text:
Itchy Balls After Kissing Cold Sore Sign Of HIV AIDS
Here's a taste of what TheBody.com has to offer on this topic:
Ask the Experts
"a kiss is NOT just a kiss" when it = HIV! Please answer...I'll be happy to donate $50Dr Bob,What is needed to get an answer from you on this forum? You must get bombarded with questions...please - this is 8th time I've asked you to answer my question...I'm sorry it's long but I'm very concerned that I'm walking around with HIV and...Response from Robert J. Frascino, M.D.
The Robert James Frascino AIDS Foundation
...HIV-related lipodystrophy, because you don't have HIV!9. Exactly what part of HIV negative are you having difficulty understanding?10. Nope!11. You do not have a new strain. You have irrational fear of being HIV infected. I suggest you seek...
Read more »
HIV from KissingHi;My Question is that can someone contracts HIV from Open Mouth Kissing. Actually I had a Open... Read more »HIV from deep kissing?I recently kissed another man who is gay. I am married. We did a lot of deep kissing with tongue... Read more »
A Little Kiss Was Big Help in Spreading Word on AIDS...Pentecostal church and standing up to her 51-year-old husband when she wanted to go public with her condition. Then the president kissed her on the cheek. That image went around the world, drawing more attention to the princess and giving her... Read more »"Kiss My Access": Community Envoy to Food and Drug Panel Urges Caution in Approving New Anti-HIV Therapueutics and in Providing Early Access...pneumonia) remains the leadingcause of AIDS-related sickness and death in New York City, and, presumably, in the United States?" "While many of these same advocates have proclaimed that people living with HIV would never enroll in an... Read more »What Are the Symptoms of HIV and AIDS?...symptoms you might get if you have another type of viral infection, such as the flu. Symptom Possible Symptom of Flu? Possible Symptom of Acute HIV? Fever Yes Yes Chills Yes Yes Night sweats Yes Yes Rashes Yes ... Read more »How to Spot HIV/AIDS Fraud... What Is HIV/AIDS Fraud? Warning Signs of an HIV Fraud Common Sense About Unproven Treatments Questions You Should Ask Take Your Time; Check Read more »
Connect With Others
hiv transmits through kissing
Posted by maruti, 2 Replies
...this is vipin my age is 26,last week i kissed one girl its a open mouth kiss for 20secs,there was no blood in my mouth,no cuts,there is any chance to get hiv infection for
Read more »
Posted by Katietaylor, 1 Reply
...Please can someone give me their honest opinion on whether this is a reason for me to be concerned and tested? Im going out of my mind with worry and keep checking my body for HIV symptoms due what I believe my risky exposure. Im a
Read more »
Kissing a HIV- person
Posted by gordon, 9 Replies
...the mouth area. The suliva with a small potion of blood will be trasmitted, hence making the other person HIV+. Correct or not?
Read more »
AIDS Timeline, Deep kissing in 1997
Posted by Anonymous, 1 Reply
...I believe the last deep kissing incident was in 1997 http://www.aegis.com/topics/timeline/default.asp
Read more »
Advertisement Advertisement
Resource Centers
Guides for People With HIV


text:
We want to ensure that making a return is as easy and hassle-free as possible! If for any reason you decide that your purchase just isn't for you, simply return the item within 30 days of receipt and we'll cover the return shipping when you choose our FREE Pre-Paid Return Shipping Label. Learn more about our return policy.
Shop now and get Free Value Shipping on most orders over $49 to contiguous 48 states, DC and to all U.S. Military APO/FPO/DPO addresses.
Cortland Line Fairplay Fly Outfit 9 ft. is a medium action starter rod. Cortland Line Fairplay Fishing Rod offers a multitude of features such as fly box, 99% graphite blanl with tip-over butt ferrule system, and a fly fishing manual and video. This Fishing Tool by Cortland is constructed for catching several freshwater fish like trout, panfish, and bass.

subset: commoncrawl


text:
Yung-Yi Chang, Miao-Li County TW
Patent application number | Description | Published |
20100134472 | FLAT PANEL DISPLAY DEVICE - A flat panel display device includes an image processing circuit, a power supply, and a gamma voltage generator. The image processing circuit receives grayscale data, identifies a range in which a gray level of the grayscale data is located, and generates a reference signal based on the range. The power supply supplies a drive voltage based on the reference signal. The gamma voltage generator generates a set of gamma voltages based on the drive voltage. | 06-03-2010 |
Yung-Yi Chen, Taipei TW
Patent application number | Description | Published |
20100295570 | Probe Connector - A probe connector for being sucked by a suction nozzle and then soldered to a PCB by moving the suction nozzle has a barrel. One end of the barrel has a base, the other end of the barrel is formed with an opening. A periphery of the barrel has a portion protruded outwards to form a ring-shaped flange. The flange has a ring-shaped flat surface back to the base for engaging with a bottom of the suction nozzle. A probing pin includes a base portion received in the barrel and a contact portion projecting outside the barrel through the opening. An elastic element received in the barrel is disposed between the base and the base portion of the probing pin. | 11-25-2010 |
20100323560 | Audio Jack Connector - An audio jack connector has an insulating housing. The insulating housing has an inserting hole extending from a front to rear for receiving the audio plug connector and a plurality of recesses communicating with the inserting hole for receiving a plurality of terminals. An elastic body which is disposed in the inserting hole perpendicular to an extending direction of the inserting hole has two opposite tightening arms and a connecting portion interconnected with opposite ends of the tightening arms. A front end of the audio plug connector passes through the elastic body and is restrained by the elastic body. Two tightening arms of the elastic body are against the portions of the front end of the audio plug connector from opposite directions, when the audio plug connector is inserted into the inserting hole of the insulating housing. | 12-23-2010 |
20110020059 | Probe Connector - A probe connector has a barrel having a main body, with a chamber defined therein, and a base connected with one end of the main body. The main body has a mounting opening at a substantially middle portion thereof and communicating with the chamber. A plunger includes a basic portion restricted in the barrel and a contact portion extended from one end of the basic portion and exposed from the other end of the main body opposite to the base. A resting element has a mounting slice received in the mounting opening, and a resting lump protruding from a side of the mounting slice and protruding into the chamber of the main body to rest against a side of the basic portion when the contact portion is pressed inside the barrel for deflecting the basic portion to contact an inner surface of the main body by an opposite side thereof. | 01-27-2011 |
20110111643 | Audio Connector - An audio connector has an insulating housing having a body. The body has a passageway for receiving an audio plug, and a plurality of installing holes of column shape, each of which extends along a direction substantially perpendicular to an extending direction of the passageway, with one end thereof intercommunicating with the passageway, and the other end thereof reaching an outer surface of the body. A plurality of probe assemblies is respectively mounted to the installing holes. Each of the probe assemblies has a hollow barrel, a plunger slidably mounted to the barrel and exposing from one end of the barrel for projecting into the passageway resiliently, and an elastic element received in the barrel for supporting the plunger. The other end of the barrel is extended opposite to the plunger to form a soldering portion exposing outside the insulating housing. | 05-12-2011 |
20110124215 | JIG FOR PROBE CONNECTOR - A jig for probe connector adapted for clutching a plurality of probe assemblies each of which has a connecting portion, a probing pin and a soldering portion disposed at two ends of the connecting portion respectively. The jig for probe connector has a base body. The base body has a plurality of passageways each penetrating a front end thereof. The passageway includes a first receiving recess and a second receiving recess disposed at a front of the first receiving recess. A cross section of the second receiving recess is larger than that of the first receiving recess, with a drop defined as a preventing portion formed therebetween. A side of the second receiving recess has a portion protruded inward to form a buckling lump, which is spaced from the preventing portion with a predetermined distance. | 05-26-2011 |
20110138612 | Jig For Probe Connector - A jig for clutching a plurality of probe assemblies each of which has a connecting portion and a soldering portion has a base body and a covering body. The base body has a plurality of first receiving grooves each penetrating a front end and a rear end thereof. The covering body is formed with a plurality of second receiving grooves corresponding to the first receiving grooves. The covering body is openably fixed on the base body, the first receiving grooves and the second receiving grooves are matched to form a plurality of passageways. A front end of each of the passageways has a portion protruded inwards to form a resisting rib. The connecting portions of the probe assemblies are received in the passageways and abut against the resisting ribs, with tip ends of the soldering potions exposing outside the passageways from rear ends of the passageways. | 06-16-2011 |
Yung-Yi Chen, Taipei Hsien TW
Patent application number | Description | Published |
20100067895 | Fastener For Fixing A Sliding Cover Of A Camera - A fastener is adapted for fixing a sliding cover of a camera. The sliding cover is arranged slidably on the camera for selectively covering a lens of the camera. The fastener has a housing with a receiving cavity defined by a circular sidewall. An elastic component and a cover are received in the receiving cavity of the housing. One end of the cover is pressed against the elastic component, and the other end of the cover defines a resistive portion extending out of the receiving cavity for elastically and forcefully urging the sliding cover when the sliding cover is slid to cover the lens. | 03-18-2010 |
20100248558 | Probe Connector - A probe connector has a barrel including a main body and a base integrally connected with one end of the main body. A holding portion is protruded inwards from an inner surface of the main body to form a first holding recess, adjacent to the base. A plunger includes a basic portion restricted in the barrel and a contact portion extended from one end of the basic portion and exposed from the other end of the barrel opposite to the base. The basic portion has a second holding recess at the other end thereof and coaxial with the first holding recess when the plunger is mounted to the barrel. An elastic element arranged inside the barrel has two ends respectively held by the first holding recess and the second holding recess to shorten an unrestrained part of the elastic element for reducing a resilient distortion of the elastic element. | 09-30-2010 |
Yung-Yi Cheng, Taichung City TW
Patent application number | Description | Published |
20140303241 | STILBENOID COMPOUND AS INHIBITOR FOR SQUAMOUS CARCINOMA AND HEPATOMA AND USES THEREOF - The present invention provides a series of derivatives of stilbenoid which are useful as new inhibitory agents against head and neck squamous cell carcinoma (HNSCC) and hepatoma. | 10-09-2014 |
Yung-Yi Chiu, Miao-Li County TW
Patent application number | Description | Published |
20140139558 | Driving controller, display panel device, and driving method capable of reducing crosstalk - A driving controller for reducing crosstalk in a display panel device includes a type detection unit and a polarity configuration unit. The type detection unit receives a color domain signal corresponding to one line data of an image so as to decide a data type of the line data. The polarity configuration unit is connected to the type detection unit for producing a polarity configuration corresponding to the data type of the line data based on the data type. | 05-22-2014 |


