Agent 007, James Bond & The Secret Cipher

A new James Bond Movie, Casino Royale will soon be reaching a movie theater near you.

It is fairly common knowledge that the character of Bond was immortalised by the writer Ian Fleming and that he picked the name from a book title on his shelves, 'Birds of the West Indies' written by a Philadelphian ornithologist, James Bond. What appears to be a subject of debate though, is why he gave his fictional British secret agent the code name of 007.

It is popularly assumed that he is the 7th agent with a 'licence to kill' and that Fleming took the moniker from the address of a building in Toronto at 1107 Avenue Road, where he had a residence. However, the real origins of the famous 007 are thought to lie somewhere else entirely; a place much more befitting of a spy. The code emanates from the language of the 'occult' i.e. the language of the hidden.

The science of sending concealed messages is known as Steganography, Greek for "concealed writing". An example of this might be the use of invisible ink or writing messages in wax and then covering them up. Steganography, however, has obvious limits. If someone finds the hidden message, all its secrets are revealed. This problem led to the need to obscure messages so that they could not be read even if they were intercepted. The result was Cryptography, Greek for "hidden writing". Encrypted messages hide the meaning, rather than the message itself.

Throughout history it has been important to hide messages and communiques, not only to prevent information reaching enemy ears and eyes, but also for reasons of personal safety. In the days of persecution by the Church and State anyone found dabbling in areas that constituted treason, or those derided as 'sorcery' and heresy, risked at least imprisonment, and at worst torture and death.

Ian Fleming has a background in British intelligence working for the NID. During World War I the NID (National Intelligence Division) was responsible for the Royal Navy's highly successful cryptographic efforts, Room 40, which was later merged to form the GCCS, Government Code and Cipher School. As such he would have been well aware of codes (secret languages) and ciphers (scrambled messages) and their history.

The real reason that Ian Fleming chose the code 007 is likely to stem from knowledge that circulated in the intelligence circles of a very famous Hermeticist and cipher writer, Dr John Dee (1527-1608). Dee was a polymath; an expert alchemist and mathematician, he was also Court Astrologer to Queen Mary I and an advisor to her sister, Elizabeth. He had a lifelong fascination with sigils and mathematical ciphers in both their numerical and geometric forms.

Dr Dee, as a known 'occultist', posed a threat to the other advisors in the Catholic Court of Queen Mary and in a bid to eradicate his influence, he was arrested and accused of plotting the Queen's death. He was, of course, duly vindicated. Queen Mary herself gave him a Royal Pardon, so he continued to work for the Court, even choosing the Coronation date for the new Queen, Elizabeth 1st. However past events, and constant fear of his enemies, forced them both to be more discreet in their political dealings together.

It is known that many of the communications between them were written in code and he used to sign his communications with Queen Elizabeth with the cipher 007. In effect, he acted as an astrologer and a secret agent for the new Queen, looking out for threats to her reign.

In the cipher, 007, the two circles symbolised his own two eyes as well as indicating that he was the secret eyes of the Queen. According to historian Richard Deacon, the two circles are guarded by what may be considered a square root sign. Deacon thinks it told Elizabeth that Dee put not only his two eyes and the other four senses at her disposal; he offered her his occult sense as well.

Deacon also sees the obvious possibility of the two eyes being guarded by an elongated number seven, as the number 7 is replete with esoteric significance. Whatever the true interpretation the majority of scholars and cryptologists have read it as a seven and Ian Fleming chose the code name of 007 for his hero, James Bond. Therefore, one cannot help but think that the longevity of the character may be down to more than just good luck for, as the author John Michel points out, the number is indeed sacred in occult belief:

"... In Revelation there are 7 churches, 7 candlesticks, 7 stars, 7 angels, 7 vials, 7 seals, 7 thunders, 7 plagues and 7 spirits of God; the Lamb has 7 horns and 7 eyes, the dragon 7 heads and 7 crowns, and the beast has 7 heads.

"Seven is the number of things sacred and mysterious, as the 7 veils of initiation. According to Philo 'nature delights in the number seven', for the astrologers know 7 planets, there are 7 stars in the Great Bear and 7 notes in music; God rested on the seventh day, a man's head has 7 orifices and his life proceeds in 7 year periods; the cycles of women and the moon occur in sevens, 28 days making the lunar month.

