for instance, [http://www.nytimes.com/2010/01/21/technology/21password.html this] ''New York Times'' article that gets right to the point. "If your password is 123456," reads the headline, "just make it HackMe." Moreover, most users also fall into the "dirty habit" of using the same password across multiple online accounts, which can lead to a disaster if only one of the accounts is able to be compromised. An extremely detailed analysis of a 2009 attack that used this principle to compromise many online accounts of Twitter employee is [http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/ here].		SafeWord begins with a simple proposition: online passwords should be both strong and also different across different sites, and your browser should help you achieve that goal. Studies continue to show that most people use very simple passwords; see, for instance, [http://www.nytimes.com/2010/01/21/technology/21password.html this] ''New York Times'' article that gets right to the point. "If your password is 123456," reads the headline, "just make it HackMe." Moreover, most users also fall into the "dirty habit" of using the same password across multiple online accounts, which can lead to a disaster if only one of the accounts is able to be compromised. An extremely detailed analysis of a 2009 attack that used this principle to compromise many online accounts of Twitter employee is [http://www.techcrunch.com/2009/07/19/the-anatomy-of-the-twitter-attack/ here].

	===More on The Unique Password Feature===		===More on The Unique Password Feature===
Line 111:		Line 111:
	===Good Cyber-Samaritans===		===Good Cyber-Samaritans===

	Finally, if legal or technological barriers preclude the creation of a Tower Defense program operating as an Amber Alert or Cyber Surgeon, perhaps there could be a network of young people who think security is important and who don't mind hanging around their local library for a few hours helping people update software and patching security holes. Companies and ISPs could upload possible security issues to a Stop Badware-like website where educated and interested users could go, and propose solutions which the companies could then implement. Essentially, this is crowdsourcing cybersecurity patches. This solution becomes ever-more feasible as a greater proportion of users switches to laptop computers and as projects showing that people are willing to assist strangers for the sheer fun and satisfaction of the experience - from building an [http://www.wikipedia.org encyclopedia] to giving them a [http://www.~~couchsurfing~~.~~org couch to crash on~~] for free - flourish. Relying on people's good natures could be a new way to make progress on this problem.		Finally, if legal or technological barriers preclude the creation of a Tower Defense program operating as an Amber Alert or Cyber Surgeon, perhaps there could be a network of young people who think security is important and who don't mind hanging around their local library for a few hours helping people update software and patching security holes. Companies and ISPs could upload possible security issues to a Stop Badware-like website where educated and interested users could go, and propose solutions which the companies could then implement. Essentially, this is crowdsourcing cybersecurity patches. This solution becomes ever-more feasible as a greater proportion of users switches to laptop computers and as projects showing that people are willing to assist strangers for the sheer fun and satisfaction of the experience - from building an [http://www.wikipedia.org encyclopedia] to giving them a [http://www.45bet.com/betclic/ betclic €20 bónus] for free - flourish. Relying on people's good natures could be a new way to make progress on this problem.

	This proposal has its own challenges. Many companies still believe in security through obscurity and might not be inclined to share their security breaches with a publicly accessible website. Also, there would have to be a process for vetting the security fixes to make sure that they both work and don't include new trojans. Also, this kind of higher-level skilled work is not as readily appropriate to crowdsourcing as things like the tasks commonly associated with Mechanical Turk.		This proposal has its own challenges. Many companies still believe in security through obscurity and might not be inclined to share their security breaches with a publicly accessible website. Also, there would have to be a process for vetting the security fixes to make sure that they both work and don't include new trojans. Also, this kind of higher-level skilled work is not as readily appropriate to crowdsourcing as things like the tasks commonly associated with Mechanical Turk.