text:
Joy, James F. (James Frederick), 1810-1896
Joy, James Frederick
VIAF ID: 71339437 (Personal)
Permalink: http://viaf.org/viaf/71339437
Preferred Forms
4xx's: Alternate Name Forms (2)
Title | Sources |
Statement of the case of John A. Burnham, J.N. Denison, and James H. Blake, Trustees, vs. the Chicago, Burlington and Quincy R.R. Co., for Wm. G. Russel, arbitrator [microform]. |


text:
recipe reviews for:
"My mom would make this every Thanksgiving. It's better than pumpkin pie!"
My Profile | Cooks I Like Reviews | Photos | Recipes | Menus | Blog
Cooking Level: Expert
Cooking Level: Intermediate
Cooking Level: Beginning
The best wintertime meals need a long, slow simmer while you're doing something else.
Our big collection of budget recipes will leave some jingle in your pocket.
Delicious recipes, party ideas, and cooking tips! Get a year of Allrecipes magazine for $7.99!
This delicious, moist pumpkin spice cake is baked in a sheet pan.
Watch and learn how to make a holiday-favorite Pumpkin Roll Cake.
See how to make a pumpkin spice cake with a simple glaze.


text:
Hi Im new here and I was told on another site this was a good place to go to ask about gun values. I recently was givin a remmington model 31 pump shotgun and I searched every where online to try and figure how much its worth around but couldnt. Its in fair condition. The numbers on the side of the reciever under the " remington' model 31 logo read 95169. On the barrel under the patent stap and location of forgeing theres a long list of numbers that read 1,763.665-1,763.714-1,786.213-1.834,410-2.023.929-2.039.814 over to the right of that it says "full" RSS and theres a navy boat anchor. Im pretty new to guns So I wanted to check online for an idea of the value before I head out to the stores. thanks.
Join FirearmsTalk.com Today - It's Free!
Are you a firearms enthusiast? Then we hope you will join the community. You will gain access to post, create threads, private message, upload images, join groups and more. Firearms Talk is owned and operated by fellow firearms enthusiasts. We strive to offer a non-commercial community to learn and share information.
Join FirearmsTalk.com Today! - Click Here
Gunbroker.com Has A Couple. One In Your Condition Seems To Be Around $400. I Typically Check With This Site Or Auction Arms To Get An Idea Of Daily Values As Firearms Tend To Be More Expensive In My Neighborhood.


text:
[Yahoo] Hingis upsets Davenport at Indian Wells (AP)
Martina Hingis won the latest round in a rivalry with Lindsay Davenport that stretches back more than a decade, taking a 6-3, 1-6, 6-2 victory Tuesday in the Pacific Life Open. On the men's side, No. 1 Roger Federer came back after a slow start to beat No. 32 Olivier Rochus 3-6, 6-2, 7-5 in their third-round match.
http://us.rd.yahoo.com/sports/rss/te...v=ap&type=lgns |
All times are GMT. The time now is 05:39 PM. |
Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2015, Jelsoft Enterprises Ltd.


text:
We want to ensure that making a return is as easy and hassle-free as possible! If for any reason you decide that your purchase just isn't for you, simply return the item within 30 days of receipt and we'll cover the return shipping when you choose our FREE Pre-Paid Return Shipping Label. Learn more about our return policy.
Shop now and get Free Value Shipping on most orders over $29.95 to contiguous 48 states, DC and to all U.S. Military APO/FPO/DPO addresses.
Extreme Dimensions Wildlife Calls Camo-Pouch carry bag for Phantom Pro-Series and former Hunter-Series calls is compact carry pouch to carry your call and is made from leather and features a metal belt clip.


text:
Bagaimana cara mendapatkan uang? Dengan memberikan evaluasi tentang sebuah situs web. Ulasan harus setidaknya 2-3 kalimat panjang. Apakah ada biaya atau biaya keanggotaan untuk bergabung? Tidak, keanggotaan di AWSurveys adalah gratis dan Anda tidak akan diminta untuk membayar biaya keanggotaan atau biaya lainnya. Kapan saya akan menerima penghasilan
Program Cepat Kerja Di Hotel Dan Kapal Pesiar – PROGRAM PENDIDIKAN & PELATIHAN CEPAT KERJA DI HOTEL DAN KAPAL PESIAR LANGSUNG PENEMPATAN KERJA – MAGANG LUAR NEGERI NHS ADALAH: CORPORATE ACADEMY SEJAK TH 1998. DI BAWAH LANGSUNG PERUSAHAAN – PERUSAHAAN BESAR TERKEMUKA INTERNATIONAL UTK HOTEL DAN KAPAL PESIAR. "1400 ALUMNUS NHS" TELAH BEKERJA
Dapatkan Keuntungan Dan Peluang Bisnis Online Lebih Besar Bersama SpeedCash. Dengan Account Speed Cash Anda Dapat Untuk Melakukan Transfer Bank di Seluruh Indonesia. Menerima Pembayaran Dan Berbagai macam Transaksi. Baca Selengkapnya Tentang SpeedCash Dan Segera Daftarkan Diri Anda Disini (Gratis) Untuk Mendapatkan No.ID dan No.Rekening SpeedCash Anda,
Melayani konsultasi jasa pelet, trawang, pengobatan jarak jauh, gratis cinta ditolak, mbh dirgoworo bertindak merasa bertepuk sebelah tangan atau di khianati oleh pasangan anda. Sekarang adalah waktunya anda bertindak, tidak ada kata terlambat untuk mengubah keinginan anda untuk dapatkan cinta anda supaya menjadi kenyataan, jangan menunggu?
The authors acknowledge the appeal and power of free online services offered by Google and their ilk. Without much The top depicts the Internet if corporate interests prevail in the battle over network neutrality. The bottom
In addition, by indexing the social measurement variables such as commenting and votes at Digg, Reddit, Netscape and various niche oriented (all of those Pligg powered hubs), search engine algorithms can also benefit from . SEO is the daily battle to keep ahead of the search engines, especially Google. It is very much like a Salmon swimming upstream. Every 3 months Google changes everything in the way they do things as far a their search results go (SERP).
#1 is correct to some extent, though the idea of "connectors" with which serve as nexus points within a network has been mooted elsewhere. CATEGORIZED UNDER: Culture. MORE ABOUT: Facebook, Sociology. We were unable to load Disqus. If you are a moderator please see our pligg.com. Facebook & Dunbar's number | Gene Expression | Discover Magazine Can technology influence the Dunbar number? Or is 150 friends still all one can really handle?
The second battle is the one between proprietary networks like Compuserve and the open Internet. Here, Zittrain attributes the victory of the Internet's . If you are afraid of cops getting access to your activities on Digg, you can set up your own Pligg. If you don't like Wikipedia, you can take both the Allowing any law the power of instant enforcement is dangerous because no law is ever perfect enough at birth to deserve it. This is in fact the procrastination principle
He's right, I mostly see companies in internal battles and struggles over resources and power, leaving them exposed to outside startups. Coincidently, may of the startups I see disrupting large companies are composed of
Pligg / Meneame. The list below contains another 50+ sites that are dead or nearly so - and most appear to be using Pligg / Meneame or something similar. These are open source systems, based on Digg. Memeame was first, in Spanish and Pligg used their code base and then split off on its own path. I have contributed a small amount of code to Pligg and . People Powered News Network Launched by Care2 · The Most Successful Digg Clones · The 5 Most
"Having helped many others in their fights against outside, profitoriented polluters, I couldn't shirk this battle when I know there is so much at stake for the San Luis Valley residents, the range, the environment, the animals, and for all of Colorado," he March 22, 2011 at 7:14 am. "Power Struggle" | LandReport.com… Louis Bacon fends off utility companies as they try to build transmission lines across his Colorado ranch. He also adds North Carolina's Orton Plantation… pligg.com says:.
control and have no connection to the mainstream anymore. In the next few months we will see digg battle its top members as they fight to control the cliques and its not going to be pretty. . After running the website Scifi2u.com for the last year we realised there was a demand for a scifi digg type website – 6 Days ago ScifiDigg.com was born and is powered by open source Pligg and the YouTube API. So what went wrong? The site went live on the 22 March 2007.
- Halaman ini diberdayakan oleh Google, Bing!, dan Blekko -


text:
Real Lyric | There were a thousand! Man it has being exchanged for pesetas |
Artist | Steve Harley (Click for more) |
Song | Mr Raffles (Man It Was Mean) (Click for more) |
I read the real lyrics on the net. I was sure I had always been right and I think my lyric is much better, the real one doesn't seem to make any sense!
Submitted by | Malteser |
Submitted on | 6/5/2011 12:58 pm |
Age it happened | 50 |
Better than original? | Yes |
Convinced others you were right? | No |
Was partying involved? | No |


text:
The Nicholls Family of England, Pennsylvania and New JerseyUpdated January 24, 2006 |
RICHARD J NICHOLLS RR 1 BOX 5204 CANTON, PA 17724 United States 570-364-8118 email@example.com |
Edit Your Page |
Our research started with the Reverend Samuel Thomas Nicholls by my son Richard Nicholls about 15 years ago. Since that start we have learned much about our ancesters and it is my son Richards intent to document in published form all that we have found todate. |
My Family History |
Family Photos |
The content shown on this page has been submitted by a Genealogy.com customer, and is not subject to verification by Genealogy.com. Neither Genealogy.com nor its affiliates are responsible for the accuracy of any information contained on this page. The opinions expressed on this page are the author's alone and not the opinions of Genealogy.com.
© 2009 Ancestry.com |


text:
This probably has been answered before but couldn't find it - I'm trying to use an iTrip with a Concert II and get an intermittent loud single beep about every 3 minutes - (it's not the itrip tuning code being played). This is the second Concert II I've tried it with (in different cars). Any ideas?
Mine did this and as far as I could tell it bleeps when it can't find any signal. I just cept trying different frequencies until I got it to work.