There are 7 colours in the rainbow and 7 petals on the temple flower,the pomegranate, but the number seven is rarely apparent in physical nature, corresponding rather to the spiritual forces that regulate the cycles of time and human development".

21 films and 6 Bond's later, it certainly looks like Ian Fleming, in choosing the code name 007 for his character, was party to 'hidden' knowledge worthy of the best secret agent.

By Kathryn Cassidy

Secrets On Security: A Gentle Introduction To Cryptography

Let us take the example of scrambling an egg. First, crack the shell, pour the contents into a bowl and beat the contents vigorously until you achieved the needed result - well, a scrambled egg. This action of mixing the molecules of the egg is encryption. Since the molecules are mixed-up, we say the egg has achieved a higher state of entropy (state of randomness). To return the scrambled egg to its original form (including uncracking the shell) is decryption. Impossible?

However, if we substitute the word “egg” and replace it with “number”, “molecules” with “digits”, it is POSSIBLE. This, my friend, is the exciting world of cryptography (crypto for short). It is a new field dominated by talented mathematicians who uses vocabulary like "non-linear polynomial relations", "overdefined systems of multivariate polynomial equations", "Galois fields", and so forth. These cryptographers uses language that mere mortals like us cannot pretend to understand.

In the computer, everything stored are numbers. Your MP3 file is a number. Your text message is a number. Your address book is a longer number. The number 65 represents the character "A", 97 for the small "a", and so on.

For humans, we recognize numbers with the digits from 0 to 9, where else, the computer can only recognize 0 or 1. This is the binary system which uses bits instead of digits. To convert bits to digits, just simply multiply the number of bits by 0.3 to get a good estimation. For example, if you have 256-bits of Indonesian Rupiah (one of the lowest currency denomination in the world), Bill Gates’ wealth in comparison would be microscopic.

The hexadecimal (base 16) system uses the ten digits from 0 to 9, plus the six extra symbols from A to F. This set has sixteen different “digits”, hence the hexadecimal name. This notation is useful for computer workers to peek into the "real contents" stored by the computer. Alternatively, treat these different number systems as currencies, be it Euro, Swiss Franc, British Pound and the like. Just like an object can be priced with different values using these currencies, a number can also be "priced" in these different number systems as well.

To digress a bit, have you ever wondered why you had to study prime numbers in school? I am sure most mathematics teachers do not know this answer. Answer: A subbranch called public-key cryptography which uses prime numbers especially for encrypting e-mails. Over there, they are talking of even bigger numbers like 2048, 4096, 8192 bits.)

When we want to encrypt something, we need to use a cipher. A cipher is just an algorithm similar to a recipe for baking a cake. It has precise, unambiguous steps. To carry out the encryption process, you need a key (some called it passphrase). A good practice in cryptography needs the key used by a cipher must be of high entropy to be effective.

Data Encryption Standard (DES), introduced as a standard in the late 1970's, was the most commonly used cipher in the 1980's and early 1990's. It uses a 56-bit key. It was broken in the late 1990’s with specialized computers costing about US$250,000 in 56 hours. With today's (2005) hardware, it is possible to crack within a day.

Subsequently, Triple-DES superseded DES as the logical way to preserve compatibility with earlier investments by big corporations (mainly banks). It uses two 56-bit key using three steps:-

1. Encrypt with Key 1.
2. Decrypt with Key 2.
3. Encrypt with Key 1.

The effective key length used is only 112-bits (equivalent to 34 digits). The key is any number between 0 and 5192296858534827628530496329220095. Some modify the last process using Key 3, making it more effective at 168-bit keys.

Advanced Encryption Standard (AES) was adopted as a standard by the National Institute of Standards & Technology, U.S.A. (NIST) in 2001. AES is based on the Rijndael (pronounced "rhine-doll") cipher developed by two Belgian cryptographers, Victor Rijmen and Joan Daemen. Typically, AES uses 256-bits (equivalent to 78 digits) for its keys. The key is any number between 0 and 15792089237316195423570985008687907853269984665640564039457584007913129639935. This number is the same as the estimated number of atoms in the universe.

The National Security Agency (NSA) approved AES in June 2003 for protecting top-level secrets within US governmental agencies (of course subject to their approval of the implementation methods). They are reputedly the ones that can eavesdrop on all telephone conversations going on around the world. Besides, this organization is recognized to be the largest employer of mathematicians in the world and may be the largest buyer of computer hardware in the world. The NSA probably have cryptographic expertise many years ahead of the public and can undoubtedly break many of the systems used in practice. For reasons of national security, almost all information about the NSA - even its budget is classified.

