Skip to content
December 11, 2019 / Jim Fenton

Japan/Singapore Day 6: Exploring Tokyo

November 13, 2019

We got a little later start today. Having finally figured out a little about Japanese breakfasts, we grabbed glasses of orange juice at the hotel and headed out on the subway for Ueno, where we wanted to see a temple and the Tokyo National Museum. In one of the subway stations along the way, we found a good local bakery/cafe, and it made a good breakfast.

Arriving in Ueno, we quickly entered the park and walked toward the museum. We stopped by the Ueno Toshogu shrine along the way, from which we got a good view of a noted five-story pagoda that is actually part of the zoo.

National Museum

There was a special exhibition at the National Museum relating to the new emperor’s coronation, and it drew a big crowd. Nevertheless, the line to get tickets and get in weren’t too long. Much of what we saw at the museum had to do with early artwork and writing dating back 1000 years or more. There was also an exhibit on conservation of historic materials, featuring some artifacts that were threatened by the terrible 2011 earthquake.

Following the museum, it was time for a late lunch, and by then I was ready for something relatively hearty. So we went to the Hard Rock Cafe in Ueno Station, which might be “cheating” in terms of not eating Japanese food, but is somewhat of a tradition from some of our other overseas travels. We then made our way to Asakusa, where Kenna had found a description of an interesting temple, and Jim remembers as a good place to shop.

Asakusa Market

We were walking through the market in Asakusa toward the temple, when I felt a tap on my shoulder. It was Dennis Dayman, a friend from the email anti-abuse community, who had just arrived in town for a conference he was participating in. It was good to see Dennis; what a small world we live in.

The temple was enjoyable and we learned a bit more about some of the traditions there from some signs that were in English. Some pieces of paper that we had thought were prayers turned out to be fortunes; you pick up a fortune (for 100 yen) and if it’s a good one, you keep it; if it’s not, you tie it onto a rack at the temple and leave it behind.

We continued to a large department store that I thought I had visited previously. It appears to have been subdivided into several smaller stores that share the building. Things change in Japan as they do at home.

Asahi Beer Hall and Skytree Tower

From Asakusa we took a bit of a walk out to the Tokyo Skytree Tower (in retrospect, perhaps we should have taken public transit). The tower was beautiful but crowded, and it had gotten dark, so we didn’t pay the admission fee to go up the tower. Instead took the subway back to Asakusa. We stopped at a beer hall run by Asahi Beer and had a light dinner there before returning to the hotel.

Total walking today: 9.1 miles, 25 floors climbed

This article is part of a series about our recent travels to Japan and Singapore. To see the introductory article in the series, click here.

December 10, 2019 / Jim Fenton

Japan/Singapore Day 5: Intro to Tokyo

November 12, 2019

We again awoke to a beautiful clear day. Once more we sought out a nearby Starbucks for breakfast, which was fine but getting to be a little boring. We continued with a short walk to Tokyo Tower, which is actually only one of two towers with observation platforms for tourists.

Mt. Fuji over Tokyo

After paying the admission fee and taking the elevator to the platform, we started looking around, came around a corner, and — there is Mount Fuji! Today was apparently an unusually clear day; we were told that it isn’t usually visible. That made up for only getting a glimpse of the mountain from the train yesterday.

After leaving Tokyo Tower, we headed for the subway to the Ginza shopping district. We had a fine time exploring the local flagships of stores we know (Apple, Uniqlo) as well as one of the big Japanese department stores. We looked into eating lunch in one of the department store restaurants, but they were all quite pricey so we looked elsewhere.

Leaving the Ginza, we found a Japanese “diner” which was fine, but not notable, for lunch, before walking toward the Imperial Palace grounds. We were impressed by the huge immaculate lawns and grounds, and that this head of state still has a moat around his residence. A bit more walking brought us to the East Gardens of the Imperial Palace, which are open to the public and as expected both elegant and peaceful.

Next we walked to Tokyo Station and were quite impressed by its size, since we ended up having to walk quite a distance to get to the other side of the station, where we finally stopped at a Starbucks to rest our feet.