text:
Industrial relations
Shorten brokers truce in war of the waterfront
PUBLISHED: 15 Dec 2011 00:02:43 | UPDATED: 15 Dec 2011 04:23:27PUBLISHED: 15 Dec 2011 PRINT EDITION: 15 Dec 2011New Workplace Relations Minister Bill Shorten has intervened in a tense waterfront lockout on his first day in the job, as both parties agreed to stop industrial action.
Already a subscriber? Please login here
Stay with the story for less than $1.90 a day
Related News
Read more
People | Bill Shorten, Paddy Crumlin, Chris Corrigan, Troy Buswell, Chris Cain |
Topics | Employment & Industrial Relations, Transport /Shipping , Politics /Federal Politics |


text:
Commentary: Making law by a living document
Don't tell anyone: This is the season when lawyers left and right cross our fingers behind our backs and solemnly swear that judges don't make law. Conservatives insist they adhere to original intent. Liberals insist they do no more than apply the commands of a living Constitution.
Get the full story
Subscribe or Log In
Are you a newspaper subscriber but you don't have a Digital Access account yet? Activate your account.
You will need your subscription account number and phone number. Not sure if you have an account? Email us or call 320-214-4364 and we can help you.


text:
4 Terminal Probe for 3532-50 LCR (up to 100kHz)
for LCR-816/817/819/821 SMD/Chip test fixture
See Price
for LCR-816/817/819/821
DC Bias Current Unit for IM Series LCR
for LCR-816/817/819/821/8101 Axial/Vertical component test box
4 Terminal Probe for IM3523/IM3533/IM3533-01 (200kHz)
Pincher Probe for 350X,3511,3532-50
Pincher Probe for LCR IM35X3 limited Avail. Use L2001
Test Fixture for LCR Remote Zero Insertion
Test Fixture for IM Series LCR Remote Zero Insertion
Test Fixture for LCR Vise Clamp
SMD Test Fixture for LCR
LCR Test Fixtures hold the device under test (DUT). These test fixtures are intended for use with benchtop LCR meters. The fixture connects to the benchtop meter and is then used to measure the inductance, capacitance, and resistance (LCR) of SMD components, air-core coils, or transformers.


text:
Neurological Associates
Vero Beach, Florida
H. Hooshmand, M.D.
( Epilepsy, Pain, MS)
An International Referral Center dedicated to Treatment, Education and Research
Number of Visitors
Chronic Pain: Reflex Sympathetic Dystrophy Prevention and Management
CRC Press, Boca Raton, Florida
" A syndrome of sustained burning pain after a traumatic
nerve injury combined with vasomotor and
sudomotor dysfunction and later trophic changes"
Causalgias are divided into two forms:
1. Causalgia major involves peripheral nerve injury with electrical "crosstalk" (ephapse) that causes severe hyperactivity of sympathetic system (hyperpathia, vasoconstriction, and movement disorder). The major form is severe, usually caused by injury with high velocity sharp objects (e.g., butcher's knife), vibratory component major trauma (e.g., bullet), or high-voltage nerve lesions (electrocution).
2. Causalgia minor involves the same principle as causalgia major, but milder injury, e.g., injury to the dorsum of hand or foot, nerve root contusion, patient falling from a height on gluteal region resulting in "guillotine" effect, bruising of nerve root caught at the narrowed intervertebral foramen.
The difference between the two categories is a matter of degree and severity. To classify causalgia as an independent illness is artificial, and causalgia is nothing but a sever form of RSD.340,363-365
In this severe form of RSD, the course of the disease is quite accelerated from stage 1 through 4 in a matter of weeks or months. S. Weir Mitchell230 in 1872 first reported rapid development of atrophic changes in the skin, nails, and soft tissues of the extremity in a matter of days to weeks.
Whereas in RSD of disuse the extremity is cold, in ephaptic dystrophy the thermography reveals in the distal portion of the extremely cold extremity that there is an isolated hot spot that points to the area of scar formation and ephaptic peripheral nerve dysfunction (Figures 4-6). In this area the vasoconstrictive capability of the sympathetic nerve is paralyzed, and there is a topical hot spot. This hot spot can be appreciated only by thermography.289
This type of RSD is quite painful and very difficult to treat. It demands multidisciplinary therapy as well as early diagnosis. The ephaptic form is characterized by increased heat emission at the area of ephaptic lesion (electric short). As the condition becomes chronic, the distal portion of the extremity involved and the contralateral extremity becomes cold, but the ephaptic spot stays hyperalgesic and warm (Figures 4,5, and 6b).
Causalgic Pain
Sunderland363 in 1978 succinctly defined causalgic pain as follows:
1. Usually pain occurs after the injury to a nerve trunk.
2. The severity of the injury to the soft tissues other than the nerve does not play a role in the severity of the pain.
3. The pain is spontaneous, severe, and quite persistent.
4. There is a markedly lowered threshold for aggravation of pain. This is the case in all RSD patients, but it is more exaggerated in causalgics. So even a breeze over the skin or the touch of a bed sheet or a change of the environment or a family argument and aggravation can markedly aggravate the pain. This feature of emotional aggravation is common to all RSD patients, and it is nothing but the role of the frontal lobe and the limbic system in aggravation of hyperpathic pain.
5. The pain is felt distal to the proximal nerve injury, i.e., in the hand or foot. This is typical but not invariable. The pain does not necessarily have to be a burning type of pain, and can be described in many other hyperpathic forms.
6. Sunderland established the requirement that the pain should be present at least 5 weeks. However, depending on the severity of the injury, the pain can develop in a matter of days or weeks. What happens to an extremity in RSD of disuse in a matter of several months can happen in a matter of a few weeks to a causalgic patient.
In no case of RSD is the pain so severe, so intolerable from burning, seering, aching, tingling, lightening, stabbing, crushing, to a combination of the above, without burning pain in a matter of a few hours to up to 7 to 10 days in close to 90% of the cases.374 However, it is not unusual to see some patients who develop the pain as late as 3 to 4 weeks after the injury.375
Major causalgia is due to scar formation of peripheral nerves but has a component of high-velocity or high-vibration injury in its etiology. This is usually seen after bullet injuries or high-velocity sharp objects such as a butcher knife or surgical instrument injury. This is typically seen in war injuries, but it can also be seen in civilian trauma due to amputation of an extremity or industrial injury to the extremity. It is not uncommon in electrical injuries. Drilling steel against titanium in the aerospace industry causes high-frequency vibration and makes the patient more susceptible to causalgia.
The difference between the minor and major causalgias is a matter of degree and severity. For more detail on causalgia, see Chapters 1 and 12.
Major Causalgia and Motor Dysfunction
Major causalgia is the best example of efferent dysfunction secondary to sensory nerve damage and RSD. This efferent dysfunction is quite frequently present among causalgic patients (at least over 50% of the patients) and is in the form of flexion deformity of the extremity, tremor, weakness of the extremity, and dystonic movements.
The management of major causalgia requires a multidisciplinary approach. Trigger point injections should be applied to referred pain areas rather than the area of peripheral nerve damage. Repetitive sympathetic nerve blocks can be quite effective. Sympathectomy should be used only for patients who have failed with every other form of therapy and when the patient has a short life expectancy.
Even among patients who have has such a conservative approach towards sympathectomy, there still may be the necessity for morphine pump after failure of sympathectomy (Table 42). Morphine pump, a last resort in treatment, provides good control of pain. As most causalgic patients in civilian (as opposed to war) practice are involved in protracted litigation (especially worker's compensation cases), by the time they are being evaluated for RSD several months or years have elapsed, and the only effective treatment is morphine pump in this stage IV of the disease. For more detail on causalgia, see Chapters 1 and 12.
Web Site designed and maintained by:
Eric M. Phillips; E-mail: firstname.lastname@example.com
This page was last updated on 11/12/2003.


text:
A private eye inside your car?
So what's the big deal about "car privacy" legislation?
Several lawmakers, including Minnesota Sens. Al Franken and Amy Klobuchar, have been active in promoting legislation to safeguard automobile privacy.
The problem is that information is being collected beyond the basic "black box" crash data — things like GPS data tracking where you've been, and mapping data tracking where you plan to go.
Are you a newspaper subscriber but you don't have a Digital Access account yet? https://secure.forumcomm.com/?publisher_ID=40&event=subscriber/lookup.
You will need your subscription account number and phone number. Not sure if you have an account? Email us at email@example.com and we can help you.


text:
Those Crazy Hooflike Shoes at the Helmut Lang Show Will Soon Be for Sale
They were inspired by Game of Thrones.
READ MORE »They were inspired by Game of Thrones.
READ MORE »They'll cost $275.
READ MORE »No sneakers.
READ MORE »"[The shoes] destroyed the back of my feet."
READ MORE »Oh well.
READ MORE »And — because you've always wanted to know! — what she eats for breakfast.
READ MORE »See something, say something.
READ MORE »"Buy a pair of shoes, get a date for free, and he will pay for the shoes!!!"
READ MORE »Here's a lesson about the Black and Tans.
READ MORE »It's the thought that counts.
READ MORE »She gets $1,000 to spend on — what else? — more shoes.
READ MORE »Oh, boy ... We mean, get in line!
READ MORE »Poor models!
READ MORE »Plus, Angelina Jolie's new cover of Turkish Vogue.
READ MORE »And he did it without tweeting to tell us!
READ MORE »"I had no idea about it!"
READ MORE »Plexiglas heels filled with colored sand!
READ MORE »Isabel Marant sneakers, leopard Louboutins, and more.
READ MORE »Shoes that are "strong and sexy."
READ MORE »They sound pretty neat.


