Eyeglass security: well-intentioned, but...

I shared in a teachable security experience moment at home the other day. Ms. Context had recently had an eye exam and needed a copy of her prescription to get a new pair of glasses. She called the doctor’s office; no problem, they said: we can email it to you.  This seemed quick and convenient. The “fun” started with a subsequent message in her inbox bearing an unexpected and, er, cryptic and concise title something like “encrypt”.  Recognizing the from address as corresponding to the doctor’s office (rather than a malware sender who might have sought to tempt with the same title), we continued. We registered an account with the proffered email encryption service provider, creating a password that will probably never have an occasion to be reused, also answering familiar life questions. After a few minutes, we successfully obtained and extracted the prescription-bearing PDF, free to email to an optician.

Ms. Context found these hoops frustrating; other patients might just have given up and waited for postal mail. As a security technologist, I could understand the rationale for encrypting the email; we’re dealing with a patient’s medical data here, after all, where privacy is fundamental and HIPAA regulations speak loudly to healthcare providers.  I’ve also had a hand in supporting the concept of Internet email encryption since the pre-Web era, as via this RFC. Nonetheless, it was hard to see that the balance of cost and inconvenient processing vs. tangible benefit clearly added up in this particular case.  What’s the actual threat?  It doesn’t seem likely that an attacker would find much value in intercepting email to become able to obtain a pair of glasses that probably wouldn’t match their own eyes.  There might be cases where people wouldn’t want specifics of their vision revealed (maybe if they’re approaching the limits of visual acuity required for a driver’s license?); while conceivable, these also seem fairly unusual.  I don’t know if or how the decryption service’s design might or might not expose protected data to insiders there, but that could become another threat to evaluate in the overall picture that wouldn’t arise if the service weren’t involved.

Security policies are normally and appropriately conservative, and medical offices should certainly be careful when storing and sending patient data.  (I’ll also recommend dialing carefully when using fax machines, but that’s another topic.)  For this example, though, many or most patients might not consider this piece of their data as particularly sensitive (vs., e.g., prescribed medications they may be taking). Security methods should be effective and also convenient to use, but instead seemed burdensome in this case. I wish (and continue to believe that) the technology could become easier to apply, so users’ data could be protected as usual practice.  Where we stand, though, it can often be much easier to see and resent the tangible annoyances that security methods impose than to value the more amorphous benefits that they’re meant to offer.

Please Don't Feed the Dinosaurs!

Window view this morning. I think the turkeys look positively prehistoric.  It's notable that the small cardinal is the only bird getting at feeder seed directly, while the larger beasts below are exploring for leftovers in the snow.  I wouldn't think that the thin, light feeder hanger would be much of a match for turkey power applied effectively, but strategy doesn't seem like their strongest point.

Tantalizingly reparseable news headline for today

From NYT: Power Vacuum in Middle East Lifts Militants; serious issues, but it's hard to avoid envisioning large suction apparatus.

Splendid unexpected failure mode example: London Walkie-Talkie building

See coverage, e.g., @ Bloomberg. Reflective glass, tapered focus, solar angle. What could possibly go wrong, and what situation might architects not have considered in their design?

I'm not much for omens, but...

When I attended my Hampshire College reunion earlier this month, the weekend's weather started out with several inches of rain.  It cleared on Saturday morning; when I stepped out from lunch then and happened to look up in the south-facing sky, I saw these wisps of colorful prismatic clouds suspended over the Holyoke Range of mountains and rushed to find a clear view before they dissipated.  I was pleased to collect the images.  I don't recall having seen this rather uncommon atmospheric phenomenon before, and it was a nice treat for at least this attendee.

Two coasts, one bird (species)

I'm hardly an expert birder, but enjoy being able to observe, photograph and sometimes identify the birds I see.  The "identify" part often becomes more challenging if I'm away from my usual New England surroundings, since many birds' habitats don't overlap different regions, but some are pleasantly familiar.  The pictures above show the Great Blue Heron rookery in Stanley Park, Vancouver, British Columbia, one of its residents carrying a straw to one of its nests, and another member of the species a few weeks later at Great Meadows National Wildlife Refuge in Concord, Massachusetts. They're majestic creatures, and I was glad to be able to collect their portraits on both sides of the continent.

Contemplating North America

I was pleased to have the opportunity to take this photo from the rear observation car of VIA Rail Canada's westbound train #1, The Canadian, in early April, a trip I've hoped to make for a number of years. There's another dome car (one of three) further up the train, Rocky Mountains ahead, as well as passing freight headlight reflections dancing on the stainless steel car roof ahead.  (Some lens flare as well, but I'll take that for some further effect.)  Altogether, representative of the end of Mountain Day, the route's third full day of travel between Toronto and Vancouver.  Mountain Day (my unofficial nickname) follows Prairie Day and Forests Day, perhaps less dramatic but both engaging in their own ways.  If the idea of several days out of time (and often away from cellular signals), while viewing most of a continent, seems appealing, I'd strongly recommend the trip.