So within the scope of computer security, we want a way to be able to check that the say the human user That's accessing a computer system is who they say they are and we use that in a number of different other security mechanisms Authenticating users some definition of authentication the process of verifying a claim that a system entity the system entity may be a Person or it may be another computer The claim that a system entity or system resource another computer or a program running on another computer a Claim that it has a certain attribute value. So for example Human claims that they are Steve The computer needs to verify that That human made a claim that they have a particular attribute and Our computer system needs to go through some procedure to verify that that human is in fact Steve It's not someone pretending to be him So that's the the general definition of authentication We will focus mainly on authenticating human users But there's a whole other side of how the computers authenticate each other We've seen some techniques regarding cryptography, but there are many other techniques as well There are two steps in authentication first. We need to identify the user and then verify So normally with the identification step that that user presents some form of ID And you know it when you log into systems that is you Log in to Moodle you log into your favorite website. You usually need to present a user ID or a user name Okay, so that identifies you it's generally unique. So within the context of that system That user ID is usually different from everyone else's But it's not necessarily secret So I think most people know everyone else's user ID for their Moodle account It's you followed by your student ID and the student IDs of other students are probably unfortunately easy to find So that's not secret same as your email account What is your user ID? If you've got hotmail gmail or some other email account. What's your user ID? You're your email username, okay, so that is of course not secret because that email address You need to distribute to others. You can't keep that secret. So the ID is usually not secret And in many cases we assume it will be public So we try to identify ourselves to the system saying who we claim to be and then the system needs to go through some verification And that involves the user presenting some information usually or generating information That acts as evidence To prove that this user is who they say they are That they have that attribute that they're claiming for example, I claim to be Steve I need to present some evidence to prove that I am that's the verification step and some common ways we know is a password so when I log into my gmail account my ID is my email address But to prove that I am the user that owns that email address I must also submit some other evidence and that's usually a password with the idea that only one person should know that password and Knowing that password is evidence that you're the person that owned that the account and there are other techniques pins so numbers but we can call it a Really a subset of passwords and also biometric information Be your fingerprint for example Often this verification step uses evidence, which is secret We usually assume passwords or pins should be kept secret Or cannot be generated by others So if we think about biometric information say your fingerprint is your fingerprint secret Not really. I mean you don't go around walking holding your finger so no one can see it you It's public, but it's hard to be generated by others, okay So one or the other it doesn't necessarily have to be secret there was a Report maybe last month that someone could take a photo from within a few meters with a good camera of someone's finger and Take a photo and then use that to fake their fingerprint Okay So there are problems with biometric information So biometric information usually is not secret, but it's hard to be recreated by someone else You must be in possession of it to be able to use it. We'll see some more examples of biometric information User authentication is a very important part of defending computer systems Many other security controls depend upon it For example access control who can do particular things on a computer who can read this file who can write to this file That's access control, but that all depends upon authenticating the user in the first step Same as who can take the quiz for for moodle for your Quiz to well that depends upon that the authentication of the user has worked correctly It's very important for even other parts of the computer system security How do you authenticate there are roughly four different ways? people talk about When we're authentic authenticating people so we're going to focus on authenticating people humans Something that the person knows can act as evidence So Something that I know that no one else could know Can be evidence that I'm that person Passwords pins answers to questions So my password in theory I only I know the password therefore if I can supply that to the computer system Then if it matches a previously supplied password That that computer system stores then that computer system Can prove or takes that as proof that the person trying to access that system is who they say they are So that's based on something that the user the human user knows We'll focus mainly upon that but we'll see a few examples of others as well Something they possess something they have with them and we call them generally tokens So a key a physical key Can act as a token whether it's a key a key card a swipe card There's smart cards, which are really key cards with with some embedded process or a memory in them physical keys They act as tokens sometimes USB Drives can be configured to if you have possession of it You can use that as evidence that you're the person who's supposed to be accessing this computer system similar with mobile phones now with mobile phones and a second form of authentication is that Sometimes a bank or a company will send you an SMS or a message to your mobile phone and The fact that you possess that phone and Can respond or use the information in the message acts as some proof that you're the person who's allowed to access the system So some systems may use a combination of what you know a password plus what you possess say a phone if you Know the password and you possess the phone that is attached to that account because you've registered your phone number there Then you can access and log in or some smart cards or bank cards May require a combination of pin and presence of The actual card if you don't have the card you cannot access your account If you don't have the pin you cannot access your account. You need both The other thing is in the last two are related. So how do we authenticate someone well based on what someone knows What they have what they possess What they are is what they are that individual is so Here we talk about static biometrics. So something about the person that doesn't change. That's the static part of it So your fingerprint doesn't change generally That's considered a biometric authentication technique and it's static your eye or your retina your face The characteristics of that generally are unique amongst a set of people a set of users so therefore You can use them as a Way to prove that you are that particular user So with a fingerprint first you register your fingerprint with the computer system and Then when you want to access that computer system you supply your fingerprint and That compares your supplied fingerprint with a registered one if they match the computer system assumes It's it's the right person it's you and this depends upon the fact that okay Again, you must have that But it's something about what you are part of your body really and These things don't change or very seldomly change The other biometric is about some things that do change. So what you What an individual does or what you do Dynamic biometrics so other things like your voice pattern Your handwriting maybe you're the way that you type keys can be used Tees on keys on your keyboard can be used to identify some users so you talk into a microphone attached to some computer system and That compares your supplied voice with some voice Recording on that the computer system has if they have the same characteristics. We can say that's the same person That's the idea same with handwriting So different four different ways to authenticate humans Which one do you use most? Which right? We all use passwords a lot. I think so we'll spend a lot of time talking about passwords So do you use any others? Which which examples? Smart card what for? Right if I entry into into buildings for example the possession of that card acts as proof that you are a person who's allowed to enter Okay, if you don't have the card you cannot enter Of course, you can think of some obvious flaws with that you can pass the card to someone else Okay, so there's some limitations This one anyone Rose some some buildings have it in SIT. We have I have to do it every day When I come to work Not so much for security more for monitoring But some of the rooms the labs here have the fingerprint on their network lab We have a fingerprint to open the door there and this one you don't see is common Okay, why? It's hard. It's hard to to implement you need say to Record the voice of someone Let's say we have on this door to get into the lecture room. We want to restrict who can come into the building Then with a key card, it's quite easy quite cheap to implement Supplying key cards to people and having a machine to read them But with say voice pattern recognition First everyone needs to register their voice and then when they try to get into the building they must say something and Getting that to work. Well, it is quite difficult because you must make sure that there is no No noise from other sources so that the voice recording is good and comparing voice patterns is computationally difficult so only in Cases where high security may be needed that these may be applied or in combination with others We will focus mainly on what you know and generally about passwords Say a little bit about the others towards the end This is a quote from a textbook about network security and it's about humans and computers so Normally we focus on the computer side how to implement the software the hardware and so on but when we deal with humans as As a designer we consider humans are large expensive to maintain with compared to computers Hard to manage humans and of course they create a lot of pollution It's astonishing that these devices us humans continue to be made and deployed But unfortunately they are so many of us around that we must design our communication protocols our security protocols Around the limitations of humans So if we didn't have to deal with humans in dividing designing computer security Life would be much easier Can humans encrypt using AES?  