Here’s an email you hope never to receive:

Dear Subscriber:
We send greetings to you and to your mother, whose maiden name is Tondelea Farbstratten and whose birthday you celebrate on February 19th. Also greetings to Pippsie, the first pet you ever owned. And is The Maltese Falcon really your favorite movie? We like Witness for the Prosecution ourselves. And is the combination to the safe in the false wall behind your boiler still L-34, R-15, L-2? Oh, and more thing – do you want to use another password besides your spouse’s birthday? It’s a good idea, because the next time you hear from us it will be to learn that we’ve stolen your identity, emptied your bank accounts and purloined your company’s trade secrets.”

Can’t happen here? Actually, something along those lines recently befell Mrs. Evan Williams. Who is Mrs.Evan Williams? She happens to be the wife of the CEO of Twitter, whose personal Internet, Amazon and PayPal accounts were also hacked. The New York Times‘s Claire Cain Miller and Brad Stone report that “A hacker calling himself Hacker Croll broke into an administrative employee’s e-mail account and gained access to the employee’s Google Apps account, where Twitter shares spreadsheets and documents with business ideas and financial details.”

Wait a minute – did they say Google? We were under the impression that our information and documents are completely secure with Google, home of cloud computing. Well, they are – but with an asterisk. If you click on the Google page entitled Is It Safe to Upload Private Documents on Google Docs? you’ll get this answer from Neil Fraser, Official Rep,

There are two tips which can greatly improve your safety:
1) When using an unencrypted wireless connection or some other network you don’t really trust, use https://docs.google.com instead of http://docs.google.com. The extra ‘s’ means ‘secure’; all traffic is encrypted. The only down-side is it’s a little bit slower.
2) When you use someone else’s computer (especially at an Internet cafe or at a hotel), don’t forget to logout of your Google account. And when logging in, don’t check “remember my password”. Pretty obvious.

Here at Google we use Docs to store all our confidential documents, spreadsheets and presentations. We use the same servers and we have no worries about people being able to see our data.

Official Rep Fraser assures us these precautions are “pretty obvious,” but if they weren’t obvious to the CEO of Twitter, what makes Google think they are obvious to us lesser mortals? Twitter’s security firewall does not appear to have been breached by some fiendish Russian geek hackster. Instead, says the Times, “ the Twitter hacker managed to correctly answer the personal questions that Gmail asks of users to reset the password.” In other words, while everyone was barricading the back door, Hacker Croll strolled in the front, sauntered past the empty security desk, and walked out with the family jewels.

Evan Williams probably should have read the Google page instructing Docs users on how to change your password. Good idea for you to read it too, and read it often.

For details of the Great Twitter Heist of 2009, read Twitter Hack Raises Flags on Security.

Richard Curtis

Every Blogger owes a debt of gratitude to newspapers and magazines. This posting relies on original research and reporting performed by the New York Times.

Unless a security notice pops up on your computer screen warning you of an attempted hack or viral invasion, you’re seldom aware of the vicious guerrilla war in progress beneath your fingertips. But it’s constant, and with every escalation by the attackers, the measures taken to throw the enemy back escalates as well. As in every guerrilla war the offense has the advantage of knowing when and how it will strike, and it employs weapons of mass destruction in the form of bots to probe vulnerabilities, neutralize defenses, and overwhelm its victims.

Though your computer’s defensive team uses powerful programs of its own to thwart attacks, a surprisingly simple weapon has proven effective in holding the line against invaders. It’s called a captcha. New York Times reporter Anne Eisenberg, in New Puzzles That Tell Humans From Machines, describes them as “a set of distorted, squiggly letters and numbers that people can decipher and type correctly for admission, but that machines still can’t.” You’ve undoubtedly cooperated with requests to type in the word you see on the graphic, and, I suspect, you’ve done it with a tolerant sigh, wondering why you’re being asked to play this childish game.

The answer is that captchas are one of the most effective ways to thwart many forms of abuse. In addition to the wiggle-words, captchas employ pictures that are elementary to most nursery schoolers raised on Where’s Waldo? but make no sense to a crawling stealth bot seeking to penetrate the soft underbelly of your desktop or laptop.

“Captcha” is a splendid onomatopoeia, sounding like the task it performs. But it is also a clever acronym coined by the team at Carnegie Mellon University that worked on it: Completely Automated Public Turing Test to Tell Computers and Humans Apart.

Will evil hackers eventually gain the upper hand, like a flu virus recombining after losing out to a vaccine? Eisenberg thinks the good guys will stay ahead:

“Many people worry that as machines become smarter, the days of captcha protection will be numbered, whether the puzzles take the form of distorted text, audio snippets or rotated images. But Henry Baird, a professor in the department of computer science and engineering at Lehigh University, disagrees. Dr. Baird and colleagues have proposed a system for captchas that, like Google’s, can be woven into the theme of a Web site.

“’Machines’ abilities are slowly improving,’ he said, “’but I think there is still a huge gap between human inborn perceptual abilities and machine skills.’”

My curiosity about the technology took me to the official Captcha website, where I discovered that anyone can download a free implementation and plugins including audio tests for blind users. And if you want to pit your wits against Captcha’s computer system there’s a new website, GWAP.com, containing a host of “addictive games that help computers learn to think more like humans. You play the games, computers get smarter!” After I took the gender test I was informed that there was a 97% certainty I was female. Looks like I will now either have to straighten out the GWAP program or commence an extensive course of gender reorientation.

Captchas, the site informs us, “have several applications for practical security.” Among them are:

• Preventing Comment Spam in Blogs
• Protecting Website Registration
• Protecting Email Addresses From Scrapers
• Preventing Ballot stuffing for Online Polls
• Preventing “Dictionary” Password Attacks
• Thwarting Search Engine Bots
• Plausible solution against email worms and spam

Thanks to Captcha technology the playing field has tilted back to humanity after the humiliating defeat of the human race, represented by chess master Gary Kasparov, by the Deep Blue computer in 1997.

Richard Curtis