Get ready to be bombarded with “May the Fourth be with you” puns regarding your passwords and identity, as this year May 4 is not only Star Wars Day but also World Password Day.

Leading up to World Password Day, I received dozens of emails about how bad our password hygiene still is, studies about poor password management, reminders to change passwords, pitches about password managers and biometric options to replace passwords, reminders to use multi-factor authentication (MFA) as well as the standard advise for choosing a stronger password. Some of that advice contradicts NIST-proposed changes for password management.

Although NIST closed comments on for its Digital Identity Guidelines draft on May 1, VentureBeat highlighted three big changes. Since this is NIST and changes to password management rules will eventually affect even nongovernment organizations and trickle down to affect pretty much everyone online, it’s important to look at them. Those changes, according to VentureBeat, boil down to:

No more periodic password changes. No more imposed password complexity. Mandatory validation of newly created passwords against a list of commonly-used, expected, or compromised passwords.

Right now, NIST is working on developing SOFA-B Framework; that is short for the project’s full mouthful of Strength of Function for Authenticators – Biometrics. It will establish a standardized method for comparing and combining authentication mechanisms and “focuses on three core concepts: False Match Rate, Presentation Attack Detection Error Rate, and Effort.” By creating SOFA-B, NIST hopes to “achieve a level of measurability similar to that of entropy for passwords.”

SecureIDNews reported:

Working with the biometrics community, NIST has a five-step approach to creating the SOFA-B framework:

1.       Analyzing the attack points of a biometric system

2.       Requiring baseline security to mitigate common attacks

3.       Quantifying factors specific to biometric systems

4.       Differentiating attack types as random attacks or targeted attacks on a known user

5.       Measuring strength of function for biometric authenticators

Why should you care? Because the basis for biometric updates in SOFA-B has worked its way into NIST SP 800-63-3, aka NIST’s Digital Identity Guidelines draft. When it’s done, you might be able to compare the biometric security in one device, say a smartphone, to another.

We’ve been hearing that passwords are dead for years, yet for most people wanting to log in on most places online, you still use a username and password—or sign in via another site such as Facebook or Google where you were authenticated via username, password and hopefully 2FA.

Most everyone knows that, as a whole, people suck at setting up strong passwords and changing default passwords. In fact, according to the latest Verizon Data Breach Investigation Report, “80 percent of hacking-related breaches leveraged either stolen passwords and/or weak or guessable passwords.” Furthermore, the report states, “If a username and password is the only barrier to escalating privilege or compromising the next device, you have not done enough to stop these actors.”

Under the discussion of breach trends in Verizon’s DBIR, it states:

Even if you are not breached, there are armies of botnets with millions (or billions) of credentials attempting to reuse them against other sites. In other words, even though components of authentication weren’t compromised from you, it doesn’t mean they were not compromised. Again, if you are relying on username/email address and password, you are rolling the dice as far as password re-usage from other breaches or malware on your customers’ devices are concerned. Those are two things you shouldn’t have to worry about.

Although a basic username/password login is not enough, despite what some of the pitches claim, I can’t imagine this will be the last World Password Day. So, have a care about your passwords as they are the key to open the door to your online life, business secrets or even networks. I encourage you to use a password manager and to set up 2FA on every site that offers it. Don’t forget to change those shared passwords for online streaming sites either!

Happy Star Wars Day, as well as World Password Day!

Microsoft’s Office applications haven’t changed much over the past 25 years. Indeed, a time-traveller from 1992 who knew how to use Word 5.5 for DOS or Mac System 7 would have to get used only to the tools moving from vertical menus to the horizontal ribbon.  

Yes, Microsoft successfully brought Office back to the Mac after years of neglect. It also used the acquisition of Accompli and Sunrise to quickly get high-quality email and calendar apps onto iOS and Android — those teams are revitalizing the Outlook applications on PC and Mac, and the new To Do service is trying to do the same thing, based on the popular Wunderlist app. Yes, there are some clever new tools in Word and PowerPoint that use machine learning to improve spell checking and automate slide design, and the monthly updates keep adding more features. And, yes, the hidden gem that is OneNote is finally getting significant investment to make the note-taking tool more useful on more platforms.

But after all this time, a Word document still looks like a Word document, a PowerPoint presentation still looks like a nice slide deck, an Excel spreadsheet still looks like a spreadsheet, and an Access database still looks like a searchable, sortable, customizable card catalogue. Meanwhile, cloud services have become far more powerful ways of capturing and using information.

