The science of password selection

From: http://www.troyhunt.com/

A little while back I took a look at some recently breached accounts and wrote A brief Sony password analysis. The results were alarming; passwords were relatively short (usually 6 to 10 characters), simple (less than 1% had a non-alphanumeric character) and predictable (more than a third were in a common password dictionary). What was even worse though was uniqueness; 92% of common accounts in the Sony systems reused passwords and even when I looked at a totally unrelated system – Gawker – reuse was still very high with over two thirds of common email addresses sharing the same password.
But there was one important question I left unanswered and that was how people choose their passwords. We now know that structurally, passwords almost always adhere to what we would consider “bad practices” but how are these passwords derived in the first place? What’s the personal significance which causes someone to choose a particular password?
It turns out there are some very recognisable patterns in the data. In fact the vast majority of passwords adhere to just a small handful of common selection practices. This is interesting research in that it begins to give a bit of insight into the thought process of the individuals who create passwords which conform to weak structural guidelines.

Source data and analysis process

The data I’m going to analyse comes from a variety of sources including the Sony and Gawker breaches I referenced in the previous post as well as other LulzSec releases including pron.com and a collection of their random logins. For each of these I have nothing more than an email address and a password – there are no other account attributes I can use to start drawing conclusions (i.e. physical address). There are about 300,000 accounts in all which should give us a reasonable cross section with which to make some observations on password selection.
There are three other sets of source data I’m going to use in this analysis:

1. People names: this includes a list of about 26,000 common first and last names.
2. Place names: this is everything from towns to states to countries and includes about 32,000 entries.
3. English dictionary: exactly what it sounds like – around 190,000 words in a typical English dictionary.

I’m going to use these three sources of data to make some assumptions about where passwords may have been derived from. The three lists above are aggregated from various sources and whilst comprehensive, are certainly by no means complete. The bottom line is that some potential matches are going to be missed and the overall numbers will be lower than what they would be if the lists were 100% accurate.
In matching passwords to potential sources I’m going to be a bit more liberal than usual by ignoring both case and punctuation. Whilst these are extremely important to password entropy, they don’t have a part to play in terms of where people derive their password from. Whether I use “Troy” or “troy” as a password (and no, I don’t use either!), or “Troy Hunt” or “troyhunt”, I’ve still derived them from the same logical source. Besides, in my previous analysis 45% of all passwords contained only lowercase characters and as I mentioned earlier, less than 1% had any sort of punctuation anyway so it wouldn’t make a difference for a significant portion of the data set.
In the analysis I’m going to start with the most personal sources – such as someone’s name – and then move onto increasingly less personal sources such as places, then dictionary words and see how many passwords correlate to each. In a case like “June” where it could be either a name or a dictionary word, it will appear in whichever statistics I run first (people names, in this case), then won’t be counted again so we’ll get a discrete set of matches. The order of the results is more a logical priority than one of prevalence.

People names

I’ve started with people names because a name is simply one of the most personal attributes of someone’s identity. I also suspect they feature heavily when someone reaches into the recesses of their mind to come up with a password. Now of course the name is not necessarily the name of the account holder; it could be a spouse, the kids or even the family dog. Furthermore, it could be a first name, a middle name or a last name.
Here’s how they break down in terms of their prevalence within the total password set:

Passwords derived from a person’s name

So what this graph is saying is that 14% of people create their password based on a person’s name. What does this look like? Well, pretty predictable really, here are the top three names as passwords:

1. maggie
2. michael
3. jennifer

But there’s a bit more to the story; just because a password is derived from a person’s name doesn’t mean it’s a perfect match. For example, prepending or appending numbers to a name is a popular practice so whilst “troy21” may not be a perfect match to my name, the origin of it is still clear.
There are three common derivatives of a name which frequently appear in passwords:

1. The addition of numbers
2. The addition of symbols (possibly along with numbers)
3. Reversing the name (with or without numbers and symbols)

The graph above includes these three practices and the propensity of them within people names breaks down as follows:

Structure of passwords derived from people names

Obviously numbers are the favourites and they’re almost exclusively appended to the name rather than prepended. Furthermore, the appended number is very, very frequently just a “1”. Two digit numbers, likely representing a year, also feature quite frequently (year of birth, perhaps?) as do four digit numbers which I assume would imply the same thing (certainly it’s feasible based on the number range).
Use of symbols is quite rare but then again, as I mentioned right at the start of this post, less than 1% of passwords in my previous analysis had a symbol anyway so no big surprises there. The reversed names are obviously an attempt to obfuscate the password and decrease discoverability. In reality, a reversed name is still the same number and type of characters so passwords such as “trebor”, “nevets” and “samoht” are still going to be very vulnerable to brute force attacks such as by rainbow table.