Shibuya Scramble Crossing

One of the things we had heard about was the huge “scramble crossing” in Shibuya, one of Tokyo’s neighborhoods, where several streets all converge in a single intersection. So we took the subway to Shibuya, and found throngs of people everywhere. The crossing itself was crazy and fun — when the pedestrian lights change, people go every which direction, and some even stop for selfies in the middle of the crossing!

We had been wishing for more sushi, so we found a sushi restaurant on the 4th floor of a nearby building. We noticed that, unlike in the US where restaurants tend to be at or close to the ground floors of buildings, there are buildings here with different restaurants on each floor. There are signs at ground level telling people what restaurant(s) are on each floor, and apparently these restaurants gain a reputation that allows them to make a go of it. In any case, we had an excellent dinner at the sushi bar, and felt a friendliness from the staff that we really enjoyed.

Kit Kat selection

After dinner, we were stopped by someone from the local tourism board to do a survey (they didn’t ask any personal questions, fortunately) and she pointed us at a “mega” souvenir store nearby. So we walked over there and found a very impressive selection of Kit Kat candy. We had heard that Kit Kat was a “thing” in Japan and this was an example. We picked up a few packages to take home.

Overall, Shibuya is just a fun place to be — lots of music everywhere, young people having a good time, and we felt safe the whole time. The tourist board seems to be doing a very good job. We highly recommend the place.

Total walking today: 10.9 miles, 16 floors climbed

This article is part of a series about our recent travels to Japan and Singapore. To see the introductory article in the series, click here.

December 10, 2019 / Jim Fenton

Japan/Singapore Day 4: Kyoto to Tokyo

November 11, 2019

Today we are traveling from Kyoto to Tokyo. This seemed like the best day to do so, since many of the museums and other attractions in Japan close on Mondays. We opted go to Tully’s Coffee, also around the corner from the hotel, for breakfast as a change-of-pace from Starbucks breakfasts. The breakfast choices (and the coffee and tea) were passable, but not as good as Starbucks has been. (We haven’t tried any of the local coffee shops yet).

Kenna inspects a loom

After repacking our bags and checking out, we made our way to the Nishijin Textile Center, one of the few museums open on Monday. We got there just in time for a short kimono fashion show, after which we were able to walk around a few exhibits, see a live weaving demonstration. There were many handmade and custom items available in their store.

For our return to the hotel (to retrieve our bags), we took a slightly different subway route through the shopping district just north of Shirl station. There we found the Daimaru department store, and stopped for lunch at the restaurant on their top floor. One of the things we noticed about the small restaurants where we have been eating is that they specialize in a particular style of Japanese food (sushi, udon, etc.) and we both have to want the same thing. The Daimaru restaurant has a broad selection, displayed in models in glass cases at the entrance and ordered by number. I was able to get soba noodles with some sushi, and Kenna got a donburi with miso soup. This was a good experience.

Shinkansen train

We picked up our bags and took the subway to Kyoto station. Tickets on the Shinkansen (bullet train) were easy there is a train every few minutes. Upon getting to the platform, we were amazed by the number and size of Shinkansen trains arriving and departing; they handle a seriously large number of people every day.

We were hoping to see Mount Fuji along the way to Tokyo, but unfortunately we were on the right side of the train, Mt. Fuji was on the left, and all the seats on the left side were sold. We did get a glimpse, but not much of one because the windows across the train car weren’t high enough to see the top. We were a little disappointed.

After arriving in Tokyo, we took a subway to the vicinity of our hotel, the Celestine Tokyo Shiba and walked the short remaining distance. This hotel has a substantially different feel from the hotel in Kyoto: the Kyoto hotel was in the middle of a shopping district and this one is in the middle of a business district (in fact, right next door to NEC Headquarters). There aren’t nearly as many places nearby to eat, but it’s otherwise very centrally located. We had dinner after arriving in the hotel’s lobby bar; the club sandwiches were good but a little expensive.

One nice thing at this hotel is the lounge down the hall from our room that offers coffee, tea, juice, and (for a fee) beer and wine. It’s also a very good place to work, which is helpful given the small (but usual size for Tokyo) hotel rooms.

Total walking today: 6.1 miles, 9 floors climbed

This article is part of a series about our recent travels to Japan and Singapore. To see the introductory article in the series, click here.