No computers can quite easily Can you remember a 64 bit key? 64 bit random binary value No Humans are not so good for that a computer can it stores it in memory So there are some limitations of us Which make it difficult to design computer security system for for different systems, so Of course, we cannot avoid us We must design around humans and often they are the weakest link in our system security And one of those weak links is passwords and using passwords to authenticate users It's very pervasive, it's everywhere But it's a big problem in terms of security So passwords include we've made other things. We don't think of passwords of pins There's also a form of a password whether it's a number of a set of letters similar What's your password for Moodle? Right that the first rule of passwords is don't tell anyone about your passwords, okay? So a general principle don't tell anyone what your password is Of course Things are not so easy one of the common This is a small cartoon So in terms of computer security and cryptography Many people think that Okay, I have my laptop I want to protect it and people an attacker is trying to break into it So they've got my laptop and they They find it's encrypted so they go and have an idea. Let's build a computer that will crack the encryption But we think that okay, let's just use a key which is long enough We know that brute force attack is not possible if we have a large enough key so we should use a long key to Stop someone from building an expensive computer to break it So we stop people accessing our my computer by using cryptographic techniques Unfortunately, there are alternatives The alternative maybe in some cases is to exploit the human weakness and that is instead of having to break the encryption of the laptop Just go to the person who owns it and hit them on the head until they tell you the the password okay, so We need to Realize that sometimes there are weaknesses that we don't often think about when we're dealing with cryptography In this course, we will not use this technique for breaking Inter-systems But it is a real issue. There are many different ways to defeat the security of a system Not just technical so with passwords that arises a lot as well. There are different ways to defeat The security of password based authentication some of them are technical some are based upon human behavior and social engineering So let's look at how password authentication works so many computer systems use password based authentication, so We talk about multi-user computer systems It could be my laptop which has accounts for multiple users who want to use that laptop We need a way to authenticate the user and make sure that I can access it and you can't access my laptop and get my exam questions It couldn't be can be a shared computer But more commonly nowadays at some website or some computer system on the internet where many users have access and We use a combination of an ID and a password to authenticate the users How does that work? Look, so we talk about the computer system that we're trying to access and the user that's trying to access it the system Initially stores a username and password for the corresponding users So there's some initial registration and I think you know that when you create an email account Then the first thing you do is you choose the email address. That's your ID and you're Maybe supply some other information about yourself, but you must supply a password. So this registration step Must be done where you store your username and password on the computer system that you're going to access later and then Later when you want to access it the way that it works is that you submit your username and password to the system And the system compares your submitted value and your stored value if they match it Assumes you're the correct user if they don't match it assumes you're not the correct user so that's the user authentication using usernames and passwords or identities and passwords So first a little bit about the ID. What's a good ID to use for user authentication? Depends a lot about the system There's a mistake it determines whether user is authorized to gain access to the system. So that's what the ID is for So if you don't supply an ID that's been registered Then you will not get access to the system. That's the first check the ID sometimes determines privileges of users So I can log in to The Moodle website as Steve And I get the privileges of an instructor or a lecturer But alternatively I could log in the same human user as a different using a different ID like admin and Then I'd have the privileges to to create courses and to do many different things that the lecturer couldn't do so the same human may log in using different IDs and the ID can be used to determine What that user is allowed to do the privileges of those users and A specific case of that is it's used in access control that is Users with particular IDs will be granted permissions to do things on that computer system And if you've been in our network lab, we've seen examples of access control of on Files we have read write execute permissions Some users can read files Other users cannot read those same files How do we determine that it's based upon the identity of that user the username for example? We will not say much more about what the ID is usually They're the structure of an ID depends upon the computer system We want to focus on the password part of it. That's the security part So when you choose a password and submit a password there are a number of issues with respect to security What is a good password? I think we can all think of what is a bad password We can think of examples of bad passwords one two three four your name Password the word password your birthday What's a good password? So up a mix of uppercase lowercase numbers other characters not a word long Okay, many characters not just two characters three characters We'll look at that later of some guidelines and some Many examples of what's bad of a password to try and arrive at well What what are some rules or some pre procedures we can use to choose a good password? The other thing that we need to address is When you register your username a password that password is stored on the computer system We need to keep that password secure Again, the password must be kept secret. It's stored somewhere on the computer system that we're accessing So how do we store that is an important thing and we'll spend some time on that So when you implement that computer system and you implement an authentication technique You need to make sure that the way that you store the password is a good way How do you submit passwords so you have a computer system on that you want to access? You're on the other side of the world using your web browser trying to log in So how that works is that you send your username and password from your web browser To the computer system across the internet How to do that such that no one in the middle can intercept and find your password so the submission is another issue and things like What to do with if the password submitted is incorrect how to respond So we'll see Examples or some issues with all of them in this topic before we go through them We just draw a quick picture of what the model is How we can think of it we have a user Is our user and we we can think that they have a computer that they're using My nice picture of a computer and Is the computer system that they want to access? That is this user Wants to access this computer system Usually they'll do it via another computer, especially in web-based systems across the internet So I've got an old PC. That's why it's this one's so big So There's I will not draw it, but there's a process of registration where this system has some some database Think there's some database inside there is a list of IDs and Password so this database For all the users that are going to access this system stores Something about the the ID of those users and the password of those users so that's the stored values and Then when our user wants to access that system They submit or supply a value So you can think that they supply a ID and password and then There should be a response That's the general model of what we'll consider with passwords Not drawn here, but initially the user registers with the system and in that registration process they select an ID and password and Then that stored on the system that we're trying to access later think of it in a database It doesn't have to be it can be a file. It can be a memory and Then when that user later wants to access that computer system we say they submit their ID and password and The system compares the submitted values with the stored values if they match Then the response will be positive saying yes, you can access If they don't match then the response will be negative saying something's wrong So that's our model. We need to look at how to store the passwords because Note that the password is secret information if someone can access this computer system and then get all the user names and Passwords then that can be a security compromise How to choose passwords when you register? That's another issue. What's a good password? How should you submit your password across an a network especially across the internet? here we have an internet and Someone may intercept that message if we're sending across the network and and discover your password and How should the system respond? What type of message should it send especially if you get the password wrong so Back to our lecture notes There are many problems with passwords We will list a few here most of them and classify them and then we'll go into some details about a selection of them So vulnerabilities of passwords what what can go wrong such that the security is compromised first What's called an offline dictionary attack Somehow the attacker obtains access to the database that is somehow The attacker finds this database, which is a database listing everyone's ID and password So if the attacker can find that Then they learn the secret information. So look the security has been compromised So we need some way to store store that such that even if they get access to the database they cannot get access to their password value and We'll go through the different options and we'll arrive at We make use of hash functions to instead of storing the password store a hash of the password So an offline dictionary attack would be the attacker obtains that database and then tries to find the corresponding passwords which are stored in there and one way is to The concept of offline means that we don't do that attack on the computer system We get the database copy it to our own computer as the attacker and do the attack using our own resources We're not limited by the the computer system a dictionary attack means simply if we're trying to find or guest passwords try common words or Try values which are related to words in a dictionary Not random characters, but words which are structured or strings which are structured based upon words than dictionary We'll spend some more time on that one as we Pass through these different vulnerabilities What we need to do is control control who can access that database on that computer system The database should be somehow protected this database No one should be able to just connect to this computer system and just download the entire database So we need some special protections on that database in addition Even if someone can get access to the to the database we need to use techniques to Either encrypt the passwords, so if they get the database they must find the key to decrypt But often that's not practical. So we instead of using encryptions we use hash functions to store the passwords So explain explain how to use them But there are other types of attacks even if they can't get the database. What can an attacker do a specific account attack an attacker wants to Get into my account on Moodle Okay, they want to get in my account. What they can do is submit My username my ID which let's assume that they know and just try some password maybe a random password so It's on a specific account on one person's account the attacker submits an ID a known ID and guesses a password if The system responds failed Then the attacker tries another password Fail try again and just keep going So try different passwords for a specific account How do we stop that and I think you've seen it? in use in practice Set a limit set a limit of how many attempts can be made So if there are say five failed attempts on that specific account Do not allow any further attempts And you see that using probably I hope you haven't seen it But you've heard it we're using your bank and an ATM if you supply your Your pin three times wrong then it eats your card Okay, the machine takes your card and you can't make a fourth attempt Okay, so that's an example of stopping someone from even if they have your card from just trying many different pins If you only have a four digit pin and there's only ten thousand combinations to try So there's a weight as a countermeasure in that case Lock the account after too many failed attempts What's the problem with this countermeasure? Okay, so that works, but what's the problem with it? So let's say Alright for Moodle you all have accounts on Moodle and I want to make the system secure So I implement a countermeasure if someone tries to log into an account and they make one failed attempt I will lock that account What can go wrong? Right, it could have been the real user and they just typed their password wrong. They made a mistake if we lock the account then they may make a mistake and Then they're locked out and it's inconvenient for them because now they need to take some other steps To try and get their account unlocked the same with a bank if you if you lose your Your ATM card because you tried the pin three times Then you need to the next day