Place names

Another very common practice is to use the name of a place in the password. This might be a city, a state or a country and it’s probably fair to speculate that these places have some degree of personal significance to the password creator. Here’s how prevalent those place names are:

Passwords derived from a place name

What we’re seeing here is that 8% of all passwords are based on a place name. The most popular place names included:

1. dallas
2. canada
3. boston

The trick with place names is that very often they could also be people names (i.e. Victoria), which is not surprising given many places are named after people. Likewise, they’re very frequently dictionary names (i.e. Sunshine) and in both cases it’s simply impossible to make an assumption about what the individual was thinking when the password was created. Either way though, the central theme is still the same: the passwords are being derived from common words.
In terms of numbers, symbols and reversing tricks, it’s a pretty consistent result with what we saw previously with people names:

Structure of passwords derived from place names

Once again, the old faithful “1” suffix is most popular. It’s as though people know they should mix character types but they take the easy way out instead of choosing truly random numbers and positioning them at unpredictable locations within the password.

Dictionary words

Here’s the big one, and it’s not at all surprising given the huge selection available. Dictionary words are by far and away the most popular source of password inspiration:

Passwords derived from a dictionary word

A huge 25% of passwords are derived directly from dictionary words. In reality, it’s probably somewhat higher than this as my dictionary had less than a couple of hundred thousand words. And they’re all only English language.
Top among the dictionary favourites are:

1. password (oh dear)
2. monkey
3. dragon

The first one probably shouldn’t be such a surprise but still, wow! My password source of several hundred thousand accounts had nearly two and a half thousand “password” passwords which is not only a pretty poor choice given its clearly available in a dictionary, it’s also an insanely obvious one.
It’s a pretty similar story to people names and places when it comes to mixing up words with a bit of randomness:

Structure of passwords derived from dictionary words

Same deal as before too – predominantly suffixes and predominantly predictable number patterns. I think we’re seeing a pattern here…

Numbers

Here’s another significant portion of passwords – numbers. I don’t mean numbers combined with words, I mean numbers and only numbers. In fact they feature rather significantly:

Passwords derived from numbers

A total of 14% of passwords are purely numeric. If that seems kind of staggeringly high to you, wait until you see the three most popular number combinations:

1. 123456
2. 12345678
3. 123456789

I don’t think we need to do much speculating about how these were derived. What’s a little more interesting though is the spread of lengths:

Length of purely numeric passwords

Why is this interesting? Well firstly, within a spread of numeric password lengths which range from 1 (yes, 1, and there’s a heap of ‘em) to 21, 83% of the passwords are either four, six or eight digits long. Is this a propensity for even numbered password lengths or something else?
For four digit passwords, the spread is pretty widely distributed in terms of number of occurrence, at least once you ignore “1234” (the most commonly used four digit password by a factor of ten). However, there’s quite a prevalence of numbers which could easily represent recent years (1984 is quite popular), so I suspect there’s often a date based significance. The other thing to consider is that given the propensity for password reuse and the fact that many PIN numbers are four digits, there’s a good chance these numbers are used on someone’s luggage or – gasp! – is the one they use to pull money from an ATM.
The thing about six digit numbers is that they very, very frequently represent dates in DDMMYY format (or MMDDYY for the Americans). The ranges of each three pairs of numbers in the password list suggest there’s a high likelihood that these passwords do indeed relate to dates, assumedly of some personal significance to the creator.
So what about the high prevalence of eight digit numbers? There’s some degree of numbers meeting a DDMMYYYYY format (or American equivalent), but for the most part, there’s no obvious pattern. Based on what we’ve seen so far there’s almost certainly a personal significance to the numbers but it’s not obvious from their format, at least not beyond those that adhere to obvious, memorable patterns such as “12345678” or “11223344”.
It might seem a bit liberal having a dedicated category for all passwords of one character type, but when you consider the extremely limited character set – ten as opposed to 95 (printable ASCII characters) – there’s obviously some very specific reasons for only choosing numbers.

