No river is too wide or too deep for me to swim to you
Come whenever I’ll be the shelter that won’t let the rain come through
Your love, it is my truth
And I will always love you
Love you, love you– “Remedy” by Adele
This is a computer post. But, I want to start with Adele. I’m not normally a modern pop music fan. The artists are talented, but I’m not their target demographic. Country music? 80’s music? Jazz? Sure, but not so much the Top 40 stuff. But, I’ve been trying to expand my musical appreciation. (What Imagine Dragons and Bruno Mars Taught Me About My Job) So, like about a million other people, I bought Adele’s new album, 25. I like it.
The other day, I noticed the above lyric; not the love references or even the second line with its beautiful metaphor about shelter and rain. The first line however struck me as wrong.
I live near a lake.
Here’s where Adele got it wrong. The shallowness of Utah Lake is its greatest danger. We get a lot of wind in Utah. The entire greater Salt Lake City area sits in a big bowl formed by the surrounding mountains. When a storm comes through, the winds comes roaring down our canyons, or blow across the top of the bowl, only to hit the mountains on the far side and “curl” back under. It’s not unusual to have high clouds moving south and the wind on the family floor blowing north.
That wind blows across Utah Lake and turns a smooth lake into a churning maelstrom in a matter of moments. And it’s the shallowness of the lake that makes it worse. The water is easily pushed around by the surface wind. Tragedies occurs every summer. Boats get swamped, or boaters simply fall out of their boat in a sudden storm. They then don’t have the strength to fight the wind and waves to swim back to their boat.
We have another lake in Northern Utah called Bear Lake. It’s less than half the size of Utah Lake, at 109 square miles. Bear Lake is 94 feet deep on average; nearly 10x deeper than Utah Lake. And yet, that depth helps make Bear Lake less dangerous than Utah Lake. Winds blowing across Bear Lake can’t really move the water around like they do further South on Utah Lake.
We tend to think of deep as dangerous and shallow as safe. That’s what Adele was singing about. And yet, in many cases it’s just the opposite. There are parallels in the IT computer world. I want to talk about two.
Passwords
No one would be surprised when we say that long passwords are safer than short ones. If you have a PIN for example and it’s 4 characters long, there are 10,000 possible combinations, 0000-9999. Increase that PIN length to 6 characters and you now have a possible 1,000,000 possible combinations, 000000-999999. It would be possible, if tedious for someone to try 1000 combinations. You may have done this if you ever forgot the combination on a suitcase. It’s virtually impossible for a single person to try 1,000,000 combinations. A password can include numbers and special characters allowing for many more combinations. Clearly longer is better.
And yet, you can take that logic too far. I have a system that I log into daily. I’ve set up my phone to automatically log into it. Occasionally, I need to access the site from my laptop and then I run into a problem. I know I have a strong password, and I know kind of what it is. But, it often takes me multiple tries to remember it. Finally, after the third failed attempt the system asks if I want to recover my password. Sure, that’s why password systems are built the say they are. The problem is that the system doesn’t actually recover my password. Instead it assigns a new password and emails that to me. This wouldn’t be a problem except that system generated password looks like x7JV2bk9A. Of course, I want to change it right away to something I can remember. As I reset it to my normal password, I get an error.
YOU’VE ALREADY USED THAT PASSWORD. PLEASE CHOOSE A NEW PASSWORD.
I’ll try all of my common passwords. And each one in turn will be rejected. Finally, I will find a unique password that is close to my normal password naming scheme, which includes a pass phrase and a sequential number. I then update my phone with this new password and things go back to normal until the next time I have to access this system from my laptop and I restart the entire process. The alternative is to write down my password. Now I’ve taken a system designed to be extra secure and made it less secure by having my password written down.
Like a shallow lake, a complex password might seem safer, but can actually result in a less secure system.
Cryptography
Another situation that turns the conventional wisdom of “longer is better” is the science of cryptography. This includes secret codes, but also trying to decypher ancient languages. I admit I’m not an expert on making and breaking codes. I’ve read several books on it and find the concepts fascinating. The success of the Allies in WWII was aided greatly by the work done to break both the German codes and the Japanese codes. Alan Turing was one of the pioneers of Computer Science and was instrumental in breaking the German codes and figuring out the Enigma code machines.
One of the ironies of code breaking is that the longer the message, the easier it is to break. All languages have patterns. Some words are more common than others. Some letters are used more often than others. The larger sample you have to analysis the more likely a code breaker will be able to spot some of those patterns. This is the same pattern that linguists, or archeologists, or archeological linguists use to attempt to decipher ancient languages. They look for patterns and try to connect the dots. Egyptologists spent years attempting to decipher Egyptian heiroglyphics.
In July, 1799 French soldiers in Egypt found a stone near Rosetta Egypt that included text written in both Greek and Egyptian hieroglyphics, and a centuries old cryptography puzzle were finally solved. When it comes to breaking codes, or deciphering text, more is better.
–
Sometimes what we think makes sense, actually is exactly the opposite of what we think. Adele wrote a beautiful song about helping the ones you love. The symbolism she seemed to be using was the idea that wide and deep separations between two people can be hard to overcome. But in reality, sometimes a deep lake (or River) is safer, or easier to cross than a shallow one.
I doubt that crypto specialists or security analysis to are looking to pop music for inspiration on creating more secure system. But at least it’s some nice music to play in the background while they are working.
Rodney M Bliss is an author, columnist and IT Consultant. His blog updates every weekday at 7:00 AM Mountain Time. He lives in Pleasant Grove, UT with his lovely wife, thirteen children and grandchildren.
Follow him on
Twitter (@rodneymbliss)
Facebook (www.facebook.com/rbliss)
LinkedIn (www.LinkedIn.com/in/rbliss)
or email him at rbliss at msn dot com(c) 2015 Rodney M Bliss, all rights reserved