Category Archives: *not* impressed

Why ebay does not care about security

The Past

I have been on eBay since 1997.

For the past ten years, I have been using two-factor authentication to protect my eBay, Paypal and other accounts.

It started with the Paypal Security Key, also affectionately known as the “Paypal Football” because of its shape.

Introduced in 2007, the football is a $5 hardware device that displays a quasi-random six-digit number when the button is pressed. The code changes every thirty seconds and makes it impossible to get into your Paypal account without the “Football”, which lived on my Key-ring and went everywhere with me. When eBay bought Paypal, the football could be used to protect access to my eBay account as well.

Four years went by. The battery in the football ran down, and the device fell to pieces when I tried to replace it. Alarmingly, eBay no longer offered the “Football”, offering instead A Credit-Card device that fulfilled the same function at the somewhat higher price of $30.Getting the feeling that eBay was trying to turn a profit out of (in)security, I looked elsewhere… and found the Yubikey VIP.

I had been using a Yubikey in the past to protect, among other things, my Gmail account (The epic Hack of the famous Wired Journalist Mat Honen, could have been thwarted, by his own admission, had he done the same). Now the good folks at Yubico were offing a Yubikey that also doubled as a Verisign VIP key (the technology that PayPal used in the football). I purchased one and have used it ever since. I am still using it to this day.

The Present

I got the following email from them yesterday.

Let me be clear: This is a really, really bad idea for a whole bunch of reasons. Let me enumerate a few:

  1. Texting is insecure. SMS is not encrypted, and SMS messages can be readily intercepted with the right equipment. Using SMS as a one-off mechanism to sign up for something is not too bad, but sending out a text every time you want to log in is a really bad idea.
  2. Not everybody has a texting plan. I am on Verizon’s ancient (not offered since 2012) un-capped, un-throttled, un-limited data plan. Verizon charges extra for text messages, so I have disabled text messaging.
  3. My phone is not always available. I may be able to take a call. I may be in a meeting. I may be in a basement or out of coverage. I may be overseas.
  4. I purposefully purchased serious securityand now eBay are replacing it with something that is less secure.

In an age where websites are becoming more and more secure, this is a retrograde step. So why did eBay do this astoundingly bone-headed thing?

  1. Money. It is my understanding that eBay have to pay Verisign to use this system, while a text message/voice system would be far cheaper.
  2. Support: Security, it is said, is the enemy of convenience. The previous system had some potential shortcomings that allowed users to easily revert to less secure options (“secret questions”, etc) if they didn’t have their hardware token with them. A properly-designed secure system would make it impossible to turn off two-factor authentication without extended vetting… which means hiring Customer Service people to establish the identity of the customer. Given the choice between “good” security and “CHEAP” security, it is hardly surprising that eBay went with the “less-good-but-dirt-cheap” option.

So what *should* ebay be doing?

  • If it ain’t broke… offer the $5 footballs again, or admit that you don’t know or care about security.
  • Use a known and trusted out-of-band key-generation system: If you don’t want to pay Verisign, use the Google Authenticator system, which runs in software, and is already trusted with Google, WordPress, DropBox and others who apparently care about security more than you do.
  • Roll your own like Blizzard and others. The technology is tried and trusted. Just do it.

But what if…What if the user cannot, for one reason or another, use the second factor? In addition, it should be possible to allow the users print out a set of recovery codes to use when the second factor is unavailable. Talk to Google about this; they obviously know something you don’t.

Advertisements

Skeptical

Why I am a Climate Change Skeptic

When I went to college, it was to study Biochemistry and Environmental Sciences. Back in those days, it was understood that we were, geologically speaking, due for an Ice Age “any day now”.

Within ten years, this changed: Over time, “Global Cooling” became “Global Warming”.

More time passed. It soon became apparent that the planet was neither warming nor cooling; some parts of the globe were getting cooler, other parts were getting warmer. So the Scientific Community, presumably in a bid to not sound like idiots, coined the term “Climate Change”, which has the advantage of meaning … whatever you want it to mean (see also “Hope and Change”).

