Getting Hacked: Who's to Blame?

The details about Duncan are he's pocked with acne scars and his scalp is brown along the hairline every two weeks when he dyes his gray roots. His computer password is "password."
—"Lullaby", Chuck Palahniuk

Mat Honan of WIRED recently fell victim to a pretty nasty hacking incident and wrote about it: http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan-hacking/

The details are pretty interesting (to me at least), but the gist of it is that attackers got his credit card numbers through Amazon and used the last 4 digits to impersonate Mr. Honan to Apple's phone support. Once they gained access to his Apple me.com email account, they used the password reset mechanism to get his Gmail, and from there his Twitter account. Finally, they deleted all of his data from his iPhone, iPad, and MacBook.

Reading all this, I got to wondering how other people would evaluate the situation. If someone hacked your accounts the same way, how would you assign blame between

• the attackers
• the service providers (Apple, Amazon, etc.)
• yourself

Honan said he blamed himself for not taking better precautions, and even agreed not to press charges against his attackers in exchange for information about how the attack was carried out. I want to hear other people's assessments, but I can definitely see several angles on the situation.

Mat Honan is clearly a pretty tech savvy guy. He might have had some chance of understanding exactly what risks he was taking and how to protect himself, but very few people would. On the other hand, Amazon and Apple are there to provide a service, and there's a limit to how tightly they can secure customer accounts, especially when customers expect to be able to recover their accounts after forgetting their passwords.

Maybe it's just wrong-headed to expect these security systems to be impenetrable. After all, the physical locks on your doors aren't perfect either. Locks can be picked, or you might forget to lock them, or someone can knock in doors or windows. The thing that makes our physical security norms more-or-less work is that if someone does break in, in most cases they will take on some risk of getting caught.

The internet doesn't always work that way. People can strike anonymously on the internet. And since it's international, regulations are much weaker and more scarce. But it's at least worth considering a setup where technological protection ends exactly where legal protection begins, a setup that requires whoever is requesting password recovery to get enough skin in the game that they could be taken to court. Maybe the only way would be for them to request it in-person and be photographed, or maybe there's a more convenient option.

The thing that bothers me the most about the situation is that everywhere I look, people are still acting as if "secret personal information" is a good method of identification. You don't really have to be a genius to see the problem. My SSN, my mother's maiden name, my credit card numbers… I've given them out to hundreds of people to "prove my identity", people that I don't know personally and don't particularly trust, and each of those people can now impersonate me. The Honan article points out that even without involving Amazon, your pizza guy has everything he needs to get into your Apple account. I must have given the last 4 digits of my SSN to at least a dozen people at Comcast in the process of transferring my internet to a new address; the only one that really irked me was the last time, online, when they explicitly told me this was for "security purposes".

So anyway, that's my take on the situation. Now it's your turn. Comment away!

The Lottery and Advertising

I'm totally outraged at the way state lotteries are managed, specifically the massive advertising campaigns they run. There's an excellent article from the Washington Monthly about it that basically explains what I'm so angry about. I'd really encourage you to read the whole article, but I'll summarize the main points I got from it:

• lottery programs are hugely successful marketing machines that rake in billions of dollars nationwide, and it's illegal for free-market businesses to compete directly with them
• the marketing campaigns are misleading, intentionally exploit vulnerable people in moments of weakness, and don't even comply with the FTC's truth-in-advertising standards
• it's by-and-large the poor that end up pouring their money into the lottery machine
• lottery campaigns claim that the money goes toward education, or some noble cause ("right back into your pocket", according to the Indiana lottery), but this is just an "accounting trick": According to David Gale,

  "What happens is, the legislature budgets this much for education. They see the lottery will contribute this much. So they take the money they would have spent on education and put it to other uses."

It might sound like I'm going back on some of my libertarian principles here, but it's a confluence of things that bother me: we're talking about a government business that outlaws competition, gets its money from the poor, and goads them on with beautiful fictions about all the good their wasted money is doing.

Let me clarify a few things I'm not claiming:

"The lottery is evil because it steals money from people."

People voluntarily participate in the lottery, albeit under false pretenses and coercive tactics.

"The lottery is a tax on the stupid. People who play it don't understand probabilities and don't realize that they're throwing their money away."

The big product people pay for when they gamble is not the money they hope to win, but the excitement that comes with a chance of winning big. If they have the money and desire to gamble responsibly, it's not something that they need to be "saved from".

But advocates of lottery programs claim that they are only providing a constructive outlet for people to do what they would be doing anyway. They claim that if our state doesn't provide a lottery, people will go across state borders and pay into other states what they should be paying into their own. That might justify the mere existence of the lottery, but it just sounds ridiculous in light of the oppressive radio, TV, and billboard advertising campaigns they launch. If the advertising isn't netting customers, stop doing it! If it is, stop doing it! You can't claim that gambling is an unfortunate vice that you're just making the best of while you're spending public money to promote it!

I've come to the conclusion that if I'm concerned about the gap between the rich and the poor, and want to support some government policy to do something about it, the most effective option would be to hamstring lottery advertising. If the lottery is a hidden tax, it's an obscenely regressive one. Furthermore, I will flatly ignore anyone's crusade for wealth redistribution or an even more progressive tax structure if it doesn't make a priority of hamstringing lottery advertising.

The Wrong Idea about Evolution

"An intelligent couple can [...] know that the ultimate reason for their sexual urges is procreation. They know that the woman cannot conceive because she is on the pill. Yet they find that their sexual desire is in no way diminished by the knowledge." --Richard Dawkins

Many people seem to get the idea that eugenics would be the natural conclusion of evolutionist thinking. If nature has been driving all life in one direction, to be as "fit" as possible, and we intervene to protect the weak instead of letting them be "naturally" removed from the gene pool, aren't we committing some sort of crime against nature?

Let me answer that with an analogy. Your entire life, hair grows on your head at about 1/8 inch per week. The process is entirely natural, and has a clear biological purpose. But I bet you cut it periodically, and I bet you don't feel the slightest twinge of hesitation.

I'd like to also rebut my strawman more directly. Evolution does continuously drive life in one direction, towards the most "fit" species, but that direction changes over time. It's called coevolution. As one species changes, so do all the others, so the ideal of "fitness" will change from generation to generation. Sometimes evolution goes in circles, often in predator-prey relationships (see "The Blind Watchmaker" by Dawkins for some excellent examples). The upshot is that "fitness" means whatever survives, and if our cultures protect the weak, they're out of evolution's jurisdiction. We're part of nature, too, so "artificial selection" is natural selection.

Does that mean we should do everything we can to protect the weak? Not really. It doesn't really have any bearing on what we should do. Either way, it's natural selection, and it wouldn't matter if it weren't (unless you are a conscientious objector to haircuts).

I think ultimately, it's a choice for each individual: would you rather live in Sparta or Athens? I personally think it would be a dystopian disaster (again) if we tried to do anything like a national eugenics program. I find the whole idea pretty revolting. If you think otherwise, I encourage you to fight for your values, but I will also be fighting back.