Pass Algorithms Vs. Passwords

Pretty much every web-based service one uses nowadays requires some sort of login and password. I have a list of most of the sites that I have registered on, and at the moment it has almost 100 entries on it. Probably 40 of those I still use at least twice a year, if not weekly. It became clear to me some years ago that I was going to have serious problems if I used the same password or small set of passwords on all of them. If someone managed to get one of my passwords, they potentially would have access to all of the other sites on which I registered using that password. This is an unacceptable risk.

The problem of course is that it would be hard to remember and keep straight separate passwords for all of those sites. There is password management software available which will help you with this by storing all of those login IDs and passwords and then entering them for you automatically when you go to those sites. Still, that strikes me as a poor solution when one uses more than one computer regularly; keeping two or more master lists of passwords synchronized would not be trivial, and would likely cause you a problem when you were most in a hurry. I wanted a solution that gave me separate passwords for every site, yet did not require any kind of additional complication of some sort of 'helper' software. I did not want to be dependent on anything but my brain.

The answer is actually an old idea which I read about, believe it or not, in a science fiction story more than 30 years ago. The key insight is to use a pass algorithm rather than a password. Such an algorithm will allow you to compute the password on the fly from the information at hand rather than having to remember it. This is much easier than it sounds. Here's a very simple algorithm one could use (although it is so simple I would not recommend it): use the name of the service as the password. Thus, the password for my Gmail account would be 'gmail', while the password for my Ebay account would be 'ebay', etc. As you can see, if this were my algorithm I would not have to remember any passwords. I would just look at the domain name of the site in the URL, and use that name for the password. Instantly every site has a unique password, but I only have to remember one thing, the pass algorithm.

As I said, this algorithm is too simple, since having seen one password, it would be easy to guess how the rest of your passwords were set up. So let's make a modest improvement. Look at the keypad of your telephone and you will see that most buttons have letter labels. Using this as a key, you could take the domain name of the site and translate it letter by letter to the corresponding digit. Thus, my Gmail password would be '46245' while my Ebay password would be '3229'. Now this is much better. It is unlikely that anyone who hasn't read this blog would be able to guess at this algorithm from just looking at one password. Still, it's possible. You could complicate it a bit more by always adding a prefix or suffix of some sort. (Be sure to make it a nonsense prefix/suffix rather than an English word or name.)

Here is another possibility: use your computer's keyboard as your key. For example, you could look at each letter in a domain name and map it to the character above it on the keyboard. With this scheme, the Gmail password is 'tjq8o' and the Ebay password is '3gq6'. The only real criterion for an algorithm like this is that it has to be simple enough that you really can do it in your head (or on your keyboard) and it has to scramble the name up sufficiently to make it hard for someone who obtains your password to figure out what you are doing. There are other kinds of mappings you could come up with. You could also combine a couple of methods in some way. However you do it, you should come up with your own algorithm, and then experiment a little to see how easy it is for you to execute it. It may take you a couple of tries, but believe me it is worth it. I find it very satisfying in a way to have a separate password for every site, yet not have to remember a single one.

Oh, by the way, the algorithm I use is not like any of the ones I described.

Addendum 12/5/2006: I just ran across this article, which describes several approaches to passwords like the ones I described above, plus a bunch of others.

The Journey Metaphor Doesn't Go Anywhere

Everyone has heard the journey metaphor. Sooner or later, every political or religious leader facing the necessity of taking an unpopular course of action always tells his faithful "Remember, we are all on a journey together, and we have to be ready to act accordingly." Somehow this is supposed to help people tighten their belts, gird up their loins, and brace themselves as they go back out into the storm. Having heard variations of this line all of my life, I'm afraid I now take a rather jaundiced view of it.

There are some problems with the journey metaphor. For example, you may realize that rather than being on a journey, i.e., going from one point to another, in reality you are just going in circles. An example of this came up a couple of months ago when I was talking with a friend about cancer and the impact it has on a family's life. We talked about my bout with multiple myeloma and her father's struggle with some other kind of cancer. I no longer remember exactly what brought it up, but somewhere in the middle of the conversation I remarked "I really hate the journey metaphor", and she vigorously agreed. She mentioned how when her father was first diagnosed, he was in a lot of distress, as were she and the other family members trying to care for him. Some social worker at the hospital, in trying to be helpful, told her "Now, remember, you are all on a journey together ... ". Before the social worker could finish, my friend interrupted her and said "This is no journey! It's a nightmare!" Certainly my own experience with cancer seems very far from being journey-like. Yes, there were constant changes, but they were cyclic, or even chaotic, to the point that it seemed at times I was making progress more on the basis of Brownian motion than because I was actually going anywhere. (Happily, I eventually did start improving, and am now in much better shape.)