Before we go any further, it must be said that I accept that there is such a thing as Climate Change. Planet Earth is not a static system. As we speak, the force of the Indian Subcontinent driving into the underbelly of Asia is driving the Himalayan mountains ever higher. And the world’s largest island, Australia, is charging around the globe looking for some unsuspecting continent onto which it can disgorge its cargo of Kangaroos, Koala Bears, Duck-Billed Platypuses… and some of the most dangerous and venomous insects in the world. So some places are getting warmer, some are getting cooler.

What I remain unconvinced about is Anthropogenic Climate Change (ACC), the idea that humans are single-handedly ruining the planet. I “deny” nothing, but I am skeptical, for a great many reasons. So if you call me a “Climate change denier“, I will call you a “Climate Change Alarmist“. I prefer the terms “Climate Change Believer” and “Climate Change Skeptic/Agnostic“. I appreciate that others will not like these terms, with their religious overtones, but the “Consensus” claims of the Alarmists, along with their eschatological panic, make them look a lot like religious zealots.

So yes, climate change is a thing. No sensible person will dispute that. The salient questions are:

  • Are we causing it?
  • How did we cause it?
  • How can we fix it?

Are we causing Climate Change?

Here are some thoughts on the subject:

  • Two thousand years ago, the Romans grew grapes in London. That no longer happens.
  • Between the 14th and the 19th centuries, Europe experienced a “Little Ice Age”. The river Thames froze over many times. That no longer happens either, and has not happened at all in the last two hundred years.
  • So England was cooling, and warming, for centuries, long before industrialization came along.
  • My utility bill tells me the average temperature during the past month, along with the average temperature for the same month last year. In the vast majority of cases, this year has been colder than last year.

Climate Change Alarmists are convinced that unless we change our ways quickly, bad things will happen. However, they cannot agree on what that change will be. We cannot trust the weatherman to tell us what the weather will be a week from now, but they expect us to believe that they know what the climate will be a thousand years from now.

How did we cause it?

The accepted answer from the Climate Change community is “Greenhouse Gases” There are two major greenhouse gases: CO2 and Methane.

CO2 is emitted by emission from burning fossil fuels and also by plants in sunlight. Fossil fuels, however, are not born equal; they range from clean-burning (in terms of CO2 emissions) Natural Gas, to the relatively “dirty” Coal (in the past thirty years, the percentage of power generated from coal has dropped from 57% to 37% in the U.S.).

Methane is a far worse “greenhouse gas” by a factor of about 30 (https://www.sciencedaily.com/releases/2014/03/140327111724.htm) is found mostly generated mostly by natural seepage. Our main contribution is cow flatulence.

Can we fix it?

If ACC is true, There is only one way that works, and that is de-industrialization on a massive scale; no more motor cars, no more power plants, no more electricity, no more civilization; we and go back to living in tents and caves, dying young, and reducing ourselves to a third-world lifestyle. Women will die from childbirth or iPhone withdrawal, men will die in battle. Life will return to its historically natural state: “Nasty, brutish, and short”. Well sign me up!

Assuming that this is not an option, what else is to be done?

  1. Build Nuclear Power Stations. They don’t emit greenhouse gases. Wind-generated power won’t be enough, and Geothermal power, while a viable future option, isn’t there yet.
  2. Give up eating beef.
  3. Buying a hybrid or electric car won’t help. All this does is move the pollution from the vehicle’s exhaust pipe to a power-plant. See #1
  4. International agreements like the Paris Climate Accords are a farce; China and India refused to sign up, and they are among the world’s biggest polluters. Yet when Donald Trump abandoned the accords, he was savaged by the press. I applaud him. No President should embark on a course of action that puts American businesses at a disadvantage.

Some will say things like “95% of scientists agree that ACC is real. That claim may be true, but should be taken with a grain of salt. What they fail to mention is that 100% of government research funding goes to defining and finding a solution to “The problem of Climate Change”. There is no money to be made in pointing out that the emperor has no clothes. It is impossible to make someone believe something if their paycheck depends on them not believing it.

Climate Change Alarmists’ predictions are inconsistent, and often hysterical.

