Re: solving the wrong problem

2005-08-10 Thread astiglic
'chindogu' seems almost appropriate but maybe not exact http://www.designboom.com/history/useless.html http://www.pitt.edu/~ctnst3/chindogu.html --Anton - The Cryptography Mailing List Unsubscribe by sending "unsubscribe cry

Re: solving the wrong problem

2005-08-09 Thread Ilya Levin
Dave Howe wrote: > > "Nonsense fence" maybe less metaphoric but more clear. > I disagree - "one picket fence" gives a clear impression of a protective > device > that is hardened at but one point - leaving the rest insecure. "nonsense > fence" > doesn't give any real image. Perhaps, but sometime

Re: solving the wrong problem

2005-08-09 Thread Anne & Lynn Wheeler
John Denker wrote: > That's an interesting topic for discussion, but I don't think > it answers Perry's original question, because there are plenty > of situations where the semblence of protection is actually a > cost-effective form of security. It's an example of statistical > deterrence. i've

Re: solving the wrong problem

2005-08-09 Thread Peter Gutmann
arkles in plastic >>> painted on the missile rather than paper? >> >> Yes. The intent was that forging the fingerprint on a warhead should cost as >> much or more than the warhead itself. > >Talking of solving the wrong problem, that's a pretty bad metric - for

Re: solving the wrong problem

2005-08-09 Thread Russell Nelson
Perry E. Metzger writes: > Anyone have a good phrase in mind that has the right sort of flavor > for describing this sort of thing? Well, I've always said that crypto without a threat model is like "cookies without the milk". -- --My blog is at blog.russnelson.com | In a democracy

Re: solving the wrong problem

2005-08-09 Thread Daniel Carosone
On Tue, Aug 09, 2005 at 01:04:10AM +1200, Peter Gutmann wrote: > That sounds a bit like "unicorn insurance" > [..] > However, this is slightly different from what Perry was suggesting. > There seem to be at least four subclasses of problem here: > > 1. "???" : A solution based on a misunderstandin

Re: solving the wrong problem

2005-08-08 Thread Peter Fairbrother
they know they >>> have a particular piece of paper on hand. >> >> Didn't the people who did US/USSR nuclear arms verification do something >> very similar, except the characterised surface was sparkles in plastic >> painted on the missile rather than paper

locking door when window is open? (Re: solving the wrong problem)

2005-08-08 Thread Adam Back
"Single picket fence" -- doesn't work without a lot of explaining. The one I usually have usually heard is the obvious and intuitive "locking the door when the window is open". (ie fixating on quality of dead-bolt, etc on the front door when the window beside it is _open_!) Adam On Sat, Aug 06,

Re: solving the wrong problem

2005-08-08 Thread Peter Gutmann
Adam Shostack <[EMAIL PROTECTED]> writes: >Let me propose another answer to Perry's question: > "Wearing a millstone around your neck to ward off vampires." > >This expresses both ends of a lose/lose proposition: > -- a burdensome solution > -- to a fantastically unimportant problem. That s

Re: solving the wrong problem

2005-08-08 Thread Peter Gutmann
Peter Fairbrother <[EMAIL PROTECTED]> writes: >Perry E. Metzger wrote: >> Frequently, scientists who know nothing about security come up with >> ingenious ways to solve non-existent problems. Take this, for example: >> >> http://www.sciam.com/article.cfm?chanID=sa003&articleID=00049DB6-ED96-12E7-AD

Re: solving the wrong problem

2005-08-07 Thread John Denker
Adam Shostack wrote: Here's a thought: "Putting up a beware of dog sign, instead of getting a dog." That's an interesting topic for discussion, but I don't think it answers Perry's original question, because there are plenty of situations where the semblence of protection is actually a cost-ef

Re: solving the wrong problem

2005-08-07 Thread Peter Fairbrother
Perry E. Metzger wrote: > > Frequently, scientists who know nothing about security come up with > ingenious ways to solve non-existent problems. Take this, for example: > > http://www.sciam.com/article.cfm?chanID=sa003&articleID=00049DB6-ED96-12E7-AD9 > 683414B7F > > Basically, some clever

