Of Ads and Signatures

Both advertisements and signatures have been with us in the analogue realm for ages, the society has learned about their usefulness and limits. We have learned that it’s (usually) hard to judge the impact of a single ad, and that the process of actually validating a contested signature is not trivial. There is a good reason why the law requires more than a single signature to authorize the transfer of real estate.

Both concepts have been translated to the digital, online world.

And in both cases, there were promises that the new, digital and online versions of ads/signatures can deliver features that their old, analogue counterparts could not do.

For ads, it was the promise of real-time tracking of their effectiveness. You could do “clickthrough rates” measuring how often the ad was clicked by a viewer. The holy grail of ad effectivity tracking is the fabled “conversion rate”: you can measure how many people actually bought your product after clicking an ad.

For signatures, it was the promise of automated validation. If you get a digitally signed document, you should be able to actually verify (and can have 100% trust in the result) whether it was really signed by the signatory. Remember: in the analogue world, almost nobody actually does this. The lay person can detect crude forgeries, but even that only if the recipient has access to samples of authentic signatures. In reality, a closer inspection of handwritten signatures is only done for important transactions, or in the case of a dispute.

So how did things work out after a few years of experience with digital ads and signatures?

Digital ads are in a midlife crisis. We’re in a death spiral of low clickthrough rates, more obnoxious formats, ad-blockers and ad-blocker-blockers. Just look at the emergence of Taboola and similar click-bait.
Digital signatures are at a cross-road as well: The take-up rates of solutions based on smart-card readers have been underwhelming so far. This applies to the German ePerso as well as to the Austrian citizen card. The usability just isn’t there. So there has been a push to increase the take-up rate by introducing alternatives to smart-card technology. That won’t make it more secure. Not at all.

So what’s the common lesson? In theory, both digital ads and signatures can offer features that their old, analogue counterparts just cannot deliver. In practice, they are killing themselves by over-promising. As long as click-through rates are the prime measurement of online ads, their death spiral will continue. And as long as digital signatures continue to promise instant, high-confidence validation, they will not achieve the take-up rates needed for broad acceptance.

Continuing the current trajectory will lead to a hard crash for both technologies. On one side it’s the ad-blocker, on the other side it’s malware.

The level of spam in the email ecosystem meant that no mail-service can exist in the market without a built-in spam-filtering solution. And given the early ad-excesses every browser includes a pop-up blocker these days. If the advertisers continue on their path of getting attention at all costs, ad-blocking will become a must-have feature in all browsers, and not just an optional ad-on (as right now).

Any digital security solution that protects actual money has been under vigorous attack. The cat and mouse game between online-banking defenders and attackers is a good lesson. The same will happen if digital signature solutions start to be actually relevant. And good luck if your “let’s make digital signatures more user-friendly” approach is actually less secure than what online-banking is using these days.

So what’s the solution?

In my opinion the right way to approach both topics is to reduce the promise. Make digital ads static images. No animation. No dynamic loading of js-code (which is its own security nightmare). Don’t overtax the visitor’s resources (bandwidth, browser-performance). No tracking. Tone it down. Don’t expect instant effects. Don’t promise clicktrough rate.

For digital signatures: Mass deployment is only possible for “non-qualified signatures”. Don’t promise “you can fully and solely rely on our solution”. Just sell “this is a good indication”, or “use this as one factor in your security design”. Prepare for it to be attacked and broken. Only use it when you have a pre-planned way to recover from such a breach. The real word is full of applications where signatures are used in a very low-security / low-impact settings. The state-sponsored digital identity solutions needs to think of those, too. For the high-impact, high-confidence settings I always have to think about the mantra we use at work: “You can’t mandate trust.”

The Edge browser

Wasn’t one of the main goals of junking the Internet Explorer codebase and building a brand new browser “Edge” the hope that there won’t be the monthly batch of patches for remote code execution vulnerabilities?

I haven’t tabulated the advisories but somehow I don’t have the feeling that things have gotten substantially better.

Why?

It looks to me like we still aren’t using the right programming environments for such complex pieces of software. There is still way too much basic security tooling the programmers have to do by themselves. Just like you shouldn’t do string operations in pure ANSI C, we need to rise the level of abstractions that all these browser bugs (that lead to RCE) just are not possible any more.

StartSSL, S/MIME and Thunderbird

This cost me an hour or two:

If you try to get a free S/MIME certificate from StartCom / StartSSL, this worked fine and in Firefox the certificate was shown as valid. But once I transferred it to Thunderbird, I got an unspecified certificate error.

Solution: Turn off OCSP.

Positive Surprise …

Wow, they put up new ticket vending machines at Brussels Central train station.

So instead of accepting only the Belgian-only cards, they finally work with international cards (Maestro, master/Visa), too.

Progress indeed. Welcome to 2014.

Adobe Flash Updates

Today we’ve seen yet another Adobe Flash Player update due to serious problems. So be it.

One thing always sets my teeth on edge when doing/verifying it: The number of clicks it takes me to check the version of the currently running Flash plugin. It would be far too simple if the download page (which is prominently linked everywhere) would just tell me if I need to upgrade. No, I have to click on “Learn more about Flash Player”, then “Product Page”, then “FAQ”, then scroll down to “How can I tell if I have the latest version of Flash Player installed and whether it is working correctly?”, click to reveal the answer, then click “Testing page”.

And then I have to manually compare the version shown above with the latest version listed by operating system and browser beneath.

