HOBA Revisted with WebCrypto

The Hoba Meteorite in Namibia

Here's direct link to the running demo which explains in much more detail what's going on than in this post at the HOBA Demo Site

Years ago, I got really pissed off about LinkedIn doing something incredibly stupid, especially for a big company which was storing unsalted passwords on their servers and their subsequent leak. That got me to thinking about getting rid of passwords on the wire if at all possible. This led me to my work on a prototype that used public key crypto to join, login, and enrolling new devices. You can see my original posts  here and here, along with the resulting experimental HOBA RFC (RFC 7486)

I was really excited when I heard about the w3c WebAuthn work hoping it was the successor to our experiment. The reality was when I tried to get WebAuthn to work, it seems regrettably difficult to get up and running, especially without an external signing dongle. It is quite possible that my problems were completely wrapped up with not wanting to require a signing dongle. Chrome doesn't support local key stores at all with WebAuthn, and Firefox does so only by fiddling with about: flags. This is a real shame as I really hoped that WebAuthn could finally bend the curve against passwords being transmitted over the wire which is still a huge problem. Since HOBA was written a lot has changed. WebCrypto now contains solid crypto  functionality accessible to browsers, in comparison to the horrible javascript hackery that I used in the original HOBA RFC. Another thing that has changed for the better is that it is much more common for servers to require an out of band verification (email, sms) to enroll new devices. This was one of my big worries at the time because HOBA required those out of band mechanism for enrolling new devices. Thankfully I don't have to fight that social problem too... lots of somebodies have done that for me in the mean time.

So I decided to give my prototype another look, and see if I could make it into what I had hoped WebAuthn was. Happily, all of the algorithms and backend code are still relevant from my prototype, it was just a matter of replacing the javascript versions of crypto to the more civilized WebCrypto version. Most of the effort was just dusting the cobwebs off the code and stripping it to a bare minimum. In fact, refactoring the crypto code to allow both to run side by side as well as actually writing the WebCrypto driver took all of one day, and a lot of that due to some whacky to/from PEM that was getting me wrapped around the axle which had nothing to do with WebCrypto at all. I've put both versions of code up on GitHub as an example of how this problem space can be attacked in a much more straightforward way if you don't need the added security of crypto dongles. The server code is written in PHP. Sew me. It could trivially be ported to any other language, and the key issue is integration with your own enrollment and login code in the backend so it serves only as an example in the first place. The HOBA-related code is actually very small and pretty easy to understand. The new device enrollment is probably the hardest to understand, but the main takeaway is that out of band verification of ownership of email, phone numbers, etc is pretty common these days so lots of sites have experience with deploying that. When I first wrote my HOBA code, that was much less prevalent.

There are two pretty big open issues. The first is the most straight forward which is whether it should be using a nonce from the server validate freshness instead of time. My guess is that the answer is yes and the implementation of a Digest-like (RFC 7616), as well as the original time based replay protection. The second is how to get enough review to actually believe that it works and doesn't have holes. I've been thinking about writing an internet draft and floating it at IETF but I'm not sure they'd want to take it because the client and server code are definitionally controlled by the same entity so it would mainly be for security review, not protocol agreement across different vendors.

I have created a site to demo the HOBA demo site as well as a Github Repo. Give it a spin and take a look. The demo is stupidly simple: join the site, logout, login to the site. If you want to enroll a new device, either find another or just use another browser and try to login in with your username. The backend will send mail to verify the new login. The only difference with all of this is that there aren't any passwords.

The Water Cooler Problem

 

Telecommuting Works, but is Different

Having telecommuted for almost a couple of decades off and on (mostly on), the technology has come long way. As a software developer and a networking geek, it's pretty trivial to work from home these days. There are undeniable benefits to working from home like saving time, frustration and money not having to commute, the obvious environmental benefits, and not having to be planted in a god-awful "open plan" row crop. Even if telecommuting were a net neutral on the productivity front, it would be a massive win for everybody, even if it were just a day or two a week.

