NComputing and Sugar

Apologies for not posting recently, but I've been really busy with various events and tasks for the summer. I just got back from NECC09, where ISTE had been nice enough to give Sugar and other FLOSS projects their own presentation room, gratis.

While assisting with the various presentations at the Open Source Center and staffing the Sugar/OLPC booth, I ran into some of the folks from NComputing. Their corporation has some similiar goals with that of OLPC, as both involve low-cost computing for the third world and elsewhere. Providing multi-seat technology, which is similar to thin-clients without the lag and network overhead, they enable multiple displays and mice to function off a single computer. Since they support both Ubuntu and SuSE Linux with their (admittedly closed) hardware, I decided to investigate their technology as a means of enhancing deployment of Sugar.

The method to activate the NComputing software (requires registration to download) is not obvious; one must navigate to the console, select "Serial Numbers" from the side menu, and then right click the empty license list and choose "Manage". Many users would not be able to do so without the manual; maybe it would be easier to prompt for a license key in the debconf install process?

Unfortunately, I wasn't able to test their software with Sugar; the most recent version of Ubuntu they support is 8.04, and I can't even insmod their kernel module on 9.04.

aside: meant to put this out an age ago, just got around to hitting "publish" today. (2009-08-16)

http://en.wikipedia.org/wiki/Free_and_open_source_software

Personal Security: the Secret Question and Answer

In this session, we'll explore some parts of infosec which should be taught in primary school.

We're all too smart to use the same password on multiple sites, right?

While most people, I included, cannot say "yes" to the first question (at least not for everything), that alone is not enough. This is because no matter how secure your password is, be it 20 letters long with various dingbats and ?? characters, there is a weak link in this system. Or rather, two:

Your email is an obvious vulnerability: if someone was able to gain access to that, it would be trivial to reset your password for Facebook, YouTube, Meebo, etc.

What if you have a strong email password, you ask? In that case, we get on to the heart of the matter (which is also the most relevant to all those social networking users out there): secret questions.

Secret Q&As (SQAs) were initially a good idea: provide an alternative in case one has lost access to one's email, or never set one in the first place. (as with Gmail or Yahoo) It presents an interesting problem, however: while the average netizine is unlikely to know the mother's maiden name of dogggzlover98382374@hotmail.com, if even your name can be figured from your email address (or the attacker knows you personally), it is trivial to use sites such as Facebook and MySpace to find the answers to SQAs. A rather public example of this vulnerability can be seen when Sarah Palin's email account was broken into last summer: all of the information needed could be found out using public records.

An example of a possible attack against Facebook in particular:

• Gain access to someone's profile by either friend-requesting outright them or by masquerading as someone they know (and don't already despise)


• Look for an email address on the profile or in wall posts.


• Visit their email provider and reset their email password via the information in their profile.


• Now reset their Facebook password. This will send an email to their address, which you already have access to.

This works against any site that uses a email-loop, even if it is well designed to avoid common SQAs. Social networking sites, however, are particularly vulnerable because of the wealth of personal information one shares freely on them.

This is because, as they are part of your personal history and not transactional, SQAs are almost always the same between sites. So, if you're truly concerned about your information security: use something random for your SQAs and store them in a safe place.