  • In 2007, Al Gore predicted that the Arctic Polar Ice cap could be gone by 2014 . This has not happened, Not even close.
  • Back in the 1970s, and 1980s, there was much talk about the “Hole in the Ozone Layer”, ostensibly caused by CholoFluoroCarbons — or CFCs for short. As a result, CFCs were banned throughout the industrialized world, though it is still in use elsewhere. Within a decade, the hysteria subsided, and there is currently no evidence that there ever was a hole in the Ozone layer. No explanation or apology has ever been given by those who were spreading all of this panic, except for the “It-is-healing-really-really-fast” theory, which is not science. But we are supposed to trust them this time. This reminds me of the end-times claims given by many religious folks.

Conclusions:

I have yet to be convinced that Anthropogenic Climate Change is real.

For obvious reasons, cutting pollution is a good idea, as long as it does not interfere with progress or economic growth.

The Evidence Is Not Conclusive. Climate change “consensus” is not science.

  • Thirty years ago, eggs were good for you.
  • Twenty years ago, eggs were bad for you.
  • Ten years ago, egg yolks were bad for you, while egg whites were good for you.
  • In these enlightened days, eggs are good for you… again.

So much for “Scientific Consensus”

Next time you hear someone saying “We believe that climate change…” or “I believe in science“, remind them that science is not something that you believe in, it is something that you do. When you “believe” in science, something that many prominent atheists claim, you are actually making science your religion.

Says Who?

Ran across this piece recently: The United States of Sex: A Survey of 17,000 Women.

Takeaway: 79%of a sample of 17000 women, most aged 18-45, considered themselves sexy some or all of the time.

Are you nuts?

In a nation where 3 out of 4 women are overweight or obese, four out of five think that they are sexy? Ladies, what are you smoking?

Here’s one for the guys. Next time you are in a public place, look around. Count the women. Now estimate the percentage of them who you would describe as “Sexy”. I guarantee it won’t be 4 in 5. Probably more like 1 in 10. Almost all of them will be under 30. And none of them will be obese.

In related news: The average man thinks the average woman is average, but the average woman thinks the average man is ugly. So who is truly capable of being objective?

Moral: Self-praise is no recommendation.

Christmas in… August?

Just got this in my email:

 

My coverage does not run out until the end of the year, but they are trying to get me to pay up now; more than four months before the bill is due.

*SIGH*… They do this every year.

Google Goes Googly

I’ve been a “fan” of Google for more than ten years. However, they just did something that made me feel very uncomfortable.

They recently updated their YouTube App, but when I went to The Android Market Google Play store I was confronted with the following horror-show:

That’s a bloody awful lot of permissions!

Why all the new permissions? Why does YouTube need access to my contents (which they already own) device info (which they already know) and Contacts (which they already store)?

But wait! There’s more! A few days later they replaced the “Not Now” link (why not a button?) on the nag screen nag screen with a thirty-second countdown timer:

Update Or else

This screen comes up every time the app is started, which is extremely annoying, Google are playing hardball in their attempt to get you to get you to upgrade… and sign away a load of your personal information for which they have no clearly explained need.

Unlike most users, I do not use my main account to watch YouTube, so it doesn’t affect me. Instead, I use a secondary account with no Contacts for them to scarf, so updating is no big deal for me. I advise other users to do the same. But it is enough to make one wonder…

Google, what on Earth are you playing at?

In. Equality

Hot on the heels of April Fools’ Day, apparently today is “Equal Pay Day”. It is not to be confused with “Equality Day”, which is in August. How many more of these feel-good political-BS Hallmark™-Holidays do we need? But I digress…

According to USA today, “Women make up roughly half the workforce. But in 2015, female full-time, year-round workers made only 80 cents for every dollar earned by men, a gender wage gap of 20%… Tuesday is Equal Pay Day, a symbolic day for advocates in the U.S. to show support for women in the workforce and draw attention to the gender pay gap.”

Close but no cigar

It is my contention that we don’t have a gender pay gap, we have a gender work gap. While it is true that the *average* man earns more than the *average* woman, this is a misleading fact: Think about it: the average schoolteacher/nurse/clerical government worker (mostly women) earns less than the average roofer/plumber/truck driver/oil rig worker (mostly men)… which is why the pay gap is bogus. Women choose jobs and careers that are less stressful, more convenient and provide better benefits. Men do most of the dirty/difficult/dangerous jobs, which, naturally pay more. And what thanks do they get? “Waaaah!

