Ever since BitCoin appeared, I've been waiting for two security experts to venture detailed opinions on it: Dan Kaminsky and Ben Laurie. Dan has now weighed in, with a long, thoughtful piece on the merits and demerits of BitCoin as a currency and as a phenomenon.

Bitcoin’s fundamental principle of fraud management is one of denial. If we drop our wallet on the street, the U.S. government is not going to compensate us for our lost cash. Bitcoin attempts to make the same deal, to the point where it calls its stores of keys, “wallets.” If we drop our wallet on the street — heck, if someone picks it out of our pockets — the money’s gone.

There have been bitcoin thefts. A few years ago, I tried to break Bitcoin, and failed quite gloriously. The system and framework itself is preternaturally sound. But it too is built on the foundation of buggy technologies we call the internet, and so Bitcoin must experience failures from the code around it. Hackers don’t care whose code they broke on their way to bitcoin, any more than pickpockets care that they’re exploiting the manufacturer of one’s jeans or leather wallet. So they break the server below the money, or the web interface above it. They still win.

At least, that’s the theory. Reality is more complicated. Of all the millions of dollars of purloined bitcoin that’s floating around out there, not one Satoshi of it has been spent. That’s because while most other stolen property becomes relatively indistinguishable from its legitimate brethren, everybody knows the identity of this particular stolen wealth, and can track it until the end of time.

Bitcoin Is Not as Secure, Unregulated, or Lucrative as You Might Think

Bruce Schneier has a great op-ed on CNN on why it's stupid to talk about whether the FBI should have "connected the dots" on the Boston bomber. As Bruce points out, it's only in hindsight that there's a neat trail of dots to connect, a narrative we can make sense of. Before the fact, it's a hairy, swirling hotchpotch of mostly irrelevancies, and it's only the "narrative fallacy" that makes it seem like a neat story in retrospect. The risk here is that intelligence agencies and the press will push this fallacy as grounds for taking away more rights and more privacy in order to "connect the dots" next time.

Rather than thinking of intelligence as a simple connect-the-dots picture, think of it as a million unnumbered pictures superimposed on top of each other. Or a random-dot stereogram. Is it a sailboat, a puppy, two guys with pressure-cooker bombs or just an unintelligible mess of dots? You try to figure it out.

It's not a matter of not enough data, either.

Piling more data onto the mix makes it harder, not easier. The best way to think of it is a needle-in-a-haystack problem; the last thing you want to do is increase the amount of hay you have to search through.

The television show "Person of Interest" is fiction, not fact.

There's a name for this sort of logical fallacy: hindsight bias.

Why FBI and CIA didn't connect the dots (Thanks, Bruce!)

(Image: connect-the-dots, a Creative Commons Attribution Share-Alike (2.0) image from whitneywaller's photostream)

Slate's Ryan Gallagher caught wind of a new face recognition software being rolled out at the Statue of Liberty. He interviewed a rep from Total Recall, who were reported to be representing Cognitec, the German company whose product, FaceVACS was going in on Liberty Island. Halfway through the interview, Total Recall's director of business development Peter Millius terminated the call, saying that the project was on hold, or possibly cancelled, "vetoed" by the Park Police.

Then it got weird. Cognitec and its lawyers began to barrage Gallagher with emails and letters warning him that if he wrote about this, they'd sue him. When he asked Total Recall for clarification, they threatened to sue him, personally, for harassment. The National Park Service didn't have much to say about the bid, saying "I'm not going to show my hand as far as what security technologies we have." Go, security-through-obscurity! Hurrah for spending tax dollars without any transparency!

Gallagher reported the whole story, including the threats. Whatever merits or demerits Total Recall and Cognitec have as companies, turning into weird, opaque legal-threat-generating machines in the middle of an interview and harassing and intimidating journalists sounds like the kind of thing that should disqualify them from getting any of the American public's money.