A brute force attack is basically to use all possible combinations in trying to decrypt encrypted materials.

A dictionary attack usually refers to text-based passphrases (passwords) by using commonly used passwords. The total number of commonly used passwords is surprisingly small, in computer terms.

An adversary is somebody, be it an individual, company, business rival, enemy, traitor or governmental agency who would probably gain by having access to your encrypted secrets. A determined adversary is one with more "brains" and resources. The best form of security is to have zero adversary (practically impossible to achieve), the next best is to have zero determined adversary!

A keylogger is a software program or hardware to capture all keystrokes typed. This is by far the most effective mechanism to crack password-based implementations of cryptosystems. Software keylogger programs are more common because they are small, work in stealth-mode and easily downloaded from the internet. Advanced keyloggers have the ability to run silently on a target machine and remotely deliver the recorded information to the user who introduced this covert monitoring session. Keystroke monitoring, as everything else created by man, can either be useful or harmful, depending on the monitor’s intents. All confidential information which passes through the keyboard and reaches the computer includes all passwords, usernames, identification data, credit card details, and confidential documents (as they are typed).

For the last definition, we will use an example. Let's say you have your house equipped with the latest locks, no master keys and no locksmith can tamper with them. Your doors and windows are unbreakable. How then does an adversary get into your house without using a bulldozer to break your front door? Answer: the roof - by removing a few tiles, the adversary can get into your house. This is an exploit (weakness point). Every system, organization, individual has exploits.

See, it is not that difficult after all. If you can understand the material presented in this article, congratulations - you have become crypto-literate (less than 1% of all current computer users). If you do not believe me, try using some of this newfound knowledge on your banker friends or computer professionals.

Stan Seecrets’ Postulate: “The sum total of all human knowledge is a prime number.”

Corollary: “The sum total of all human wisdom is not a prime number.”

By Stan Seecrets

The Art of Non-Verbal Communication

When you talk to your business partners, employees, journalists, spouse or friends, you certainly hear what they say, but can you also hear what lies beneath the words?

Have you ever had the feeling that someone is trying to fool you, or that the ones you were talking to don’t give a damn on what you have to say?

Guess what? Your “feeling” was right.

In a face-to-face communication words do the talking and the body sends out the message. If you take a careful look at the gestures, body pose and facial expressions displayed by your interlocutor you’ll certainly be able to understand his/her real feelings.

On the other hand, if a person is tired, nervous, worried or has any other negative feelings (for personal reasons) the gap between the verbal message and the non-verbal signals is often misleading, especially if you cannot interpret body language correctly.

Reading body language is not an easy task. Women, who are more perceptive than men, are able to notice body language warnings faster and interpret them (often unconsciously) quite accurately. When a man is lying to his wife she is almost always able to tell, because she “sees the signs”: his Adam’s apple jumps, he is not able to look her in the eyes, he is faking a smile, he is rubbing his hand for no reason, his body bends away, etc.

You shouldn’t read each gesture separately. To make sense of what you see, you need to take the signs as a whole. Words have deeper and more accurate meanings within a context. So do gestures. The moment you are able to make sense of gestures you’ll be able to tell whether your dialogue partner agrees with you or not.

You should always read gestures in the context. People do cross their arms when they have negative feelings towards a certain issue, but they also cross their arms to show superiority or because they are cold.

Reading body language is an art, but you’ll be able to master it in time. All you need to do is to learn the meaning of each gesture and then start looking at people, seeing what they do and “translate” their feelings.

The purpose of learning body language should not be reduced to “reading others”. Body language is the key to good communication. By learning it, you will know what negative non-verbal signs to eliminate from your behavior. You will not be able to “fake” body language – there are micro signals that sooner or later will give you away. But you will be able to communicate clearly, without sending out the wrong messages by accident.

By Mihaela Lica

The Mechanics of Deception Cryptography - Part I

Secret communication is nothing new. Books on the history of cryptography reveal that hidden messages date to as far back as there are records. After millennia of efforts to conceal messages, one might think that every imaginable cryptographic technique was tried long ago and is now widely known. "Not so," according to Morten St. George, author of a book on cryptic thinking.

