Re: solving the wrong problem

2005-08-10 Thread astiglic
'chindogu' seems almost appropriate but maybe not exact http://www.designboom.com/history/useless.html http://www.pitt.edu/~ctnst3/chindogu.html --Anton - The Cryptography Mailing List Unsubscribe by sending unsubscribe

Re: solving the wrong problem

2005-08-09 Thread Daniel Carosone
On Tue, Aug 09, 2005 at 01:04:10AM +1200, Peter Gutmann wrote: That sounds a bit like unicorn insurance [..] However, this is slightly different from what Perry was suggesting. There seem to be at least four subclasses of problem here: 1. ??? : A solution based on a misunderstanding of what

Re: solving the wrong problem

2005-08-09 Thread Russell Nelson
Perry E. Metzger writes: Anyone have a good phrase in mind that has the right sort of flavor for describing this sort of thing? Well, I've always said that crypto without a threat model is like cookies without the milk. -- --My blog is at blog.russnelson.com | In a democracy the

Re: solving the wrong problem

2005-08-09 Thread Peter Gutmann
? Yes. The intent was that forging the fingerprint on a warhead should cost as much or more than the warhead itself. Talking of solving the wrong problem, that's a pretty bad metric - forging should cost the damage an extra warhead would do, rather than the cost of an extra warhead. That's got

Re: solving the wrong problem

2005-08-09 Thread Anne Lynn Wheeler
John Denker wrote: That's an interesting topic for discussion, but I don't think it answers Perry's original question, because there are plenty of situations where the semblence of protection is actually a cost-effective form of security. It's an example of statistical deterrence. i've

Re: solving the wrong problem

2005-08-09 Thread Ilya Levin
Dave Howe wrote: Nonsense fence maybe less metaphoric but more clear. I disagree - one picket fence gives a clear impression of a protective device that is hardened at but one point - leaving the rest insecure. nonsense fence doesn't give any real image. Perhaps, but sometimes rubbish

Re: solving the wrong problem

2005-08-08 Thread Peter Gutmann
Adam Shostack [EMAIL PROTECTED] writes: Let me propose another answer to Perry's question: Wearing a millstone around your neck to ward off vampires. This expresses both ends of a lose/lose proposition: -- a burdensome solution -- to a fantastically unimportant problem. That sounds a

locking door when window is open? (Re: solving the wrong problem)

2005-08-08 Thread Adam Back
Single picket fence -- doesn't work without a lot of explaining. The one I usually have usually heard is the obvious and intuitive locking the door when the window is open. (ie fixating on quality of dead-bolt, etc on the front door when the window beside it is _open_!) Adam On Sat, Aug 06,

Re: solving the wrong problem

2005-08-08 Thread Peter Fairbrother
similar, except the characterised surface was sparkles in plastic painted on the missile rather than paper? Yes. The intent was that forging the fingerprint on a warhead should cost as much or more than the warhead itself. Talking of solving the wrong problem, that's a pretty bad metric - forging

Re: solving the wrong problem

2005-08-07 Thread Ilya Levin
John Denker [EMAIL PROTECTED] wrote: So, unless/until somebody comes up with a better metaphor, I'd vote for one-picket fence. Nonsense fence maybe less metaphoric but more clear. -- - Ilya O Levin http://www.literatecode.com

Re: solving the wrong problem

2005-08-07 Thread Dave Howe
Ilya Levin wrote: John Denker [EMAIL PROTECTED] wrote: So, unless/until somebody comes up with a better metaphor, I'd vote for one-picket fence. Nonsense fence maybe less metaphoric but more clear. I disagree - one picket fence gives a clear impression of a protective device that is

Re: solving the wrong problem

2005-08-07 Thread Adam Shostack
Here's a thought: Putting up a beware of dog sign, instead of getting a dog. On Sun, Aug 07, 2005 at 09:10:51PM +0100, Dave Howe wrote: | Ilya Levin wrote: | John Denker [EMAIL PROTECTED] wrote: | | So, unless/until somebody comes up with a better metaphor, | I'd vote for one-picket fence. |

Re: solving the wrong problem

2005-08-07 Thread Peter Fairbrother
Perry E. Metzger wrote: Frequently, scientists who know nothing about security come up with ingenious ways to solve non-existent problems. Take this, for example: http://www.sciam.com/article.cfm?chanID=sa003articleID=00049DB6-ED96-12E7-AD9 683414B7F Basically, some clever folks

Re: solving the wrong problem

2005-08-07 Thread John Denker
Adam Shostack wrote: Here's a thought: Putting up a beware of dog sign, instead of getting a dog. That's an interesting topic for discussion, but I don't think it answers Perry's original question, because there are plenty of situations where the semblence of protection is actually a

solving the wrong problem

2005-08-06 Thread Perry E. Metzger
Frequently, scientists who know nothing about security come up with ingenious ways to solve non-existent problems. Take this, for example: http://www.sciam.com/article.cfm?chanID=sa003articleID=00049DB6-ED96-12E7-AD9683414B7F Basically, some clever folks have found a way to fingerprint the

Re: solving the wrong problem

2005-08-06 Thread John Denker
Perry E. Metzger wrote: We need a term for this sort of thing -- the steel tamper resistant lock added to the tissue paper door on the wrong vault entirely, at great expense, by a brilliant mind that does not understand the underlying threat model at all. Anyone have a good phrase in mind that

Re: solving the wrong problem

2005-08-06 Thread John Kelsey
From: Perry E. Metzger [EMAIL PROTECTED] Sent: Aug 6, 2005 2:28 PM To: cryptography@metzdowd.com Subject: solving the wrong problem Frequently, scientists who know nothing about security come up with ingenious ways to solve non-existent problems. Take this, for example: http://www.sciam.com

Re: solving the wrong problem

2005-08-06 Thread Perry E. Metzger
Steven M. Bellovin [EMAIL PROTECTED] writes: Tickets are an excellent use for this, because it binds the printing to a specific physical object. The concert industry has had a problem with trying to use print-at-home tickets -- the fraudsters buy a single ticket, then print it multiple

Re: solving the wrong problem

2005-08-06 Thread Sherri Davidoff
Reminds me of the White Knight from Alice in Wonderland, who doesn't understand his threat model, and doesn't know how to effectively use his tools: `I see you're admiring my little box,' the Knight said in a friendly tone. `It's my own invention -- to keep clothes and sandwiches in. You see I

Re: solving the wrong problem

2005-08-06 Thread Anne Lynn Wheeler
Perry E. Metzger wrote: A variant on the moviefone.com model might work better for these folks -- have the person buy the tickets with a credit card, and use a machine to check that they are in physical possession of said card when they enter the theater. Most people will not loan their cards

Re: solving the wrong problem

2005-08-06 Thread J.A. Terranson
On Sat, 6 Aug 2005, Perry E. Metzger wrote: We already have the term snake oil for a very different type of bad security idea, and the term has proven valuable for quashing such things. We need a term for this sort of thing -- the steel tamper resistant lock added to the tissue paper door on