Telecommuting can work, and can be way more productive. It does take discipline and is an acquired skill, but it can be learned. There are lots of people who say that telecommuting doesn't work, but it begs the question of whether the reason telecommuting fails is because companies are shit to begin with. Telecommuting does give you more ways to give them the finger, after all. The very act of not trusting their workers is its own problem and says way more about the people who distrust than the ones who stand accused. There is a simple problem to people who goof off: you reprimand them, or fire them. Same as going into the office. Being there physically does not mean they are actually working. Their output tells you that, both in the office and at home. If you think you can tell just by watching people in person, you are deluded. 

It is true that some people have a hard time telecommuting though, and not all  jobs are as easy from home as being an anti-social software engineer. But telecommuting need not be an either-or proposition. I would often telecommute in the mornings and then arrive late in the office with much less traffic, and then leave relatively early to beat traffic again, so as to have 4 or so hours to interact in person. In other situations, I would almost completely telecommute unless there was some particular reason to come in, like a coworker flying in to have some high bandwidth time with.

That said, telecommuting has its share of problems, both social and technical. In the following sections I will attempt to create an inexhaustive list of problems which I'll bundle together as the "Water Cooler Problem". I'm not trying to solve any of these, just enumerate what they are. This is especially relevant given the giant social experiment happening right now with the covid-19 pandemic. They say that things like pandemics cause huge changes. Like the previous one that I've lived with, I expect this to be no exception. This is telecommuting's debutante ball, for better or worse.

The Actual Water Cooler  

The Water Cooler is an abstraction for a place that coworkers can casually meet. It could be the lunch room, kitchen or by an actual water cooler. Quite a bit has been written about the benefits of the Water Cooler such as making and keeping social bonds which are not necessarily work related. I'm not entirely sure I buy into this though, at least for the non-work related stuff. When I was at Cisco, I rarely talked about outside life with coworkers unless they were a close friend as well. I barely knew who had kids or not and what outside interests they had. It just wasn't relevant or important. Even over lunch it was more about what was going on work wise. Same with other places I've worked.

That said, there is definitely worth to having lunch together and informally talking about what the current problems are, various shitshows around the company, and other comings and goings. Virtually, this doesn't happen that I'm aware of. There isn't much to prevent it given current technology: you could just have a standing meeting called "Lunch?" at noon every work day for your group and you can gross out virtually at them chomping down a hideous pb&j sandwich. It's not the same, but it wouldn't be especially different. Given the current lockdown, maybe it will become more popular. When I mainly telecommuted, I really didn't miss it particularly. Other people may value it highly. So I have mixed feelings about this entire form of interaction.

The Over the Cubical Phenomenon

Sticking your head over your cubicle, or hanging out in the doorway of a coworker is a classic example of how workflow happens when you are in the office. You ask a quick question, and get a quick answer within a few exchanges, or it can turn into something bigger because you realize that you are both clueless and need to hash it out.

The main aspect of the over the cubical problem is that it cannot require a classic threeway handshake before information flows which is what current meeting tech requires (eg, a meeting invite...). Information must flow from the start of  your presence over the cubical, and not after a response. This implies that some amount of gate keeping needs to be available to limit who can look into your cubical, based on "location",  hierarchical distance, and social availability so as not to subject people to interruption denial of service attacks.

Another factor is appropriate interruption. Interrupting people has been measured to require a significant amount of time to get back to the previous task. A common mode in real life is to give a quick "give me a sec" or "can you come back in a few" so they can finish up what they are currently working on. The other thing that real life gives are hints that they are not available at all and that you should come back later. Like if they are already with somebody, or they look like they are really busy. That is a much more difficult task remotely. As in I have no clue how you'd do that.

Chat is Not a Substitute

Chat is sort of a half-way between email and a meeting. And while it's often good enough to hash out problem, it's not a panacea. The main thing I see is that it is rare for chat to upgrade to face to face style interaction when that is actually appropriate. Maybe it's just me being an old geezer and not knowing that the younguns do this all the time, but it's definitely not been my experience. It needs to be extremely seamless to work correctly. Like one click from the initiator and with little or no effort on the recipient.

Which points to the second problem: there seems to be social barriers to doing that. I really don't know why, but it would just never occur to me change to face to face midstream. If I am the norm, that means that it will take some amount of social training to make that an acceptable thing to do.

