Section No9’s crappy security

22 Jul 2013 by Christopher Noessel

The heavily-mulleted Togusa is heading to a company car when he sees two suspicious cars in the parking basement. After sizing them up for a moment, he gets into his car and without doing anything else, says,

"Security, whose official vehicles are parked in the basement garage?"

It seems the cabin of the car is equipped to continuously monitor for sound, and either an agent from security is always waiting, listening at the other end, or by addressing a particular department by name, a voice recognition system instantly routs him to an operator in that department, who is able to immediately respond:

"They belong to Chief Nakamura of the treaties bureau and a Dr. Willis."

"Give me the video record of their entering the building."

In response, a panel automatically flips out of the dashboard to reveal a monitor, where he can watch the the security footage. He watches it, and says,

"Replay, infrared view"

After watching the replay, he says,

"Send me the pressure sensor records for basement garage spaces B-7 and 8."

The screen then does several things at once. It shows a login screen, for which his username is already supplied. He mentally supplies his password. Next a menu appears on a green background with five options: NET-WORK [sic], OPTICAL, PRESSURE, THERMO, and SOUND. "PRESSURE" highlights twice with two beeps. Then after a screen-green 3D rendering of Section 9 headquarters builds, the camera zooms around the building and through floorplans to the parking lot to focus on the spaces, labeled appropriately. Togusa watches as pea green bars on radial dials bounce clockwise, twice, with a few seconds between.

The login

Sci-fi logins often fail for basic multifactor authentication, and at first it appears that this screen only has two parts: a username and password. But given that Togusa connects to the system first vocally and then mentally, it’s likely that one of these other channels supplies a third level of authentication. Also it seems odd to have him supply a set of characters as the mental input. Requiring Togusa to think a certain concept might make more sense, like a mental captcha.

The zoom

Given that seconds can make a life-or-death difference and that the stakes at Section 9 are so high, the time that the system spends zooming a camera around the building all the way to the locations is a waste. It should be faster. It does provide context to the information, but it doesn’t have to be distributed in time. Remove the meaningless and unlabeled dial in the lower right to gain real estate, and replace it with a small version of the map that highlights the area of detail. Since Togusa requested this information, the system should jump here immediately and let him zoom out for more detail only if he wants it or if the system wants him to see suspect information.

The radial graphs

The radial graphs imply some maximum to the data, and that Nakamura’s contingent hits some 75% of it. What happens if the pressure exceeds 37 ticks? Does the floor break? (If so, it should have sent off structural warning alarms at the gate independently of the security question.) But presumably Section 9 is made of stronger stuff than this, and so a different style of diagram is called for. Perhaps remove the dial entirely and just leave the parking spot labels and the weight. Admittedly, the radial dial is unusual and might be there for consistency with other, unseen parts of the system.

Moreover, Togusa is interested in several things: how the data has changed over time, when it surpassed an expected maximum, and by how much. This diagram only addresses one of them, and requires Togusa to notice and remember it himself. A better diagram would trace this pressure reading across time, highlighting the moments when it passed a threshold. (This parallels the issues of medical monitoring highlighted in the book, Chapter 12, Medicine.)

Even better would be to show this data over time alongside or overlaid with any of the other feeds, like a video feed, such that Togusa doesn’t have to make correlations between different feeds in his head. (I’d have added it to the comp but didn’t have source video from the movie.)

The ultimately crappy Section No9 security system

Aside from all these details of the interface and interaction design, I have to marvel at the broader failings of the system. This is meant to be the same bleeding-edge bureau that creates cyborgs and transfers consciousnesses between them? If the security system is recording all of this information, why is it not being analyzed continuously, automatically? We can presume that object recognition is common in the world from a later scene in which a spider tank is able to track Kunasagi. So as the security system was humming along, recording everything, it should have also been analyzing that data, noting the discrepancy between of the number of people it counted in any of the video feeds, the number of people it counted passing through the door, and the unusual weight of these "two" people. It should have sent a warning to security at the gate of the garage, not relied on the happenstance of Togusa’s hunch and good timing.