Double words

We’re getting into the more abstract patterns here but one which does occur quite a bit is double words (i.e. “troytroy”):

Passwords comprised of double words

Again, we’re talking small numbers now, and less than 3% hardly sets the world on fire, but there’s a clear pattern nonetheless. Here’s what’s popping up most frequently:

1. blahblah
2. poopoo
3. lovelove

As well as repeating words, there are also patterns of doubling up on other random characters. We could speculate the thought process is that this practice is enabling simple passwords of very short length to be literally doubled in size, but of course in many cases, they’re still short (eight characters or less), lowercase alphanumeric strings which is a pretty basic pattern.

Passwords found within email addresses

This is a pretty brazen attempt at simplifying the whole logon process – why struggle to remember a password when you can simply use the identity component of the email address? Confused? It would be like me taking the “troyhunt” out of troyhunt@hotmail.com and using that as my password. There’s a bit of that going on here:

Passwords derived from the email address

Ok, less than 3% is a small number but again – wow! – people actually do this! Let me illustrate with the domain excluded so there’s some degree of privacy retained:

1. Email: murphy666@… Password: murphy666
2. Email: baolihua@… Password: baolihua
3. Email: racecar73@… Password: racecar73

The inspiration for these passwords is pretty clear – no more speculation needed!

Short phrases

This one is a little tricky to quantify as the only way of identifying the phrases was to literally eyeball the data and build up a phrase list based of the most common occurrences. However, I thought it was worthwhile pursuing and whilst the numbers below are inevitably lower than the true number (I didn’t read through every password), I know from previous experience that short phrases are often – and incorrectly – thought to be a “secure” form of password. Here’s what I found:

Passwords that are short phrases

What sort of phrases are we looking at? Here’s the most popular few:

1. trustno1
2. letmein
3. iloveyou

The first one is a little amusing given the context and that it appeared as agent Fox Mulder’s password in the X-Files series (not a great password role model!) The others are obviously simple and easy to remember which is a pattern repeated throughout most of the remaining phrases. Yes, they add length and variety (at least in a dictionary sense), but once again, they’re short, predominantly alphabet-centric lowercase passwords. The other thing is that they’re frequently found in password dictionaries (note – not English dictionaries, rather lists of common passwords). In fact “letmein” and “iloveyou” can both be fund in the popular darkc0de.lst password dictionary.

Keyboard patterns

Whilst we’re now getting down into small numbers, keyboard patterns have long been advocated by some as a “secure” means of creating passwords. The theory is that they don’t appear in English language dictionaries (although they often do in password dictionaries), and they’re easy to remember as they’re pattern based. Here’s how they features in the data set:

Passwords that are keyboard patterns

Again, this was based on me manually identifying patterns so inevitably I’ve missed a few but certainly I’ve caught a lot of the high frequency ones. Here’s the sort of patterns I’m regularly seeing:

1. qwerty
2. asdfgh
3. asdf1234

Obviously in a case like the last example, they’re trying to mix things up a little but the pattern is still very clear:

Some of the more creative ones start to take different directions across the keyboard or add a bit of randomness to the recurrence of letters and numbers but the practice remains the same: predictable.