Re: solving the wrong problem

2005-08-07 Thread Adam Shostack
Here's a thought: "Putting up a beware of dog sign, instead of getting a dog." On Sun, Aug 07, 2005 at 09:10:51PM +0100, Dave Howe wrote: | Ilya Levin wrote: | >John Denker <[EMAIL PROTECTED]> wrote: | > | >>So, unless/until somebody comes up with a better metaphor, | >>I'd vote for "one-picket

Re: solving the wrong problem

2005-08-07 Thread Dave Howe
Ilya Levin wrote: John Denker <[EMAIL PROTECTED]> wrote: So, unless/until somebody comes up with a better metaphor, I'd vote for "one-picket fence". "Nonsense fence" maybe less metaphoric but more clear. I disagree - "one picket fence" gives a clear impression of a protective device that is

Re: solving the wrong problem

2005-08-07 Thread Ilya Levin
John Denker <[EMAIL PROTECTED]> wrote: > So, unless/until somebody comes up with a better metaphor, > I'd vote for "one-picket fence". "Nonsense fence" maybe less metaphoric but more clear. -- - Ilya O Levin http://www.literatecode.com

Re: solving the wrong problem

2005-08-06 Thread J.A. Terranson
On Sat, 6 Aug 2005, Perry E. Metzger wrote: > We already have the term "snake oil" for a very different type of bad > security idea, and the term has proven valuable for quashing such > things. We need a term for this sort of thing -- the steel tamper > resistant lock added to the tissue paper do

Re: solving the wrong problem

2005-08-06 Thread Hadmut Danisch
When I came to Washington DC last november, my portrait and fingerprints were taken for the first time. I was the last one in the queue and the immigration officer was a nice guy, so I asked him how this should protect against terrorists. As far as I read in the newspapers, the 911 attackers just c

Re: solving the wrong problem

2005-08-06 Thread Sherri Davidoff
Reminds me of the White Knight from Alice in Wonderland, who doesn't understand his threat model, and doesn't know how to effectively use his tools: `I see you're admiring my little box,' the Knight said in a friendly tone. `It's my own invention -- to keep clothes and sandwiches in. You see I ca

Re: solving the wrong problem

2005-08-06 Thread Anne & Lynn Wheeler
Perry E. Metzger wrote: > A variant on the moviefone.com model might work better for these folks > -- have the person buy the tickets with a credit card, and use a > machine to check that they are in physical possession of said card > when they enter the theater. Most people will not loan their car

Re: solving the wrong problem

2005-08-06 Thread Perry E. Metzger
"Steven M. Bellovin" <[EMAIL PROTECTED]> writes: > Tickets are an excellent use for this, because it binds the printing to > a specific physical object. The concert industry has had a problem > with trying to use print-at-home tickets -- the fraudsters buy a single > ticket, then print it mult

Re: solving the wrong problem

2005-08-06 Thread Steven M. Bellovin
In message <[EMAIL PROTECTED] nk.net>, John Kelsey writes: > >On the other hand, think about the uses of this technology >for paper bearer instruments. Design travelers' checks that >include a 2D barcode with a BLS signature, bound to the >piece of paper, and you can print the damned thing on >re

Re: solving the wrong problem

2005-08-06 Thread John Kelsey
>From: "Perry E. Metzger" <[EMAIL PROTECTED]> >Sent: Aug 6, 2005 2:28 PM >To: cryptography@metzdowd.com >Subject: solving the wrong problem >Frequently, scientists who know nothing about security come >up with ingenious ways to solve non-existent problem

Re: solving the wrong problem

2005-08-06 Thread John Denker
Perry E. Metzger wrote: We need a term for this sort of thing -- the steel tamper resistant lock added to the tissue paper door on the wrong vault entirely, at great expense, by a brilliant mind that does not understand the underlying threat model at all. Anyone have a good phrase in mind that

solving the wrong problem

2005-08-06 Thread Perry E. Metzger
Frequently, scientists who know nothing about security come up with ingenious ways to solve non-existent problems. Take this, for example: http://www.sciam.com/article.cfm?chanID=sa003&articleID=00049DB6-ED96-12E7-AD9683414B7F Basically, some clever folks have found a way to "fingerprint" th