Another problem with the journey metaphor is that it encourages the wrong set of priorities. If you are on a journey, then you won't be coming back to the point again. So you have no incentive whatsoever for cleaning up your messes. It's easier just to pack up and move on, leaving your trash behind. Even figuratively this is not a good idea. Unresolved problems left behind can certainly come back and bite you, especially if it turns out that you are not journeying, but going in circles.

A much better metaphor, it would seem to me, is construction. You are trying to build something, whether it is a healthy body or a new organization. With construction, you have to pay attention to the details. You have to make sure that you have the tools and materials you need, and you have to take care of the trash.

A grimmer but more apt metaphor sometimes is war or battle. If you are facing a genuine obstacle, perhaps other people or even the perversity of nature, you might well find yourself conducting metaphorical military operations. However, don't get carried away with this. The war metaphor is way over-used, too.

Nevertheless, if you are facing a problem and are responsible for getting a group of people to deal with it, for heaven's sake, don't tell them they are on a journey. Be honest with them, and tell them that they have a problem, and they have to deal with it, perhaps by fighting something or building something. Going on a journey is just running away.

Another Marketing-Created Term I Hate

I have come to thoroughly detest the term 'user experience', as in 'these new features will enhance the user experience'. I'm sorry, but I don't want to experience your software at all. I may want to use it, but that's all. I'll keep my experiences to myself.

Problems with Google's AdSense

I just spent some interesting but ultimately fruitless minutes looking for a particular blog entry I saw somewhere a few weeks ago. It was on a scientifically-oriented blog of some sort (like The Bad Astronomer) that had Google AdSense ads on it. What struck me at the time was the irony of the fact that the particular posting on that page was a rant against some pseudo-science while AdSense provided an ad for a service based on exactly that pseudo-science. That got me wondering how often it happened that an ad was diametrically opposed to the content of the page it appeared on. So I tried a very small experiment. I got onto my Gmail account, and sent myself a message containing the one line:

This is a rant against water dousing and water witching.

When I read the message in Gmail (which also shows AdSense ads), it showed these four ads over on the right side of the page:

New Winner Every Day
Win 5 Pet Peeves Characters(tm) Enter the Free daily Contest here.

Pendulum of Pendulums
Dowsing results you can trust -free shipping

Spiritual Dowsing
Beautiful Pendulums & Great L-rods Dowsing Books & Dowsing Services

Innovative health product
Preventive, non-invasize technology Subtle Energy Technologies

As you can see, two of the ads are exactly for services based on the pseudo-science I mentioned in my mini-rant. I tried the same thing again using different text and, as I expected, got essentially the same outcome. Google searches (upon which AdSense is based) are very effective for finding matches for words and phrases such as those that occur in a blog page or an email message. The problem is that AdSense cannot distinguish between positive and negative mentions of these terms. (BTW, I have no explanation for the 'Pet Peeves' or 'Subtle Energy' ads.) So, the moral of the story is:

If your page uses AdSense, and it is showing ads you don't like, try changing the wording of the problematic phrase, or try rendering it in some clever way that human readers can easily read but which AdSense will not pick up on. For example, space the p r o b l e m w o r d s out.

It's About Time

I've been a long time coming, but I'll be a long time here.

People have been telling me that I should start a blog somewhere. As my friend Karen Fenton once put it "I'm having a moment of inertia." In my defense, I've been kind of sick for a while.

In March 2005 I was diagnosed with multiple myeloma, a very nasty bone marrow cancer. After extensive chemotherapy and two bone marrow stem cell transplants, I'm definitely doing better, but I'm not out of the woods yet. Recently, I have relapsed. (Although since the doctors never declared that I was in remission, I'm not sure telling me that I relapsed is all that informative.) Anyway, there is a protein called immunoglobulin gamma (IgG) which is indicative of how active my particular form of myeloma is. From January to June of 2006, the IgG level steadily fell. However, over the summer it started rising again, to the point that it got almost back up to the January level by mid-August. The doctors put me back on thalidomide, which is one of the drugs I was on for all four rounds of chemotherapy last year. It apparently is pretty effective against so-called 'refractory' myeloma, so we are hopeful that this will help. Unfortunately thalidomide has some pretty serious side effects. The most serious is probably peripheral neuropathy, which is the degeneration of nerves in the limbs, particularly in the hands and feet. The problem manifests itself first with a tingling, pins-and-needles sensation in the fingers. So far that hasn't happened, although I did experience that last year when I was on higher doses of thalidomide. The main problem I'm experiencing now is dizziness, nausea and general dopiness. The only upside of that so far is that thalidomide has cured my insomnia.

Regarding writing, I've been storing up a long list of topics about which I have something to say. At least I think I do. Having never actually written out my thoughts on these topics, it's hard to say how coherent they will be when finally put down as bytes in a database. We shall see.