This points to a larger problem that Hollywood has with technology being part of its stories. It needs heroes to be smart and heroic, and having them simply respond to warnings passed along by smart system can seem pointedly unheroic. But as technology gets smarter and more agentive, these kinds of discrepancies are going to break believability and get embarassing.

Mangalore Bomb

24 May 2013 by Christopher Noessel

Sadly for Zorg, just after he deactivates his bomb, a fallen Mangalore warrior remotely activates his own bomb in Plavalaguna’s suite. The remote control is made from a combination lock. The Mangalore twists the dial to the right numbers, and on reaching the last number, a red LED lights in the center. In the diva’s suite, the box that secretly housed the bomb opens, and the bomb rises like a small metallic ziggurat, accentuated in places with red LEDs. A red, 7-segment countdown timer begins ticking down its final 5 seconds.

Aggression

Mangalores are warlike, as in they really like war. They breathe war. They sleep war. They eat war for breakfast, then poop war, then root around in their couches for war scraps and snack on that. The detonation device isn’t very sophisticated, and that’s just fine by Mangalores. If a Mangalore declared a Design major instead of War in college, they’d have been killed on the spot. This device is perfect for a species that just wants to grab something cheap and convenient, make a few modifications, and get to the boom.

We don’t see a deactivation mechanism. And while you can imagine that a nice safety would be to deactivate if the dial drifted more than, say, 5 clicks from the final activation number, Mangalores wouldn’t have it. They’d “liberate” your mother’s homeland merely for having suggesting it.

If I had to improve it in any way, it’s that it places a burden on memory, and there’s not a lot of indication that Mangalores excel in the thinking skills department, c.f. warlike. Do they have the capacity to memorize a series of numbers in order? And it is easy to recall the series in the middle of a war zone? If not, what would be better? They have their weapons with them nearly at all times, so how about a little glowing, red button on the forestock?

Ha. Joke’s on you, Mangalores. As we know from earlier in the movie, you couldn’t resist pressing it, long before you made it to ocean liners. I think if you’re that warlike and stupid, this would be best for everyone.

Multipass

13 May 2013 by Christopher Noessel

The multipass is the all-purpose card of 2263. It’s a driver’s license, work authorization record, proof of identity, emergency medical information, phone card, plus all your credit cards in one. There is a white rectangle and yellowish, rounded-bevel shape on the lower left, each of which may be a button, but that we don’t see in use.

Often just showing it is enough for a human’s satisfaction, but sometimes it must be read by a machine. To do this, the holder inserts it into a slot, where the machine verifies its authenticity and registers the user locally. In Korben’s taxi, he has to leave it in as he operates the vehicle. At the Fhloston Paradise check-in booth, travelers dip it in and out of the reader.

The act of inserting the card to authenticate may seem a bit old-fashioned in the days of RFID and read-at-a-distance technology, but it’s also nice to see that whatever agency was able to get the various corporations and government agencies to cooperate has also got privacy in mind. If it needs to be dipped to be read, maybe it can’t be read at a distance. That means the holder has more control over when and how it’s accessed.

As far as convenience, hot damn. It’s practically a wallet in and of itself. But there are security concerns to having all of this in one place. There are many cards that work like this in the world. Bus passes, skeeball tickets, gift cards. They’re generally low-cost. If you steal or forge Korben Dallas’ multipass, though, do you suddenly have his charge accounts, his taxi, and his phone card all at once? Seems high-cost, especially since the one forgery we see in the movie actually works.

This returns us, as so many things do, to multifactor authentication. This security philosophy requires that the user presents three factors: something they have, something they are, and something they know. The multipass covers only the first two.

The multipass itself is the thing they have.
The picture is something they are, i.e., what they look like.
It could be improved by requiring something they know, like a PIN or a password.

We don’t know what kind of power Cornelius’ order wielded in the world, but since it wasn’t enough to sway the president or purchase tickets to Paradise, let’s presume it wouldn’t have been enough to uncover Korben’s password, and in that case, the PIN would have foiled the attempted forgery.