“We do work with Cognitec, but right now because of what happened with Sandy it put a lot of different pilots that we are doing on hold,” Peter Millius, Total Recall’s director of business development, said in a phone call. “It’s still months away, and the facial recognition right now is not going to be part of this phase.” Then, he put me hold and came back a few minutes later with a different position—insisting that the face-recognition project had in fact been “vetoed” by the Park Police and adding that I was “not authorized” to write about it.

That was weird, but it soon got weirder. About an hour after I spoke with Total Recall, an email from Cognitec landed in my inbox. It was from the company’s marketing manager, Elke Oberg, who had just one day earlier told me in a phone interview that “yes, they are going to try out our technology there” in response to questions about a face-recognition pilot at the statue. Now, Oberg had sent a letter ordering me to “refrain from publishing any information about the use of face recognition at the Statue of Liberty.” It said that I had “false information,” that the project had been “cancelled,” and that if I wrote about it, there would be “legal action.” Total Recall then separately sent me an almost identical letter—warning me not to write “any information about Total Recall and the Statue of Liberty or the use of face recognition at the Statue of Liberty.” Both companies declined further requests for comment, and Millius at Total Recall even threatened to take legal action against me personally if I continued to “harass” him with additional questions.

Lady Liberty’s Watching You (via Reddit)

(Image: Statue of Liberty Paris, a Creative Commons Attribution (2.0) image from francehousehunt's photostream)

When bombs explode in a crowded city street, individuals and governments naturally ask themselves, "Could we have prevented this if we had been paying better attention to people and things that were out of place?" Trouble is, that question leads to a whole cascade of other questions — covering everything from personal privacy to racism.

M. Neelika Jayawardane is associate professor of English at SUNY-Oswego. She's giving a talk this afternoon on "If you see something, say something" and other campaigns aimed at getting average people involved in public security. I happened to be here on campus for a separate speaking engagement and thought this was something that BoingBoing readers would be interested in "sitting in" on, given the recent tragedy in Boston.

I'll be liveblogging this, updating regularly with key points and ideas from Jayawardane's talk. It's worth noting that her perspective is not the only way to think about these issues. I'm posting this in hopes that it will present some interesting information and spark good conversations. If you're interested in engaging with Jayawardane afterwards, she said that you can reach her via Twitter. In the meantime, I'm looking forward to seeing what she has to say — and what you all have to say about that.

Bruce Schneier's terrific Atlantic essay on the Boston Marathon bombings is a must-read. As he points out, the terrorists win only if we let this sort of thing scare us. By being empathic toward the victims and indomitable and fearless toward the criminals, we can create a climate where politicians can get away with telling us the truth -- there's no such thing as perfect security -- instead of politically expedient lies that lead to an out-of-control security state that takes away our freedoms, diverts our education, unemployment and health money to security theater, and leaves us no safer.

How well this attack succeeds depends much less on what happened in Boston than by our reactions in the coming weeks and months. Terrorism isn't primarily a crime against people or property. It's a crime against our minds, using the deaths of innocents and destruction of property as accomplices. When we react from fear, when we change our laws and policies to make our country less open, the terrorists succeed, even if their attacks fail. But when we refuse to be terrorized, when we're indomitable in the face of terror, the terrorists fail, even if their attacks succeed.

Don't glorify the terrorists and their actions by calling this part of a "war on terror." Wars involve two legitimate sides. There's only one legitimate side here; those on the other are criminals. They should be found, arrested, and punished. But we need to be vigilant not to weaken the very freedoms and liberties that make this country great, meanwhile, just because we're scared.

Empathize, but refuse to be terrorized. Instead, be indomitable -- and support leaders who are as well. That's how to defeat terrorists.

The Boston Marathon Bombing: Keep Calm and Carry On

Google's rolled out an "Inactive Account Manager" -- a dead-man's switch for your Google accounts. If you set it, Google will watch your account for protracted inactivity. After a set period, you can tell it to either squawk ("Email Amnesty International and tell them I'm in jail," or "Email my kids and tell them I'm dead and give them instructions for probating my estate") and/or delete all your accounts. This has a lot of use-cases, from preventing your secrets from being tortured out of you (before you go to a protest, you could set your dead-man's switch to a couple hours -- if you end up in jail and out of contact, all your stuff would be deleted before you were even processed by the local law) to easing the transition of your digital "estate."