December 8, 2019 / Jim Fenton

Japan/Singapore Day 3: More Kyoto

November 10, 2019

After another breakfast at the Starbucks next to our hotel, we took the subway and a light-rail line to Arishiyama, on the west side of Kyoto, on the recommendation of Emi, a friend of Kenna’s. Emi’s dad was from Kyoto, and Emi provided us with beautiful hand-drawn maps he had made that were immensely helpful.

Bamboo Forest

It was a nice change of pace to get out of the center of the city. It was, however, a sunny Sunday afternoon during the fall color season, which attracts crowds. Once there, we took a path through a bamboo forest, which was impressive in size but made us wonder how they kept the bamboo from spreading everywhere. We eventually turned off into a private garden that charged admission; it gave a chance to walk through a well-kept Japanese garden and enjoy a fine hilltop vantage point. It was well worth the price of admission for this. We then followed a path into a nearby park and along the Katsura River.

Crossing the river by a nearby bridge, we found an udon restaurant for lunch. Mine (udon with tempura) was quite good, but the beef with Kenna’s udon was less enjoyable.

Kiyomizu Temple

After lunch we took the rail and subway across town to the north end of Muruyama Park and walked through it and then through a popular shopping district with many traditional stores. Many young people in couples and groups were dressed in traditional costume for a day out. We arrived at to Kiyomizu Temple, one of the more notable Buddhist temples in the Kyoto area. We admired the architecture and artwork, but wish we understood more about the various rituals going on there, such as the ringing of a gong and the various prayer sites.

Leaving the temple, we walked through a huge cemetery leading back into central Kyoto. At this point it seemed like we had done quite a bit of walking. We made our way back to the subway, and north and east to a district known as the geisha (Gion) district. We walked around a bit, finding a place called Gion Corner where there are twice-daily performances, but decided not to attend one. The restaurants in the immediate vicinity were rather expensive, so we took a break from Japanese food and stopped for dinner at an Irish pub we had walked by. Kenna sampled and enjoyed the sake, learning about how it is traditionally poured and consumed.

We returned to the hotel through a very active shopping district. It’s Sunday evening, but apparently that doesn’t stop the shopping culture in Kyoto.

Total walking today: 10.5 miles, 27 floors climbed

This article is part of a series about our recent travels to Japan and Singapore. To see the introductory article in the series, click here.

December 7, 2019 / Jim Fenton

Japan/Singapore Day 2: Kyoto

November 9, 2019

Nijo Castle entrance

We awoke in Kyoto to a beautiful sunny day. Despite jet lag, we both got a reasonable night’s sleep and got up at a normal time this morning. We had breakfast at a Starbucks next to the hotel, since we prefer Western-style breakfasts and weren’t sure what else to do. We found that the meal options at Japanese Starbucks are somewhat more limited, but still quite acceptable.

We decided to do a hop-on/hop-off bus tour to get an overview of the city and it would take us to a few places we wanted to see. We took a short walk through a pleasant neighborhood to the bus stop and noticed that we were in a banking district, and since we were using credit cards and a little leftover yen from a previous trip, we decided to get some cash from the ATM. That’s where we ran into the major challenge of the day.

There were several banks near the bus stop, so we picked one, found an ATM with an English button (reassuring), and tried to get some cash. Just when it would have dispensed the cash it returned my card with a “receipt” saying it couldn’t read the card. Same thing happened with Kenna’s ATM card, and we couldn’t use our credit cards because they don’t have PINs. The next ATM we tried had a sign on the door saying (in English) “Japan domestic ATM cards only”. That saved some time. We tried one or two more to no avail, so returned to the bus stop and bought bus tickets with a credit card.

Our first stop was at Nijo Castle, one of the premier tourist attractions in Kyoto. On the recommendation of our guidebook, we opted to get the audio guides. We learned a great deal about the structure: a classic castle in the sense of being surrounded by a water-filled moat, but in Japanese style. The shogun’s home was impressive, with many rooms for receiving visitors of various ranks. But I needed to remind myself that these buildings are really old — although they have been rebuilt at various times in history. I noticed that the rooms were connected by hallways, a fairly recent architrave development, at least in Western buildings.