go to the bank and get get a new card or something so it's inconvenient if if it's the real user that gets locked out and similar we can an attacker can take advantage of this countermeasure and do a denial of service attack so what I can do if I want to Stop you from accessing your account Then all I do is submit say three wrong passwords into your account and now you're locked out of your account So I deny you from accessing the normal service So we need to make a trade-off between these countermeasures Which improve security and the consequences of them which usually make things more inconvenient or perform worse Related but slightly different a popular password attack Let's say I know many different IDs for a particular computer system Instead of attacking a specific account attack any account and Trying a popular password for many different IDs An example I know the user IDs for all the students who have a Moodle account I know that the list of ID numbers So I know all the IDs what I do is for the first ID I try the password one two three four It didn't work. So I move on to the next user ID and try one two three four and I'm Unfortunately, I I'm quite confident that after I try all the students here that have a Moodle account I probably get one that gets access So this is trying a popular password Something that many people may use on Many different accounts with the aim of just getting access to one of them from the attackers perspective So we can't lock the account after too many attempts because we only make one attempt per account So somehow we need to make sure the user doesn't choose that popular password When you register your password have some rules that say you cannot choose the password one two three four Okay So control how users select their passwords Or maybe block computers that make multiple attempts We identify the IP address who's making many attempts at many different accounts and then block that computer What can go wrong? What are the the negatives of using these countermeasures? The user is not going to try a normal user is not going to try to log in with different IDs. That's unlikely What's the problem with controlling password selection? That is for example, I set a rule when you create a new password on Moodle I set a rule the password Cannot be a popular password So I set up some rules and I say it cannot be a word that's in a dictionary. I that's the rule Popular means Maybe we'll see later that one that's too short. So it needs to be 15 characters long It needs to be random So that's the rule for creating your password. What's the problem with that? You you will not be happy with that password that is 15 random characters. You'll forget it You'll write it down and then it's easier for someone else to learn it So it lets in other weaknesses if we have a password that users do not find convenient okay, so We need to make a trade-off. We need to control What passwords the user can select but don't make it too hard for the user to select a password they can remember? Blocking computers that make multiple attempts It may be that via the the networking techniques of firewalls and network address translation that Blocking a computer from making attempts may block the normal users from accessing the system So you need to be careful when you block things that you don't just block the attackers But you're You shouldn't block the normal users. Let's keep going Password guessing against a single user You want to get access to my account for Moodle so you can change your scores for the quiz So you'll try to guess my password. You don't try many random passwords. That was the specific account You try and guess it within three attempts. You know the system will lock you out after three attempts So in this attack you try and guess the password based upon knowledge of that person So if you know something about the person who has that account, maybe you can guess the password easier Again, we to a stop that control how users select passwords. So they're hard to guess They're long and they don't follow some common structure So involves not just controlling the user by some technical controls, but also training the user inform users that the way they select passwords should Should follow certain guidelines and inform them of the consequences of selecting a bad password another one computer hijacking I've logged into my computer. I go out for a break for five minutes Someone walks up to my laptop and now they think of hijacked my computer They logged in as me because it didn't log out when I left How do we stop that some form of auto log out? After two minutes of inactivity on my laptop it automatically logs me out So when I go away, someone can't log in Again, I think you can see the trade-offs with inconvenience Let's say your computer automatically logs you out every one minute Then you just have a break because you don't do something for one minute and now you need to log back in again So there's a trade-off there exploiting user mistakes a user writes down their password because It was too too long or too too random for them to remember a user shares their password with friends Or somehow they're tricked into telling someone their password Then we need again some training of users not to do these things explain them How those things can arise and what the consequences are and maybe use passwords with some other form of authentication? Like not just a password But also have to supply some number which is sent to you via SMS or a message on your phone a One-time password you you see with different online systems today So even if someone gets your password, they also need that other thing your mobile phone to get access Again inconvenient If you don't have your phone with you at that point in time, then you cannot access We access many different computer systems many different websites. We may have accounts for One thing an attacker can do is exploit that the fact that many people use the same password in different computer systems So if I'm an attacker that can learn your password for Moodle Then I may of course get access to your Moodle account But then I may try that same password for your bank bank account so If people reuse passwords of different across different systems, then the attackers can take advantage of that How do you stop that? The suggestion the countermeasure there is not really practical How do I stop someone from not using the same password in Moodle as they use in their bank account? I cannot really stop it Maybe if I control both websites You could coordinate and check that say within an organization your account on Moodle on registration and so on They don't use the same password But generally over Outside of the system and yet in our control we cannot control what password a particular users user uses on different systems So that's a hard one Can anyone access your password for Moodle? Of course the person who who administrates the computer system can Remember our picture Your password when you registered is stored on this computer the server There's some person who has access to that server Who could in theory get access to the passwords? Who is that person? It's me So in theory I can access all of your passwords and in any Computer system where you've registered password assume the administrator of that computer system Can learn the password they shouldn't and they should but in There's no really technical ways to make it hard for someone to do that So again, we're using across different accounts is a problem not just if someone Gets it from hacking into this system But the administrator knows the password that you use on this system Therefore you shouldn't use it on another system When you submit your password, it's usually sent across a network. So if someone can intercept at this point Then if you don't use the right techniques, then Someone can learn the password as it's been submitted. How do we stop that? How do we stop someone from overhearing this password sent across the internet between you your web browser? and some website What mechanism do we use? Encrypt the password Okay, so we've learned the concepts of encryption if we want to send a message Across a public network like the internet and we don't want others to see that message We should encrypt that message What key do we use to encrypt? That's another problem. We have okay. How do we choose a key that both sides know? We'll see that maybe in a later topic when we look at web security some approaches for that many vulnerabilities of passwords But we still use them Okay, so there are many weaknesses and many computer systems are compromised due to these weaknesses but The trade-off has made that they have currently the most convenient for people to use So we do need still need to improve how they used Any questions about the vulnerabilities the difference between those six or seven vulnerabilities? remember them good idea or at least recognize if I If I say what's the difference between the specific account attack and a popular password attack? Think about that. We'll spend some time. We'll start it today and Start tomorrow We've got to spend some time on how do we store passwords? that is That database on the computer system when you register the password how should that be stored because One job that you may have in the future is creating Websites creating applications that store passwords. So there's some some ways to do that and some weaknesses But maybe we'll do that tomorrow because it takes some time. What we'll do is go do this one selecting passwords Much easier. How should we select passwords? some suggestions You want to create a rule that you can give to some other users your parents your friends The users of your website you want to create a rule to suggest them how they should choose a good password What would you tell them or if you don't know think of how do you choose a good password? How do you do it? right, so Make sure your password is a mixture of uppercase letters lowercase letters and numbers All right, so some mixture of different characters Anything else? So Yeah A long password so you should give a suggestion about How long the password should be? more than More than 12 characters good suggestion. I Will not ask you what your password is, but just think about maybe two or three of your passwords you use the most They think about them and think about their length How many people have one of those passwords which is less than four characters? All right, not many systems today will allow less than four some do less than eight eight or less on Some systems I have a password eight or less less than ten so ten nine more than ten Who has a password more than ten characters? More than twelve more than sixteen good right, not many people will be Have passwords more than say ten or twelve characters will give some statistics Shortly, but that's a big issue the length. Why don't you have a password more than 12 characters? You cannot remember it why not choose Right, you can remember some passwords more than 12 characters Okay, but yes if it's a Say random or semi random mixture of characters. It's hard to remember. What else is wrong with a long password? harder to remember and again Storage on the computer system in theory. Yes, but in practice not a big problem. What's the problem for you using a long password? Typing is hard Okay, all right There's not much difference to type in a password of six versus eight But six versus twelve well takes a bit more time Especially on a mobile device if you're using your phone to enter that password 12 characters versus six characters the convenience of doing a long password is an issue any other suggestions long password What's your suggestion for the long password? What length? What's the minimum length? Six or more okay Eight or more maybe all right. We've got mixture of uppercase lowercase and digits numbers long say eight or more any other suggestions Some people said them before don't use your name. Don't use your birth date Don't use things which are about you Don't use your username an obvious one don't use words from dictionaries So some rules let's have a look there are a few slides here which just show Some people have done analysis of some leaked passwords That is a list of passwords of many users has been leaked on the internet So someone has obtained that and done some looked at the statistics of those passwords Troy Hunt has a website which I've grabbed