The Importance of Authentication

There was an article today in the Wall Street Journal that reminded me of the problems with deterrence for the kind of events that Russia has created by trying to undermine and influence governments in other countries.  In the U.S. many of the press corps is focused only on Russian involvement in the US national election of 2016, when the Russians have been equally busy in trying to influence Germany, England, France, Italy, and almost any country on its border.  NATO is always a target for them.  As the response to the Russian use of a nerve agent in an assasination attempt in England has shown, a number of countries are starting to think alike in deterring Russia from doing that again.  judging from the subdued response from the Russians, even they know they have gone to far on that one.  As this article points out, a nerve agent is one thing, but political meddling is something else entirely.

When Russian hackers created a false news story about the Lithuanian Defense Minister, they used that story to spread a worm that could take over the computer of anyone who accessed the story on line.  This is a trick the Chinese used in the Great Cannon to discourage their own people from accessing news sites outside of China.  [When Russia was working on its own internal controls for its Internet, it got help from Chinese experts, so there was bound to be some transference of technical capabilities between them.]  Their capabilities make it more difficult for anyone who accesses the Internet to avoid being infected with trackers, penetration tools, and other criminal things that we find hard to avoid.

This is a hard thing to get together on, especially if we focus only on Russia.  We should look first at how to make the Internet a safe place for people who use it.  That nerve agent scared people because it might have infected many more than just the victims.  Cyber infections are making the Internet a dangerous place without putting any of the victims in the hospital.

The companies that need to do a good deal of the work are the ones that profit the most from having a safe Internet, yet they have done next to nothing about authentication anywhere in the web of networks that are out there.  Third party agents are taking control of many of our networks so a source with a story in the Middle East may be a trap that allows my computer to be compromised by somebody in Russia or China.  I can’t stop that.  My service provider might be able to if it gets help from Amazon, Google, Facebook, Twitter, et al.  But none of them can do it alone.  Facebook, Twitter and a few others have already found that Russia bought more ads on its sites than it wanted to admit.  But they also used fake humans to promote causes, help organize events, or influence media stories.  Mark Zuckerberg is not a very sympathetic leader, but lets not blame him for all those ills, when there is almost nothing he can do without any authentication of his users.