Yellow circles everywhere

9 May 2013 by Christopher Noessel

Korben (and his poor neighbor) aren’t the only ones to deal with the yellow circles. Apparently they appear everywhere.

When Right Arm fails to convince the counter staff for Fhloston Paradise that he is Korben Dallas. Knowing that he works for a sociopathic killer, he gets upset. As the doors to gate 18 close behind her, the ticket taker smiles and says, “Sorry, sir, boarding is finished!” and the platform on which she stands lowers her out of sight. At the same time a pane of glass with the familiar two yellow circles rises up. In his frustration, Right Arm shouts, “I don’t believe this!” and pounds the glass(?) around the booth.

Instantly, a whooping warning is heard, and three columns of computer-controlled guns drop from the ceiling, clacking into place as if they were being armed. Two columns are behind him and one directly in front, each with two guns, pointing a total of six automatic weapons at him. Red LEDs blink on the column in front near a camera and a voice sternly warns him, “This is not an exercise. This is a police control. Put your hands in the yellow circles…”

The scene is played for laughs, as an example of an inappropriately harsh reaction to an expression of frustration. But the design of the system is worth noting. The compliance technique is designed to be easy to communicate and comprehend. The recorded voice could have said something like “stand in a spread-eagle position against the glass” but that is too wordy and leaves lots to interpretation. Giving the user very basic signals, i.e. yellow circles, and a very unambiguous task, i.e. putting your hands in the circles, is as clear as it could be. (Though I’m not sure what would happen if you were someone with only one hand, or no hands, or a prosthetic hand.)

The red lights, stern recorded audio, mechanical sounds, and whooping sound all let Right Arm know the gravity of the situation he’s in. Even the fact that they drop and swivel toward him give him the clear signal that if he tried to run, these weapons could track him. The sound appears behind him first, causing him to swivel, where he’s met with the four menacing barrels. He is first disoriented and then cowed.

Sure, I’d really hate to live in such an oppressive police state where expressing frustration in public is met with possible death from a robot, but looking at it purely from the perspective of the signals and instructions, it’s well done.

Apartment Lockdown

7 May 2013 by Christopher Noessel

Zorg issues orders to the police to arrest Korben Dallas. A squad of 8 officers arrive to his apartment block. They know what apartment number he’s supposed to be in, but Korben’s number has been removed by Cornelius, and the neighbor has blacked his out.

To authorize the lockdown, the squad leader opens a police box mounted on the wall in the hallway by placing the top edge of a transparent warrant into a slot on its side. The box verifies the warrant and slides open. The squad leader presses a red button within.

During lockdown a klaxon sounds, red beacon lights descend from the hallway ceiling, and a loud, clear voiceover is heard in the hallway and in the apartments themselves.

THIS IS A POLICE PATROL. THIS IS NOT AN EXERCISE…THIS IS A POLICE PATROL. THIS IS NOT AN EXERCISE. CAN YOU PLEASE SPREAD YOUR LEGS AND PLACE YOUR HANDS IN THE YELLOW CIRCLES.

The circles in question are painted at chest height on the walls inside of each apartment, a little wider than shoulder width. There is a small intercom interface mounted in the wall directly between the yellow circles. The police use different interfaces for peering inside apartments and this intercom for communicating with citizens, but these will be discussed separately in the next post.

Analysis

There are a few sets of users for this particular set of interfaces: The police, Zorg, and Korben. To evaluate the system, we need to look at each user independently.