these figures from From different leaked passwords in this case from 300,000 passwords of different users Someone of that database has released it on the internet and some statistics in this case Analyzing the passwords see that The green one twenty five percent of those passwords one quarter a dictionary words So this is some indicator of how people do choose passwords 25% we consider a bad because they are from a dictionary How many words in a dictionary? about How many words in a dictionary in the order of hundreds of thousands? Okay, say in an English dictionary there may be a hundred thousand But if we have stemming and so on maybe up to a million, but not so many so In terms of just words usually in a language hundreds of thousands of words so Many people choose words from a dictionary That's bad because what the first thing that the attacker tries when they try and guess your password is one of those 100,000 words and we'll see the ways that that is quite easy to try with modern-day computers What else do we see? The blue one up the top is a person name So 14% of people chose a password, which is a name of someone not necessarily their name But a name of someone again what an attacker does if they're trying to guess a password If a word from a dictionary doesn't work try a word Which is someone's name so get a name list and you can download a name list to try them 8% a place name like a city or a country 14% were numbers so no no uppercase or lowercase letters just digits and then a mix of others like Some short phrase so not just a single word but a combination of words some keyboard pattern q-w-e-r-t-y Okay, the first five letters at the top of the the keyboard or other more complex patterns And again assume the attacker knows this so the first things an attacker is going to do if they are trying to guess a password is try the common ones and If they're trying just trying to find some accounts, then it's a good chance that they can guess a password some other Some other details. What about changing the language? Does it help? Not much if it's a computer trying to guess the password using a different language doesn't help much because the same statistics would apply usually in in that language so If it's a human trying to guess your password Maybe the language helps because the human cannot make so so many guesses But a computer can try many guesses within a short amount of time So a different language doesn't change things much. This is from some other analysis of a different database of passwords which would leak and Analysis of the length and this showed that most people chose between six and eight Character long passwords Few people will use less than six and in fact most computer systems today will limit you must have a password longer some value Few people use more than ten Okay, I think here in the class the statistics of this class because you're very security conscious you have long passwords But in the general population, I think most people will not use more than ten Okay, have you got a password more than 12 characters? No, most people would not but I see someone here was counting on her fingers. So I think you do good so just This is indicating that despite the rules that we may create Humans are going to follow this pattern and try and choose passwords in the order of six to eight characters Some other studies have been done in some common characteristics of passwords most use alphanumeric characters that is letters and numbers alphabet and numbers Most passwords are in dictionaries Not just your standard dictionary, but password dictionaries lists of strings that people have created which are common for passwords Many users reuse passwords across systems hands up if you reuse a password across different websites everyone does because nowadays You need passwords for so many different systems. You can't just Create a new one or a member at each one for each different website So that's a big problem There are some very common passwords So in all leaks of passwords that come up. There's usually some at the top okay another study has has realized that When you force someone to change their passwords every month or every few months, they must change their password Most users will try and change just a single character My password is Steve. I have to change it for Every month so the next month I change it to Steve 2 and the next month Steve 3 and Just keep changing it. So Forcing people to change their passwords doesn't always have the intended effect. So We will not study too much more about What are the best rules for choosing a password? But I think you should give us some thought about how you choose passwords and Whether it's a good approach and whether You can think up maybe a better approach for suggesting to others of choosing passwords and Some strategies include to make password selection better inform people of What why it's important to choose a good password what can go wrong if you don't choose a good password? Advise them on what strategies they can use Maybe think of a song name Think of your favorite song and choose the first letters of each word in that song name Okay, so easy to remember the song name and just think of the first letters In each word in that song name. It doesn't have to be long The resulting password may not be long. Okay, and it mixes up the characters So just an example of a strategy computer-generated passwords Instead of getting the user to select the password create one for them. It doesn't work very well Can I find an example? You can find software that would generate passwords for you Zoom out a bit. For example, this is some simple software that generates passwords Let's say When you create an account you must use this password Again, what's the problem with computer-generated passwords? Inconvenient okay, hard to remember. Here's your password a uf 7e y 3z inconvenient and That is hard to remember and sometimes hard to type in so it makes it Unlikely to get it correct all the time You can have variations where you generate pronounceable random passwords So this is roughly Random type passwords, but we could generate passwords which were pronounceable, but semi random to make something pronounceable you need the right combination of consonants and vowels Okay, so you need an e a e i o or you in the right position and it can be a Nonsensical word, but still pronounceable and people generally find it easy to remember pronounceable things So computer-generated passwords don't seem to work very well because users don't like them reactive password checking when a System automatically checks user passwords and lets them know if they have a bad password and proactive is when they are Selecting the password the system advises them on the strength And I think nowadays you see this in many websites when you register to password the website will give some visual feedback strong Fair weak and maybe show a color to indicate is the password you're choosing a good one or not So that seems to help people in selecting better passwords What we'll do tomorrow is look at how to store passwords and Then look at some of the attacks that can happen on someone who tries to get access to the password database


Hello, I am Krista Burns, the State Erate Coordinator at the Nebraska Library Commission. In this video, I am going to show you how to complete and submit the Erate Form 470, the first form in the Erate Process. This is a new version of the form just updated and released in December 2013. To begin, go to the USAC School and Libraries webpage. The URL is usac.org forward slash sl and in the menu on the left-hand side of the page under resources and tools, we choose the first option, apply online. This will bring you to the page where you can apply, submit all of the Erate Forms that you need to do all online. A couple of things to be aware of before you get started. Internet Explorer is the only browser that you can use to submit your forms online. Other browsers, it is the only one that is tested with the forms and they are programmed for it. Other browsers will cause problems, errors, you'll have issues working with the forms, and if you think you have submitted it, in reality, you most likely have not. So, in order to submit Erate Forms online, i.e. is the browser you must use. Another thing to be aware of is allowing pop-ups. In your browser, allow pop-ups to don't have them blocked, turn off your pop-up blocker. There will be warnings and instructional guides and help things that will pop up within all of the Erate Forms letting you know various information, so you will need to have that allowed. If you don't do it ahead of time, that's fine. The first time a pop-up comes up, it will let you know that something has been blocked and that Internet Explorer will take you through being able to allow pop-ups specifically for the USAC web pages. So, to get started with our Form 470, over here on the left, the very first button, the blue button, is Erate Form 470.  You can do this either by zip code or by entity number. If you're not sure what your entity number, you can do a zip code search, and it will bring up a list of all of the build entities that USAC has aware of that have your same zip code, and you can choose the one that is yours. If you do have your build entity number, you can just enter that. To find out what your build entity number is, you can look on a previous Erate Form. If you have applied for Erate in previous years, it will be listed on those forms. There is also an option on the USAC website to do a search for build entity number, so you can look up your library and see what the number is. And you still aren't sure what it is and can't find it. You can contact the Schools and Libraries Division Client Service Bureau at their 800 number,<PHONE_NUMBER>, and they can either look it up for you or if you don't have one at all, they can assign one to you. We're going to type in the build entity number that we know for our library. And so it was the only one that we knew the entity number. It only gave us one option here, so that is us. We choose Next. And this is the first pop-up that will come up. I want you to double-check the information in Block 1, your address and phone number information. This is information that USAC has already in their system based on your build entity number. So you need to double-check and make sure it's the information right down here that's grayed out right now, address and phone number, and fax number. If it's correct, great. You can go on and continue working on your form. If it's not correct and needs to be changed, you will need to contact the Client Service Bureau at their 800 number and let them know so they can update the information. And then once that information is correct, then you can go on and start a new form for our 70. We'll just click OK to get rid of that. The first thing to do in your form is to create a form identifier. This is a number that you can use to identify this specific form for this year. It's just a reference number. You make up whatever number you want. USAC, if they need to contact you for more information about this form, they will reference that number when they reach out to you so you know which form for 70 they are talking about, contacting you about. Next thing you do is choose the funding year. It will have the most upcoming funding year on here. So this is funding year 2014. Our address information is correct. Now we got to tell them what kind of application we're doing. We are a, we're going to do this as a public library. So we choose library as 5A and public under 5B. 5C is where we enter how many eligible entities are we looking for service for. In this case, we're just a single library. So just one. If you were in a consortium or a library with multiple blanches, you'd put how many of those there are. Next, we put down our contact person name who is in charge of submitting this form. And the contact person information address and phone number information goes down below. If that information is the same as the library's address and phone number, they've got this handy button right here that can copy that and pop it right down into the, into the boxes there. The last thing we do have to enter is our email address for our contact person. And you'll see just as it is common in most online forums nowadays, you have to enter your email address twice so they can confirm that you typed it incorrectly. And you