Related to the site

Whilst this is a very small result in terms of percentages, I thought it was a pattern worth commenting on as it’s quite a different approach to deriving a password. In this pattern, the password has a very direct link to the site in which it’s created, either based on name or other attributes relating to the nature of the site. Here’s how it breaks down:

Passwords related to the site they're created on

Let me put this into context:

1. Site: Gawker Password: Gawker
2. Site: Sony Pictures Password: sony123
3. Site: pron.com Password: ilovepron

So once again we have password that are easy to recall based on a memorable attribute. Of course this is also a rather obvious attribute (it’s staring you in the face when you go to logon), and on that basis alone, it really doesn’t form a very robust password. Incidentally, some of these are rather amusing, particularly the ones from pron.com :)

Everything else

So what does that leave? Well, a rather large number of passwords which don’t comply with recognisable patterns or they simply slipped through my filters (the latter is highly likely and there would be a significant number of passwords in this category). Here’s what’s left:

Passwords not derived from sources in the above analysis

High prevalence, typical examples include:

1. thx1138 (turns out this is a movie from forty years back)
2. gundam (actually an anime series)
3. ncc1701 (codename for the USS Enterprise in Star Trek)

So there’s a whole range of passwords out there which whilst they won’t be picked up by any of the patterns discussed above, do in fact relate to popular culture. This is a fairly obvious source of inspiration although one that’s difficult to define in a set word list.
Then of course there are simply passwords which don’t adhere to any discoverable pattern, for example “mw818283” (although interestingly a Google search does show this up in an online password dictionary). The thing is though, these fall into the minority and even if they are “strong” (long, random, unique), they’re now commonly available in password dictionaries to be used in future brute force attacks. Because my entire password database has come from compromised sites which are now readily available online, the reality is that none of these passwords should be used again. Ever.

Summary

So what do we make of all this? There are some obvious conclusions:

1. Passwords are inspired by words of personal significance or other memorable patterns.
2. Attempts to obfuscate or strengthen passwords usually follow predictable patterns.
3. Truly random passwords are all but non-existent – they’re less than 1% of the data set.

A significant part of the problem is clearly websites implementing very lax password policies (or none at all based on the one character instances), where at the very least, there should be a robust minimum criteria. How high should the bar be set? Well, that’s another topic of much debate and there are obvious usability implications. Then there’s the idea of taking password requirements to a whole new level and doing what Hotmail has just done by actively disallowing vulnerable passwords.
But the intention of this post was always to identify how people are presently choosing their passwords and we have good insight into that now. Of course the next question is “how should people be choosing passwords”? The answer to this is simple: The only secure password is the one you can’t remember.

10 Most Secure Locations on the Planet

From: http://www.brownsafe.com/

They say safety is relative. Some people go their entire lives and NEVER feel safe. Others take incredible precautions to protect both themselves and their loved ones from anyone and anything that may seek to cause them harm (babyproofing anyone?).

Where are you most safe? Are you thinking about places where you can retreat and hide from the world? If so, here are the 10 Most Secure Locations on the Planet that are considered the safest, for various reasons.

1. Fort Knox

Located in Kentucky south of Louisville, Fort Knox is home to the United States’ monetary assets, said to hold tons of gold – 5,000 tons at last estimate (equal to about 2% of ALL Gold ever mined from the Earth). To make it safe enough (if the location surrounding by the military camp isn’t enough) there is a bank vault within a deep basement of the building that has a 250 ton door marking its entrance.

Source

2. Cheyenne Mountain

This is also in the United States, located just outside of Colorado Springs, CO. It is the command center and control, communication and the intelligence center for both the United States Space Command missions and the North American Aerospace Defense Command (NORAD). Built at the height of the Cold War, the facility is said to be sturdy enough to survive a multimegaton nuclear detonation within 1 nautical mile (1.9km) of it’s center. It has blast doors that each weigh, individually, 25 tons.

Source

3. Haven Co

Located in the Sealand in the North Sea, about six miles off the coast of Britain, this location is a company base founded in 2000. The company provides data protection. The only way you can get in is if you are an authorized staff member, an investor in the company or you are a Royal Family member. Although services for HavenCo ceased without explanation in 2008, it’s an example of the type of “island data haven” that is very secure do to it being SO HARD to get to traditionally.

Source

4. Area 51

The famed stories be true or not, this area in the remote deserts of Las Vegas is more than just strange. It is also one of the most secure locations on the planet. It is a United States military base ( a detachment from Edwards Air Force Base in CA) where no one knows what’s occurring, except those that work there and the President. Known by many names (Groom Lake, Dreamland, Paradise Ranch, etc.) Area 51 is believed to be a testing ground for advanced and experimental aircraft.