For the police, this interface seems to work well. Since the lockdown is part of the infrastructure, they don’t have to bring anything but their standard gear and the warrant. They save energy and the tedium of alerting the citizens and issuing standard compliance instructions. In a fully networked world, you might think to simply have him or her authorize themselves using biometrics, but in keeping with the principles of multifactor authentication, you might require the officer to carry something anyway. Since you’d want a physical warrant for a poor or luddite citizen to be able to see and verify, it’s going to be there, might as well use it.
For Zorg and issuing authorities like him, he kind-of wants to minimize danger to his people and certainly his equipment, which this helps do. He also wants to cover his ass from citizen lawsuits, and having the traceability of the warrant-scan means he will have a record that due process has been followed. As we’ll see tomorrow, ultimately he doesn’t get what he needs, but as far as this lockdown interface, it seems like it would work just fine.
For the citizen Korben, the interface provides a clear signal and easy-to-follow instructions, so the proximal part “works.” What doesn’t work is that the whole system is horribly demeaning, authoritarian, and—fully risking Godwin’s Law, here—fascist.

Security is almost always at odds with usability, and this interface proves no different. To improve the experience for the good citizen, you might want to provide some warning, some ability to finish what they’re doing, or some less demeaning way to show that they are cooperating. But any concessions made for the good citizens will be taken advantage of by the bad ones, and so I don’t know that design can really fix that tension.

P.S. As of this writing my Minority Report review is not posted, but readers interested to compare and contrast a similar scene done with more seriousness some 5 years later should check it out.

Profiling “CAT” scan

17 Apr 2013 by Christopher Noessel

After her escape from the nucleolab, Leeloo ends up on a thin ledge of a building, unsure where to go or what to do. As a police car hovers nearby, the officers use an onboard computer to try and match her identity against their database. One officer taps a few keys into an unseen keyboard, her photograph is taken, and the results displays in about 8 seconds. Not surprisingly, it fails to find a match, and the user is told so with an unambiguous, red NO FILE banner across the screen.

This interface flies by very quickly, so it’s not meant to be read screen by screen. Still, the wireframes present a clear illustration of what the system doing, and what the results are.

The system shouldn’t just provide dead ends like this, though. Any such system has to account for human faces changing over the time since the last capture: aging, plastic surgery, makeup, and disfiguring accidents, to name a few. Since Leeloo isn’t inhuman, it could provide some results of “closest matches,” perhaps with a confidence percentage alongside individual results. Even if the confidence number was very low, that output would help the officers understand it was an issue with the subject, and not an issue of an incomplete database or weak algorithm.

One subtle element is that we don’t see or hear the officer telling the system where the perp is, or pointing a camera. He doesn’t even have to identify her face. It automatically finds her in the camera few, identifies her face, and starts scanning. The sliding green lines tell the officer what it’s finding, giving him confidence in its process, and offering an opportunity to intervene if it’s getting things wrong.

Nucleolab Kill Switch

12 Apr 2013 by Christopher Noessel

General Munro isn’t sure what’s going to come out of the other end of Mactilburgh’s process. He’s never seen a Mondoshawan and doesn’t know if they can be trusted. Fortunately for his sense of panic, there’s a built in kill switch on the control panel facing the nucleolab chamber. To activate the switch, he slips his multipass into a slot. While this card is in the slot, a small red LED lights, and the Big Red Button is active.

The interface is simple to read, which is nice. The button conveys a bit of its importance through its size and color. The order of operations is well laid out for a Western user: left to right, in the order of reading.

Three improvements

There are lots of questions about the security strategy, though. Single-factor authentication is too easy to thwart. Couldn’t someone just take his multipass and use it? How does the system know it’s really Munro? Better would be multifactor authentication, requiring both this token and either a knowledge token like a password, or an inheritance factor. Maybe it could require Munro to place his other hand on a handprint reader before the button activates.

Another problem is that the signal that this button is active is too tiny: that little red LED that’s associated with the slot rather than the button. If this is an undoable action, you’d hope that the input would convey the sense of risk. Maybe have the button glow, or surround it with a glowing red ring (think the Krell warning system)?

If it really is a kill switch, i.e. would kill the subject, a nice safeguard against accidental activation would be a press-and-hold button, requiring Munro to hold it down for a few seconds while a warning klaxon sounds. This would give Munro the opportunity to change his mind or move his hand if he’d placed it accidentally. If it triggers something nonlethal, like an incapacitating sticky foam, then no such delay is necessary.