text:
Issue Archive
Micropulse Detonation Rocket Engine for Nano-Satellite Propulsion
Sunday, 01 February 2015
Goddard Space Flight Center, Greenbelt, Maryland
An efficient propulsion system would use a micropulse detonation rocket engine (–PDRE) for nano-satellite maneuverability in space. Technical objectives are to design, build, and conduct a small detonation tube experiment in order to explore the feasibility of using –PDRE for propelling a nano-satellite. The plan is to study the requirement and predict the performance of –PDRE using various candidate propellants, as well as to conduct ground experiments, demonstrate useful thrust, and measure the specific impulse in a two-year time frame, so that a follow-on project can be proposed in a future NRI Center Innovation Fund.
Read More >>
Posted in: Briefs, TSP
Read More >>
Propellant Loading Visualization Software
Sunday, 01 February 2015
Monitoring of complex propulsion pressure systems has been simplified with colors.
Goddard Space Flight Center, Greenbelt, Maryland
Complex pressure systems are utilized during testing in the propulsion branch as well as during the propellant loading stage of a mission. Keeping track of the state of such a system becomes more difficult as the complexity of such a system increases, and when extensive procedures are being followed. A book-keeping system is needed for visualizing these complex systems.
Read More >>
Posted in: Briefs, TSP
Read More >>
Robust Gimbal System for Small-Payload Manipulation
Sunday, 01 February 2015
This is a low-mass, small-volume gimbal unit.
NASA's Jet Propulsion Laboratory, Pasadena, California
Spaceborne gimbal systems are typically bulky with large footprints. Such a gimbal system may consist of a forked elevation stage rotating on top of the azimuth motor, and occupy a large volume. Mounting flexibility of such a system may be limited.
Read More >>
Posted in: Articles, Briefs, TSP, Motors & Drives
Read More >>
Enabling Microliquid Chromatography by Microbead Packing of Microchannels
Tuesday, 01 October 2013
The microbead packing is the critical
element required in the success of onchip
microfabrication of critical
microfluidic components for in-situ
analysis and detection of chiral amino
acids. In order for microliquid chromatography
to occur, there must be a stationary
phase medium within the
microchannel that interacts with the analytes
present within flowing fluid. The
stationary phase media are the
microbeads packed by the process discussed
in this work. The purpose of the
microliquid chromatography is to provide
a lightweight, low-volume, and lowpower
element to separate amino acids
and their chiral partners efficiently to
understand better the origin of life.
Read More >>
Posted in: Imaging & Diagnostics, Materials / Adhesives / Coatings, Monitoring & Testing, Optics/Photonics, Bio-Medical, Briefs, TSP, Briefs, TSP, Diagnostics, Fluid Handling, Measuring Instruments
Read More >>
Computer-Assisted Laser Treatment Using Real-Time Retinal Tracking
Tuesday, 01 September 2009
This computerized system accurately guides laser shots to diseased retinal areas.
Diabetic retinopathy resulting
from long-term diabetes
mellitus is one of the common
diseases that leads to
choroidal neovascularization
(CNV), a leading cause of
blindness. Among the currently
available treatment
methods, a laser can be used
to photocoagulate the diseased
areas. Several thousand
laser shots are usually
required during such treatment.
Special care must be
taken to avoid hitting the
blood vessel tree, the macula,
the optic disk, and the region
among them. For a single
eye, this procedure requires up to
several hours that are usually divided
over many treatment sessions. Consequently, the development of an accurate
laser treatment guidance system to
treat the whole retina in one session
would improve the effectiveness of
such procedures.
Read More >>
Posted in: Bio-Medical, Briefs, TSP, Briefs, TSP, Lasers & Laser Systems, Photonics
Read More >>
White Papers
| ||||||


text:
- News
- Video
- People
Find by writer
- Yasmin Alibhai-Brown
- Rebecca Armstrong
- Memphis Barker
- Max Benwell
- Chris Blackhurst
- Ian Burrell
- Andrew Buncombe
- Ben Chu
- Patrick Cockburn
- Mary Dejevsky
- Grace Dent
- Robert Fisk
- Andrew Grice
- Stefano Hatfield
- Lucy Hunter Johnston
- Howard Jacobson
- Alice Jones
- Ellen E Jones
- Comment
- Editorials
- Letters
- IV Drip
- Campaigns
- Archive
- Our Voices
- Commentators
- Columnists
- Democracy 2015
- IV Drip Archive
- Blogs
- Scottish independence
- Save the tiger
- The state of the NHS
Find by writer
- Sport
- Tech
- Life
- Property
- Arts + Ents
- Travel
- Money
- IndyBest
- Student
- Offers
When will the Commons start telling the truth about Afghanistan? Other than immigration, no other subject was raised so often on the doorstep in the election. But no other issue was less discussed by the party leaders. There is an ever widening gap between the military-political establishment and the people of Britain who fail to understand why so many of their own people are dying or returning home hideously maimed. This is not the Falklands or even a conflict to stop the UK being blown apart by unionist bigotry and IRA terror bombs.
Conservatives talk grandly about creating a "war" cabinet to wage war in Afghanistan. Mr Cameron should find a word other than "war" to use. We are winning battle after battle: when British troops take on the Taliban face to face, there is only one winner, despite the sad sacrifices that are made. But the notion that we will win a war in Afghanistan commands no serious support anywhere, even among those who support our presence there. Talking of war implies victory. It is the dream of the generals as they send young officers and men achieve the unachievable – to win a war in the sense of the destruction of Nazism in 1945.
Can containment replace confrontation as policy? After 1945 the democracies adopted a philosophy of containment rather than military destruction of opposing ideologies. So too in Afghanistan; we cannot keep on sending British soldiers to die in the will-'o-the-wisp search for an ultimate military victory. Instead of warcraft we need statecraft and that must involve a stronger relationship with Pakistan. There has been much talk about Pakistan and the solution to Afghanistan. But there will be no solution in Pakistan until India changes its strategic approach in the area.
According to a report in Le Monde earlier this year, The Times of India reported a secret conclave of the Indian general staff at Simla in December, at which they discussed a "double-front" strategy – an assault on both China and Pakistan. General Kapoor, the Indian chief of staff, has talked about a limited military attack on Pakistan. It beggars belief that a fellow Commonwealth country and nuclear-armed power – and a democracy to boot, can be talking about an invasion of Pakistan, when what we need is a complete re-setting of India-Pakistani relations. As is well known, in 1989 democracy was suspended in Kashmir, and 500,000 Indian troops moved in. Since then, between 50,000 and 70,000 people have been killed in probably the biggest bloodbath of Muslims in recent times under the Indian army occupation. Some of that was in response to Pakistan-initiated terrorism – the horrible explosions at Srinagar and elsewhere, but India is not even on the way to finding a political solution to the problem of Kashmir, and it is under pressure given the Mumbai massacres and other issues.
Britain has long been in thrall to its 250-year-old love affair with India. Today India fits the lines from Oliver Goldsmith: "Ill fares the land, to hastening ills a prey, / Where wealth accumulates and men decay." India has more billionaires and millionaires than Britain does, but this fabulous wealth co-exists beside more absolutely poor people than live in sub-Saharan Africa. After more than six decades of democracy, India still has hundreds of millions of its citizens who cannot read or write or who do not have access to clean water and sewers. But whereas Pakistan has to put up with a condescension and patronising sneers from a pro-Indian establishment in London, India's failure to create peace on its border with Kashmir rarely if ever gets criticised.
I have sought on several occasions in the House of Commons to get the then Shadow Foreign Secretary, William Hague, to acknowledge that India should do more to bring stability to the region by seeking to become part of the solution to Kashmir instead of remaining part of the problem, but the Conservative leadership is totally India-obsessed.
As any visitor to Pakistan can see, the nation has a vibrant civil society and a very good, free and energetic media and legal-judicial system. It has a strong women's movement and a strong human rights movement. Yes, it is very poor, so the real answer is to improve Pakistan's economic and growth perspectives. David Miliband took the lead in pushing the European Union hard to open a dialogue and to try to increase trade between Pakistan and the rest of Europe. That is certainly where we should focus some of our efforts with our Pakistani and Kashmiri diaspora in Britain.
We have to look again at the ideology that spurs on the Taliban and other extremists. That ideology is not of the Islam religion, which should have the same respect as any other Abrahamic faith, but is a coherent world ideology of Islamism that is rooted in the Muslim Brotherhood that was founded by Hassan al-Banna in the 1920s and that has developed steadily since. London focuses too much on Muslim Brotherhood-linked organisations when the real representatives of the Muslim community in Britain are to be found in elected councillors, community leaders and mosque councils.
The new Government needs to work with our Pakistani-British citizens to increase economic relations with Pakistan. We should set up effective structures using the Department for International Development, the Foreign Office, the departments that deal with education and other departments to find ways of explaining that what is happening in Afghanistan is a threat, not just to the region and not just in terms of providing incubators for terrorism in our country, but to everything that we should value if we want a peaceful and prosperous world.
Britain should build a strong UK-Pakistan relationship to promote economic growth, shared prosperity, increased democracy and human rights and a withering down of the ideologies that justify terrorism. That will also mean asking India to make a contribution by finding peace in Kashmir. These are ambitious goals. But a happy 21st century for Britain and Pakistan and for British citizens connected to both nations requires no less.
Denis MacShane is the Labour MP for Rotherham and was deputy to Jack Straw as Minister for State at the Foreign and Commonwealth Office
Legendary isle of nights
The festival that made rock'n'roll history boasts a star-studded line up.
Crowdfunding: The end-end solution for business success.
Calling all entrepreneurs! See how crowdfunding can provide you with a full-circle, end to end solution for your business.
Enter the latest Independent competitions
Win anything from gadgets to five-star holidays on our competitions and offers page.
Business videos from commercial thought leaders
Watch the best in the business world give their insights into the world of business.
Related Articles
iJobs General
Ashdown Group: Technical Presales Consultant - London - £65,000 OTE.
£65000 per annum: Ashdown Group: Technical Presales Engineer - central London ...
Recruitment Genius: Physiotherapist / Sports Therapist
£20000 - £50000 per annum: Recruitment Genius: A Physiotherapist / Sports Ther...
Recruitment Genius: Sales Executive / Advisor
£8 - £9 per hour: Recruitment Genius: Sales Executives / Advisors are required...
Recruitment Genius: Warehouse Operative
£14000 - £15000 per annum: Recruitment Genius: An opportunity has arisen for a...


