Taken from: http://litemind.com/thinking-traps

Harry is an introverted guy. We know that he is either a librarian or a salesman. Which one do you think he most probably is?

Of course, we may be tempted to think he’s almost certainly a librarian. Haven’t we been conditioned to think of salesmen as having outgoing, if not pushy, personalities? Too bad this reasoning may be dead wrong (or at least incomplete).

This conclusion neglects the fact that salesmen outnumber librarians about 100 to 1. Before you even consider Harry’s character traits, you should have assigned only a 1% chance that he’s a librarian. (That means that even if all librarians are introverted, all it takes is 1% of introverts among the salesmen to make the chances higher for Harry being a salesman.)

That’s just one example of how overlooking a simple data element can make our intuitions go completely astray. We keep mental images — simplifications of reality — that make we jump to conclusions before questioning assumptions or checking whether we have enough information.

• Masked Passwords
• Reset Buttons on Webforms

Reset buttons need to go. They are never used. If a user wants to reset a form they will type-over any of the material that has been entered already in the form. It’s a sensible and acceptable suggestion to improve usability of a given web form.

Masked passwords are another kettle of fish. The argument that they lead to a loss in security by users who feel uncomfortable remembering passwords and typing them blind into masked password fields. The resulting behaviour means that users:

• employ overly simple passwords
• copy-paste passwords from a file on their computer.

I feel the argument is a little wishy-washy.  Sure people choose simple passwords. They have to remember it at the end of the day how they do it doesn’t depend on user interface design.

Even though that the above may hold true I would feel that users would not feel comfortable entering passwords plainly into a web form. The perceived security that goes into entering a masked password gives reassurance to the user. Neilsen may argue that it costs the business time/money with the users struggling to remember passwords and haggle their way through password challanges. But what cost does a customers faith and trust in entering their personal details come at? I think the perceived confidence with users entering passwords via masked forms has more advantages than it’s perceived disadvantages.

Had to implement a secure webservice this week. It was built in .NET and it was called by a website on the same machine. The most secure implementation of this was to disable the annonymous user and have it use Integrated Windows Authentication. Using a server running Windows Server 2003 and IIS 6.0

The next step was to create a windows machine account that there would allow the website and web service talk to each other.  This seemed to cause a problem. Trying to connect to the webservice via Internet Explorer on the test server was becoming fruitless. Each time there it prompted for credentials and each time returned an 401.1 error page back to the browser. Most annoying and very difficult to troubleshoot once you’ve checked every possible permutation of permissions and passwords.

The Solution

http://support.microsoft.com/?id=896861

To specify the host names that are mapped to the loopback address and can connect to Web sites on your computer, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. In Registry Editor, locate and then click the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0
3. Right-click MSV1_0, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames, and then press ENTER.
5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the host name or the host names for the sites that are on the local computer, and then click OK.
7. Quit Registry Editor, and then restart the IISAdmin service.

After the restart the site worked fine and accepted the authentication credentials.

Hardy Bucks follows the lives of four lazy but likable lads from Castletown, Co Mayo as they try and make enough money to make a fresh start in the ‘big shmoke’ – Galway.

Reading the Irish Times today I read that a Bord Gais representative say that while the machine was not encrypted, the data saved on it could only be accessed using a username and password. It is relatively trivial to remove the hard drive from a computer/laptop and place it in another machine in order to retrieve information. You needn’t be a fully fledged computer hacker to do this, nor do you need a username and password.

So perhaps it would pose difficulty for the Bord Gais representative to obtain the data, BUT, for someone re-furbing the laptop for resale on the black market. It would then be quite a trival task to extract the harddrive and extract the data.

My second point is that it seemed that it seemed very unfortunate that a laptop, supposedly portable computer was left in the office overnight. Why give someone a laptop if they are going to leave it behind them inthe office in the first place? It makes no sense to me at all – Rant over!

For those worried about keeping sensitive information on computers then help is at hand. It is help in the form of a piece of software called TrueCrypt. It allows home users to encrypt and decrypt important and sensitive information. There are various flavours of use from full drive encryption to creating a volume where you can put  information securely safe fashion.

It is well worth looking into if you deal with sensitive data on your own personal machines. It means that if your data is stolen then you can rest assured that for the person trying to break in has more than than a hard drive swap to steal your precious data.

The sad fact remains that JP Grealis is STILL missing after all this time. Whether you agree with the views expressed in this blog going forward or not. I think that we all agree that finding out where JP is quite high on the list.

On October 23, 2008 James Patrick (JP) Grealis last had contact with his family in Ireland. Since then nothing has been heard from him. He was last seen in Breda Netherlands.There were several sightings of him in Eindhoven during the 1st week of November but there has been nothing since.

He has red wavy hair, slim build and broad shoulders. He always wears jeans, a T-shirt and hooded sweaters. He has a habit of walking with his sleeves over his hands.

Anyone with information regarding JP is asked to contact:

• Dutch National Police, National Missing Persons Bureau, tel. +31 79 3458882
• Gardai at Achill, Co Mayo phone 098 20830