for-profit
(not much info online)
Challenge/Response, LLC
RocketSync

non-profit
Voting Transparency Project
SafeForBikes.org
Telecom working group notes 

code
SoftwareUpdate Java class
NoNox server security tool
Boston.com easy access
BankRate.com easy access

other
Collections, one-offs and archives

me
I care about the ways technology changes our lives for better and worse. My research interests include agent software architectures, markets and electronic commerce, security, privacy, location, user interface design, the implications of pervasive Internet connectivity, and novel human-computer interaction.
 
CV (PDF)
Publications

words
My blog writings are rough cuts, probably containing typos, bad grammar and incomplete arguments. Please don't think less of me for that. Hardly any were intended as noisy rants, and most are backed by at least a little research. Constructive feedback is encouraged.

The SiteKey anti-phishing system used by Bank of America and other financial institutions is susceptible to a real-time exploit in which an attacker can create a fake web page that includes a victim's correct, secret SiteKey image, text phrase and challenge questions.

So... if you're looking at a web page that claims to belong to your bank, and it's even showing your secret SiteKey image, it's possible the page is not coming from your bank, but from an attacker trying to steal your login secrets. Really.

"Rules" and "physical laws" are two powerful, immediate, external influences on our behavior.

At its heart, a rule is little more than a suggestion backed by a threat. A rule's power comes from outside itself, through enforcers who detect and punish violations. Without support, a rule can be freely ignored, or at least "bent" a little.

By contrast, a physical law is a sort of self-enforcing rule. Physical laws are obeyed not because they threaten punishment, but because they're either impossible to violate, or because violation will assuredly cause immediate pain or damage. Drivers run red lights all the time, but nobody hides from gravity.

This essay briefly contemplates the use of cryptography to bring the strength of physical laws to procedural processes, particularly vote counting in public elections.

I guess I've evolved my holiday tradition, a hybrid of my grandmother's feasts with some twists, plus parallel meatless/meatful entrees now that there are vegetarians at the table... counting those, six courses for diners means 6+2 (in this case 6+4 including this year's cheese-less variants) for the cook. And definitely do put out boiled eggs, wax pencils (or white candles) and egg dyes so your friends can make colorful decorations while settling in with the apps.
Read more