Edge of the Web (EOTW) 2008, Perth – PART 1

Edge of the Web (EOTW) 2008

Today was the main conference day of the inaugural ‘Edge of the Web’ conference, held at the University of Western Australia, Perth.

Having such a strong line-up of speakers in Western Australia, coupled with the excellent facilities and organisation at the University Club, has helped move forward the understanding and debate about Web 2.0 and the future of web applications and social inclusion for business, government and recreation.

Some highlights from the morning sessions follow:

1.       Keynote: Derek Featherstone

Derek provided a nostalgic trip down memory lane, and reminded us of just how far we have come in the first 15 years or so of the internet. He started off with a quote from Jules Verne:

“Looking back to all that has occurred to me since that eventful day, I am scarcely able to believe in the reality of my adventures. They were truly so wonderful that even now I am bewildered when I think of them”.

Journey to the Centre of the Earth, 1864.

 

It was a good choice of quote. What was considered science fiction a century ago may be the most basic utility now, but if we reflect for a moment we still maintain a sense of wonder at what was, and what will be.   A fun and nostalgic illustration followed:

Gopher browser

Yep – that’s what the internet used to be, and I remember it well! This was the ‘Gopher’ platform on which I first browsed the web at university in 1994, and I remember it as well as if it was just last week. The feeling it engendered was one of exhilaration: that you somehow were able to hop between exotic-sounding resources in different countries, and it didn’t cost a penny. Then to walk out into the streets of North London safe in the knowledge that tomorrow you could pick another resource to tap into… a ‘fantastic voyage’  indeed, to pick up on another Jules Verne theme. (On top of that there was the miracle of a VAX email account and the trauma of keeping up with messages from a whole four contacts online – exhausting stuff).  

By way of contrast Derek then gave a live demo of the Radiohead video House of Cards – a great example of a new web application that makes its data freely available, allowing end users to customise their experience with multiple navigation and view options (see it at http://code.google.com/creative/radiohead/viewer.html ). 

Radiohead - House of Cards video

 Looking back at these you see Derek’s point – it is an almost bewildering progression from lines of sluggish text to a 3D, interactive, customisable information superhighway.

Derek made some other pertinent points:

• Progress like this comes from willingness, passion, and commitment
• We need to aspire to the ‘impossible’, and in the process of working towards it we find that we make what was once considered impossible  commonplace;
• When in doubt, open it up. Get the information out there and let others bring new ideas and uses for information.

 

2.       Laurel Papworth – How to Develop a Social Media Marketing Campaign

Laurel gave an outstanding presentation on social media marketing that contained a deluge of social tools and websites (all of which she seemed to be an active member of – Twitter, Kwoff, Slide Share, Flickr, wiki.co.mments, Blogger, and many more!).

 

A key slide was her depiction of influence ripples, showing how links between popular bloggers (or distinct subjects) are created by people at the periphery of each subject, not those main players at the centre (a good example was Deaf Mom (http://deafmomworld.com/), who blogged on the poor service and abuse she got at a drive thru takeaway – a story that quickly found its way onto the main news services at Fox & ABC. Within a week she was meeting the executives of the company who were apologising in person).   

This goes a long way to showing the folly of some organisations who think that the only way to promote online is to target popular bloggers or news services with traditional press releases, which they expect to be cut & pasted close to verbatim leading to a controlled and consistent message.

 

The corollary is increasingly being used by corporations and indeed governments to promote various messages:  smart, modern communications and public relations delivered via inclusive, long term, and devolved information sharing and reticulation. 

Laurel presented her version of web 2.0 communication & development strategies as comprising of 5 steps:

• Involve
• Create
• Discuss
• Promote
• Measure

A memorable line she presented was (paraphrased!) “To understand the social web you have to live it”. Certainly advice she practices as well as preaches

In reference to promotion and communications online Laurel outlined the need to think beyond the old world of web-based metrics. Success is now much more than just page hits or click-thrus. We must consider the utility of information to people, and think of the niche that our sites can fill. This means we have to build community (starting off with changing internal cultures), rather than sticking with outdated models of simply broadcasting information in a shotgun approach, using static web pages and laborious menu-driven sites . We can no longer just talk at people, we have to talk to (and listen to) them.