St. George maintains that forty-two of the Nostradamus prophecies employ a unique type of cryptography that until now has never been identified, catalogued, or reused. Moreover, St. George claims that it may be the most powerful form of cryptography ever devised. Surprisingly, however, its techniques are extremely simple; it employs no complex mathematical codes or anything like that. As St. George puts it: "Its enormous strength lies in deception. If you don't know that cryptographic techniques are being employed, if you don't suspect that there is a hidden communication underneath, then you look no further than what's on the surface and the real meaning forever evades you." St. George calls it "deception cryptography."

To illustrate deception cryptography and its techniques, I will return to the "historical secrets" of an earlier article to show how those secrets were uncovered. In case an acknowledgment box for this article doesn't appear in all places, I am inserting here an opportunity to thank Morten St. George for this follow-up interview, for technical assistance, and for permission to derive material from his cryptic thinking book. Note that the book's analysis often spans many pages and in a paragraph or two I can only hope to point to the key elements.

*** Napoleon Bonaparte was murdered on his island of captivity by poison in the wine, instigated by a woman enraged over the defeat of his army in 1813.

St. George informs me that countless Nostradamians have meticulously examined each and every stanza looking for tie-ins with Napoleon, and in the end they believe they found dozens of stanzas that apply to Napoleon. St. George observes that there are only two stanzas that really do apply to Napoleon, and to his knowledge, no Nostradamian has ever found either one of them.

The stanza that deals with Napoleon's death is numbered VIII-13. There, the road to Napoleon lies in the first few words of the third verse: "Army to a thousand years." You need a number for adding a thousand years, but internally this stanza has no numbers. You are therefore forced to resort to the stanza number, VIII-13, or 813, producing the year 1813. The army of 1813 was one of the most famous in all of history, Napoleon's Grandee Armee. In 1813, in the aftermath of its retreat from Russia, that great army wholly disintegrated. In the last verse, the poison drink (inferred from elsewhere to be wine) kills two people. The second person was Napoleon's bodyguard.

Often, the prophecies affirm a theme elsewhere. In VIII-13, the affirmation lies in the second verse that invokes Greek mythology, a classic myth of betrayal, referring to the hero Bellerophon by name. Bellerophon was the name of the English ship that took Napoleon into captivity.

*** President John F. Kennedy was assassinated by a group of conspirators led by his vice-president, Lyndon Baines Johnson. Officially accused by the Warren Commission, Lee Harvey Oswald was completely innocent since the bullets that killed Kennedy were fired from a rooftop, not from an open window.

St. George derives this from the stanza numbered VI-37. "From a rooftop, evil ruin... Innocent of the act, after his death, he shall be accused." Then comes the all-critical final verse, beginning "The guilty one hidden." According to St. George, "hidden" is a magical word in the prophecies. You have to take it literally. The name of the guilty one is hidden in the French words that follow: "taillis" to the "bruyne." Symbolic of the death of a Roman Catholic (Kennedy) would be the Latin cross, so that's what you have to create. Put "taillis" directly on top of "bruyne." For the left side of the cross, bring down the three letters "B", "A", and "I". For the right side of the cross, bring down the three letters "N", "E", and "S". That spells out "Baines." Now looking at the middle of the cross, up on top, we see the letters "LY". Four letters have to be invented to complete the central shaft on the bottom end. The guilty one: LYndon BAINES.

*** The JFK conspirators were also behind the assassination of Kennedy's brother, Senator Robert F. Kennedy, several years later.

The answer here lies in stanza VI-11. This stanza begins by talking about a family with seven children, retroactively clarifying that the children at that time consisted of four sisters and three brothers, of which the oldest two will be surprised by death. The last two verses read: to kill the two brothers (an instance of grammatical deception) they shall be seduced; the conspirators shall pass away in their sleep. It's clear: these conspirators killed both Kennedy brothers, and since the conspirators died of natural causes, we can infer that they got away with it.

In The Mechanics of Deception Cryptography - Part II, I plan to show how deception cryptography ingeniously conveys information about the assassination of Martin Luther King, the attempted assassination of Pope John Paul II, and other secrets. At this point, I took a break from the technical stuff to ask Morten St. George if he can foresee future events in the prophecies.