Even within the same professions, men and women make different choices, in the medical profession, most dermatologists (9-5, low risk, predictable workload, no emergencies) are female, while most ER Trauma surgeons (blood, guts, bullets and screams at 3AM) are male. Women tend to gravitate toward comfortable, air-conditioned, predictable office jobs. They do not generally want to work in hazardous environments, out in the elements or at night. Men to be drawn to high-paying jobs, often in unsanitary or triple-D (Dirty/Difficult/Dangerous).

Do not misunderstand me here: If a man and a woman do the same job with equal effort and competence, they should receive the same rewards. But there is a saying in the financial markets: “It’s all in the price“. What this means is that the price of a stock reflects all that is know about the performance of the underlying company, its values and its reputation.

Let’s take a look at the sporting world: Among professional tennis players, the men move faster, hit harder and have more stamina than the women. A men’s match is best of five sets, a women’s match is best of three. Men attract bigger crowds and bigger sponsorship deals. And yet there are some who think that women tennis players should be paid the same as men. But competitive sports are a meritocracy – the fact that the women players may “work harder” than men is irrelevant; it’s all in the price. It’s not all one-sided though; as an extreme example females in the porn industry get paid five times more than their male counterparts.

Once you control for the same job, the “pay gap” drops to less than 5%, and in some cities (Atlanta and Chicago, among others) women actually out-earn their male counterparts. Is there a pay gap? Perhaps, but it is not as bad as people like to think that it is, and government intervention won’t fix it, in the same way that they couldn’t fix poverty or drugs. But even when two people do the same job, there are differences: For one thing, women are less likely to ask for a raise; sorry girls, but if you don’t ask, you don’t get.

For another thing, men tend to work longer hours than women. According to the Bureau of Labor Statistics in 2014

“…even among full-time workers (those usually working 35 hours or more per week), men worked longer than women—8.4 hours compared with 7.8 hours.”.

That’s three hours a week, or 7.5% more hours. So if the men are working 7.5% more hours and getting paid 5% more, who is really getting the sharp end of the stick here? This can be seen in most office buildings: take a walk around the floor at 6PM. How many men are working late? How many women?

Even Forbes magazine admits what most of us already know: Men work longer hours than women. Of course, those who insist that women do the same work as men for 20% less forget about one crucial point: If profit-driven, greedy corporations know that women are cheaper and just as good, why don’t they replace their men with cheaper women? That’s a question that the pay-gap-advocates cannot answer and continually avoid. Indeed, one female CEO has gone on record to say that she will not hire women. Why? Short answer: Men get things done, women create drama. If a man had the temerity to say such a thing in public, he would be ostracized, disgraced and probably jailed. Equality. Yeah, right.

It seems that women have plenty of advantages as it is; there are almost twice as many female students in the US as male (great for guys who like chasing girls, lousy for girls looking for a M.R.S. to go with her B.A.). Women get more grants, loans and government help than men, who are beginning to look more and more disadvantaged. But the majority of less-useful degrees are pursued my women.

Why are so many women taking Psychology  and Sociology, and so few are studying Philosophy and Physics? This is reason why there is a dearth of women taking STEM subjects; for precisely the same reason that only 2% of Chess Grand Masters are female; not because of some vast conspiracy to keep them out of the winner’s circle, but simply because they don’t want to.

And let us not forget that married men make more money than single men – for precisely the same reason; they will work longer, less convenient hours, and put in extra time and effort. Yet you never hear single men complain that they are “victims” need government-level “help” and “encouragement” in order to achieve “equality”; they’re probably too busy drinking beer, watching games, chasing girls and enjoying life – and good luck to them.

Bottom line: Life isn’t fair. But it is not as systematically unfair as you would like to wish it were. So make your choices, and live with them. It’s all in the price.