This led to a key point – if there is no conversation then the content may as well not exist. After all it is the user community that creates and adds the value! No community = no value = no audience = no ratings = no searching = no point.  

An interesting fact that Laurel presented was that this year (2008), for the first time, Australians spent more time online than they spent watching TV (http://slicemedia.blogspot.com/2008/04/australians-spend-more-time-online-than.html ). Given the rise of social networking in the last few years this can only mean that Web 2.0 is gaining serious traction, and the notion of user-generated content is a concept that warrants consideration for professional bodies of all persuasions.

Given this high-volume of societal use the trend is towards using web resources (including within organisations) to discover and manage links and friends/colleagues, rather than focussing on depth of content. This results in three primary roles within socially-aware web sites: creator, responder and host, with different elements within an organisation taking on these roles at different times. What is interesting is that the ‘host’ role (often the ICT department) is decreasing – all they need to do is setup the baseline/structure with which subsequent creator-responder relationships can flourish. Then it is just a case of getting out of the way and allowing the wisdom of the crowd to take over.

Some of Laurel’s useful and entertaining online resources can be found here:

• http://www.slideshare.net/Silkcharm/
• http://silkcharm.blogspot.com/
• http://laurelpapworth.com/
• http://twitter.com/silkcharm

Perth’s new Smartrider cracked

Perth is now among the worlds cities whose public transport payment system (“Smartrider”) has been cracked by security researchers.

The smartcard used in Perth contains a ‘Mifare’ chip supplied under a 2003 $30 Million contract with Wayfarer, that uses a weakened implementation of encryption standard ISO 9798-2 (which itself is several years old – 1999).

The weakness in random number generation used in the chip means the security implementation, that it was initially estimated would take some 44,600 years of computation to crack, can in fact be undone in around 1 hour. Current estimates are that common attacks will be possible on a massive scale within about 18 months.

And the advice from Mifare’s manufacturers?:

The security of a system must not be restricted to the individual components. It is also essential to ensure that the individual components are used in the right way to prevent some attacks on the system.

So basically they know, they can’t do anything about it, and it is down to the customers/users to mitigate the weakness (although how you use a ticketing machine the ‘right way’ remains to be seen).

The investigation into this weakness not only allowed researchers to ride public transport in London for free, but also allowed them to gain entry into buildings that use the same chips in building access systems. 

In terms of future threats we can expect similar scams that currently plague credit card use – the ability to simply brush up against the card, clone it, and then use this information to either sell the valid account details online, or create multiple clone cards that can be resold and used in the original owners name. This is worrisome, considering that many Transperth users have an automatic direct-debit from a bank account to get the maximum 25% fare discount – so could 100 cloned copies of your Smartrider suck 100 direct debit updates from your bank once their credit was exhausted?

Any evolution in the sensitivity of aerials that could read the chips from more than the current few centimetres away would also represent a nightmare scenario – a thief able to remotely clone 1000’s of travellers cards at a single station in a single day would create a denial of service attack on the transport system that would cause chaos.

The purpose of telling you this is really to increase vigilance and healthy cynicism – considering that also in recent news UK passports have been successfully cloned, and 3000 blank ones were stolen before they could be issued (Australian passports are also smart-chip based).

The hype is that these systems are smarter and safer, but as we invest so much more faith in them these small flaws can be exploited to exact much more damage that was previously possible. The real elixir of security is to have smart people making smart choices – but this is what automated systems take us farther from, instead making us unthinking automatons incapable of realising that something has gone wrong until days or even weeks later – by which time we are often financially poorer for it.

The other thing that is essentially wrong about these systems is that we are trading-in previously trusted tokens (currency issued by the government to pay for tickets) for a privatised least-effort-to-get-paid alternative where the implications of counterfeit fraud is exponentially greater.   

Take a look at the Mifare response, details of the Transperth contract in 2003,  The Times’ article on passport cloning, and the Times article on the orignal Mifare vulnerability, with a simple demonstration of the attack. Also you can see the technical details of the research into the security weakness of the system here: http://www.cs.ru.nl/~flaviog/publications/Attack.MIFARE.pdf.