also need to choose your preferred mode of contact. If USAC does need to contact you with more information, to ask for more information with questions, clarifications, what's the best way to reach you? You can choose telephone number, fax number, or email address. And we're going to choose email address for this one. The final item on this first page is consultant information. There are companies and or individuals out there who can help you do your e-rate form. They will, you'll pay them to either submit it in complete and submit it for you or they will give you advice and assistance. If you have contracted and paid someone to help you out with it, you would enter their registration number here. They are required to register with USAC to be an official legal consultant for this. If you haven't used one, you just leave that blank and go on to the next page. The next screen is where once you've entered your basic information, it assigns your form 470. It's a specific application number. You'll either want to write down this number or I recommend just print out the screen. You will be able, you need that number to get back into this application again if you get pulled away and you can't complete the form, this form when you're right here right now. You'll use that number to get in and to continue your complete form, picking up where you're left off and continuing on with the rest of the application. So print this out so you have that application number handy. Then click next to go on to the next page where we now tell what kind of service we are looking for, what services do we want to receive an e-rate discount on. There are three different categories of service that we can choose from here. Priority 1 services, which is your basic phone and internet services, basic telephone, local long distance, internet service provider, and then internal connections and basic maintenance of those internal connections. Internal connections are if you have construction done or a wiring put in or upgrading a computer lab that you have, that would be your internal connections. And then basic maintenance is the ongoing service or repair or upkeep of those connections. We're going to do for this example just Priority 1 services, so we check the box for that where it's going to do a basic phone and internet and choose next. And you can see here it specifies, it just tells you now that you've gone on that this is written reference Priority 1 services, cover telecommunications and or internet access. The first thing I ask for is if you are going to be releasing a RFP, Request for Proposal. For e-rate purposes, RFPs are not required. You only need to do one of those if that is something that your local city library, your local city or municipality requires. If it does not, you'd be able to check, no, I do not have one and I don't intend on releasing one. And then you tell them what kind of services you're looking for. And we're going to put some basic local, our local phone service wired. And you do want to tell whether that you want wired or wireless or cell phone so they know what kind of service you're looking for. We're going to say the library has three phone lines and put in our long distance as well. Those same three lines, we have long distance. Oops. And then we also have a fax number, so we'll put in a fax line. We have one fax line. And then also our internet service. And specifically we're looking for DSL. That's the kind of service we can receive. Now for the quantity or capacity for the internet service, you need to put in what speed that you want to have your internet service at. So how fast you want it to be. And you want it to be as broad and open as you can with this, not limiting it to only a certain speed. If you're currently receiving a certain number of megabytes per second, that's fine. But you want to be able to open in case you have other options when you finally hear from different service providers. So we're going to put a minimum here. We want at least five megabytes per second in our internet service. And then if you receive anything five or above, you'll be able to work with those service providers to get your service. So once we have all that entered, we do next. And this is where you can give some more information if necessary. If there is a specific technical service person or a person who they should be contacting any service providers for more information, you'd enter that information here. If the person who's your main contact, which in our cases are library director Jane, you don't need to enter that in here. And then number 13 is if there's any local, state or local procurement requirements for looking for services. If you do have them, you would check the first box and explain what they are in the text section down here. We're going to say no, we don't have any specific requirements that our state imposes upon us. And on to our next form page. Now it brings us back to that menu where we started with choosing what kind of service we wanted in case we forgot to do internal connections or basic maintenance. We could add them in now at this time if we wanted to. We're not going to, we're going to stick with our basic phone and internet and go on to the next part of the form. Here's where we list who the recipients of the service will be. Once again, you can search by zip code or entity number. We'll put in our entity number here. If you had, as I said, branches that you wanted to list, you need to list all of them or a part of a consortium. This is where you'd list all of those different individual entities. But we're just going to put in our build entity number, search for it. It comes up in the left-hand box here as our, who we are, and we highlight that by clicking on it. Add it to the build entities list on the right-hand side. And then click next at the bottom of the page. And then it just confirms, yep, this is who you are looking for. Hit next again. Now here's where we start our certification and signature, certifying all the legal use of the form and signing it. The first choice on here is telling them if you are a school or a library.  We are a library, so we are choosing 16B. Number 17 is if you need to submit a technology plan or not. We, technology plans are only required if you're doing it non-Priority One services. So those internal connections and basic maintenance of them. If you're doing just priority One services, the phone and internet, like we are, a technology plan is not required. So for our purpose, we would choose the second box here. If you were doing internal connections or basic maintenance, you'd choose the first box. And the rest of these certifications are the legal certifying. I'm certifying that you will have your 470 available for 28 days before you make your choice of service provider and go on to the second form in the E-rate process. Certify that you'll retain all the documents for at least five years. You need to keep everything, any forms, any applications that you receive for five years after the date of service that you certify that you know that there will be other things that you need to pay for besides the E-rate app of eligible services that you will cover those. You certify that this is, we'll only get the E-rate service if we actually get these, the E-rate discount is we get these services if we receive them from a service provider. You say you are the authorized person allowed to be submitting this form, that you review all the FCC requirements, that everyone will think here is legal, and all the FCC rules have been followed as well. Then you enter the information for the authorized person submitting this form. So this is our library director. So we're going to say her title is, and then we enter the address information for where our library is located, oops, there we go, in DC, in our phone number, in our fax number, and then enter the email address again here, and then who is our employer? And we're going to say this is Townsville's public library, and then we scroll to the bottom to go on to the next page. Now we've clicked all of our certifications and entered our contact person's information. And now this page is where you have entered everything for the form, and you still need to, a final step is to actually submit the form and then submit the certification. At this point you can do a print preview of the form, definitely want to do that. At the bottom of the screen here has a print, gray print preview button that will bring up your application in a new window, where you can go through and look over it and verify that all of the information is correct. You just scroll through it and make sure you've got all the application and applicant information, the services you're looking for is all correct, all of your certifications are checked off correctly, and all this information is correct. So use your browser to print out this so you have a copy of your full form for your own records. And then to actually submit the form you need to click the green, this bright fluorescent green submit button at the bottom of the page. Then on the next page we have a choice of submitting our certification either electronically or in paper. If you are submitting this e-rate form for the very first time, you've never done e-rate before, you need to do a paper certification. Once you submit a form of any of the e-rate forms in paper and they actually have your physical, your actual signature written out on file, then USAC will issue you a PIN number that you can then use to do all your future submissions and certifications electronically. So you have to figure out do I already have a PIN number or not. If I don't, do a paper certification. And if you need, you will need to print this out and actually mail it in. So paper certification comes up here, and when it goes over to it you'll see that it has all of the items that we checked previously are all marked on here. And here is the post section, the area we would type, sign the form and date it. You scroll down to, and this is where you would mail the form to the addresses at the bottom of the form. We recommend that you use the return receipt request from the post office. So when you do bring it in, request one of those, it'll give you a little, it'll be a green postcard. That means that when it is received at USAC, at their offices, they will have to sign the form and send it back to you, and then you have proof that they did receive your form. So do, if you're doing paper certification, do return receipt, send it to this address in Lawrence, Kansas to submit it. So you would print out this page, stick it in the envelope, mail it to there, and then click the done button. If you do have a pin number, if you have already done a previous form and you've been issued a pin number to use, you can do an electronic certification.  If you have that, you can do electronic certification instead. You click that button, and it brings up the same thing as you saw in the paper one. All the boxes checked that you had previously done. And here is where you can actually enter your pin number onto the form, and the date is automatically entered for you there. Enter that. Beneath that, you have to check the box to confirm your compliance. This is saying that, yes, I agree that this pin number does serve as my electronic signature in making this form all legal and submitted. And then scroll all the way to the bottom. Until you click this done button, this small little button at the bottom here, you have not actually certified the forms. You have to make sure you click the green button to submit the form, and then the done button at the bottom here to submit your certification. Once you do that, a box will pop up telling you that the form has been successfully certified, and your ID number is so-and-so. And then you can print this page for your records. You will also receive an email generated from the system to the email address you put on the form as the contact person, telling you that confirming that the form has been received. We'll click OK here, and you'll see now on this page where we had previously typed in our certification number, we now have the ID number. So print out this page to go along with the page when you've printed out the form, and you'll have your form, a paper copy of your form for your records, and a copy of your certification for your records all ready to go. And with that, you are done submitting your form for E-rate form for $470.