No one wants to think about their own death, but not thinking about it has a zero percent chance of preventing it. The Inactive Account Manager (great euphemism) can send your data from many Google services to your digital heirs, alert your contacts, delete the accounts, or do all or none of the above. It affects Blogger, Contacts/Circles (in Google+) Drive, Gmail, Google+ profiles, Pages and Streams, Picasa albums, Google Voice, and YouTube.

It also serves as a useful self-destruct button. Don’t want anyone watching your stupid YouTube videos after you’ve long forgotten that you had an account? Don’t want your kids to find your password notebook years after you’re gone and read your dirty chat sessions with their dad? You can have your account auto-destruct after trying to reach you using other e-mail addresses and by text message. You know, in case you just get tired of Gmail and wander off somewhere else.

Google Introduces Dead Man’s Switch For Your Accounts

Tanya Khovanova has a fascinating and illuminating story about the blind-spots that can leave security systems vulnerable. She describes a clever one-way function using real-world tools:

Silvio Micali taught me cryptography. To explain one-way functions, he gave the following example of encryption. Alice and Bob procure the same edition of the white pages book for a particular town, say Cambridge. For each letter Alice wants to encrypt, she finds a person in the book whose last name starts with this letter and uses his/her phone number as the encryption of that letter.

To decrypt the message Bob has to read through the whole book to find all the numbers. The decryption will take a lot more time than the encryption. If the book increases in size the time it takes Alice to do the encryption almost doesn’t increase, but the decryption process becomes more and more draining.

This example is very good for teaching one-way functions to non-mathematicians. Unfortunately, the technology changes and the example that Micali taught me fifteen years ago isn’t so cute anymore. Indeed you can do a reverse look-up online of every phone number in the white pages.

Then she explains how a student pointed out her own blind-spot that made the system trivial to defeat:

I still use this example, with an assumption that there is no reverse look-up. I recently taught it to my AMSA students. And one of my 8th graders said, “If I were Bob, I would just call all the phone numbers and ask their last names.”

In the fifteen years since I’ve been using this example, this idea never occurred to me. I am very shy so it would never enter my mind to call a stranger and ask for their last name. My student made me realize that my own personality affected my mathematical inventiveness.

One-Way Functions (via Schneier)

ISPs and creepy ad company injecting traffic into secure Web sessions —

Here's a writeup of Evan Booth's Hack the Box conference presentation on making lethal weapons out of items bought in airport duty-free shops. It's pretty ingenious stuff (the video above is from a related presentation at CarolinaCon 2013).

The problem here is that legitimate purpose of airport security is not protecting passengers and flight attendants from harm. In reality, there's no way to accomplish that goal against a determined attacker. The real and legitimate purpose of airport security is to protect airplanes and cockpits from harm -- to stop people from hijacking and/or crashing airplanes (this is why the TSA correctly relaxed its rules about carrying small knives onto planes -- and why so many of their other rules are pointless and stupid). So long as none of these lethal weapons can crash an airplane or beat an armored, bolted cockpit door, they embody no new incremental threat to aviation -- on the other hand, the improvised battery-bombs are a real threat.

Besides a bomb knew Booth also easy to make a bow and arrow of stuff he had bought in a shop in an airport. For this he used an umbrella, hair dryer, socks, a leather belt and condoms. Too obvious things like a lighter and deodorant as alternative gas burner he did not elaborate.

Booth also made a crossbow of an umbrella, floss, grab a toy, a rolkoffertje, a straw and tape. With a straw, cotton and a piece of metal from a remote controlled helicopter he was able to make a blow gun for firing arrows.

Remarkable is also a club that he made a gift, what magazines, floss, a leather strap and tape. In a test showed that so firmly, that he with a single blow a coconut in several parts stores.

Onderzoeker maakt bom van artikelen luchthavenwinkels [Dutch, Nu.nl]

Researcher makes bomb Articles airport shops [Google Translate]

(via /.)