Source

5. Air Force One

One of the most well built planes in the world and what many consider the world’s most secure moving location, Air Force One has plenty of security. The United States President travels in a modified Boeing 747-200B series aircraft. It has the world’s most advanced flight avoidance, air-to-air defense, and electronics technology packages available anywhere in the World, all for the protection of the Commander-in-Chief and his entourage.

Source

6. ADX Florence Prison

The Administrative Maximum Facility (ADX for short) is a supermax prison (for men) in Colorado housing the baddest of the bad. These criminals are considered the most dangerous cons in the US and has earned the prison the nickname of “Alcatraz of the Rockies.” Described by one former ADX warden as “a cleaner version of hell”, security measures at the prison include attack dogs guarding the area between the prison walls and 12 ft. high razor wire fences, 1,400 remotely controlled steel doors, motion detecting laser beams, pressure pads and cameras. Current residents of the prison include infamous “Shoe Bomber” Richard Reid, 9/11 terrorist mastermind Zacarias Moussaoui, and Oklahoma City bombing conspirator Terry Nichols among many, many others.

Source

7. The 1960’s Bar

Located 100 feet underground within Britain’s secret subterranean Burlington bunker complex in Wiltshire, England, the 1960’s Bar is a recreation of a pub popular with British Government officials. This top secret base was first constructed during the Cold War and designed to be a refuge for the higher-ups to reconstruct Britain in the event of a nuclear attack…needless to say they figured they would need a few pints to wait out the radiation.

Source

8. Bold Lane

Located in Derby, England, this car park is multi-story stronghold for 440 cars. First conceived and designed by an agricultural engineer after he had the window of his car smashed and his radio stolen while in an airport parking structure. Sophisticated security measures include CCTV cameras, panic buttons, bar-code scanning entry doors, and advanced sensors controlled by a central computer that detect any and all movements of each car. Although, at over $30 dollars an hour, keeping your auto safe in the UK isn’t cheap.

Source

9. Deposed Iraqi Leader Saddam Hussein’s Baghdad Bunker

The 2,150 square-yard bunker was originally designed to withstand the blast of a nuclear bomb and house 50 people. Located nearly 100 feet underground, security measures for the Dictator’s refuge included three-ton Swiss-made doors, 5ft-thick walls, a 6ft-thick steel-reinforced concrete ceiling, and two escape tunnels. The bunker survived seven American dropped bunker busters and 20 cruise missles during the war. Unfortunately, it couldn’t survive looting and was picked almost completely clean during the last days of the war by Iraqi soldiers.

Source

10. Granite Mt. Mormon Church Records Facility

The records storage of the Mormon Church is a massive vault encased in rock at Granite Mountains, Utah first opened in 1965. Armed guards waving metal detector wands usher visitors into a concrete bunker before swinging open metal gates to a tunnel entrance. Excavated 600 ft inside the mountain, the vault features state-of-the-art environmentally controlled document storage chambers as well as administrative offices, shipping and receiving docks, a processing facility and a restoration laboratory for microfilm.

Source

These are just a sampling of some of the world’s most SECURE locations. With the near daily unrest that occurrs even in developed countries today, there has been a lot of discussion about how secure any location really is. However, chances are good that if you are deep within these systems, you will be safe at least for some time.

The First Zombie-Proof House

From: http://all-that-is-interesting.com/

Somehow, ritual drunk-conversation concerning team captains for the apocalypse has become a major part of the lives of 20-somethings. Having been matured in the Grandaddy-crowned masterpiece film (put “A.M. 180” on and forget that you have a job), 28 Days Later, we’re all a little too ready to deal with the 2012 of our dreams.

“The Safe House,” designed by KWK Promes, starts to get eerily close to something I could work with, if say 200 bludgeoned members of the undead army came over to eat their way into borrowing some sugar.

“The most essential item for our clients was acquiring the feeling of maximum security,” begins the designers’ website in the summary of the structure. Who wouldn’t feel safe in a concrete rectangle that folds in upon itself to become completely sealed? Even the windows are covered with a slab of concrete when the structure is on nap time.