Linking data not documents

Power BI takes massive data sets from multiple services and data stores and creates visualizations that would need deep expertise to create in Excel. Drag and drop programming in Microsoft Flow lets you take information from services like Twitter, run it through machine learning APIs like sentiment analysis and use it to generate alerts or control internet of things (IoT) device like a lightbulb. PowerApps lets you add information to the very specific workflows that are too specific to your business to be covered by a CRM system or even industry-specific software.

For example, if you’re a small business that inspects and repairs engines and generators, you can use PowerApps to create your own app to capture all the steps of your checklist on a phone or tablet, including taking photos of the machinery and calculating the measurements instead of filling out paper forms that end up as a document. For that PowerApps customer, doing those calculations was the single most error-prone step of the process. And Microsoft’s new Health team is trying to do something similar for doctors, who (in the US) currently spend 102 minutes a day filling out forms.

Dynamics is increasingly becoming Microsoft’s third commercial cloud, alongside Azure and Office 365, and that’s where Microsoft has been “reinventing business process” as Nadella puts it. That starts with shifting software you used to run on your own servers into a cloud service that’s managed for you and updated regularly with new features, to compete with both Salesforce and ERP tools from companies like Oracle and SAP, and unifying the system of record for your business with the system of engagement that tells you about your customers.

This is where the LinkedIn integration that Microsoft is just starting fits in. Currently it’s being used as a source of information to understand which people are relevant to your sales pitches (Dynamics and the LinkedIn Sales Navigator show you to whom you should send what information and when, and you can now buy them together as the Microsoft Relationship Sales Solution for $135 a month), and for keeping track of employees and potential hires on LinkedIn.

The new Dynamics sales tool looks at email and calendar information compared to who you’re connected to on LinkedIn to see if you’re meeting and talking to the right people, and it might suggest a coworker who could help make a connection that would help your deal. Instead of filling out a document in Office and sending it to a human, in the future you might chat with a bot to kick off a business process. That’s intelligence aimed at making you more productive, and this broad notion of productivity covers everything from blockchain-based smart contracts running on Azure to being able to have a business conversation with live translation through Skype – to the MyAnalytics add-in for Office that uses the Office Graph to tell you how much time you spend in meetings and whether you’re missing email from key contacts.

In a blog post, Nadella wrote about “systems of intelligence that are tailored to each industry, each company, each micro-task performed by each person, systems that can learn, expand and evolve with agility as the world and business changes.” And the approaches outlined above do something very different with the information that would otherwise end up in a document as just another step of a business process — but what about changing those documents?

Documents get intentional?

For the past quarter-century, the cash cow that is Office has simply been too successful to be replaced, despite several projects targeting it over the years.

Some of you may remember that, back in 2000, part of the original .NET vision was to create a “universal canvas” that “[built] upon XML schema to transform the internet from a read-only environment into a read/write platform, enabling users to interactively create, browse, edit, annotate and analyze information,” Microsoft wrote.

Over the years that canvas was going to be the web browser, or XML data structures in documents, but what we mostly got out of it was a more reliable, XML-based file format for Office documents that isn’t really used for any of the clever things you could do with a semi-structured document. There are, for example, tools that can automatically combine information from a system like Microsoft Dynamics to generate an invoice or a marketing document, but the majority of documents are still manually generated, and they look very familiar.

The most interesting recent attempt from Microsoft to come up with a new kind of document since OneNote (which is still familiar as the digital version of a paper notebook) is Sway. Sway uses machine learning-driven design and layout to take your information and make it into something that’s a bit like a web site and a bit like a mobile app and a bit like a slide deck (and a lot like what hypertext might have evolved into if prosaic documents hadn’t been more useful for most people). If apps are for building a workflow out of inputting information, Sway is about persuasive ways of conveying information.

Now Microsoft is buying Intentional Software and bringing the creator of the first WYSIWYG word processor Charles Simonyi back after 15 years to work under Rajesh Jha, executive vice president of the Office product group and co-author of some significant patents about using XML for documents.

Is reinventing documents, and the Office applications that create them, the next step in Nadella’s promise to reinvent productivity?

Simonyi’s vision

Intentional Programming was Simonyi’s idea for making development easier for non-developers using domain-specific languages that describe all the details of an area of expertise, whether that’s marine engineering or shoe manufacturing. “The Intentional platform can represent domain specific information both at the meta-level (as schemas) and at the content level (as data or rules),” Simonyi notes in his rather vague explanation of the acquisition; it’s all about moving from generic applications that help anyone create a generic document like a letter or an invoice, to much more specific systems that incorporate rules and definitions but are still as easy to use as Word and Excel.