The Door

29 Mar 2013 by Christopher Noessel

The door to unit 281-53 has security and control features that make it Not Like Our Doors.

Sweetie’s Door

Korben’s white cat is named Sweetie. After a long night of carousing the 5000 block, she wants to be let back in, so she meows at the door as soon as she hears Korben’s alarm go off. He presses the lowest on the 5-button panel and a little cat-sized door opens up to let her in. After she passes through, it immediately closes behind her.

The kitty door could be improved by lessening the work it requires of Korben to zero, by automatically opening and closing for Sweetie. Even if Korben wanted her outside for certain hours of the night, we’ve seen that the apartment knows about schedules, so could accomodate another few bytes of scheduling information. To provide automatic access, though, would require some kind of identification. Low-level tokens like an RFID on her collar could work (such systems are sold today) but Korben lives in a crime-ridden area and any criminal could swipe the collar and use it to open the kitty door to “case the joint” or use some trickery to open the big door. An implanted RFID chip would be worse since it would put Sweetie’s life at risk as a “key.” More passive systems like kitty-biometrics would be much more expensive, and all the other evidence in the film tells us that this is not a wealthy man’s apartment. Ultimately, though there are other solutions for the problem, none fit the circumstances as well.

Four out of five of the panel’s icons are clearer than those seen on the apartment’s other panels.

A moon (the mysterious one. Night mode?)
A high star (for shining a light from above the door, downward?)
An ajar door, for opening or closing it
A low star (for shining a light below on Sweetie
A a cat face (and cat butt?) for opening Sweetie’s door

In addition to being readable, they’re also well-mapped. The button for the human is in the middle. The cat door is lower on the panel. Let’s presume the lights are similarly well mapped.

The only difficulty this system might have is accidental activation of the wrong thing since the buttons are so similar and close together. It might not be so bad to accidentally turn on a light when you meant to open the door, but if you’d intended to turn on the light to check who’s outside and then accidentally opened the door, it could mean a home invasion. This is a Fitts’ Law problem for a doorknob. Better would be for the “knob” to be a hand’s width distant from any of the other buttons. This would also save him from having to look to target it precisely to do something as common as shutting the door.

Video peephole

Unlike adorable kittens, humans on the other side of the door may pose a threat. Korben can see who has come calling via a video monitor, located above the panel. The feed is always on. The video camera sits above the lintel and aims straight down, so Korben can see all the way to where Sweetie would be. Three buttons below the monitor are not seen in use. For most cases, the monitor would work well. Korben can glance at it from anywhere in the room and have a good idea who is there. And, since it’s a one-way system, he has time to get quick things done before answering without seeming too rude.

That said, the camera is not foolproof. Early in the film Korben checks it and though it looks as if the hallway was empty, upon opening it finds a would-be robber who has donned a “hat” with a picture of the empty hallway from the perspective of the camera. Though he’s ultimately unsuccessful in robbing Korben his ruse to appear invisible to the door monitor worked perfectly. Multiple cameras might make it harder for this trick to be effective, but some other sensors, like a weight sensor under the floor outside or heat sensor would be harder to fool.

As if that weren’t bad enough, the fact that the camera has a very limited field of view allows anyone to hide just off to the side. Cornelius uses this tactic when he uses Leeloo as a sort of video bait to get him to open the door.

This latter problem could be solved with a fisheye lens on the camera (y’know, like real peepholes), which would show him more of the hallway and reduce the places where an assailant could easily hide.

The Door to the Chamber of Dreams

7 Mar 2013 by Christopher Noessel

Durand-Durand forces Barbarella at gunpoint to take the invisible key she wears in a chain around her neck to the bedchamber of the Black Queen, also known as the Chamber of Dreams. There they encounter an invisible wall and have a difficult time trying to discern the location of the keyhole. Luckily, in a struggle she drops the key, and it falls through the transparent floor which ripples like water under their feet. This unlocks the invisible door and allows them both to pass into the Chamber of Dreams.

keyhole

Just within the chamber atop a pedestal sits a second invisible key that can reclose the invisible door. To imprison Barbarella and the Queen within, he rushes in, grabs the key, and throws it down to the floor before Barbarella can react.