The house, with its movable walls, has only one entrance, which is located on the second floor after crossing a drawbridge. Seems like the perfect opportunity to use a flamethrower and defend the life of your family, while stylishly nesting in a piece of architectural elitism.

Imprint Text Messages on Flesh with SkinDisplay Concept

By: Simon

From: http://www.intomobile.com/

A project sponsored by BlackBerry-maker Research In Motion in the UK proposes a bold new use for your battery door. By using piezoelectric technology (which stiffens materials based on electrical current), SkinDisplay is a concept which lets you press your finger into raised text messages on the back of your phone, and read the impression. The idea here is that you could see what’s going on in a discreet way, without pulling out your phone. The actual implementation sounds mostly crazy, but the concept was introduced alongside some software, SmartCall, that actually sounds pretty good; using their app, you would be able to set your current status as busy or otherwise unavailable, as well as request calls back from others within varying time frames and levels of urgency.

The inspiration for both of these ideas is to enable more sensitive communicating over mobile, which is noble indeed given the bad rap BlackBerry gets for continually distracting users from the immediate world around them. BlackBerry in particular is so speedy with delivering text messages that it has set a new level of etiquette when it comes to the time it takes to respond; it’s not uncommon in some circles to be put off if a BBM message isn’t replied to within five minutes. With the right tools though, we might be able to relax a little bit, and put our phone away once in awhile without feeling utterly and completely disconnected. I’m not quite sure the answer is subtle skin-printing, or a biometric ring that senses my mood and shares it online, but they’re both directions to consider. The SmartCall software seems most viable at this point, but depends on everybody using the same app or service; maybe it’ll be a manufacturer’s job to start baking these kinds of etiquette options right into the native messaging and phone applications.

Anyway, here’s a video demonstrating how SkinDisplay could work. Wacky and far-fetched, maybe, but I wouldn’t have concept projects any other way.

[MetropolisMag via Recombu]

Clever Bike Lock Can Climb a Light Pole (Video)

by Stephen Messenge

from: http://www.treehugger.com/

When it comes to thwarting bike thieves, even the best bike-locks can't guarantee your cycle won't get jacked. But here's a simple idea -- instead of chaining up your ride to an object at ground level, imagine if you had a lock that could hoist it high overhead, safely out of reach from would-be robbers. Well, that's exactly what gave one group of German designers the bright idea to create a bike lock that can climb a light pole.

In this video from the German company Conrad, a group of designers fashion a bike lock that can scale light-poles. The invention looks fairly simply: some inline-skate wheels, fixed onto a metal ring with a small motor. In a matter of seconds, the clever contraption transforms your bike from a tempting target for bike thieves into a logistical challenge few crooks would have the courage to undertake -- unless, of course, they moonlight as coconut collectors.

Inventiveness aside, the pole-climbing bike lock probably won't put an end to cycle thievery as we know it -- but it does make for a cool concept. For starters, the prototype in the video doesn't appear to be able to adapt to poles of varying circumference, meaning it might just work on those types of streetlights. Secondly, each pole could really only hold one bike at a time, lest a 'double-parking' type of situation were to arise. And finally, unless the contraption really cinches-down in place, a rope might just be enough to award a determined thief both bike and high-tech climbing lock with little trouble.

The idea is reminiscent of another bike-storage concept covered here a while back -- the bike tree. Instead of holding just one bike reasonably, this design allows for the safe keeping of four cycles at a time while providing more security with a coded access system.

Whether or not we see such climbing bike-locks on the market anytime soon, with so many inventive minds coming up with ways to make cycling a more practical alternative for getting around, things are looking up -- even if there's no bike up there to block the view yet.

Via BoingBoing

Taiwanese Animation: TSA’s Enhanced Security Spurs US ‘Airport Rage’

Hilarity ensues

UAE crackdown on BlackBerry services to extend to foreign visitors

From: http://www.washingtonpost.com/

Video

Video: UAE, Saudi Arabia to block BlackBerry features

The UAE said it will block key features on BlackBerry smart phones, citing national security concerns because the devices operate beyond the government's ability to monitor their use. Saudi Arabia quickly indicated it planned to follow suit.