Unfortunately, St. George answered in the negative. He says that beyond the inherent obscurity of deception cryptography, future events are rarely envisioned, and if you can't envision it, you can't predict it, no matter how clear or unclear the wording might be. St. George gave me a couple of examples, "Can you envision before the event that a phrase like "dead alive like a stump" could be alluding to Ronald Reagan's brain-dead Press Secretary? But after the event you can see it. Or can you envision before the event that a phrase like "from the sky shall come a great king of terror" could be alluding to hijacked airplanes on a terror mission? Only after the event it makes sense."

St. George continued: "For sure, anyone can use the prophecies to make predictions but that doesn't mean they will come true. I have a good one for you, a natural disaster beyond human manipulation: Earthquake Strikes in December 2006. It could be an earthquake in the North Atlantic, with tidal wave reaching London, or it could be an earthquake that hits the Greek city of Corinth. Mind you, the stanzas in question were already spectacularly successful for past events, and normally there would be no expectation of a second application. But here there is. I see a danger of failure, not of prophecy, but of one of the fundamental ciphers of deception cryptography. The prophecies do not fail."

Deception cryptography clearly has its weaknesses, and also a few unusual strengths, on which I plan to expand next time.

by: Gersiane De Brito

Personal Security Awareness

It is a sad commentary on our society that we should even have to worry about our own personal security. Unfortunately there really are people who watch our every move, just to see if we will let our guard down, even for a moment, that is when they will make their move.

The buzz words are Identity Theft, ATM Security, and Internet Fraud, and there are many, many more scams with new ones coming to light all the time. However lets just talk a little about being aware of those 3, some of the ways they work, and how we can combat them.

Identity Theft can happen many ways, the risks are very real, however with the formation of a few judicious habits, we can go a long way toward prevention of this crime of opportunity.

Cut down on the number of credit cards you carry, and never give the number over the phone or Internet, unless you have purposely initiated the transaction.

Never give out your social security number.

Buy a paper shredder and use it to shred all personal trash from your home or business. Never include address information on your key ring.

By very careful with the personal information you give to anyone you don't know, it takes very little information for the unscrupulous people in our midst to start building their new identity to match you.

ATM Security

Find out from your financial institution if video surveillance is being used at the ATM machines you typically use.

By very careful that someone standing near you cannot see you enter your pin number.

Internet Fraud

Never open an email attachment from someone you are not familiar with, or were not expecting to receive.

Never give personal information on a web site if you did not initiate the contact via a link you have used to contact that company before. I get at least 1 or 2 scam emails a day, that look exactly like the real thing, no matter how convincing they sound, almost no legitimate company or financial institution will ever send you an email asking for account numbers or any other personal information, most will not ask you to clink a link within that email. if they ask you to contact them, be sure you enter a link you trust.

If you accept credit cards over the internet, be very wary of multiple orders from the same person using different cards, they are almost always stolen.

By Jimmie Newell

Finding The Perfect Home Security System

In this day and age, peace of mind is sometimes hard to find. That is why home owners are turning to home security systems to attain that peace of mind.

Basic home security systems will usually cost between $25 and $35 monthly and provide home owners with 24 hours coverage 7 days per week. Most home owners will agree that this is a small price to pay to protect their home and their loved ones. Home security systems possess some essential components that allow the system to alert home owners and the proper authorities of home invasions. The five main elements include contacts, motion sensors, a control panel, a keypad and a siren.

These elements all play an essential part in home security. When the contacts are tripped, they send a signal control panel which begins to beep. The home owner must input the security code into the keypad before the 30-45 second time limit is up or the home security company contact center will be alerted. The motion sensors do essentially what their name implies. They detect motion and send a signal to the control panel if the alarm is set and motion is detected.

The control panel receives signals sent by the contacts and the motion detectors and is basically the system’s command unit.

The keypad allows the user to arm, disarm, turn off or alert the system monitoring cent re. There may also be buttons for specific emergencies located on the keypad. Different companies are likely to manufacture keypads with different options.

The basic task of the siren is to scare away intruders. The particular sound of the siren is often at the home owner’s choosing. When deciding on what type of home security system to buy, consider what type of life you lead. Do you have a family? Does your home contain many valuables? Do you have a pet? What kind of neighborhood do you live in? The answers to these questions will help you determine what kind of system you need. If you live in a posh neighborhood, you may wish to have a complex system because these neighborhoods are often targeted. If you do not have a family and you live in the country, your need for a complex home security system would be greatly diminished. When you are in the market for a home security system, make sure to shop around.