Though of course this sequence of events is in place simply to show that Durand-Durand has imprisoned Barbarella and the Black Queen, as a system it raises many questions.

An invisible key certainly means that it can be hidden in plain sight and so has some extra security from that perspective. But its being invisible means that recovering it when lost is problematic at best. Plus, unless it is kept somewhere on the body, the invisibility places a burden on the memory of the keeper as to where it is. (You can’t leave a physical reminder of where it is or you lose the benefit of its being invisible.) Are these costs to memory worth the mildly increased security?

Also, as we see, any spot on the floor is an acceptable target for dropping a key. At first this might seem like hyper-usability, since it’s nearly impossible to miss the keyhole, but it also means it’s hard to recover from a mistake. No, wait. It’s impossible to recover from a mistake. That is, if you fumble and accidentally drop a key, the door will activate. We don’t see a key-return mechanism, so this mistake is deeply unrecoverable. Even if that key-return mechanism is somewhere else in the palace, that’s a disaster for usability.

That might be bad enough, but when you realize that this is a royal chamber, it seems an impossible oversight, as if it were custom designed just to imprison people. The Queen seems genuinely distressed when she realizes Durand-Durand has stolen her key, insisting that they “are doomed. Dooooomed!’ but I’m pretty sure anyone who had given it just a moment’s thought before would have realized that this was the inevitable result of this ridiculous design. Maybe the true power of the Mathmos is to keep the queen perpetually blind to stupid interaction design.

Touch Walls

21 Jan 2013 by Christopher Noessel

When exploring the complex, David espies a few cuneiform-like characters high up on a stone wall. He is able to climb a ladder, decipher the language quickly, ascertain that it is an interface rather than an inscription, and figure out how to surreptitiously operate it. To do so, he puts his finger at the top of one of the grooves and drags downward. The groove illuminates briefly in response, and then fades. He does this to another groove, then presses a dot, and presses another dot not near the first one at all. Finally he presses a horizontal triangle firmly, which after a beat plays a 1:1 scale glowing-pollen volumetric projection.

The material and feedback of this interaction are lovely. The grooves provide a nice, tactile, physical affordance for the gesture. A groove is for dragging. A dot or a shape is for pressing. But I cannot imagine what kind of affordances are available to this language such that David can suss out the order of operation on two undifferentiated grooves. Of course presuming that the meaning of the dot and triangle are somehow self-evident to speakers of Architect, David has a 50% chance of getting the order of the grooves right. So we might be able to cut this scene some slack.

But a few scenes later, this is stretched beyond credulity. When David encounters a similarly high-up interface, he is able to ascertain on sight that chording—pressing two controls at once—is possible and necessary for operation. For this interface, he presses and drags 14 different chords flawlessly to open the ancient alien door. This is a much longer sequence involving an interaction that has no affordance.

Looking at the design of the command, an evaluation depends if it’s just a command or a password. If it’s just a control that means “open the door,” why would it take 14 characters’ worth of a command? Is there that much that this door can do? Otherwise a simple press-to-open seems like a more usable design.

If it’s a door security system then the 14 part input is a security password. This would be the more likely interpretation since the chamber beyond contains the deadly, deadly xenomorph liquid. With this in mind it’s a good design to have a 14-part password that includes a required interaction with no affordance. I’m no statistician, but I think the likelihood of guessing the correct password to be 14 factorial, or around 87,178,291,200 to 1. I have no idea what the odds are for guessing the correct operation of an interaction with zero affordance. We’d have to show some aliens MS-DOS to get some hard numbers, but that seems pretty damned secure. Unfortunately, it also stretches the believability of the scene way past the breaking point, to presume that David can just observe the alien login screen and guess the giant password.

Sci-fi interfaces

Stop watching sci-fi. Start using it.

Tag Archives: security