Why I can’t vote for Hillary

I recently got a well-meaning email from a friend, exhorting me to vote for Hillary in the upcoming election. Sadly, I cannot, in good conscience, oblige him. Why? Let me count the ways:

1: Too many questions

  • Her conduct regarding the Benghazi situation — It appears that she was unable/unwilling or unavailable to authorize reinforcements and as a result, four Americans died. Then she blamed it on a video.
  • The Email scandal: There is nothing wrong with using a separate email address for strictly personal content. However, the fact that she was discussing Government business using her private email is negligent at best. At worst, it is treason.
  • Potential health issues: She has been seen falling over, collapsing and having a seizure in public. She passed out on 9/11, initially claiming that she was “overheated” (it was early in the day, not that hot, and she was the only one in the crowd who passed out). Then she claimed that she had Pneumonia, a claim that, if true, means that she has no respect for the health and well-being of others. The fact that she refuses to give clear answers to questions and refuses to even discuss her health until after the election is alarming
  • Allegations of corruption/Financial irregularities: People donate to the Clinton Foundation, then later get appointed ambassador later in the same day. Coincidence? I choose to believe otherwise.

I do not dispute that one of more of these bones of contention may not be valid, but there are too many of them to ignore.

2: Abysmal track record

For someone who has walked the corridors of power for 26 years (First Lady, Senator and Secretary of State), she has a poor record for original thought or real change. But if you vote for her, everything will be just fine. Right…

3: Nothing New

I’ve said before that Elections are not won, they are lost. Gore lost in 2000 (yes, he lost, get over it) because of Bill Clinton. Kerry Lost in 2004 because people who knew him doubted his fitness to command. McCain lost in 2008 because he couldn’t prove that he wasn’t George W. Bush. Romney lost in 2012 because he wasn’t offering anything new. Ironically, Barack Obama offered “Hope and Change” and… well… he disappointed us. The only question in my mind is whether Hillary’s presidency will be Bill Clinton’s Third Term or Barack Obama’s.

4: Too much media bias

The media’s pro-Hillary stance is obvious and palpable. In their minds, She can do no wrong, and her opponent can do nothing right. The mass media are even refusing to ask the hard questions about her health. This is hardly surprising, as the oligarchs who own the media are the same ones who have bought and paid for all of the candidates on both sides of the aisle… with one notable exception.
There is also evidence that Twitter and Google are censoring Dissenting voices, but only those on the right. Perhaps the most obvious example of this is Milo Yiannopolous, about whom I have already posted. A more recent example is the sad case of David Seaman, a liberal journalist, who was fired from and erased from the Huffington Post for daring to ask questions about Hillary’s health. This is the very definition of the “Useful Idiot” described by Stalin. The trouble with Useful Idiots is that once they realize that they become disillusioned and realize that they have been duped, they become your most dangerous enemies.

Boldly going… nowhere

Star Trek: Beyond Review

I am an old-time star Trek fan. My childhood was filled with re-runs of the original series (Kirk, Spock, Bones and the ever-expendableEnsign Ricky Redshirt), and I grew up “Star Trek: The Next Generation”. So I decided to pay out good money to see “Star Trek Beyond” (shouldn’t there be a semi-colon in there somewhere?) in the theater.

Beyond Star Trek

I can’t say that I was that impressed. Star Trek was all about the future of humanity. About Optimism. About where we are headed. And if this is where we are headed, then the future looks disappointing indeed. The Star Trek universe used to be filled with adventurers, and explorers, and feats of derring-do. Aside from the few “hero” characters in the movie, most of the crew and almost all civilians have become hedonistic sheep, wandering about, having a good time, and doing the 24th-century equivalent of staring at their iPhones every thirty seconds. It is no surprise that the Bridge of the Enterprise looks a lot like an Apple store.

Having said all that, this is a great action movie, and a fun enough romp for grown-ups. But it is not really a Star Trek movie: there are more fistfights than starship battles, and the philosophical moments resemble an infomercial for a “let’s-all-be-friends” brand of pacifistic globalism. The stunts are “oh-come-on” unrealistic, and the characters are “oh-come-on” invincible. And Dr McCoy still has a potty mouth. Physician, heal thyself.

