Great post! Bletchley Park cracked Enigma-encoded and other intercepted messages, and combined this information with signals intelligence to anticipate enemy ship routes, troop movements and planned attacks. The technology used today may be different, but there are many similarities. Bletchley Park was unlike anything else at the time, and I encourage anyone with an interest in security to read about their history. Hopefully, there are concentrated efforts like this currently underway. As Sarah points out, the people who worked there and their accomplishments exemplify the true spirit of information security.

Good point. Knowing just the last 4 could be good enough to launch a successful phishing attacks. Also, per the book Zero Day Threat: "A prospective borrower filling out an online loan application can submit less than nine correct digits of [a] Social Security number and just three matching letters of the first name of someone of good credit standing...The three letters of the first name don't even have to be in the same order or sequence." So for some systems just having partial information is just as good. Scary.

That would be great if update downloads were free--this should be required of all ISPs. It would take some logistical work by the OS vendors and internet providers, but would definitely address the problem. And true, many major updates are also available via CD--I just updated my Ubuntu from 8 to 9 by getting a CD off eBay. It's the customer not getting all the smaller updates and security patches that can be the problem. Thanks for the input!

Speaking from my own experience, I recently switched to a 5GB/month plan. It was a new experience to have to keep track of what and how much I was downloading. It was toward the end of the billing cycle when I got a Mac Software Update notice telling me I had over 400MB of updates ready for download. So I had to make a choice: update my OS or wait until next month and do it then. I also had the choice not to update at all. For customers on the 400MB/month plan, will they always choose to update their OS above all else? I posit that PCs of customers with bandwidth caps may be more likely to be compromised, because they are less likely to be updating their PC due to cost. I also suggest that the current update process has an unlimited bandwidth mindset. I agree a physical delivery method isn't the best either, but I do think we need at least a second (less costly) option for consumer to choose from. Thanks for a perspective from outside America!