Spontaneity and Brainstorming

Part of the supposed benefit of the Water Cooler is spontaneity so that you can brainstorm. The chance meeting that turns into something bigger. Sometimes much bigger. When I was working at Cisco a small group of upper level engineers were tasked with what Cisco could to help with the spam problem. A chance meeting by myself and one of the others (Eliot Lear) allowed me to talk about something I was thinking about without having to show my cards to everybody else in case it was insane or useless. I might have done the same by email, but it was better in real life because the back and forth is faster. He ended up liking parts of it, and was dubious about other parts, which gave me confidence to explain what I was thinking to the larger group. The rest as they say, is RFC 4871 (DKIM) which signs almost every piece of email on the internet these days.

So that was definitely a success story, and I'm sure there are zillions of others just like that. It's hard to say that it was the thing though: I'm pretty brave at revealing my ignorance so it would likely have gotten out one way or the other. Others are not as brave (or reckless) as I am, so bouncing ideas off of others privately can be really important. The current state of tech with respect to conferencing is definitely not conducive to this kind of interaction. The main question is how much it matters.

Before and After Meetings

Before and after formal meetings is a place for the Water Cooler effect to happen. On conference calls, allowing people to chat amongst the other participants before the meeting is pretty common, but it seems like either it's the default or meeting owners choose to disable that feature which is puzzling to me. After conference calls, however, are completely different: people just hang up. In real life, it is much more nuanced. As people leave, they may linger either in the conference room, or out in the hall and chat either one on one, or in smaller groups. There may be more than one of these groups. It may be social, or more often it's a followup to the meeting itself but in a smaller setting. These are completely spontaneous and often more informative than the meeting itself, given structure. It is also a very good place for junior and senior workers to mix and especially more junior workers to be able to be more open with their ignorance than in an open meeting setting. It is super important that junior workers be comfortable knowing that they don't know it all and just ask and learn. That is a serious problem for telecommuting.

This to me is probably the most important problem. On the bright side, it seems like it could be amenable to technical solutions. But there are always the social implications that make it hard. How do I know if they have to jump onto another call? How do know that in real life? It's pretty obvious if they are scurrying to their next meeting. If they hang out a bit finishing up, that probably means they are amenable. So it's pretty easy gauge in real life. In virtual life? I don't know.

Mixing of Junior and Senior 

Cisco was/is a complete creature of mailing lists. It had a pretty unique mailing list though called clueless. It was populated by junior engineers all the way up to fellows. Though it was much more technically oriented, it had lots of participation from high level execs -- often geeks turned suits, but not all. I'm sure that Cisco is not unique with this kind of interaction, but it was a very curious creature in a way. It facilitated younger engineers to actually interact with people who are gods in the networking industry and see them as people rather than just technical specs, and delivered products. This one is cranky, that one is surprisingly social and very accessible. You find out what's going on around the company, what people are interested in, what people's hobby horses are, etc. Likewise, the senior engineers get to see the up and coming engineers and what their talents are, and how they might be worthy of helping them along to grow their talent.

For a large company that is almost impossible to do in meat space, so here virtual is actually a win in terms of in the large. In the small however, virtual doesn't work as well. It's much easier to see somebody who probably knows what you need to know, and ask them in a few minutes which otherwise may have taken hours or days. Email works to a degree, but in person it is better especially if a whiteboard is helpful (which it often is). And there is the social cuing that makes it easier to ask somebody something in person who you barely know, than sending off email that may go unread for a long time.

Whiteboards and Casual Meets

Often you'll meet up with somebody either by chance or by interrupting them, and find the need for a whiteboard. I've never used one of these virtual whiteboards in formal conference calls, but I am extremely dubious that using a mouse to draw something is any way a substitute for a marker. I suppose you could get a e-pen, but that's just one more thing on my desk. Maybe phones and/or tablets with touchscreens make this easier. But that too is problematic because one of the advantages of a whiteboard is that they are physically big, and phones and tablets are tiny. I use a 4k monitor which is attached to my Mac so I suppose that might be a possible compromise, but I'm not sure how it would work. Happily, this post is not about solution space. The problem remains a problem and this post remains something to point them out.

Customs are Different Online?

