Protecting poorly chosen secrets from guessing attacks

In a security system that allows people to choose their own passwords, people tend to choose passwords that can be easily guessed. This weakness exists in practically all widely used systems. Instead of forcing users to choose secrets that are likely to be difficult for them to remember, solutions that maintain user convenience and a high level of security at the same time are proposed. The basic idea is to ensure that data available to the attacker is sufficiently unpredictable to prevent an offline verification of whether a guess is successful or not. Common forms of guessing attacks are examined, examples of cryptographic protocols that are immune to such attacks are developed, and a systematic way to examine protocols to detect vulnerabilities to such attacks is suggested     

The Desktop Computer as a Network Participant

A desktop personal computer can be greatly extended in usefulness by attaching it to a local area network and implementing a full set of network protocols, just as one might provide for a mainframe computer. Such protocols are a set of tools that allow the desktop computer not just to access data elsewhere, but to participate in the computing milieu much more intensely. There are two challenges to this proposal. First, a personal computer may often be disconnected from the network, so it cannot track the network state and it must be able to discover and resynchronize with that state very quickly. Second, full protocol implementations have often been large and slow, two attributes that could be fatal in a small computer. This paper reports a network implementation for the IBM Personal Computer that uses several performance-oriented design techniques with wide applicability: an upcall/downcall organization that simplifies structure; implementation layers that do not always coincide with protocol specification layers; copy minimization; and tailoring of protocol implementations with knowledge of the application that will use them. The size and scale of the resulting package of programs, now in use in our laboratory for two years, is quite reasonable for a desktop computer and the techniques developed are applicable to a wider range of network protocol designs.     

Cognitive moderators of the relationship between behavioral intentions and behavior.

A prospective study associating prior behavioral intentions with subsequent actual behaviors explored whether locus-of-control expectancies and values on the outcome of the behavior would influence the relationship between behavioral intentions and behavior. Survey questionnaires were mailed to 115 15–68 yr old prospective adult female patients at a weight reduction clinic immediately prior to their beginning treatment; 79 respondents completed the 6-wk program. The strength of the relationship between initial behavioral intentions and actual behavior was influenced both by expectancies for control of weight loss and by values relevant to weight reduction. Weight-locus-of-control internals with high outcome values for physical appearance or health were significantly more likely than externals with high outcome values to translate their intentions to lose weight into successful actions. More generally, it may be the case that among individuals who believe that certain behaviors lead to highly valued outcomes, internals are more likely than externals to perform those behaviors. (31 ref) (PsycINFO Database Record (c) 2010 APA, all rights reserved)