You will want to make sure that the company will provide you with 24/7 coverage and that the company operates their own monitoring center.

Check out the policies offered by the company in terms of coverage and look for any loopholes. Also, do not necessarily for the system with the most options. Go for the system with the options that are right for you. Home security is not a subject to take lightly.

When it comes time to purchase your home security system, make sure that you are well educated on the subject. In the event that something does happen, you will take comfort in knowing that you took the time to shop around for the perfect home security system and that you and your family will be safe because of that.

by: Martha Mountjoy

Security Classification Primer

Much is heard these days of government secrets being uncovered, national security being compromised, and of sensitive information getting into the wrong hands. Most countries have a classification system to formalize state secrets and protect information from being used to endanger citizens. This article will familiarize you with the security classification system.

Although the exact number varies from country to country, there are generally five levels of security classification:

Top Secret: Information which, in the hands of the enemy would put the security of America at exceptionally grave risk. Individuals undergo meticulous investigation to receive the level of clearance necessary to view this information. Clearance must be renewed every five years.

Secret: Information which could cause serious damage if publicly available. Intense investigation is required for individuals with this clearance, which must be renewed every ten years.

Confidential: Information which could compromise the safety of Americans. Clearance must be renewed every fifteen years for individuals on this level.

Restricted: Information which could have undesirable effects if publicly available. Some countries (the US included) do not use this security level.

Unclassified: Not technically a classification. This includes all information that does not pose a security risk, which is available to the public.

All classified information, regardless of the level, is available only on a "need to know" basis. Therefore, an individual having Top Secret clearance may not be privileged to view all Top Secret documents, only those documents which are pertinent to his or her work.

When two or more countries agree to share information with each other they must agree upon a uniform classification system. The United Nations, NATO, and the European Defense Organization all have their own security classification systems.

One example of a country without a formal classification system is China. The Criminal Law of the People's Republic of China makes it a crime to release a state secret. However, there is only a vague definition of what constitutes a state secret; therefore the government has used this law to imprison journalists.

Private corporations make use of a similar type of security classification system when working with new product development teams, mergers, and the company's financial reports. This type of information is protected under trade secret laws. Employers can require their employees to sign confidentiality agreements and undergo extensive background checks. While corporate classification lacks the harsh criminal sanctions of the government classification, individuals who leak company secrets can be tried and punished in courts of law.

Many citizens live out their lives without a thought for the secrets their government keeps from them. The military is the largest employer of people with such clearances. It might surprise you to know that one out of every thirty Americans, or 3-5 million individuals are authorized to some extent to know state secrets. Of all individuals with such clearances, it is estimated that one in a thousand can be expected to compromise the secrets they are entrusted with, either out of blackmail, greed, or sloppiness.

Only those individuals in positions where it is anticipated they will be dealing with classified information may apply for security clearance. Once the candidate has completed the application phase a detailed investigation ensues. The applicant's background will be thoroughly examined by the Defense Security Service, and depending on the level of clearance needed, family members and relatives may also be scrutinized. The investigation phase can last up to a year or more. Candidates who pass this phase will then enter the adjudication phase. In this phase all information gathered in the previous two phases is reviewed and analyzed, based on thirteen factors determined by the Department of Defense. Allegiance to the United States and personal conduct are examples of areas that are considered. Four factors that are certain to lead to rejection of an applicant are:

1. Candidate was convicted of a crime and imprisoned for more than one year.

2. Candidate uses controlled substances.

3. Candidate has been deemed mentally incompetent by a health professional approved by the Department of Defense.

4. Candidate was discharged from the armed forces under dishonorable conditions.

Having a security clearance is nothing to sneeze at, and some experts say that having such a clearance can increase one's salary between $10 and $15K. It is evident that the ability to keep a secret is a valued commodity in this increasingly precarious society.

by: Francesca Black

Airline Security

Ours is a changing world, and recent events have caused people the world over to take on new security measures, both personally and on a corporate level. Traveling to a foreign country, and even within your own country, has become more stringent with enhanced security requirements.