People do not seem to like video on conference call. It's been available on formal meetings for ages, but people don't seem to use it from what I've seen. Which is very peculiar because obviously in real life you can't do otherwise. There may be something deeper going on here though. When I am in a real life meeting there is no way I can forget what I'm doing when I'm constantly bombarded with the feedback of seeing and hearing the people around me. I had one mortifying incident happen to me as I was driving to San Jose from San Francisco on a conference call. Somebody cut me off, and as normal I screamed at him (even though he couldn't hear of course). It was not on mute. Oops! That would never happen in real life, so there may be a  rational reason we may not want to show our mugs to make certain we don't floss while sitting in a meeting.

It's all the more peculiar because humans are social animals and visual cues are extremely important. There seems to be a big difference when you get a bunch of people staring blankly at their computers than in real life. In real life, attention (or not!) is given to the person who is talking but can veer off to look at somebody else to judge what their reaction is, or to signal to another that a response is necessary, etc. Since you can't tell what the person on the other side is actually looking at remotely those sorts of interactions are not possible.

Lack of visual cues make another problem almost insufferable: blowhards can speak forever and you can't get a word in edgewise. I mean if I wanted a lecture, record it and I'll listen to it when I feel like it. If at all. This is in fact a technical problem largely of our own making, but it is also a social one in that the blowhard may believe that his prolific words of wisdom have captivated the audience. This simply doesn't go down that way in real life. Exasperation is a readily observable social cue as well as just signaling that you want to talk. Which isn't to say that they can't blow-hard in real life, but they can get non-verbal feedback too.

Etiquette  

There are a lot of questions about etiquette in the virtual realm, and it's not clear that they map 1:1 to real life. Or at the very least, they present new dimensions to how you map real life etiquette to a virtual one. Suppose I wanted to transition from text to a live conference.  If I offer and you decline, that is bad. If I offer and you accept unwillingly but socially required to, that is bad too. This is especially true of meeting/chance encounters. In real life, you can see somebody and guess whether they are really busy or whether they are coming up for  a breath of air. Or at least it's a lot easier, if imperfect. Likewise, even if you intend to interrupt, you can let your presence be known and let them tell you when it is OK to interrupt.

There are no doubt lots of other areas of etiquette which may well be different or new in a virtual setting.  As anybody who knows me, I am treading on thin ice with anything pertaining to etiquette so I'll stop while I'm behind.

Adding it Up: How Important is the Water Cooler?

As I've said, I've telecommuted a lot in the last 20 years. Even though I have a long, if incomplete,  list of differences they are not all equally important. It is manifestly the case that you can do good work completely from home not having any of these real life features outlined above. Or that you can get by mostly virtually, with the occasional meet up for high bandwidth interaction. That tells me that it is much more of a nice-to-have feature than a must-have feature. Some nice-to-haves are much more important than others. The End of Meeting problem is a pretty serious deficiency and especially for more junior coworkers. That is when items discussed are freshest on people's minds, but just hanging up abruptly stops those interchanges dead in their tracks.

The Over the Cubical problem is also pretty serious. For years, I didn't have anybody to just geek out with on the spur of the moment. Once you schedule an actual meeting, you've already lost any momentum toward just getting past something you're working on -- formality is the enemy. That I really missed. The Actual Water Cooler Problem is much more meh for me. I'm willing to be convinced that I'm the outlier but I'm suspicious that it is solution in search of a problem. I'm more than willing to not know about other coworkers lives if it saves me from being planted as an open office row crop. It is deeply satisfying that study after study shows that the benefits of collaboration with open offices is in fact negative and that it was always about saving money with a post hoc rationalization about its benefits.

Telecommuting can definitely be done successfully, but we are still quite a ways off from solving some serious downsides. We'll be learning for years to come given the Great Covid Experiment in Telecommuting. For one, we'll find out about the validity of baked in biases, given this was widespread without the self-selection problem. We should also be able to gauge what productivity is, and how it balances with all of the upsides. Since a large slice of the people who telecommuted are new to this, they can feed back what their hurdles were. It should also inform the industry what technical problems are out there for the new telecommuters, and the remaining problems for old hat telecommuters.

Interesting times we live in, fer shure.