I'm so done.   That's a good man.  No, I'm a defensive player.    What what card is good? What card what card is good?  They definitely got a nerf it dude. They definitely got a nerf man coverage for real What are you asking me? The Eagles team team is good after tomorrow.  I just want to ban the whole chat dude. I want to ban the whole chat.  I just wanted like I like Yeah, Kaiser white makes the Eagles good dude. It's Kaiser white is the difference He's the fight.  Definitely the difference man What is these click-ons right now, dude? I'm so done.   Yeah Yeah, you need a linchpin.     He's got the ability. He's got the ability.  It's so bad. It really is so bad right now I'm getting stopped by every Tom Dick and Harry in the world right now Linchpin. That was linchpin. Oh My god, dude, what route in the game can we stop does anybody know what route we can stop it'd be nice to know But we don't know He will a pillow a pillow a my dog.          That's why you always just have pick artists boys Never doubt me Always they'll give you a chance.   How many times I gotta do it, you know how many times?  I'm just throwing the ball all willy-nilly May he got an accurate bro feel bad for him.  There you go Right back.  W? What are you doing?        Can the boys get a stop here?  He's really just not dude. This is unreal Like Patrick willis is just not I don't even know what to tell the boys.  Who's 93? Randall, right? Come on boys.  Oh my god.  Dude, my defense is bad man.  Come on, dude I'm getting so getting rid of Kelsey Kim.   I'm trying everything I got I'm unloading my I'm unloading my package now boys. I mean dawg.   It's that bad Yeah, I mean dude, he's playing really well. Yeah, he's playing well I don't know how to say dawg like I'm telling you that's why I just wanted to try that ability I just literally he's like he's through the agap every single play. I can't cover anything You know what? I'm like another touchdown on the field. You know what?   Let's go according to my man ed also known as the den master It works on everything got a spike here. We just have to do Well, we got a little bit of life if we can get a touchdown lifeington Gotta make sure it goes 10 yards. I'm kicking it like over 10 yards here It's a good spot. He drops that. Oh my god. Murray.     There's people running right at the quarterback. We're pressing the receiver.  What better defense can I play than that? Like is there a better defense in the game for curls than man press Three people through the agap and I can't cover a curl Seriously, like what can I guard right now? Like seriously? What can I guard right now? Hard flat? You don't want me to stop that Oh my god, man, like dude, I I'm going to see that one. Why would you see that? Why did you ever see that? Look at like all the running back picked him up that time Like dog, how is my deep blue this bad though, dude? Like how are we out of the play this much man? I trolled too much. I just trolled too much, dude


Right now at Appalachian Wireless, you can get the Samsung Galaxy S7 for just $99.99 and get a second one Service agreement is required on both devices serving you for the last 25 years with better service and bigger savings at today's Appalachian Wireless While fire officials and emergency crews are doing their best to control the woodland fires They are also battling the issue of house fires Around 8 o'clock last night in the topmost area of Knot County, the Kite topmost volunteer fire department and the Knot County Fire and Rescue Squad Were called to a house fire beside the Beaver Creek Elementary School Three trucks and 18 men responded to the scene, but the home was already engulfed in flames Fire crews worked throughout the night and were called back twice because the fire had rekindled However, despite their efforts, the home was a total loss Woodland fires are currently burning along the hillside behind the home But fire officials are unsure whether the forest fires are the initial cause of the home fire No injuries were reported and the family is being assisted by the American Red Cross Reporting in topmost for EKB news, I'm Shelby Still


The results of this study indicate that only one third of reproductive age women with disabilities have accessed any form of sexual and reproductive health SRH services in the past year. The most common predictor of SRH service uptake was having three or more children, followed by autonomy to visit health care facilities, living with a sexual partner, being exposed to radio, television in daily basis, autonomy to visit friends and relatives, discussing sexual and reproductive health with family members, and engaging in sexual activity after the age of 18 years. This suggests that access to information through mainstream media exposure, having full autonomy to visit friends and families, open discussion with family members, living with a sexual partner, having optimal family size, and starting sexual act at the recommended age can help increase the uptake of SRH services. This article was authored by Bayu Kelkarad, Anamut to Jel Tamiru, Giti Lake Ainalum, and others.


I'm Lea, here's Mohammed and we're going to introduce you to WikiData today. Yes, hi everyone. So in the course of the talk, if you do have a question just feel free to ask them in the chat and then we are going to try and answer them at the end of the talk. Yes, so let's dive straight in. What is WikiData? WikiData is a free knowledge base that is based on facts and references that anyone can edit and reuse. It is part of the Wikimedia projects and like all of us to start open projects, WikiData is multi-lingual and has no language barriers. Data in WikiData is released under CC0 license. That means WikiData's data is in the public domain and it has no exclusive intellectual property rights that is applied to it. WikiData is not a primary source of information. It only aggregates or collects structured data that is already available, some of which are linked to other databases. So it is not meant to be a place for original research. WikiData is made for humans and machines and is available for everyone to use, whether on other Wikimedia projects or outside of it. Next slide. So what is in WikiData? WikiData was launched some eight years ago and was originally created to solve the problem of unstructuredness in the plain text format that information in WikiData is rendered in and also to provide a central storage location where all of the different language WikiData can connect and talk to each other. Today, WikiData has since outgrown its intended purpose and has become so big and successful that it is not only the most edited Wikimedia projects, but WikiData's data is now used more outside of the Wikimedia projects than within it. There are more than 25,000 active editors. That means people who make at least one edit every month. WikiData is used across 800 plus Wikimedia projects in more than 300 languages. And it's interesting to note that the largest proportion of WikiData's items are in the category of scholarly items, comprising about 30% of the whole. Next slide. So far, people in bots have made more than 1.3 billion edits to WikiData and created more than 91 million items. This map you see here is a visual impression of geolocated items currently existing on WikiData. So the bright areas are items that have a coordinate location property added as a statement. Next slide. So WikiData has a vision. And what is this vision? WikiData's vision is to give more people more access to more knowledge. So WikiData gives access to information regardless of the language that people speak. Because WikiData is multilingual, it expects translations of so-called QO numbers into different languages. And so doing WikiData helps us support the smaller Wikimedia projects data. You know, by helping them to benefit from all of the work that the bigger projects are doing. And applications and projects outside of media are also able to benefit from the rich data sets in WikiData. So in a nutshell, WikiData can be taught off as an online repository of structured data that anyone can edit and reuse. Next slide. Okay. Now, how is WikiData connected to Wikipedia and to the other Wikimedia project? Among other things, WikiData can assist the project with more easily maintainable info boxes. So the table at the right corner, this article on WikiData is called an info box, which I'm sure you've seen before. WikiData is able to retrieve content on WikiData into those info boxes. And for smaller language, Wikipedia is like, you know, the band of Wikipedia or Welsh Wikipedia, that really leverages WikiData to see their content. And this is helpful because it helps to reduce editing workload for volunteers. Next slide. So what should you expect to see on a typical WikiData item? WikiData expresses relationships in the form of triples that use items starting with KO and property starting with P. Okay. And the item will typically be made up of at least one statement. So in this example you see on the screen, we have two statements about an entity called Douglas Adams. The first statement Douglas Adams was educated at P.69 St. John's College. What this means is that this statement is qualified by federal properties. That is the academic major, the academic degree, his start time, and then the end time. And qualifiers add more meaning to statements. So WikiData records not just statements, but also their sources. And as you can see here, this helps us to reflect the notion of verifiability on the project. So that statement Douglas Adams was educated at St. John's College. Has two open references that points to the source of that information. And the second statement Douglas Adams Q42 was educated at P.69 Brentwood School. Only has the qualifier start time and end time. And it has no references. So a single statement consists of a property that is made up of a value, with or without a reference or with or without qualifiers. Next slide. So a typical WikiData item looks like this. And you can edit by clicking on the edit button. It has a span symbol which edits next to it. As you can see, each item has a unique ID that is KO, followed by some number. In this case, the item Douglas Adams has a KO ID of Q42. And when you look at the top, there's a 10 box. We call it the 10 box at the top that contains the label in different languages. A description of the items that is more of a short phrase telling us what the item represents. It's easier in English that Douglas Adams is an English writer and humorist. Then there's the Ilias next to the description which, aside from the label, tells us what the item could also be known by here. Next slide. So creating a new item is as simple as going to any page on WikiData and clicking on create a new item. And once you click on create a new item, you get to fill in the form that is asking for a label, description, and an Ilias. And KO IDs are assigned automatically. Next slide. Next slide. Next slide, please. Right. So there are tools that allow us to edit WikiData more efficiently and make bulk edits to WikiData, such as quick statements and open refine. Please go to the previous slide. Okay. Yeah. Right. So yeah, quick statements and open refine allow us to make automated edits and changes to WikiData. Other tools are available that allow us to visualize WikiData's data. Some of them enhances the user interface of WikiData. And these could include scripts that editors can install or they could be gadgets that may be enabled in your preferences settings. Next slide.  