Warm Fuzzies

def. Warm Fuzzies

The feeling you get when you are happy with the way things are going - akin to how you felt as a child with a warm fuzzy blanket on a cool Fall evening.

Last month's article was about pet peeves - things that bug me, and maybe even bug you. This month I want to talk about something that can no longer be categorized as a "pet" peeve - it has grown somewhat, into more of a monster peeve.

Some History

My work with technologies goes back almost 30 years. During that time I've been both an early adopter of many technologies and an evaluator of them; not only for myself, but for companies that either deploy such technologies or use them. 

The point of the story is that there are examples of two completely different and mutually exclusive methods of evaluating potential for fraud in this tale:

Well, to be honest, I don't really know that. But on the other hand, they had to have some feeling that I was not going to stiff them. They certainly had the potential for others to come in and do it since the hotel and restaurant were not in the best part of town.

Extension to Today

Today we are in the midst of the Internet revolution, and we have extended the concept of technology as a means (as the means?) of authenticating the guy/girl/company/... (entity) at the other end of an Internet conversation, be it web, chat, e-commerce, file transfer session or whatever. We (or at least many/most of us) who use the Internet or electronic banking system, credit card system, telephone system, door entry systems, alarm systems and all manner of daily activities which involve authentication and authorization by electronic means have put our undying faith in the infallibility of these systems to the point where we are turning into easy marks for the bad guys. We seem to have lost our "BS" filter when it comes to many of the transactions that affect our lives now that computers are involved. We have in fact simply abrogated our responsibility for our own physical and financial well being to firms who have no personal interest in being correct, and who don't take the individual's interests to heart the way an individual would in different circumstances.

Of course this abrogation of responsibility (or loss of BS filter) is not limited to just online transactions as shown by the recent spate of major corporate fraud cases such as WorldCom and others. These show that some of us may have unadvisedly abrogated our decision process to the legislators and regulators in the case of corporate health, and in the case of the US 401K employee plans in Enron, abrogated the responsibility to look after retirement investment too.

In the case of the Internet and security, the major Certificate Authorities (CAs) such as VeriSign have taken on the responsibility of determining whether or not a particular user of a domain or user name is who they say they are. This is done by requiring the company/individual to submit some proof that they are the registered owner of a company or the legitimate holder of the name. Once this proof has been vetted, the CA then issues a digital certificate, signed cryptographically with several bits of information, and with the private key of the CA. The software users use to identify such a certificate uses the public key of the CA, included with most browsers and operating systems pretty much as a matter of course now, to determine whether the certificate is correct. The software should also check with the CA's system to see if the certificate has been revoked or invalidated for some reason.

In theory this should all work as advertised and everybody would get warm fuzzies except when their software kicked up a stink at a particular certificate proffered by a site we wanted to do some transaction with. In practice there are a number of reasons why individuals (and companies) still must take it upon themselves to decide whether or not things are as they should be. Some of them are technical, some of them are human failure, some of them are poor implementation, and some of them are outright subversion of the system.

One of the most basic problems is a failure on the CA's part to actually do their job to the degree necessary. The advisory from CERT regarding two bogus Microsoft certificates issued in error by VeriSign is the best known example of this problem, but it is highly unlikely that it is the only one. But there is in fact a way for such an error (once detected) to be fixed, if the software that uses certificates properly implements it and the CA's methods and the software writers' methods coincide. The facility is called "certificate revocation lists" or CRL - and is used to list any invalidly issued certificate or any cert. that the CA no longer considers valid even if correctly issued to start with (company violates rules, goes bankrupt, undergoes major problems, etc.)

The problem is that software creators must correctly implement a system that does the actual validation and checks the CRL as well. In Microsoft's case in particular, this was not done; and the whole thing is the subject of a number of articles for those of you interested in the gory details:

But even this is only one aspect of the potential problems associated with the "trust" system that surrounds the "traditional" Internet infrastructure that gives many people a false sense of well being and inveigles them into forgoing their own "sniff testing" (comes from the concept of sniffing a piece of meat or a vegetable prior to purchasing it to determine whether it is good or bad) when it comes to technological interactions. 

