http://umbcaiga.tumblr.com

They have lots of great events throughout the semester promoting Graphic Design, Animation, Illustration, etc. There are workshops, portfolio reviews, screenings and lots of other fun stuff. Their tumblr is a great way to keep up to date with everything going on!

Usually you have to pay to join AIGA, but is free to join the student group. They’ll also help you become a professional member if you’d like to (about $50). It’s definitely worth it as you get access to their job listings, professional portfolio fair, and you get your own online portfolio.

Did I mention that 2 of our employees, Mayen and Michelle, are the Secretary and Vice President? Pretty Rockin.

umbcaiga:

Hope everyone’s summer has been going well!

Mark your calendars for September 9th, we have a Welcome to ART event! Anyone within the Visual Arts discipline is welcome, no matter what your concentration is. Come to meet and greet fellow students & faculty, have some food, and have a good time!

Some online sites let you use any old five-character strong as your password for as long as you like. Others force you to pick a new password every six months and it has to match a complicated set of requirements — at least eight characters, mixed case, containing digits, letters, punctuation and at least one umlaut. Also, it better not contain any substrings that are legal Scrabble words or match any past password you’ve used since you were 21.

A recent paper by two researchers from Microsoft concludes that an organization’s usability requirements is the main factor that determines the complexity of its password policy.

Dinei Florencio and Cormac Herley, Where Do Security Policies Come From?, Symposium on Usable Privacy and Security (SOUPS), 14–16 July 2010, Redmond.

We examine the password policies of 75 different websites. Our goal is understand the enormous diversity of requirements: some will accept simple six-character passwords, while others impose rules of great complexity on their users. We compare different features of the sites to find which characteristics are correlated with stronger policies. Our results are surprising: greater security demands do not appear to be a factor. The size of the site, the number of users, the value of the assets protected and the frequency of attacks show no correlation with strength. In fact we find the reverse: some of the largest, most attacked sites with greatest assets allow relatively weak passwords. Instead, we find that those sites that accept advertising, purchase sponsored links and where the user has a choice show strong inverse correlation with strength.

We conclude that the sites with the most restrictive password policies do not have greater security concerns, they are simply better insulated from the consequences of poor usability. Online retailers and sites that sell advertising must compete vigorously for users and traffic. In contrast to government and university sites, poor usability is a luxury they cannot afford. This in turn suggests that much of the extra strength demanded by the more restrictive policies is superfluous: it causes considerable inconvenience for negligible security improvement.

h/t Bruce Schneier

Penny typography by Stagmeister Inc. “Obsessions make my life worse and my work better”. I love that. More here.

Privacy continues to be an important topic surrounding social media systems. A big part of the problem is that virtually all of us have a difficult time thinking about what information about us is exposed and to whom and for how long. As UMBC colleague Zeynep Tufekci points out, our intuitions in such matters come from experiences in the physical world, a place whose physics differs considerably from the cyber world.

Bruce Schneier offered a taxonomy of social networking data in a short article in the July/August issue of the IEEE Security & Privacy. A version of the article, A Taxonomy of Social Networking Data, is available on his site.

“Below is my taxonomy of social networking data, which I first presented at the Internet Governance Forum meeting last November, and again — revised — at an OECD workshop on the role of Internet intermediaries in June.

• Service data is the data you give to a social networking site in order to use it. Such data might include your legal name, your age, and your credit-card number.
• Disclosed data is what you post on your own pages: blog entries, photographs, messages, comments, and so on.
• Entrusted data is what you post on other people’s pages. It’s basically the same stuff as disclosed data, but the difference is that you don’t have control over the data once you post it — another user does.
• Incidental data is what other people post about you: a paragraph about you that someone else writes, a picture of you that someone else takes and posts. Again, it’s basically the same stuff as disclosed data, but the difference is that you don’t have control over it, and you didn’t create it in the first place.
• Behavioral data is data the site collects about your habits by recording what you do and who you do it with. It might include games you play, topics you write about, news articles you access (and what that says about your political leanings), and so on.
• Derived data is data about you that is derived from all the other data. For example, if 80 percent of your friends self-identify as gay, you’re likely gay yourself.”

I think most of us understand the first two categories and can easily choose or specify a privacy policy to control access to information in them. The rest however, are more difficult to think about and can lead to a lot of confusion when people are setting up their privacy preferences.

As an example, I saw some nice work at the 2010 IEEE International Symposium on Policies for Distributed Systems and Networks on “Collaborative Privacy Policy Authoring in a Social Networking Context” by Ryan Wishart et al. from Imperial college that addressed the problem of incidental data in Facebook. For example, if I post a picture and tag others in it, each of the tagged people can contribute additional policy constraints that can narrow access to it.

Lorrie Cranor gave an invited talk at the workshop on Building a Better Privacy Policy and made the point that even P3P privacy policies are difficult for people to comprehend.

Having a simple ontology for social media data could help us move forward toward better privacy controls for online social media systems. I like Schneier’s broad categories and wonder what a more complete treatment defined using Semantic Web languages might be like.

So, some of you may have noticed that the new myUMBC is NOW LIVE!!

We're pretty freakin' excited about it, and have received a lot of positive feedback.  The most negative thing we've heard a few times is that the yellow background is causing severe abdominal discomfort. We're looking into it.

The launch went pretty smoothly, so all we have to report today are a few simple bug fixes that folks stumbled upon:

• Fixed a typo in the Dashboard.
• Updated the list of your upcoming spotlights to be a little more intuitive. We also made it so group members who can post spotlights can see all upcoming spotlights in a group so they don't post a duplicate.
• Group categories should now be copied on content.
• Tags should now be copied on spotlights.
• Prevented Graduate Applicant and Admit from being incorrectly selected after editing existing content.
• Added a Print This Page button to pages that load inside the myUMBC frame.
• Fixed audience bug that was affecting the iPhone app.
• Added some more "page moved" links for services.