What the fscking hell is Adobe thinking? They’ve been a top reason for PC infections for the last years (Flash + Acrobat) and still they don’t tell their web-visitors as quickly and efficiently whether they need to update.

Can someone please administer the necessary clues with a suitable LART?

Dear Niki/AirBerlin

For this week’s flight from Paris CDG to Vienna I used the Web-Checkin. This is the boarding-pass I got from them:

All nice and fine, but one important detail is missing: Which terminal?

Kunst hat Rechte, aber nicht immer recht

Aktuell wird mal wieder viel über das Urheberrecht und die armen Künstler gesprochen. Die Piratenpartei feiert Wahlerfolge und die Gegenseite formiert sich auch.

Ich hab in einem Online-Forum Kommentare dazu geschrieben, hier die kurze Zusammenfassung:

Die Menschen fühlen sich aktuell von der Content / IP – Industrie massiv verarscht. Der kleine Schaffende, der jetzt unter die Räder kommt, ist nicht schuld dran.

Wenn man sich ein bisschen in die Thematik eingelesen hat, und die Exzesse der IP-Industrie sieht, dann ist es mit der Sympathie für diese Leute schlicht vorbei. Beispiele:

  • Software/Business-Patente. Das ist zu einem Kartell der Erpresser verkommen.
  • Verarschung der legitimen Kunden. Ich sag nur DVD mit Region-code, non-skippable Werbung/warnungen (kommt genial auf Kinder-DVDs)
  • Die Explosion des Wissens
  • RIAA Accounting
  • Wir kennen das Lied schon.
  • “Nein, du kannst das nicht in der Form kaufen, die du haben willst.” Beispiel: aktuelle US-Serien. Das ist ein relevanter Markt, der nicht bedient wird. No na wird da filesharing gemacht.

So ganz einseitig und einfach ist aber aber auch nicht, ich empfehle den Piraten mal die Lektüre von Charlie Stross’ Common Misconceptions About Publishing.

Weiters:

Der normale Bürger da draußen, der sich sein Brot in der freien Wirtschaft verdient, fühlt sich ernsthaft verarscht, wenn er von den Künstler ein “Ich brauche die Festplattenabgabe, weil sonst kann ich nicht mehr von meiner Kunst leben!” hört.

Das “ich kann nicht davon leben, was ich gern machen / gelernt habe” ist leider eine Sache, die viele trifft. Vom Greißler über den Cafe-Besitzer bis hin zur Historikerin. Ganze Scharen von arbeitslosen Akademikern haben genau das Problem.

Ja, Diebstahl ist ein Problem. Aber ein vorbeiproduzieren an dem, was (und wie) die Leute denn kaufen würden ist es ebenfalls. Und falls die Kunst meint, es kann ihr egal sein, ob sie was macht das der Markt haben will, dann ist das Liebhaberei und ein Hobby. Aber keine Berechtigung, davon Leben können zu müssen.

Die Gesellschaft als Ganze mag entscheiden, dass man sich Kunst leisten will. Dann sind wir wieder in der Subventions/Almosen/… Schiene, die manchen Künstlern so aufstößt.

Aber:

Der Kern der Problems ist meiner Meinung nach was ziemlich Böses: Die Industrie hat sich daraus entwickelt, dass das Duplizieren von Information (inc. Musik und Filmen) ein technisch anspruchsvolles und daher teuer zu lösendes Problem war. Die Studios, Verlage, … haben eine Lösung für einen Mangel verkauft.

Das hat sich jetzt massiv verändert: Das technische Problem existiert nicht mehr. Der Mangel ist weg. Und es gibt in vielen Bereichen einen massiven Überfluss an Inhalten. Die alten Methoden können in diesem Szenario nicht mehr funktionieren. Ein Beharren darauf kann es nicht sein.

Ein “jeder kann alles und immer ohne jegliche Vergütung kopieren” wird auch kaum die Lösung sein.

Interesting Times. Ich seh keine simple Lösung für das Problem. (und ja, das ist eines)

Addendum (10.5.2012): Auch Meldungen wir diese erhöhen nicht das Verständnis der Bevölkerung für die Forderungen der Musikindustrie.

Secunia PSI Fail

Actually, I like Secunia’s PSI: it makes keeping a Windows PC up-to-date a lot easier.

But today it failed:

  • Update of flashplayer did not work, but showed this:

    Notice how it says in green 100%, but Firefox and IE were still using the vulnerable version.

    Maybe it got confused by Chrome’s autoupdate which ran in parallel.

    A re-scan make PSI aware of the problem, but the autoup-date failed again.

  • It failed to update irfanview
  • I spent a few mins looking for an email address for feedback and found none. Thus this public blogpost.

Digitale Signatur mal wieder

Heute hat mich ein Kollege zu einem signiertem PDF befragt: Ist das korrekt und qualifiziert unterschrieben?

Sind wir mal naiv und öffnen es mit Acrobat X. Ja, ist signiert, kann das aber nicht überprüfen. A-Trust tools sind installiert; ein update auf den aktuellen download von a-trust ändert nichts dran, dass ich von dem Teil nur Fehlermeldungen bekomme.

Ok, gut, wozu gibt es einen Online-PDF checker unter https://www.a-trust.at/pdfverify/. Nix da:

Nur gut, dass die RTR bessere Arbeit abliefert: Der Online-Validierer unter https://pruefung.signatur.rtr.at/ funktioniert.