The point of this is that despite the best intentions of the participants, it is still possible for the electronic "warm fuzzies" to turn out to be a skeleton key into your deepest, darkest secrets or to your bank account. 

Even when there is no CA involved, we tend to give credibility where it is not necessarily due, and have no easy mechanism to either keep track of whether we have decided someone is a good/bad guy or what level of trust we should give them. We almost daily hear of children who have struck up a net conversation with what turns out to be an adult with bad intentions. We get bogus e-mail with nasty attachments from what appear to be friends and/or relatives but are actually neither. We go to web sites looking for one thing, and end up with endless windows of unwanted and invasive advertising and/or nastyware injected into our computers.

Part of the problem is that the Internet and PC revolution has come upon us at such a pace that many people are simply overwhelmed. Many don't know where their computer leaves off and the rest of the world begins (actual words from caller: "the internet isn't working..." ) Another part is that the typical PC simply was never intended to be put into a hostile network environment (and still isn't in my opinion.) Add these two things together and you have what we have now, an environment ripe for abuse by those in the know and with less than civil intentions.

I've come to the conclusion that the only way to deal with this problem is to start putting the onus back onto the system user to determine whether a particular entity at the other end of the connection is one they want to deal with, and/or what level of credibility to give them. 

The problem is that this will take some changes to software and habits. Some of the software changes are minor, some are major and will be subject to resistance from vendors and other affected parties (the CAs for example).

Focus on the Problem

Every now and then I get called to attend a focus group session on some product or service or other. A recent one put on by a financial institution  was on the concept of trust in the light of the Enron and WorldCom (and other) scandals and the meltdown of much of the large corporate infrastructure in recent times. There were six of us plus the moderator at this session, and the two hours we spent kicking around the topic resulted in some interesting observations on the topic of personal trust today.

Two of us admitted (bragged?) to consciously working at testing trust in our relationships with newly met people and corporate entities. The others didn't consciously do it, but found that they did it none the less, at least in some instances.

Another aspect of the group's discussion centered around icons of trust, both those we thought were real icons today, and those we wished were icons but that we thought had fallen from favour. In the category of current icons; those we would trust with essentially no hesitation were exemplified by the Firefighter - especially in the light of the happenings of 9/11. In a similar vein but with fewer votes were the physicians, paramedics, teachers, police and other (at least in North America) government regulated/funded aid workers. Interestingly enough, the government itself was pointed out as an icon that nobody really trusted but all wanted to. The lower votes on the others mentioned were mostly due to negative stories heard about problem individuals.

I found it interesting that there were so few generic "icons" identified as trustworthy without thought or "testing".

On the other hand, all of us had companies and individuals we have dealt with for many years, with no thought that such a relationship might end. Once we made up our minds, it seemed that it took a lot to change our minds. It was summed up up by one of the group that we don't like to take time to make decisions, so having made them, we don't want to have to revisit them. 

In essence what we were saying was that people create their own list of entities/people they trust, complete with the level of trust (from "trusting they will try to screw me" all the way to what was essentially blind trust that the person/entity would "do the right thing") and kept this list for long periods of time. The list of entities entitled to blind trust has lessened recently, dropping things like publicly traded companies.

The point is that many of the group recognized that they had put trust in entities that they probably should not have, and they have revised their trust relationships because of their learning of problems. On the other hand, there has been no action from the likes of Verisign on revoking the certificate of WorldCom - maybe this tells us something. 

It may be (and I make the case that it is) only ourselves who can and must establish and maintain the trust relationship with an entity - maintaining our own Certificate Authority for our electronic conversations with them, and demanding that the software we are sold allow and in fact encourage this expression of our concern over trust. We are entitled to decide when we should have that warm fuzzy feeling, because we are pretty much the only ones who can decide with only our own best interests in mind.