To beef up security and enhance customer service, many airlines, like TSA, are now conducting individual passenger screening at security checkpoints. TSA staff and screening equipment are concentrated at these checkpoints to perform random searches. Every passenger is required to have a boarding pass and photo identification in order to pass through a security gate. Tickets and ticket confirmations are longer accepted as valid identification at these checkpoints.

Many airlines now offer four methods of purchasing a boarding pass. New and convenient options include using the curbside check-in option, the airline's self-service ticket kiosk in the airport lobby, and the opportunity to purchase and print the boarding pass directly from your airline website. Of course, you can also pick up your boarding pass at the airline's ticket counter in the airport.

Check with your airline or travel agent to confirm the time you should arrive at the airport. It's also a good idea to confirm that there are parking lots available at the airport, or if shuttle service might be required.

Double-check to make sure that you have all of your valuables with you, as well as the documents required for boarding. Make sure that you have your boarding pass or ticket confirmation ready, as well as a piece of government-issued photo identification such as a driver's license or passport. If you have a medical implant or other device that can trigger the security alarm system, make sure that you have certified documentation from your doctor. Remove any prohibited items, such as pocketknives, before going through airport security.

It's a good idea to stay on the alert at all times. Keep close watch on your luggage, carry-on bags and other belongings. Never agree to carry a parcel for a stranger. If you find unattended bags at the airport, report it to a security officer rather than trying to pick them up yourself. If you see any individual that looks or acts suspicious, point it out to airline security. More than ever before, airline security is very serious business. Never joke about having bombs or firearms on board a plane or at security. The mere mention of such items can lead to lengthy questioning and possible expulsion from the airport.

You have definite rights as an airline passenger, but remember that this is a commercial service and your agreement may be subject to changes. In the case of a delayed flight, airlines will usually try to accommodate passengers by offering a seat aboard the next available flight. Rescheduling your flight on another airline is also an option, but there may be cancellation policies in effect.

Airlines typically overbook flights so double check your reservations to make sure you're guaranteed a seat. When a particular flight is overbooked, the airline will ask for volunteers to wait and board the next flight, and may offer cash or a free trip as an incentive. If there are no volunteers and you are involuntarily bumped, the airline will reserve another flight and you will be compensated for the inconvenience. If you fail to confirm your reservation or meet the check-in deadline, and if the plane has fewer than six available seats, no reward is offered for involuntary bumping.

You can easily avoid boarding hassles if you know your rights as a passenger and understand the airline terms and conditions for boarding. For your own safety and the security of airline personnel and other passengers, you need to take extra caution to avoid inevitable circumstances.

Being well informed is the ticket to enjoying a safe, secure, and pleasurable flight.

by: David Wilson

Web Site Security: 8 Tips

The computer age has made the personal computer affordable for most people of virtually every industrialized country. Whether it takes the form of a desktop or laptop, all computers are used for a wide variety of functions. As the number of people on the Internet soars ever higher, security becomes an increasing concern. Here are some tips to help ensure a personal or business Web site is secure against attack.

1. Passwords are the first line of defense. Most programs have a maximum number of characters for the password, and it is best to use all every available character. Each additional letter or number in a password makes it that much more difficult for someone to figure out what it is.

2. It is very common for people to use important dates, names of loved ones, and other things close to the heart their heart as their password. Unfortunately this information is not very difficult to discover. Then it simply becomes a matter of trying each likely candidate until one works. Passwords should never be these kinds of things so that the contents of the computer will not be compromised.

3. The worst kind of passwords are those that are simply a sequential series of letters or numbers, or those where the log in name and password are the same. This lack of imagination practically begs for a security breach to happen.

4. Only the owner of a Web site should be privy to the security codes on it. No one else should know password and it is best never to write it down. If the password falls into the wrong hands, or is even suspected of being compromised, it should be changed immediately.

5. Some passwords are case sensitive. If the password was originally entered with the caps-lock off, but upon logging on it was typed with caps-lock on, the system will not honor the password. A clever user can take advantage of this feature by randomly distributing capital and lower-case letters in a password.

6. The natural assumption when trying to guess someone’s password is to believe it to be a real word. However this need not be the case. Some of the most unbreakable passwords are those which are not words at all.

7. Another security problem that some people create is the act of using the same log in and password when logging on to many different sites. Should only one of these sites be cracked the chances are the others will also be compromised. It is best to use a different password for each site. At the very least, reused passwords should be limited only to applications where security is not important. For example, Web forum memberships, if compromised, represent very little danger to the user so long as the password used for those sites is not reused for anything where sensitive data could be stored.