text:
How to Make Dried Chickpeas in a Crock-Pot
Total Time
5 minsCook
3 hrsIt was a garage sale bargain I couldn't resist. So after all these years, I am first using a crockpot--and one of the first things I made was this--and these chickpeas are outrageously good. No more canned chickpeas for me.
Nutrition- 2 cups dried garbanzo beans
- 6 cups water
- 1 teaspoon salt
- Rinse and drain chickpeas in cold water. Pick out any stones and dark brown chickpeas.
- Put drained chickpeas into your crock pot. Add water and salt.
- Cook on High for 2-3 hours or until soft. Depending on your tastes and what you are going to use them for you can remove when slightly firm or cook until they are very soft.
- When done, carefully pour into a colander, being careful to use oven mitts to handle the crock – it will be hot. Drain and rinse well.
- Chickpeas will keep for about 2 days in the fridge. They will keep longer if made into hummus. They also freeze quite well.
- To freeze chickpeas rinse and drain them thoroughly. Leave to drain well for about 15 minutes. Spread chickpeas onto a baking tray, making sure they don't touch one another. Put into freezer. When frozen, you can transfer the chickpeas to a freezer bag or plastic container for more permanent storage.
Nutrition Info
Serving Size: 1 (1828 g)
Servings Per Recipe: 1
- Amount Per Serving
- % Daily Value
- Calories 242.7
- Calories from Fat 36
- 15%
- Total Fat 4 g
- 6%
- Saturated Fat 0.4 g
- 2%
- Cholesterol 0 mg
- 0%
- Sodium 410.7 mg
- 17%
- Total Carbohydrate 40.4 g
- 13%
- Dietary Fiber 11.6 g
- 46%
- Sugars 7.1 g
- 28%
- Protein 12.9 g
- 25%
Email This
Enter the two words from the image to verify you are human *
Saving Photo...
Add to Recipe Box
Please select a folder