Via the bus, we stopped next in the grounds of the old Imperial Palace prior to the moving of the Japanese capital to Tokyo in the 1868. By this time, we were rather hungry, so we stopped at a restaurant in the park surrounding the Palace. When we went to order, we noticed a “Cash Only” sign, and immediately our ATM problems became more serious. We found another ATM outside the park, and again no luck. Although hungry, we toured the Imperial Palace grounds, which were worth seeing, but Nijo Castle was a hard act to follow. The hunger didn’t help either. We returned to the bus stop and found a burger joint near there that accepts credit cards, so at least we got fed.

Somewhere along the way to the next stop, I did an internet search for “Japan ATM problems” or something like that. An article on told me that others have had the same problem, but that the ATMs at the 7-Eleven stores generally work for foreign ATM cards. I don’t generally use ATMs in convenience stores, but in Japan apparently 7-Eleven stores are associated with “7-Bank” and very reliable with reasonable fees. 7-Eleven as a bank makes me feel like I’m in an alternate universe.

We stopped in the vicinity of a craft museum we were interested in visiting and walked to a nearby 7-Eleven, and voila, we were able to get cash from their ATM. We celebrated (and broke the large bills from the ATM) with a couple of ice cream cones.

The craft museum is unfortunately closed for renovations for several months, but a Shinto shrine, the Heian Shrine, was right nearby and worth a visit even if we don’t understand much about the religious significance. There was also a nearby outdoor market that had a variety of interesting and unfamiliar goods.

We got back on the bus and rode to Kyoto Station. Just outside, we ran across a series of elaborate (and very impressive) dance performances by groups of young people, which we watched for a while.

We went up Kyoto Tower and got a view of the city from there, although by this time it was getting dark. We then went looking for dinner, which was an unexpected challenge; it was Saturday night and many restaurants were full. We ended up going to the Food Court below Kyoto Tower and got a quite reasonable dinner there — we need to remember these food courts as good options in the future. Although we couldn’t communicate well, we connected with a friendly couple at the next table, who shared a bit of candy with us as they departed.

Total walking today: 9.7 miles, 12 floors climbed

This article is part of a series about our recent travels to Japan and Singapore. To see the introductory article in the series, click here.

December 5, 2019 / Jim Fenton

Japan/Singapore Day 0-1: To Japan

November 7-8, 2019

Flight map, SFO/KIX

It has been quite a while since we’ve taken a trip that has lent itself to a travel journal, but we’re leaving on one this morning. I have been planning to travel to Singapore for the 106th Internet Engineering Task Force meeting, and wanted to bring Kenna along this time since we’re now empty-nesters.

Kenna wasn’t enthusiastic about the 17-hour flight from San Francisco to Singapore, so we’re taking the opportunity to spend a week in Japan on the way there. Our plan is to fly to Osaka, take a couple of days in nearby Kyoto, followed by a couple of days in Tokyo, before continuing from there to Singapore.

Your characters for this adventure are myself, Jim, and my wife Kenna. There will also be mention of our daughter Celeste, who is a student at the University of Colorado and unfortunately not accompanying us. As with past travel journals, this is mostly written while on the trip, and edited and posted on the blog day-by-day as we return, offset by a few weeks.

I have been to all of these places on business, but haven’t had much time for sightseeing. This is Kenna’s first trip to Asia. It will be fun to see it from the perspectives of both someone who has been there before and someone for whom all of this is new.

I went out to get the newspaper this morning, and it was quite foggy. This concerned me a bit, because it could spell a considerable delay in our flight. Fortunately the United app tells what incoming flight the plane arrives on, and I was reassured to learn that flight (from Denver) was in the air, and not subjected to a ground stop.

The incoming flight was delayed a few minutes, and accordingly our flight was delayed by just a few minutes to allow for servicing. Once in flight, we crossed the Date Line and arrived in the afternoon of the next day.

Hello Kitty themed train (Osaka to Kyoto)

Immigration and customs were fast and efficient on arrival, and we bought train tickets to Kyoto at the Tourist Information. Unfortunately it was getting dark so we didn’t see much of the countryside. Upon arriving at Kyoto Station, we navigated our way to the subway and on to our hotel.