But in 2018, we also started storing a new type of information in WikiData, which is lexicographical data, which is basically information about words and phrases in all kind of languages. And so you see on the left the data model that is a bit complex and that's why I'm not going to get too much into details now, but we can talk about this later. And you can see an example on the right, where we basically describe the word Luftballon in German and we indicate the language, the lexical category and all kind of informations that are not about the object anymore, but actually about the word and how it's composed of two words as we like to do in German and things like this. So again, if you want to know more about this, you can have a look at lexicographical data in WikiData or we can talk about it together later in the questions, for example. So WikiData doesn't come alone. It comes with a bunch of tools that have been, some of them have been developed by the development team of WikiData, some of them have been developed by the community themselves in order to do things more efficiently. That can be, for example, adding data and some of the tools have already been mentioned by Mohammed. That can also be matching data with other databases, querying the data, reusing the data. There are also a bunch of tools that are about watching the data and watching its quality, watching what edits have been done recently and so on. And you can find the page that is called WikiData Tools on WikiData to discover plenty of these tools and you can, of course, create your own. So we mentioned that the goal of WikiData is to be reused by everyone, but do we wonder who's actually reusing the data? Well, the first re-users of WikiData's data is actually the WikiData community itself, the WikiData editors, because all of these items are connected. So one item can be linked from another, the content of one item can be reused on one other and so on. The WikiMedia project, such as Wikipedia, but not only WikiMedia Commons, WikiSource, almost all of the WikiMedia project at that point reused part of the data that is coming from WikiData. And then we have companies from the biggest one to the small ones, because the data is in CC0, everyone can just reuse the content that they need. We have, of course, public institutions, such as museums, libraries, and so on. We also have journalists and, for example, data journalists. We have scientists and researchers and probably much more. And the thing is that we don't necessarily know who's reusing the data because it's here in the open, but there are probably many usages that we don't even imagine. So if you're reusing WikiData or if you would like to use WikiData data, let us know because we're always interested to discover more. Now, the question is how can one reuse WikiData? I'm going to present very quickly one of the most popular ways to query the data. I'm not going to get into details right now because there will actually be a workshop at the conference in two days on day three about the query service. I'm going to go there and discover more about how to use it. The query service is basically a sparkle endpoint, sparkle being a query language where you can basically ask questions to WikiData and get lists or visualizations as results. For example, here's the map of the airports of the world named after the person and the color of the dot represent the gender of the person. Or you can make a list of country flags that are including a sun because if the data is properly modeled in WikiData you're able to describe what are the different elements that compose a country flag. Or you can have this bubble charts with the occupation of accused witches because why not? That's the kind of data we have in WikiData. Now there are other ways of course to query the data. I'm not going to get into details right now but if you want to talk more about this you can for example join the WikiData meetups that are going to happen tomorrow. We have dumps of the data where you can download part of all of the data in a file. We have a bunch of APIs to access the data directly from your program. And on a WikiMedia project specifically the community developed a bunch of templates that are using WikiData's data using Lua. And now for something a bit different, WikiBase, you may have heard of it and you may even have wondered what's the difference between WikiData and WikiData? Well, WikiBase is basically the software powering WikiData and more precisely the MediaWiki extension that is turning MediaWiki into a database. And so WikiBase was started to power WikiData but it also started developing on its own. WikiData is still for now the biggest existing WikiBase instance but people can also install WikiBase directly on their server and basically create their own little personal or public WikiData. And the development is still ongoing there are all kind of super exciting features coming up soon and for example the ability to connect better WikiData and your own instance of WikiBase for example to be able to reuse data that is already in WikiData and to connect it to the data that you have in your own WikiBase. So if you're interested in WikiData if you want to know more there are a bunch of pages that you can find there is a help portal the project chat is the main discussion page on the Wiki where you can interact with the other editors, the community it's super important to get in touch with them if you want to get started with WikiData we also have a mailing list we have a newsletter that is called WikiSummary that you can find on Wiki but also if you subscribe to the mailing list you will also receive it and then we have some accounts on the social media, on Twitter there is a Facebook group, there is a telegram that is linked from the project chat and there is also an IRC channel so you can basically find people from the WikiData community everywhere so we are approaching the end of this session but it's not done we have more WikiData related sessions at the C3 in the Wiki Packer so for example tomorrow you're going to get an introduction to WikiData specifically for journalists and especially data journalists then in the afternoon we're going to have two WikiData meetups in German, the second one is going to be in English so depending on your preferred language you can attend one or the other or both and on day 3 as I mentioned before we're going to have a workshop to learn how to query WikiData as data with Sparkle so feel free to have a look and check them also in the main schedule of Wiki Packer thank you very much for attending this session these are our contact details if you want to contact us and of course you can now ask questions as we mentioned in the chat or with the hashtag and we will be very happy to answer all of your questions right now thank you for your input and the overview about WikiData there has been a few questions already answered by Joel in the IRC channel one was about the big dump of scholarly data and what scholarly data is and how this came to be in WikiData but there is one more question from the chat right now Tilla asked, can I add new types of data that are not yet tracked in WikiData? I'm wondering what do you mean exactly by type of data maybe you can give a bit more details because that can mean a lot of things WikiData the data model of WikiData is very flexible and it's absolutely not set in stone every week the community comes up with some new ways to describe things sometime we realize that there is an area of the world that we completely forgot to cover and then we create new properties to describe for example a certain type of I don't know of concept a certain type of building or objects or philosophical concept that we didn't describe yet so this is always in movement and in action when it comes to what we actually call data types which is for example a string of text or a date or a picture we have all kind of data types like this this is a bit more complicated and overall it's quite rare that we add a new data type and it needs a strong use case so we add that to the software I hope that it answered your question and if I didn't feel free to ask again yeah we've got a feedback the example till meant was there's an organization or a project called Parliament Watch in Germany there was one talk earlier today where they tried to track and scrape and analyze arbitrary protocols and one big issue they had was with structural data about all the members of parliament and how they are organized and stuff like that and if I remember correctly there actually was a project that tried to include the structural data of members of parliament in wiki data if I'm not mistaken absolutely it's a wiki project that is called something politicians all politicians I don't remember the exact name right now but indeed some people are already working on members of parliament and like political people in general so it's very likely that there is already a way to structure the data the best way is to contact the people directly involved on this wiki project wiki projects by the way is where basically people who have a specific topic of interest gather and can discuss about the specific questions about this topic so have a look at this project about politics and try to see if anything is missing but generally wiki data definitely welcome information about politicians, about member of parliament this kind of stuff what we do not do however like documents for example in that case the reports or the documents that belongs elsewhere maybe on wiki media comments for example if it's possible if the license allows it but on wiki data we'll be happy to store the metadata about them all right you will just posted the link to the wiki project every politician so if anybody looks for every politician on wiki data they will find the project so basically the bottom line is pretty much anything is possible with wiki data right? yeah thank you Jules and hi almost everything so on wiki data just like on wikipedia we still have some criteria to define what can get in wiki data and what not because we're aware that this knowledge base it needs to stay quite general and it cannot contain absolutely everything for example the community decided a while ago that they would not create them for each human living or who used to live on earth that's just not possible so there are some notability criteria that you can find in the help pages and I would say that the level of like how fine grained data should be has to be discussed with the community and the good thing about having wiki base also available as a separate instance of wiki data is that if some people want to work on a topic where they have some information that is very very specific and would maybe not fit the scope of wiki data they can create their own wiki base and then they can connect the content with what is already in wiki data so all together in this wiki base ecosystem yes pretty much everything is possible well the future is certainly here at least with wiki data thank you again Lea and Mohammed for your insightful introduction to wiki data and we're looking forward to joining you in your efforts thanks for your presentation thank you see you soon