8. When using Web sites that require a login, simply closing the browser is not sufficient to prevent other users from accessing that information from the same computer. It’s possible to simply re-open the browser and gain access to the site without needing to log back in. Use the proper log-out procedure on the Web site before closing the browser in order to avoid this from happening.

Keeping secure on the Internet is not just the job of those who create software products for the consumer. It is also the responsibility of each and every computer user. The user can feel at ease knowing the contents in the Web sites are safe by simply taking the appropriate safety measures.

by: William Davis

Biometrics: Uses and Abuses

Biometrics are seductive. Your voiceprint unlocks the door of your house. Your iris scan lets you into the corporate offices. You are your own key. Unfortunately, the reality isn't that simple.

Biometrics are the oldest form of identification. Dogs have distinctive barks. Cats spray. Humans recognize faces. On the telephone, your voice identifies you. Your signature identifies you as the person who signed a contract.

In order to be useful, biometrics must be stored in a database. Alice's voice biometric works only if you recognize her voice; it won't help if she is a stranger. You can verify a signature only if you recognize it. To solve this problem, banks keep signature cards. Alice signs her name on a card when she opens the account, and the bank can verify Alice's signature against the stored signature to ensure that the check was signed by Alice.

There is a variety of different biometrics.In addition to the three mentioned above, there are hand geometry, fingerprints, iris scans, DNA, typing patterns, signature geometry (not just the look of the signature, but the pen pressure, signature speed, etc.). The technologies are different, some are more reliable, and they'll all improve with time.

Biometrics are hard to forge: it's hard to put a false fingerprint on your finger, or make your iris look like someone else's. Some people can mimic others' voices, and Hollywood can make people's faces look like someone else, but these are specialized or expensive skills. When you see someone sign his name, you generally know it is he and not someone else.

On the other hand, some biometrics are easy to steal. Imagine a remote system that uses face recognition as a biometric. ``In order to gain authorization, take a Polaroid picture of yourself and mail it in. We'll compare the picture with the one we have in file.'' What are the attacks here?

Take a Polaroid picture of Alice when she's not looking. Then, at some later date, mail it in and fool the system. The attack works because while it is hard to make your face look like Alice's, it's easy to get a picture of Alice's face. And since the system does not verify when and where the picture was taken--only that it matches the picture of Alice's face on file--we can fool it.

A keyboard fingerprint reader can be similar. If the verification takes place across a network, the system may be unsecure. An attacker won't try to forge Alice's real thumb, but will instead try to inject her digital thumbprint into the communications.

The moral is that biometrics work well only if the verifier can verify two things: one, that the biometric came from the person at the time of verification, and two, that the biometric matches the master biometric on file. If the system can't do that, it can't work. Biometrics are unique identifiers, but they are not secrets. You leave your fingerprints on everything you touch, and your iris patterns can be observed anywhere you look.

Biometrics also don't handle failure well. Imagine that Alice is using her thumbprint as a biometric, and someone steals the digital file. Now what? This isn't a digital certificate, where some trusted third party can issue her another one. This is her thumb. She has only two. Once someone steals your biometric, it remains stolen for life; there's no getting back to a secure situation.

And biometrics are necessarily common across different functions. Just as you should never use the same password on two different systems, the same encryption key should not be used for two different applications. If my fingerprint is used to start my car, unlock my medical records, and read my electronic mail, then it's not hard to imagine some very unsecure situations arising.

Biometrics are powerful and useful, but they are not keys. They are not useful when you need the characteristics of a key: secrecy, randomness, the ability to update or destroy. They are useful as a replacement for a PIN, or a replacement for a signature (which is also a biometric). They can sometimes be used as passwords: a user can't choose a weak biometric in the same way they choose a weak password.

Biometrics are useful in situations where the connection from the reader to the verifier is secure: a biometric unlocks a key stored locally on a PCM-CIA card, or unlocks a key used to secure a hard drive. In those cases, all you really need is a unique hard-to-forge identifier. But always keep in mind that biometrics are not secrets. Bruce Schneier <schneier@schneier.com> is CTO and Founder of Counterpane Internet Security, Inc. You can subscribe to his free security newsletter, CRYPTO-GRAM, at http://www.counterpane.com.

by : B. Schneier