» LAUNCH VIDEO PLAYER

By Associated Press

Tuesday, August 3, 2010

DUBAI, UNITED ARAB EMIRATES -- The United Arab Emirates' crackdown on BlackBerry services will extend to foreign visitors, putting the government's concerns over the smartphones in direct conflict with the country's ambitions to be a business and tourism haven.

The UAE's telecommunications regulator said Monday that travelers to the city-state of Dubai and the important oil industry center of Abu Dhabi will -- like 500,000 local subscribers -- have to do without BlackBerry e-mail, messaging and Web services starting Oct. 11, even when they carry phones issued in other countries. The handsets themselves will still be allowed for phone calls.

UAE authorities say the move is based on security concerns because BlackBerry transmissions are automatically routed to company computers abroad, where it is difficult for local authorities to monitor for illegal activity or abuse.

Critics of the crackdown say it is also a way for the country's conservative government to further control content it deems politically or morally objectionable.

About 100,000 travelers pass through Dubai's airport each day, making it the busiest airport in the Middle East. The new restrictions could leave time-pressed business travelers hurrying through, many of them changing planes for other destinations, without access to their e-mail or the Web.

In Washington, State Department spokesman P.J. Crowley called the restrictions "a move in the wrong direction."

Cell Phone Security

Posted by: admin
From: http://cellphones.org/

With the increased capabilities and conveniences of today’s cell phones comes the increased risk of viruses, malware and identity theft. While some mobile operating systems are more secure than others, the level of security can be easily increased when users take precautions such as downloading security software, being aware of cellphone scams and password protecting their cell phones.

CLICK TO ENLARGE

Video Surveillance deployed inside London Public Bathrooms

Is nothing sacred anymore!

By jheary
From http://www.networkworld.com/

You can imagine my surprise after I paid my 50pence to use the public bathroom, walked in and found myself staring at not just one but three ceiling mounted video surveillance cameras. I had to get real close to their enclosures to convince myself that I wasn't seeing things. Not only was it really there, but it was a Pan-Tilt-Zoom model with a microphone to top it off. Must get some great noises coming from there. It has also been reported that London officials are now installing cameras with speakers to allow them to talk as well as see and listen. Perhaps its just me, but I had absolutely no idea that this was legal anywhere, let alone in downtown London, UK. Sure I knew that London has more cameras per square mile than any other country on the planet, but in bathrooms?! How are they getting away with that one? It is appalling!

According to the London Assembly of Liberal Democrats, London has been outfitted with over 500,000 surveillance cameras. Other put the number much higher at 1.4million cameras but nobody is telling what the real number is. Another few 10,000 cameras have been installed in taxis and police cars as well.
Sounds a bit big brother to me folks, downright scary in fact. Now it gets scarier when you consider that the vast majority of these camera feeds are not sent encrypted across the wire. This makes hacking these video feeds trivial, just a simple wire tap.

Here's a scenario, I wake up, walk out of my hotel room and see a camera in the hallway watching me. I get into the elevator and look up to smile at the camera there, I walk through the lobby and out to the street. Along the way half a dozen cameras watched me walk less than 200ft. I get in my cab and the camera in there watches me all the way to my destination. I walk into the building followed by 4 cameras. I use the public restroom, 3 cameras watch me in there. I head up the elevator to my office on the 2nd floor and smile at the camera there. I walk down the hall to my office while under surveillance the whole way. I close my office glass door. Turns out the camera in the building has a vantage angle through my glass door and the outside camera on the opposite street corner pole has a clean shot into my office through the windows. I'm feeling a lot of love right now. So I logon to the internet and start surfing. Hmmm. Now I guess they are watching physical me and virtual me at the same time as they inspect the bits and bytes I send ripping around the network.

Just in the last couple years, U.S. cities (like my hometown of Denver) have begun installing their own public video surveillance systems in a big way. Now I need to check and see if U.S. cities are also watching you in the public bathroom.

Here is a shot I took in a London public bathroom. Notice the two cameras on the ceiling. Another one was behind me on the other wall facing towards these cameras. They had all of the angles covered that’s for sure. Don't want to miss any of the action.

_______________________________________________________________________________