Thank you very much. Thank you for including me on this panel. It's very exciting to be part of it with this with this great group and but an amazing correction of people and just to be part of them. PAA again is really exciting and great fun. So, thank you very much. I have a, like it's just a different tone or approach, which I think it's going to hopefully make the panel interesting. I start to sort of with this anecdote where Disney tweeted this very positive progressive message about pride month with the Mickey Mouse Funhouse people marching in the room for everybody in the, the, the, the, the really just terrible on response from the, from this random just sort of, you know, with where anybody anything associated with sexual orientation is about pedophilia. But so that's disgusting but what was interesting is that they put it in that I like this phrase the grand march of progress. The idea that on the liberal agenda of the gay is is is is the progress agenda so like we are on this, we're on this path forward and that's kind of what I'm interested in. And this is influenced by this, the seminar I teach every other year or so on families and modernity theories, where, where demography is very hooked up with or hitched it's hitched to or, or, or majority is hitched to demography on questions about sort of this about developmentalist things industrialism capitalism democracy individualism rationality scientific method. So the transition is, is the demographic transition is very much related to all of these things and some complicated on unsatable or tricky ways but definitely part of that whole story. In retrospect, maybe the second demographic transition seems a little desperate like we want to get our mojo back and be part of, like world history happening in a, in an incontrovertible or inevitable direction. But it seems almost quaint now I'm although not, you know, it's been. I love this academic demographic transition. But it's this idea that marriage and less less marriage and later marriage and more cohabitation of fewer children and more divorce and more single parents and flexibility and gender symmetry quality. And with the shift in values this mass low and shift from survival to individual self realization and democracy expressive work and anyway, I'm less doggy wrote this piece in 2014 sort of defending the idea against critics who said, you know, this is just a very western idea at the end of history remember when after the Cold War ended and everybody said that's it we've arrived this is the final state. Western democracy liberal democracy is the is the pinnacle of human achievement and now we just now it's just mopping up. Now we just need marriage equality you know and then we'll be will have really finally arrived. And I noticed he had this little caveat in there like oh sure it's going to extend to non Western societies, just as long as they have a greater accentuation of mess low and higher order needs and a solid democratic institutions protecting respect for diversity. As long as we have that, you know, then this, then the second demographic transition is assured, which does that really describe, you know, our society or the world we live in. So the spectacles now of guided missiles hitting apartment buildings in modern industrial European cities which, despite the kind of racist overtone of being shocked that that it's happening in Europe is happening in a in a developed a more developed society and that is messing with our narrative. You don't have to be racist to be to to see that there's a clash there. There are millions of refugees created in just a matter of weeks. Not to mention, literal war in the streets against the very concept of democracy in our country, and the existential threat of climate change that we're really basically not doing hardly anything about. So, the, what I want to kind of say in this talk is, we can't have this, we can't really have this idea that there's normal society with its normal progression. So the other thing is kind of getting in the way, and we're just trying to like study the core of what's really happening there's like normal, it's modernity it's on some kind of track, which, which we're trying to get a handle on, while we work around all these things like this giant pandemic and climate change, and this diverging growing inequality which makes it increasingly hard to characterize society in any one way. I'm going to send for Fugl or for Frickle, Andrew's going to explain this, the tendency of identities to be fragmenting. And then of this policy and coherence I mean the idea of modernity and demography is partly that we're going to use our scientific rationality to explain the way things should be. And then like the policy that emerges will be the result of the knowledge produced in some way there's some relationship between all the learning and studying and science we're doing and the policy that comes out of it and there's a lot of assumptions that, that the behavior of the society reflects the knowledge generated and there's anyway so I'll give some examples of how this is not really true. I forgot to start my time. Oh, no I didn't. I think I have seven minutes I think right. Okay, so I'll go for six. What are like New Orleans what's the population of New Orleans well, you know, up to 1960 New Orleans it was industrializing the cities were growing it was it was like modern modern society and urbanization. Well, so then the population start to fall well we had this kind of unique set of circumstances in America with the industrialization, especially in our industry and you know obviously in our industrial cities.  Okay, that's kind of the point I'm trying to make. So in the case of divergence you know we have this.  And yet we have this, this basic that that lines to show that women with college degrees are now much more likely to be married than women without college degrees and that's widening and, and not only does that make it hard to characterize like what direction are we going, but there's a big a well being inequality gap. It might be hard to see, but the dotted line show the ratio of single to married mortality for men and women. And in 2017 versus 2007 so the gap in well being in survival between married and single people widen just in that 10 years. So the origins. Our ability to sort of tell a story about one story, that's really undermined in the case of fragmenting identities. I love fragmenting identities I don't mean undermine in the sense of anything bad, but the idea that what we need to do and I, you know Gary Gates was right and Wendy is right we need to study these things, but the idea that we're going to like nail it and finally get it. I think it's just a misnomer I mean this process has its own momentum at this point, and we're just going to generate more and more and more identities all kinds not just about sex and gender. But that's just that's just the way we're going experiences if people have become identities. Now, and like you notice each of these has a flag it's not just that you've experienced something is that you now carry this flag. I just think we're going to stop. So it has its own. Okay, so you can't tell one story. In the case of of a policy and coherence I think this really undermines us in ways that we really have not that it's hard to grapple with and we might not be able to grapple with it. Consider abortion I mean when the Supreme Court overturns Roe versus Wade if they do this year or you're soon whenever that is, we're going to have some states that are constitutionally protecting abortion and some states that are immediately criminalizing it's going to be a felony in Oklahoma or Kansas or wherever just passed that new law. And there's no, there's no rationality to to either to that to that disparity or look at the child tax credit. So it's not a political evidence based scientifically designed intervention that lifted millions of children out of poverty, and we threw it we threw it away because it was inconvenient for Republicans. So it's just that there's not even a policy case made for eliminating it they just don't like it so they got rid of it. Let's go brand. So like what is the what so so we're going to sit here and be like all rational with our science. And it seems to be having one. That's what we expected to do. So how should we interpret change. I guess, well I don't know. There's there's kind of a fetishization of normality that's all I'm going to say and I don't want to pick on the Census Bureau for their projections I don't know how to make projections, but their projections total fertility rate is 1.84 for the next 40 years. And their projections life expectancy continues to just kind of increase. It hasn't increased in, you know, 10 years it's fell a lot. Two years ago it's probably not going to be increasing a lot anytime soon, except maybe to get back a little bit of what we lost in the pandemic. But this kind of assumption we all learned it in demography it's like how fast is life expectancy going to increase. That was the big question I taught methods courses where we asked that question. What if it's just not going to increase anymore. So, how should you look at it well, you know we have a giant change this was a very big change in marriage in the last year. I'm just from the this is just from the vital records data. And you could say okay well at this rate the last wedding will take place in 2025. Or you can have the more moderate view like we're in an era of change here it's going it's in the direction of downward ignore the pandemic year just focus on 2019 in which case we've got until about 2075 to the last marriage. I'm being tongue in cheek, or you could just sort of take like we're in an era we're in the, we're in the period of about seven marriages per thousand. And of course there's fluctuations, right none of those are really ideal ways to do it and I think the problem we have in general about the future is that you can't see the future, the president gets in the way of seeing the future. I love this, just like penumbra is the penumbra is the part the shimmery part of the eclipse. There's the light of the future coming out but it's just the edges of it so we just get glimpses of it, and we're stuck back there. And I think there's a there's, I guess what I've become skeptical about it, about attempts to put us on a track to say that we're on a track from here to there there being someplace in particular. I love the future I want us to be able to see the future but it's really hard to do that. So my advice is not to not to not to stop asking big questions at all. But just to avoid treating the actual events of the day as anomalies are things that are in the way of our historical building they are what's happening they are our society. And to watch out for progressives narratives that assume that they know where we're going. We have momentum, you know, demographers we understand there's such a thing as momentum, but, but we can't assume that there's a normality which is coming which will be back at some point. You know it reminds me of the when the FBI decided not to count the deaths on 911 as homicides, just just messed up the statistics basically but they were murders they took place. It was just an awful lot of murders that year, but they still don't count them as homicides in that year. Anyway, that kind of thing drives me not so do family demography in light of disasters inequalities identities and policies as messy and coherent unpredictable features of society not as bugs in the ointment of modern progress. My concluding sense. Thank you.


We're here with Lisa Prince, who's a nutrition specialist at Vance Weight Loss and Fitness here at Basics Fitness Center. Lisa's going to talk to us today about healthy snacks, especially this summer. Lisa, you have some great ideas for healthy snacks. Thanks, Linda. So I like to focus on all the fresh fruits of the season in the summer, like watermelon, kiwi, grapes. But I like for my clients to combine those fresh fruits with a healthy nut. Oftentimes people say to me, but Lisa, aren't nuts really high in calories? Not in moderation, and they have lots of health benefits. So 14 almonds is just 100 calories, but they help lower cholesterol and prevent heart disease. 30 pistachios are only 100 calories, and they have 20% of the daily value for vitamin B6, and they also have copper. Walnuts, two tablespoons of walnuts are 100 calories, and they provide omega-3s and help lower cholesterol. A handful of walnuts, after a meal high in saturated fat, helps reduce your risk of heart disease. So that's why I like to combine nuts and fruit together for all your healthy summer snacks.