text: Security Engineering: A Guide to Building Dependable Distributed Systems C H A P TE R 3 Passwords Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptable speed and accuracy when performing cryptographic operations. (They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed. But they are sufficiently pervasive that we must design our protocols around their limitations.) —KAUFMAN, PERLMAN, AND SPECINER [444] Taking care of old-fashioned access control tokens such as metal keys is a matter of common sense. But common sense is not always adequate for the measures used to protect computer systems. The human-machine gap causes security problems in a number of contexts, from straightforward system administration to the ways in which users mismanage security products such as encryption software [803]. (I won't use the fashionable euphemism "human computer interface": "chasm" might be better.) However, most of the problems arise in a simple context in which they are relatively easy to analyze and discuss—the management of passwords. In addition to things that are "obviously" passwords, such as the password you use to log on to your computer and the PIN that activates your bank card, there are many other things (and combinations of things) that have an equivalent effect. The most notorious are the likes of Social Security numbers and your mother's maiden name, which many organizations use to recognize you. For example, AT&T's wireless service contract states that anyone who knows your name, address, phone number and the last four digits of your social security number is authorized to make changes to your account; it also disclaims all liability for lack of privacy [201]. The ease with which such data can be guessed or found out from more or less public sources has given rise to a huge identity theft industry [285]. Criminals obtain credit cards, mobile phones, and other assets in your name, loot them, and leave you to sort out the mess. In the United States, about half a million people are the victims of this kind of fraud each year. Passwords are one of the biggest practical problems facing security engineers today. They are the (often shaky) foundation on which much of information security is built. Remembering a password is contingent on frequent use (so that passwords are imprinted well on memory) and consistent context (so that different passwords do not 35 Chapter 3: Passwords interfere with each other in memory). Neither of these conditions is met when people are asked to choose passwords for a large number of Web sites that they visit rarely. So as they become principals in more and more electronic systems, the same passwords get used over and over again. Not only may attacks be carried out by outsiders guessing passwords, but by insiders in other systems. 3.1 Basics In a typical system, human users must authenticate themselves to a client (which may be a PC, a mobile phone, an ATM, or whatever), and the client in turn authenticates itself to one or more servers or services (such as an electronic banking system or a phone company). As explained in Chapter 2, "Protocols," authenticating electronic devices to each other is a more or less manageable problem (at least in theory). Authenticating people to devices is more difficult. There are basically three ways to do it. The first is that the person retains physical control of the device—as with a remote car-door key, a PDA, or even a laptop computer. The second is that he or she presents something he or she knows, such as a password. The third is to use a biometric, such as a fingerprint or iris pattern. (These options are commonly summed up as "something you have, something you know, or something you are.") For reasons of cost, most systems take the second option. Even where we use a physical token such as a hand-held password generator, it is common to use a password as well to lock it. So passwords matter, and managing them is a serious real-world problem. We'll look at the human issues first, then at the different kinds of attack model, and finally at technical attacks and defenses. All of these issues are important, so tackling only one of them is likely to lead to a bad design. 3.2 Applied Psychology Issues There are basically three types of concern: • Will the user break the system security by disclosing the password to a third party, whether accidentally, on purpose, or as a result of deception? • Will the user enter the password correctly with a high enough probability? • Will users remember the password, or will they have to either write it down or choose one that's easy for the attacker to guess? 3.2.1 Social Engineering One of the most severe practical threats to the confidentiality of information is that the attacker will extract it directly, from people who are authorized to access it, by telling some plausible untruth. This attack, known as social engineering, will be discussed at greater length in Chapter 8, which deals with medical systems, as it is the main current threat to medical privacy. The typical perpetrator is an insurance investigator who phones a hospital or doctor's office pretending to be a doctor involved in the emergency care of the target of investigation. This technique, also known as 'blagging' in 36 Security Engineering: A Guide to Building Dependable Distributed Systems Britain and 'pretexting' in America, is widely used to extract information from banks, insurance companies, and other firms that hold personal information; some people earn a living at it [261]. Passwords are often extracted by false pretext phone calls. A harrassed system administrator is called once or twice on trivial matters by someone who claims to be a very senior manager's personal assistant; once he has accepted the caller's story, she calls and urgently demands a high-level password on some plausible pretext. Unless an organization has well-thought-out policies, attacks of this kind are very likely to work. In a systematic experimental study, for example, 336 computer science students at the University of Sydney were sent an email message asking them to supply their password on the pretext that it was required to "validate" the password database after a suspected break-in. 138 of them returned a valid password. Some were suspicious: 30 returned a plausible-looking but invalid password, while over 200 changed their passwords without official prompting. But very few of them reported the email to authority [354]. One company controls this vulnerability with a policy that states: "The root password for each machine shall be too long to remember, at least 16 alpha and numeric characters chosen at random by the system; it shall be written on a piece of paper and kept in an envelope in the room where the machine is located; it may never be divulged over the telephone or used over the network; it may only be entered at the console of the machine that it controls." If a rule like this is rigidly enforced throughout an organization, a pretext attack on a root password becomes conspicuous, and is much less likely to succeed. Another approach, used at the NSA, is to have different-colored internal and external telephones that are not connected to each other, and rules that when the external phone in a room is off-hook, classified material can't even be discussed in the room, let alone on the phone. A somewhat less extreme approach (used at our laboratory) is to have different ring tones for internal and external calls. This works as long as you have alert system administrators. Physical authentication devices, like the password generator discussed in Chapter 2, are even better but are often too expensive, incompatible with legacy systems, or contrary to some policy (whether reasonable or not). 3.2.2 Difficulties with Reliable Password Entry The second human issue is that if a password is too long or complex, the user might have difficulty entering it correctly. A long random password may confuse the person entering it, and if the operation they are trying to perform is urgent, this might have safety or other implications. One application in which this is important is encrypted access codes. By quoting a reservation number, we get access to a hotel room or rental car. Airline ticketing is going this way, with many operators giving passengers a number to quote at the departure gate rather than a boarding card. As the numbers get longer, what happens to the error rate? An interesting study was done in South Africa, in the context of the prepaid electricity meters used to sell electricity in areas where the customers have no credit rating and often not even an address. With one make of meter, the customer hands some money to a sales agent, and in return gets one or more 20-digit numbers printed out on a receipt. He takes this receipt home and enters the numbers at a keypad in his meter. These numbers are encrypted commands, whether to dispense electricity, to change the tariff or whatever; the meter decrypts them and acts on them. 37 Chapter 3: Passwords When this meter was introduced, there was concern that since about a third of the population was illiterate, and people might get lost halfway through entering the number, this meter might be unusable in practice. But it turned out that illiteracy was not a problem; even people who could not read had no difficulty with numbers ("Everybody can use a phone," as one of the engineers said). Entry errors were a greater problem, but were solved by printing the 20 digits in two rows, containing, respectively, three and two groups of four digits [39]. A quite different application is the firing codes for U.S. nuclear weapons. These consist of only 12 decimal digits. If they are ever used, it is likely that the operators will be under the most extreme stress, and possibly using improvised or obsolete communications channels. Experiments suggested that 12 digits was the maximum that could be conveyed reliably in such circumstances. 3.2.3 Difficulties with Remembering the Password The greatest source of complaints about passwords is the fact that most people find them hard to remember [146, 823]. Twelve to twenty digits may be fine when they can be simply copied from a telegram or a meter ticket, but when customers are expected to memorize passwords, they either choose values that are easy for attackers to guess, or write them down, or both. The problems are not limited to computer access. For example, one chain of hotels in France introduced completely unattended service. You would turn up at the hotel, swipe your credit card in the reception machine, and get a receipt with a numerical access code that would unlock your room door. To keep costs down, the rooms did not have en suite bathrooms, so guests had to use communal facilities. The usual failure mode was that a guest, having gone to the bathroom, would forget his access code. Unless he had taken the receipt with him, he'd end up having to sleep on the bathroom floor until the staff arrived the following morning. Problems related to password memorability can be discussed under two main headings: design errors, and operational failures. 188.8.131.52 Design Errors Attempts to design systems so as to make passwords memorable are a frequent source of severe design errors—especially with the many systems being built rapidly by unskilled people for electronic business. An instructive, and important, example of how not to do it is to ask customers for "your mother's maiden name." Many banks, government departments, and other organizations authenticate their customers in this way. There are two rather obvious problems: first, your mother's maiden name is easy for a thief to find out, whether by asking around, chasing birth and marriage records, or using online genealogical databases. Second, even if you decide that from now on your mother's maiden name is going to be, say, Yngstrom (or even yGt5r4ad), rather than Smith, there are problems. You might break your credit card agreement, and perhaps invalidate your insurance cover, by giving false data. Moreover, asking for a maiden name makes assumptions that don't hold for all cultures (Icelanders have no surnames, and women from many other countries don't change their names on marriage). There might be no provision for changing such a password, so if it ever becomes known to a thief you could have to close and reopen bank accounts. Finally, you will be asked to give it to a lot of organizations, any one of 38 Security Engineering: A Guide to Building Dependable Distributed Systems which might have a crooked employee. You could always tell "Yngstrom" to your bank. "Jones" to the phone company, "Geraghty" to the travel agent, and so on; but data are shared extensively between companies, so you could easily end up confusing their systems (not to mention yourself). Slightly more thoughtfully designed e-commerce sites ask for a password explicitly rather than a maiden name. But the sheer number of applications for which the average person is asked to use a password nowadays exceeds the powers of human memory. So either customers will write passwords down (despite being told not to) or they will use the same password for many different purposes. Thus, the password you use to authenticate the customer of the electronic banking system you've just designed, is quite possibly known to a Mafia-operated porn site as well. The risk you face as a consumer is not just a direct loss through identity theft or fraud. Badly designed password mechanisms can undermine your credibility and can cause you to lose a genuine legal claim. For example, if a thief manages to forge a copy of your cash machine card, then loots your bank account, the bank will ask whether you have ever shared your personal identification number with any other person or company. If you admit to using the same number for your mobile phone, the bank may well say that either you were grossly negligent by allowing someone to see you using the phone, or somebody at the phone company must be to blame. In either case, it's up to you to find them and sue them. Some organizations try to find other security information. My bank asks its business customers the value of the last check from their account that was cleared. In theory, this could be a good system: it has the advantage that even if someone compromises my password—such as by overhearing me doing a transaction on the telephone—the security of the system usually recovers more or less automatically. The implementation details bear some attention though. When this system was first introduced, I wondered whether a supplier, to whom I'd just written a check, had a chance of impersonating me. I concluded that asking for the last three checks' values would be safer. But the problem I actually had was different. Having given the checkbook to our accountant for the annual audit, I couldn't authenticate myself to get a balance over the phone and had to visit the branch. Attempts to find alternative solutions have more often hit the rocks. One bank sent its customers a letter warning them against writing down their PIN, and instead supplied a distinctive piece of cardboard on which they were supposed to conceal their PIN in the following way: suppose your PIN is 2256. Choose a four-letter word, say blue. Write these four letters down in the second, second, fifth, and sixth columns of the card, respectively, as shown in Figure 3.1. Then fill up the empty boxes with random letters. Figure 3.1 A bad mnemonic system for bank PINs. 39 Chapter 3: Passwords This is clearly a bad idea. Even if the random letters aren't written in a slightly different way, a quick check shows that a 4 by 10 matrix of random letters may yield about two dozen words (unless there's an "s" on the bottom row, when you can get 40 to 50). So the odds that the thief can guess the PIN, given three attempts, have just shortened from 1 in 3000-odd to 1 in 8. Some banks allow customers to choose their own PINs. It is believed that about a third of customers use a birthdate, in which case the odds against the thief are now a bit over 100 to 1 (and much shorter if the thief knows the victim). Even if this risk is thought acceptable, the PIN might still be set to the same value as the PIN used with a mobile phone that's shared with family members. To analyze this problem, we have to consider a number of different threat models, which we'll come to in the next section. 