Stuff people encrypt ....

Enigma rotors with alphabet rings
Rotors from an Enigma Machine

This week on the Introduction to Cyber Security MOOC (hosted on Futurelearn), the topic is cryptography.  Learners are having fun figuring out how Alice and Bob communicate while keeping their messages secure from Eve - and sharing some funny xkcd.com cartoons in the process.  One of the exercises we set was to use a PGP mail tool (Mailvelope) to sign and encrypt an email sent to a mailbox we set up specifically for the MOOC.  I have a mail rule that invokes a simple script to strip out the PGP message text, decrypt it and send it back to the learner in an email.

Although many people have successfully completed the task, there is a general consensus that routinely encrypting emails is unlikely to be adopted by most people.  The hurdles identified by people range from the impracticality of getting other people to use crypto in their communications, to the challenge of configuring the crypto tools and their general (lack of) usability.  It seems that Whitten and Tygar's findings on "Why Johnny Can't Encrypt" and Sheng et al's research on "Why Johny Still Can't Encrypt" continue to hold true.

It has also been interesting to check out the types of messages that learners are choosing to encrypt and send to us.  Many of them are along the lines of "This is a test message", but there also seems to be a significant proclivity towards "This is my secret message, please don't steal it".  However, the outlier by a long distance was the learner who encrypted and sent in the complete lyric to "Barbie Girl" by Aqua!

Comments

Post a Comment

Popular posts from this blog

Cloud Wedge - geek of the week

Image
CloudWedge: 'Geek of the Week' My colleague Yijun Yu recently wrote a opinion piece for The Conversation about how cloud computing could have made a difference to the search for Malayian Airlines MH370.  Essentially the question he poses is: why, in the age of global internet connectivity (including now onboard planes!), do we depend on the onboard flight data recorder for information about what happens on a plane? Of course there are numerous challenges with this - not least the cost of bandwidth for all the flight data (including cockpit audio) to be uploaded in real time and the security of the data.  Yijun's article addresses some aspects of the latter, and the former is not an insurmountable problem.  For example it should be possible to upload basic flight telemetry (e.g., GPS location, air speed, engine statistics and fuel data) without requiring significant bandwidth.  Indeed aero engine manufacturers such as Rolls-Royce deployed engine monitoring systems
Read more

Priming Code Club

Code Club Assembly Presentation from akbandara As part of my work with STEMnet, I recently signed up as a CodeClub volunteer at St. Bernadette's Catholic Primary School in Milton Keynes.  Working with Kate Clarke, the ICT leader at the school, I am going to be leading an after-school club that will introduce kids in Year 5 and Year 6 to the exciting world of programming.  CodeClub is a nationwide, volunteer driven, grass-roots movement to get kids learning about the fun that can be had programming computers, rather than simply using them. In order to give the kids some idea about what they might be letting themselves in for, last week I delivered the short presentation (embedded above) at the school.  I started out by getting the kids to identify different computers, and think about what a computer really does, i.e. follows a set of instructions to complete a task.  We then played with a neat little iPad game called 'Kodable' which allows the player to progr
Read more

Cyber security by the rest of us ...

Image
Breakdown of cyber crime types reported by learners in Week 1 As part of the Introduction to Cyber Security MOOC , we asked learners to review their computer security practices at the start of their learning by completing a simple online survey / self-audit.  Over 9100 learners completed the survey in Week 1 of the course, highlighting some interesting findings. For example, although 84% of respondents had configured their computers to require a password on startup, 30% did not 'lock' their computer so that it required the password to be re-entered if they left it unattended. With regard to password management, 55% of respondents depended on their memory for storing passwords, whereas 26% used software (password manager / web browser) to manage their passwords.  It is noteworthy that 18% reported that they write their passwords down and 59% reuse the same username / password across multiple websites. It was reassuring to note that 90% of learners who completed the
Read more