An expert in pensions, for example, could write down the details of a pension contract as mathematical formulas and tables (like a spreadsheet) and test cases in text descriptions (like a Word document), and have that description act as the rules of the pension in code. Instead of writing business applications to do what those expert users need, developers would write a tool that allows the experts to create the applications themselves by specifying what the application should do. In the example above, the pension system would be an end-user tool like a spreadsheet, but it would always follow the rules the expert specified — and it could be updated by the expert without needing the developer to come back and help.

It’s a grand vision; when Simonyi wrote a research paper on it in 1995 he called it “the death of computer languages.” In the 15 years since Simonyi left Microsoft (taking the idea but not the code for his research project with him and rewriting it twice), Intentional Software hasn’t shipped a product publicly, despite demonstrating its Domain Workbench for creating domain-specific tools in a variety of languages some years ago. The company has a handful of customers, including consulting firm Capgemini, which worked with Intentional Software to create a pensions “workbench,’” though it’s not clear whether that was a pilot or a live project.

But cloud services, machine learning and new approaches to development mean that revisiting ideas that were impossible to develop ten or 15 years ago can yield very different results now. Plus, including them in the Office platform has major advantages.

For Intentional Software, building business tools as a small software company meant competing with every other software development tool on the market, including the ‘low-code’ app creation services like Salesforces Lightning and Microsoft’s own PowerApps. Intentional’s tools could have more impact by being built it right into the Office applications where billions of people get their work done —  and they could make use of an increasing range of add-ins in those Office applications to pull in information from services and route documents into different workflows.

Office as a service

The intelligence and machine learning services that Microsoft is investing in so heavily can help you do research, or let you validate addresses and find out if the person who needs to sign a contract is available before you route a document to them for signing. It’s the first steps of what Nadella promised when he wrote about reinventing productivity, saying that “productivity requires a rich service spanning all your work and work artifacts (documents, communications, and business process events and tasks). It is no longer bound to any single application. It’s a service that leverages the cumulative intelligence and knowledge you and your organization need to drive productivity.”

The focus of Office 365 is becoming less about the individual productivity of creating an Office document, and more about teamwork, or ‘social productivity, as Nadella puts it. That includes Microsoft Teams, Skype and Cortana, as well as Word, Excel and PowerPoint, where you can collaborate on documents and reuse information from SharePoint.

Today, all these new services still sit alongside the familiar document interface, or take you out of Office onto web sites, rather than changing the experience of working with information. The Intentional platform could give us Office applications that make working with business information — and the rules and policies that govern it — much more like using generic applications to create generic documents. It could deliver on Microsoft’s ideas about moving “from tools that require us to learn how they work, to natural tools that learn to work the way we do.”

It could also build on the ‘business application platform’ Microsoft is creating between Office, Dynamics and PowerApps, where the system knows what entities like customers, suppliers and invoices are, using the Common Data Model (CDM). The CDM connects your business information in a graph that a domain-specific system could take advantage of, so the pension-specific language from the earlier example wouldn’t have to specify all over again what a job, salary and contract are.

As Simonyi puts it, “imagine the power of an ontology consisting of thousands of terms covering most of the common activities that comprise our personal and professional lives ranging from life transitions, education, entertainment, buying and selling.”

Simonyi also talks about building on pen computing (like the Surface Pro) and wall-sized screens (like the Surface Hub), as well as the Common Data Model, and says Intentional has “patterns for distributed interactive documents and for views for a universal surface.”

Bill Gates has continued to be enthusiastic about Simonyi’s methods and ideas and mentions him frequently to current Microsoft executives. It’s not clear whether Nadella is bringing Simonyi back to create new kinds of Office applications that might be a better fit for what we want to do with business information, or whether Simonyi is coming back because he wants to use all the resources that Microsoft already has created that fit in so well with his vision. It’s also not clear whether the ideas of the Intentional platform will fit better at Microsoft than they did in 2002, when many Microsoft divisions decided against adopting them.

Whether or not it succeeds, bringing Intentional to the Office group certainly signals that Nadella is interested in shaking up the familiar Office applications and documents and creating something quite different. It’s yet another unexpected but apparently logical step for his attempt to reinvent productivity, which is really less about productivity apps and much more about what you accomplish relative to the effort you invest. It’s “simply a way of thinking about how well we use our time” as Frank Shaw put it in a 2014 post on the Official Microsoft Blog, or rather more grandly, “it’s the engine of human progress.”

This story, “How Microsoft plans to reinvent business productivity” was originally published by
CIO.