22.214.171.124 Operational Issues A failure to think through the sort of rules that organizations should make, and enforce, to support the password mechanisms they have implemented has led to some really spectacular cases. One important case in Britain in the late 1980s was R v. Gold and Schifreen. The defendants saw a phone number for the development system for Prestel (an early public email service run by British Telecom) in a note stuck on a terminal at an exhibition. They dialed in later, and found that the welcome screen had an allpowerful maintenance password displayed on it. They tried this on the live system, too, and it worked! They proceeded to take over the Duke of Edinburgh's electronic mail account, and sent mail 'from' him to someone they didn't like, announcing the award of a knighthood. This crime so shocked the establishment that when prosecutors failed to convict the defendants under the laws then in force, Parliament passed Britain's first computer crime law. Placing an administrator password in an envelope taped to the side of a workstation in an office that is always attended or locked may in some circumstances be reasonable practice. The people who can get at it are those who can physically access the machine anyway. But if you operate a policy like this, then you have to see to it that people understand the reasoning behind it, and don't think that the password can as easily be left on a logon screen. For someone to use the same administrator password for the live system as in the development environment is much less excusable. A similar and very general error is failing to reset the default passwords supplied with certain system services. For example, one top-selling dial access system in the 1980s had a default software support user name of 999999 and a password of 9999. It also had a default supervisor name of 777777, with a password of 7777. Most sites didn't change these passwords, and many of them were hacked once the practice became widely known. Failure to change default passwords as supplied by the equipment vendor has affected many kinds of computer, some cryptographic equipment, and even mobile phones (where many users never bother to change an installed PIN of 0000). 40 Security Engineering: A Guide to Building Dependable Distributed Systems 3.3 System Issues After gaining an understanding the psychology of the users, the next step is to understand that of the attackers. Just as we can only talk about the soundness of a security protocol in the context of a specific threat model, so we can only judge whether a given password scheme is sound by considering the type of attacks we are trying to defend against. Broadly speaking, these are: Targeted attack on one account. An intruder tries to guess a particular user's password. He might try to guess the PIN for Bill Gates's bank account, or a rival's logon password at the office, in order to do mischief directly. Attempt to penetrate any account on a system. The intruder tries to get a logon as any user of the system. This might be to steal service directly (e.g., use a phone card service without paying) or as a stepping stone to a wider attack. Attempt to penetrate any account on any system. The intruder wants an account on any system in a given domain; it doesn't matter which one. For example, common teenage hacker motives are to get a place to hide pirated software or pornography, or a platform from which attacks can be launched anonymously on other systems. More serious threats come from skilled people attacking a target organization. A spy seeking classified information might initially try to hack any computer in the ⋅mil namespace, while a private eye tasked to get access to Microsoft's intranet might only need a logon to some random machine in microsoft.com. Service denial attack The attacker may wish to prevent the legitimate user from using the system. This might be targeted on a particular account (such as cancelling somebody's credit cards in order to annoy them) or systemwide. This taxonomy is useful because it helps us ask many relevant questions when selecting or designing a password system. However, there are other issues that interact with the type of attacks that are expected and the kind of countermeasures that can be used. 3.3.1 Protecting Oneself or Others? First, to what extent does the system need to protect users from each other? In some systems—such as mobile phone systems and cash machine systems—no one should be able to use the service at someone else's expense. It is assumed that the attackers are already legitimate users of the system. So systems are (or at least should be) carefully designed so that knowledge of one user's password will not allow another identifiable user's account to be compromised: they provide multilateral security (which we discuss at greater length in Chapter 8). A user who chooses a password that is easy to guess harms only himself, and so a wide variation in password strength can perhaps be tolerated. (Bear in mind that the passwords people choose are very often easy for their spouses or partners to guess [146], so some thought needs to be given to issues such as what happens when a cheated partner seeks vengeance. This is a common enough problem.) 41 Chapter 3: Passwords But with many systems, it can be bad news if even one enemy gains access. Operating systems such as Unix and Windows may have been designed to protect one user against accidental interference by another, but they are not hardened to protect against capable malicious actions by other users. These systems have many well-publicized vulnerabilities, with more being published constantly on the Web. A competent opponent who can get a single account on a shared computer system can usually become the system administrator fairly quickly; and from there he can do whatever he likes. The typical exploitation path is thus outsider to normal user to administrator, with the first of these steps being the hard one. So it may not be a good idea to let users choose whatever password they like. With military systems in particular, it is common to assign users random passwords in order to guarantee a minimum password strength. (I'll have more to say on this later.) 3.3.2 Intrusion Detection Issues The second question concerns the manner in which the password system might interact with an intrusion detection system. Organizations such as banks often have a rule that a terminal and user account are frozen after three bad password attempts; it is then necessary to contact an administrator to reactivate them. This could be rather dangerous in a military system, as an enemy who got access to the network could use a flood of false logon attempts to mount a service denial attack; if given a list of all the user names on a machine, it might well be possible to take it out of service completely. It's not just military systems where you have to pay attention to this. Telephone calling cards are another example; they usually have a prefix, followed by the local number to which they're billed, and a four-digit PIN. One phone company scans calling card numbers and cancels any for which more than one PIN appears. This leaves them wide open to anyone who wants to cancel someone else's card. (It also doesn't stop the crook who wants to guess a valid card number, as he can just try the same PIN with a whole lot of different local phone numbers.) The design of intrusion detection systems varies greatly by what they are supposed to achieve. They can range from simple threshold alarms, which go off after three bad logon attempts to a particular account, up through much more sophisticated and distributed systems designed to cope with intruders who might try one password on many accounts, or on one account on each of many machines, or whatever. There's more on intrusion detection in Chapter 18; here, I'm just flagging up the fact that password and intrusion detection policies interact. 3.3.3 Can Users Be Trained? The third question is whether users can be trained and disciplined. In a corporate or military environment—and even to some extent in a university—you can control your user population. You can teach them how to choose good passwords; you can give negative feedback if they choose bad ones; you can issue them with random passwords, and order that if these passwords are written down they must be treated the same as the data they protect (so 'Top Secret' passwords must be sealed in an envelope, in a safe, in a room that's locked when not occupied, in a building patrolled by guards). You can see to it that only cleared people have access to the terminals where the passwords can be used. You can send the guards round at night to check that no-one's left a note of a 42 Security Engineering: A Guide to Building Dependable Distributed Systems password lying around. You can operate a clean desk policy so that nothing can be overlooked in a pile of papers in plain sight. Colleagues and I studied the benefits that can be obtained by training users [815]. While writing this book, I could not find any account of experiments on this that would hold water by the standards of applied psychology (i.e., randomized controlled trials with big enough groups for the results to be statistically significant). The closest I found was a study of the recall rates, forgetting rates, and guessing rates of various types of password [146]; this is valuable, but doesn't tell us the actual (as opposed to likely) effects of giving users various kinds of advice. We therefore selected three groups of about a hundred volunteers from our first-year science students. • The red (control) group was given the usual advice (devise a password of at least six characters long, including one nonletter). • The green group was told to think of a passphrase and select letters from it to build a password. Thus, "It's 12 noon and I am hungry" would give I S12&IAH. • The yellow group was told to select eight characters (alpha or numeric) at random from a table we gave them, write them down, and destroy the note after a week or two once they'd memorized the password. What we expected to find was that the red group's passwords would be easier to guess than the green group's, which would in turn be easier than the yellow group's; and that the yellow group would have the most difficulty remembering their passwords (or would be forced to reset them more often), followed by green and then red. But that's not what we found. About 30 percent of the control group chose passwords that could be guessed using cracking software (which I discuss later), versus about 10 percent for the other two groups. So passphrases and random passwords seemed to be about equally effective. When we looked at password reset rates, there was no significant difference between the three groups. When we asked the students whether they'd found their passwords hard to remember (or had written them down), the yellow group had significantly more problems than the other two; but there was no significant difference between red and green. The conclusions we drew were as follows. • For those users who follow instructions, the use of passwords based on mnemonic phrases offers the best of both worlds. They are as easy to remember as naively selected passwords, and as hard to guess as random passwords. • Merely using mnemonic passwords or random passwords does not help much, as the problem then becomes one of user compliance. A significant number of users (perhaps a third of them) just don't do what they're told. So, while centrally assigned, randomly selected passwords may be a good strategy for the military, its value comes from the fact that the passwords are centrally assigned (thus compelling user compliance) rather than from the fact that they're random (mnemonic phrases would do just as well). However, there are at least two cases where centrally assigned passwords may be inappropriate. The first is where a user controls access to a resource that the organization should not be able to override. Where digital signatures are used to provide evidence, and a user's digital signing key is protected by a password, then assigning this pass43 Chapter 3: Passwords word centrally could enable the system administrator to get at the signing key and forge messages, which would destroy the evidential value of the signature. The second, and more subtle, case is systems that offer a service to the public. Whether you offer a service through dedicated terminals, such as cash machines or mobile phones, or over the Net to standard PCs, you can't expect to train and discipline your users; and if you try to, there is a real risk that a judge will find your contract terms unreasonable. Perhaps the ideal solution is instruct users to choose mnemonic passwords, and to have a password cracking program installed as a password filter; users who try to choose a password on its guessing list are told to try again. More empirical psychological research on this topic is needed. 3.3.4 The Growing Famine for Security Data The fourth question is the really hard one: will your users compromise their passwords by using them on other systems? People who are allowed to select their own password or PIN will often choose the same one for a number of systems, so it's easy to remember. If you don't let customers change their PINs, some of them will write them down. You can forbid this in their contract, but they'll do it anyway. Some people will just take their business elsewhere (given the option, I prefer to use Web sites that don't ask for a password at all, regardless of whether I choose it or they do). There is a severe shortage of good security information by which people can be identified and can authorize actions. Attempts to solve the problem by issuing people with "multifunction" smartcards have so far foundered on arguments over whose logo will go on front and who will control the mailing list. It would require less expenditure on infrastructure if we could get people to authorize transactions using existing equipment such as mobile phones. But even if, in a few years' time, everyone in the world has a third-generation mobile phone capable of doing banking transactions and of receiving encrypted text messages containing authorization codes for Web-based ecommerce transactions, there will remain a whole host of technical problems. These include the chosen protocol attack, which we discussed in the previous chapter, and the difficulties of preventing programs from interfering with each other, which we will discuss in the next. Even more serious problems are likely to arise from business and legal issues, such as what if a single company gets control of everyone's credit card data, or purchase history data, or both. We'll discuss these issues in Chapters 19 through 21. 3.4 Technical Protection of Passwords A broad range of attacks can be used to recover other people's passwords. Some of them target the password entry mechanism, while others exploit the way that passwords are stored. 3.4.1 Attacks on Password Entry Password entry is often poorly protected. 44 Security Engineering: A Guide to Building Dependable Distributed Systems 220.127.116.11 Interface Design Sometimes the problem is thoughtless interface design. For example, some very common models of cash machine had a vertical keyboard at head height, making it simple for a pickpocket to watch a customer enter her PIN before lifting her purse from her handbag. The keyboards were at a reasonable height for the men who designed them, but women—and men in many countries are a few inches shorter and were highly exposed. Ironically, one of these machines "protected client privacy" by forcing the customer to gaze at the screen through a narrow slot. Your balance was private, but your PIN was not! Many pay telephones have a similar problem, and shoulder surfing of calling card details (as it's known in the industry) has been endemic at some locations such as major U.S. train stations and airports. For that reason, I usually cover my dialling hand with my body or my other hand when entering a card number or PIN in a public place—but systems shouldn't be designed on the assumption that all customers will do this. 18.104.22.168 Eavesdropping Taking care with password entry may stop the bad guys looking over your shoulder as you use your calling card at an airport telephone, but it won't stop all the eavesdropping attacks. For example, a hotel manager might abuse his switchboard facilities to log the keystrokes you enter at the phone in your room. That way, he might get the credit card number you used to buy a ticket from an automated service; and if this isn't the card number you use to pay your hotel bill, he can plunder your account with much less risk. Many networked computer systems still send a password in clear over a local area network for checking at a server; anyone who can program a machine on the network, or attach his own sniffer equipment, can harvest them. This is one reason that Microsoft adopted the Kerberos authentication protocol for Windows 2000—the cleartext password is not transmitted over the network. (NT v 4 used a proprietary authentication protocol.) 