Our hotel, the Gracery Hotel Kyoto Sanjo in the central part of Kyoto, is connected to a few streets that form a pedestrian-only shopping district. Once we got our room (a very comfortable, but not overly large one), we wandered around looking for dinner. We were about to “give up” and have pizza or something when we found a small sushi restaurant. The sushi was fortunately described in English on the signs and we had a very enjoyable meal (good, but not fabulous sushi) for a little less than it would have cost at home. Then we returned to our room about 9 pm and crashed for the night.

December 1, 2019 / Jim Fenton

Requiring TLS transmission of email

RFC 8689 cover page image

It’s considered a “best practice” to support Transport Level Security (TLS), which encrypts traffic over the internet (including this web page), for submission and relay of email messages. Yet many email messages are sent without TLS protection, unbeknownst to their senders, so it’s not something that can be depended upon. Email systems generally prioritize delivery of email over security (something I refer to as the “nor rain nor sleet” principle) so if TLS can’t be negotiated for some reason, the message is sent in the clear.

This past week, the Internet Engineering Task Force (IETF) published “SMTP Require TLS Option” as a Standards Track specification, RFC 8689, to address this.

A few years ago, I became aware of research [1] providing strong evidence that certain countries, notably Tunisia, actively interfere in the negotiation of TLS on email connections, presumably so that they can intercept and read the traffic. It occurred to me that for sensitive traffic it might be preferable to allow the message to be sent only if TLS can be successfully negotiated, and to return an error if this can’t be done. So in early 2016 I wrote the first draft of the REQUIRETLS specification, and submitted it as an IETF Internet Draft.

The way it works is this: when email is sent using the SMTP protocol over the internet, it can be tagged with a “REQUIRETLS” option. Messages tagged with this option can only be sent to mail servers over TLS connections that verify the SMTP server’s identity, and where the mail server receiving the message also advertises that they also support and honor the REQUIRETLS option for onward relay of the message. If none of the email servers to which the message could be relayed meet those requirements, a “bounce” message is returned to the sender.

This raised a number of questions, such as:

  • Why not use end-to-end encryption, such as S/MIME or PGP? These encrypt only the body of the message, so all the header information (To and From addresses, Subject, etc.) are still exposed. This is very valuable information for adversaries doing traffic analysis. You often want both transport-level encryption (TLS) and end-to-end content encryption.
  • What’s to prevent a mail server from advertising REQUIRETLS and then not honoring it? Nothing, but we’re talking about mail servers that the recipient trusts enough to allow them to be used to accept email on their behalf, so one expects they’re trustworthy enough also to honor a commitment to do REQUIRETLS properly.

As it happened, a complementary specification, MTA-STS, was in the standardization process and intending to solve a similar problem. The goal of MTA-STS is to allow a domain that receives email to advertise the fact that they support TLS, so that if it cannot be negotiated the discrepancy can be detected. One of the challenges with MTA-STS is how to advertise that fact in a way that cannot be altered by an intermediate adversary. This is addressed in the MTA-STS specification, RFC 8461. This is also the goal of DANE, an existing protocol (RFC 7672) that allows domains with DNS Security (DNSSEC) configured to advertise their use of TLS.

But another challenge is how the sender of a sensitive message can know that MTA-STS will be checked as the message is relayed. They might know that the recipient domain publishes an MTA-STS policy, but it’s harder to know whether or not the intermediate hops will honor that policy. It’s in this way that MTA-STS and REQUIRETLS are complementary.

On the way to standardization, one significant additional feature was added. There are times when the sender of a message wants explicitly to ignore MTA-STS and DANE policies, for example when they want to report a misconfiguration in these mechanisms. A new header field, Require-TLS (with mandatory value NO) was added to allow that to be asserted. Servers that support REQUIRETLS and encounter this header field are expected to relay the message without regard to those policy mechanisms. Of course, since the goal is to enhance delivery of the message, it isn’t appropriate to relay the message only if the recipient SMTP server supports it, so support of this header field can’t be depended upon by the sender.

At this writing, no known commercial products yet support REQUIRETLS, although I have been in touch with the MDaemon people who are actively implementing it for their products. There was also an early implementation for the Exim open-source mail server that needs to be brought up to date with the latest specification.

REQUIRETLS is a bit of email infrastructure; nothing in the specification addresses how users will turn it on, either on a per-message or per-domain basis, or for all messages they send. I’m hoping to see some creative solutions for that: perhaps a button on the user interface or some rule causing mail to particular domains or addresses to be tagged REQUIRETLS.