Perhaps the most poignant moment for me was right at the end. This movie was dedicated to Leonard Nimoy – the original Spock – who passed away earlier this year, and “For Anton“, which I later found out was Anton Yelchin, the actor who played Ensign Pavel “Wictor-Wictor” Chekhov, who died in an accident shortly after the movie was completed. Chekhov, the word is given. Warp Speed.

The Final Final Frontier

The Star Trek reboot has been a jolly enough jape, but at fifty years of age, it is time to put the franchise out to pasture. I don’t think that I will be seeing another Star Trek movie, and I will be avoiding Paramount in future. Not only because this movie fails to live up to the true spirit of Star Trek, but because the Executives at Paramount have gone back on the creator’s word. Gene Roddenberry used to say that “Star Trek belongs to the fans“; he welcomed Fan fiction. But Paramount recently issued a directive that said, among other things, that Fan films should not be more than fifteen minutes in length, and cannot include any known Star Trek actors), and their suing of the creators of the fan film “Star Trek: Axanar” has left a bad taste in my mouth.

And for that reason, if nothing else, I regret seeing “Star Trek Beyond”

 

 

 

Vega Conflict: Finding the Pattern

For the past week or so I have been farming the new Level-60 Iron Star Deserter Supply Run fleets. They come in 5 flavors that yield boxes for Iron Star ships: Hunters (Python Cutter), Raiders (Heretic Cruiser), Battalion (Vigilante Battleship), Artillery (Machete Destroyer) and Scouts (Hurricane Frigate).

Although the fleets are technically different, they are actually precisely the same, consisting of four Python Cutters, Two Vigilante Battleships, Two Machete Destroyers and one Freyja Carrier. Various strategies exist to crush these fleets, and I have my own; you are welcome to peek into my battles and see how I do it. I can usually farm an entire hour-long supply run usually without losing a ship (the Cutters are the only real challenge, the rest is easy to kite), followed by a 1-6 hour repair cycle.

Any road up, the subject of this post is neither the makeup of the enemy fleet nor the strategy required to defeat it; my purpose here is to examine the “prizes” contained in the boxes.

Screenshot_2016-08-25-19-08-37Each box contains:

  1. Either a Tier-5 core, a Tier-4 core (I wish Kixeye wouldn’t give out sub-standard cores!) or a pattern (Mk II, III, IV or V)
  2. Ship Parts
  3. Iron Star Armaments

To mark up a single Hurricane Frigate to Mk V, you need:

  • 2048-2560+3200+4000=6688 Iron Star Armaments
  • 10+30+90+270=400 Hurricane Frigate Parts
  • 5+5+5+5=20 Tier-5 Frigate Cores
  • One each of Mk II, Mk III, Mk IV and Mk V Patterns

So, how much farming would that entail?

As an experiment, I collected a whole lot of Hurricane Boxes. When I opened them, I got the following results:

Screenshot_2016-08-25-19-09-08Screenshot_2016-08-26-04-10-12Screenshot_2016-08-26-22-07-48

This means that after after opening a total of 49 Hurricane boxes, I got:

  • Countless Iron Star Armaments (once so hard to find, now as common as muck)
  • 150+42+102=294 Hurricane Frigate Parts
  • 10+1=11 Tier-5 Frigate Cores
  • 13+4+12=29 Tier-4 Frigate Cores
  • 8 Mk II Hurricane Patterns
  • 1 Mk III Hurricane Patterns
  • NO Mk IV Hurricane Patterns
  • NO Mk V Hurricane Patterns

What does this tell us?

  • Tier-4 Cores (useless) outnumber Tier-5 (the ones you really want) by about six-to-one
  • Only one in four drops contain a Pattern.
  • Most of those patterns are Mk II.
  • You will have to farm fifty fleets to get one ship to Mk III
  • Mk IV and V? Forget it.
  • It is almost like Kixeye wants us to spend coins to get the pattern boxes ($4 per ship to get all four patterns)

Dear Kixeye, stop giving with one hand and taking with the other. Stop giving out sub-standard cores and stop playing silly buggers with the higher level patterns!

Hobson’s Choice

An oldie but a goodie: I no longer have the phone but I found this screenshot:

Screenshot_2014-01-07-07-39-47

So where’s the “Cancel” Button?