126.96.36.199 The Need for Trusted Path The machine to which you log on may be malicious. A simple attack program may be left running on an unattended machine in a public terminal room; it will look just like the usual logon screen, prompting for a user name and password. When an unsuspecting user does this, it will save the password somewhere in the system, reply "sorry, wrong password" and then vanish, invoking the genuine password program. The user will assume that he made a typing error the first time and think no more of it. This is why Windows NT has a "secure attention sequence," namely ctrl-alt-del, which is guaranteed to take you to a genuine password prompt. A facility that assures the user she's talking to a genuine system is called a trusted path. If the whole terminal equipment is bogus, then of course all bets are off. We once caught a student installing modified keyboards in our public terminal room to capture passwords. When the attacker is prepared to take this much trouble, then all the ctrlalt-del sequence achieves is to make his software design task simpler. 45 Chapter 3: Passwords There have also been a few cases of criminals setting up false cash machines. In one famous case in Connecticut in 1993, the bad guys even bought genuine cash machines (on credit), installed them in a shopping mall, and proceeded to collect PINs and card details from unsuspecting bank customers who tried to use them [19]. Within a year, crooks in London had copied the idea, then enlarged on it by setting up a whole bogus bank branch [405]. Other cases have involved home-built cash machines, fitting false fronts over the front of genuine cash machines, or even replacing the card-operated door locks at the entrance to ATM facilities. Such attacks are even easier in countries where cards are used with PINs at the point of sale. 22.214.171.124 Technical Defeats of Password Retry Counters Many kids find out that a bicycle combination lock can usually be broken in a few minutes by solving each ring in order of looseness. The same idea works against a number of computer systems. The PDP-10 TENEX operating system checked passwords one character at a time, and stopped as soon as one of them was wrong. This opened up a timing attack, whereby the attacker would repeatedly place a guessed password in memory at a suitable location, have it verified as part of a file access request, and wait to see how long it took to be rejected [493]. An error in the first character would be reported almost at once, an error in the second character would take a little longer to report, and in the third character a little longer still, and so on. So it was possible to guess the characters one after another, and instead of a password of N characters drawn from an alphabet of A characters taking AN/2 guesses on average, it took AN/2. (Bear in mind that, in 30 years' time, all that might remain of the system you're building today is the memory of its more newsworthy security failures.) A similar attack worked on one remote car-locking device: as soon as a wrong byte was transmitted from the key fob, the red telltale light on the receiver came on. Password retry limits fail in other ways, too. With some smartcards, it has been possible to determine the customer PIN by trying each possible input value and looking at the card's power consumption, then issuing a reset if the input was wrong. The reason was that a wrong PIN caused a PIN retry counter to be decremented, and writing to the EEPROM memory that held this counter caused a current surge of several milliamps, which could be detected in time to reset the card before the write was complete [478]. 3.4.2 Attacks on Password Storage Passwords have often been vulnerable where they are stored. There was a horrendous bug in one operating system update in the 1980s: a user who entered a wrong password, and was told "sorry, wrong password" merely had to hit carriage return to get into the system anyway. This was spotted quickly, and a patch was shipped, but almost a hundred U.S. government systems in Germany were using unlicensed copies of the software and didn't get the patch, with the result that hackers were able to get in and steal information, which they are rumored to have sold to the KGB. Another horrible programming error struck a U.K. bank, which issued all its customers with the same PIN by mistake. As the procedures for handling PINs were carefully controlled, no one in the bank got access to anyone's PIN other than his or her own, so the mistake wasn't spotted until after thousands of customer cards had been shipped. 46 Security Engineering: A Guide to Building Dependable Distributed Systems 22.214.171.124 Attacks via the Audit Trail In systems that log failed password attempts, the log usually contains a large number of passwords, as users get the "username, password" sequence out of phase. If the logs are not well protected, then attacks become easy. Someone who sees an audit record of a failed login with a nonexistent user name of e5gv, 8yp can be 99 percent sure that this string is a password for one of the valid user names on the system. 188.8.131.52 One-Way Encryption Password storage has also been a problem for some systems. Keeping a plaintext file of passwords can be dangerous. In MIT's Compatible Time Sharing System, ctss (a predecessor of Multics), it once happened that one person was editing the message of the day, while another was editing the password file. Because of a software bug, the two editor temporary files got swapped, with the result that everyone who logged on was greeted with a copy of the password file! As a result of such incidents, passwords are often protected by encrypting them using a one-way algorithm, an innovation due to Roger Needham and Mike Guy. The password, when entered, is passed through a one-way function, and the user is logged on only if it matches a previously stored value. Sometimes it isn't possible to protect a file of security information by one-way encryption, however, such as when this information must be processed in some way. The classic example is in GSM mobile phones, where each user has a cryptographic key on the home location register database. As this key is used to compute challenge-response pairs for authenticating users over the air, it is kept in the clear. (We will discuss the reasons for this design decision, and the possible alternatives, in Chapter 17). 184.108.40.206 Password Cracking However, some systems that do use an encrypted password file make it world readable (Unix is the prime example—a design error now too well entrenched to change easily). This means that an opponent who can fetch this file can then try to break passwords offline using a dictionary; he encrypts the values in his dictionary and compares them with those in the file (an activity called a dictionary attack, or more colloquially, password cracking). NT is slightly better, but the password file can still be accessed by users who know what they're doing, and passwords may be passed to other systems (such as Netware, or earlier versions of NT) in old formats that use old, weak protection mechanisms for compatibility reasons. Left to their own devices, people will use spouses' names, single letters, or even just hit Enter which gives an empty string as their password. So some systems require minimum password lengths, or even check user-entered passwords against a dictionary of bad choices. Still, designing a password quality enforcement mechanism is harder than one might think. Grampp and Morris's classic paper on Unix security [350] reports that after software became available that forced passwords to be at least six characters long and have at least one nonletter, they made a file of the 20 most common female names, each followed by a single digit. Of these 200 passwords, at least one was in use on each of several dozen machines they examined. According to one report, when users were compelled to change their passwords, and prevented from using the previous few choices, they changed passwords rapidly to ex47 Chapter 3: Passwords haust the history list and get back to their favorite password. A response, of forbidding password changes until after 15 days, meant that users couldn't change compromised passwords without help from the system administrator [603]. In my own experience, insisting on alphanumeric passwords and forcing a password change once a month led people to choose passwords such as julia03 for March, julia04 for April, and so on. So I am not at all convinced that demanding frequent password changes is a good idea. A well-known study was conducted by Klein who gathered 25,000 Unix passwords in the form of encrypted password files and ran cracking software to guess them [460]. He found that 21 to 25 percent of passwords could be guessed, depending on the amount of effort put in. Dictionary words accounted for 7.4 percent, common names for 4 percent, combinations of user and account name 2.7 percent, and so on down a list of less-probable choices such as words from science fiction (0.4 percent) and sports terms (0.2 percent). Some of these were straightforward dictionary searches; others used patterns. For example, the algorithm for constructing combinations of user and account names would take an account klone belonging to the user Daniel V. Klein and try passwords such as klone, klone, klone123, dvk, dvkdvk, leinad, neilk, DvkkvD, and so on. There are publicly available programs (crack for Unix and L0phtcrack for Windows [481]) that implement this kind of search. They can be used by system administrators to find bad passwords on their systems. They can just as easily be used by a bad guy who has got a copy of your password file. So password cracking is something to which you have to pay attention, especially if your system contains any machines running Unix or Linux. One way to use a program like crack is to filter user password choices; another is to use a custom program that understands language statistics and rejects passwords that are too likely to be chosen by others at random [98, 220]; another is to mix the two ideas using a suitable coding scheme [725]. 3.4.3 Absolute Limits Regardless of how well passwords are managed, there are often absolute limits imposed by the design of the operating system or other platform on which the system is built. For example, Unix systems limit the length of the password to eight characters (you can often enter more than this, but the ninth and subsequent characters are ignored). The effort required to try all possible passwords—the total exhaust time, in cryptanalytic jargon—is 96 8 or about 2 52 ; the average effort for a search is half of this. A well-financed government agency (or a well-organized hacker group, using PCs distributed across the Internet) could now break any encrypted password in a standard Unix password file. This motivates more technical defenses against password cracking, including shadow passwords, that is, encrypted passwords hidden in a private file (most modern Unices), using an obscure mechanism to do the encryption (Novell), or using a secret key with the encryption (MVS). The strength of these mechanisms may vary. For the above reasons, military system administrators often prefer to issue random passwords. This also lets the probability of password-guessing attacks be estimated and managed. For example, if L is the maximum password lifetime, R is login attempt rate, S is the size of the password space, then the probability that a password can be guessed in its lifetime is: P = LR/S 48 Security Engineering: A Guide to Building Dependable Distributed Systems This equation is taken from the U.S. Department of Defense password management guideline [242]. There are a couple of problems with this doctrine. First (the niggle) the password space can be completely exhausted, in which case LR/S > 1, and P isn't defined as a probability. Second (more serious) is that the attacker is not interested in guessing a password as much as getting acess to an account. So one has to take account of the number of users. If a large defense network has a million possible passwords and a million users, and the alarm goes off after three bad password attempts on any account, then the attack is to try one password for every single account. Thus, the quantity of real interest is the probability that the password space can be exhausted in the lifetime of the system at the maximum feasible password guess rate. To take a concrete example, U.K. government systems tend to issue passwords that have been randomly selected with a fixed template of consonants, vowels, and numbers designed to make them easier to remember, such as CVCNCVCN (e.g., fuR5_Eb8). If passwords are not case-sensitive, the guess probability is only 21 4 .5 2 .102 , or about 2 29 . So if an attacker could guess 100 passwords a second—perhaps distributed across 10,000 accounts on hundreds of machines on a network, so as not to raise the alarm—then he'd need about 5 million seconds, or two months, to get in. In commercial systems, you can have a policy of simply blocking accounts after a number of false password attempts. If the threshold were three bad guesses in any one month, then with 10,000 accounts the maximum guess rate would be 30,000 passwords per month, and the rate at which guessing could be carried out undetectably would be much lower. But military system designers are reluctant to introduce account blocking, as it leaves them open to service denial attacks. As I mentioned in Section 3.3.2, an enemy who gets access to the network and enters enough wrong password guesses could freeze every account on the whole system. 3.5 Summary Password management is one of the most important and yet most difficult design problems in many secure systems. As people get accounts on more and more systems, they reuse passwords in ways that expose serious vulnerabilities. But even where users operate in a controlled environment, things are by no means straightforward. The ability to do offline password guessing more or less guarantees that an attacker will be able to compromise at least some accounts on any system, unless passwords are centrally assigned or filtered when users choose them. Where possible, one should stop offline guessing, for example, by keeping the password file secret. But systems such as Unix are often bought because of their large software base, and the software your customer wants to use may make changing the password mechanism difficult. Critical questions to ask when designing a password system include not just whether people might reuse passwords, but also whether they need to be protected from each other, whether they can be trained and disciplined, and whether accounts can be frozen after a fixed number of bad guesses. You also have to consider whether attackers will target a particular account, or be happy with breaking any account on a machine or a network; and technical protection issues such as whether passwords can be snooped by malicious software, false terminals, or network eavesdropping. 49 Chapter 3: Passwords Research Problems I mentioned the lack of published empirical research. Although a little has been done, there's a lot more to do. For example, what are the best ways of enforcing user compliance with a password policy? There are some extreme solutions—such as issuing each user with a printed list of random passwords, each of which can be used once only—and these certainly work. But what can be done in applications where such drastic measures aren't justified? Another problem, which straddles the borderline with security protocol design, is whether we can design interactive password systems that are better. There are various visual schemes and memorization schemes in the literature, and some early products: one system presents users with nine faces, only one of which is of a person they know; they have to pick the right face several times in a row to log on [223]. Other schemes present a table of numbers, and let the user do a secret computation using mental arithmetic. Designing such schemes is fairly easy; evaluating them is harder, as it involves elements of cryptology, psychology, and systems engineering. An increasingly common mechanism is to ask for several pieces of security information rather than one. A call center might ask not just for your mother's maiden name, a password, and the amount of your last purchase, but also your dog's nickname and your favorite color. The underlying idea is that although an attacker might find out anything you know, it's much harder for him to find out everything you know. Again, such schemes need careful evaluation of their usability and effectiveness using the tools of applied psychology. Further Reading There isn't as much literature on passwords as one would like, despite the subject's importance. The papers by Bob Morris and Ken Thompson [561], Fred Grampp and Bob Morris [350], and Dan Klein [460], are the classics. The DoD guidelines are very influential [242]. 50