I’m hoping that now that it’s a published standards-track specification, REQUIRETLS becomes a standard part of the email toolkit to enhance senders’ control over the security of messages they send.

[1] Durumeric, Zakir, J. Alex Halderman, David Adrian, Ariana Mirian, James Kasten, Elie Bursztein, Nicolas Lidzborski, Kurt Thomas, Vijay Eranti, and Michael Bailey. 2015. “Neither Snow Nor Rain Nor MITM…: An Empirical Analysis of Email Delivery Security.” In , 27–39. ACM Press.

January 16, 2019 / Jim Fenton

Another NIST SP 800-63 mirror

Many people seem to be having trouble accessing NIST publications with the current partial* government shutdown, so at the risk of redundancy, here are copies of the documents in the NIST Special Publication 800-63 Digital Identity Guidelines suite:

*partial, in this case, seems to refer to the interesting parts of the government.

Please do not link to these, as they are not intended to be an archival source and will be taken down once the government is again fully functional.

November 3, 2018 / Jim Fenton

In memory of my grandmother and the Great Influenza

Anna Crandell Robson and children

Today is the 100th anniversary of the death of my grandmother, Anna Crandell Robson, at the age of 33. She died of influenza only five days after her husband, Findlay Robson, and seven days after Findlay’s brother Neil. The death of Anna (usually called Annie) orphaned my uncle Fremont (age 5), aunt Pat (2), and mother Mary (15 months).

Anna grew up in Lindsay, Ontario, the eldest of five children of Fremont Crandell and Irene Fee. She was the granddaughter of Captain George Crandell, who was well-known in the area as the operator of a number of steamboats that operated in the Kawartha Lakes area of Ontario at the time. Prior to their marriage in 1910, Annie had worked at Flavelle Flour Mills, at the site of the mill ruins in Lindsay, Ontario. Since Findlay was in the grocery business, it is likely that they met through that connection.

They moved to British Columbia about 1913, where all three of the children were born. Her younger sister, Agusta (“Gussie”) lived in Calgary, Alberta, the wife of Charles Elliott, a Canadian Pacific Railway employee. Gussie came to Cranbrook to take care of the children at some point (the timing is uncertain, but perhaps before Annie passed). After Annie died, she reportedly had planned to adopt the children; she and Charles had none. However, Gussie also contracted the flu, and died on November 14 at the age of 26. Another relative, perhaps Annie’s mother, came to Cranbrook to retrieve the children and bring them back to Toronto, where they were raised by the families of two of Findlay’s brothers.

The family was thus devastated by the deaths from influenza of four young adults between ages 26 and 37.

October 29, 2018 / Jim Fenton

In memory of my grandfather and the Great Influenza

Today is the 100th anniversary of the death of my grandfather, Findlay Robson, at the age of 37. Findlay (sometimes spelled Finlay) and his wife Anna (Crandell) Robson lived in Cranbrook, British Columbia, where he was the manager of Cranbrook Jobbers, a wholesale grocer. They had three children, Fremont (age 5), Pat (2), and my mother, Mary (15 months).

Findlay grew up in Fenelon Falls, Ontario, about 100 miles northeast of Toronto. His father, William Lithgow Robson, ran the local grocery and Findlay got his start in the grocery business there. Findlay and Anna were married in 1910, and in about 1913 they moved west to British Columbia.

Findlay died of pneumonia that was caused by the great influenza pandemic that year. Newspaper reports said that Cranbrook was hit hard by that flu outbreak; the papers were operating with a reduced staff because of the number of people down with the flu.

Findlay Robson obituary
Findlay Robson obituary, The Cranbrook Herald, October 31, 1918

Only two days before, Findlay’s brother Neil died in Toronto of influenza. According to a newspaper report, his brother’s death “took away the fighting chance he had for his life.”

100 years later, we have the benefit of a much better understanding of what causes influenza and the availability of flu vaccines that, even if not 100% effective, can make the difference between a severe case of the flu and a mild one. I make a point of getting a flu shot every year, both to keep myself from being down with the flu, but also to honor my grandparents’ memory. I recommend the same to everyone.

Spoiler alert: Anna died of the flu a few days later. I will post another article about her on that anniversary.