IELTS Academic Reading Practice Test 184

A hovercraft is a vehicle that travels on a cushion of air trapped beneath it, so that its hull never touches the surface below. Because there is no contact, there is almost no friction, and a craft can move across water, mud, sand or ice with equal ease. The principle sounds simple, yet making it work requires a continuous supply of air, since the cushion escapes from every edge and must be constantly replaced. The machines that resulted were fast, expensive and noisy, and they flourished only where nothing else could do the job.

The man who made the idea practical was Christopher Cockerell, an English engineer born in 1910, who studied engineering at Cambridge and then worked for many years on radio equipment, including a period with the Marconi company. During the Second World War he was involved in the development of airborne radar, and afterwards he and his wife ran a small boat-hire business on the Norfolk Broads. It was there, trying to reduce the drag that limited the speed of boats, that he began to think seriously about air.

Cockerell's key insight concerned the edges of the cushion. If air is merely pumped into a cavity beneath a hull, it spills out around the rim and much of the lifting force is lost; containing it with a rigid wall, on the other hand, means that the craft must sit so close to the surface that it collides with every wave.

His solution was to blow the air downwards around the rim at high speed. This fast-moving jet, which he called a momentum curtain, is deflected outwards by the surface below and forms a barrier that the slower, denser air inside finds hard to push through. He tested the idea not with a boat but with a nest of tin cans and a vacuum cleaner, using kitchen scales to measure the lift it produced.

The results were promising enough for Cockerell to file a patent in 1955. Because the device might have had military value, the patent was for a time subject to a security restriction, and it was some years before a British firm was willing to take the idea further. Support eventually came from the National Research and Development Corporation, a government body established to help inventors, which paid the aircraft manufacturer Saunders-Roe to build a full-size craft. Known as the SR.N1, it was completed on the Isle of Wight in 1959.

The SR.N1 resembled an inverted saucer with a large fan mounted at the front. On 25 July 1959 it crossed the English Channel, exactly fifty years after Louis Blériot had made the first flight across it in an aeroplane. The crossing was a publicity triumph, although the craft carried only its crew and its designer, and for a few years the hovercraft seemed likely to replace the ferry altogether. It had no skirt: the air cushion was contained by a rigid extension of the hull, which worked only in calm conditions.

The addition of a flexible skirt in the early 1960s transformed the hovercraft. Made at first from rubberised fabric and later from tough nylon, the skirt hangs down from the hull and holds a deeper cushion of air. Air still escapes through the gap between the bottom of the skirt and the surface, but because the skirt can bend, the craft is able to ride over waves and rough ground that would have stopped an earlier design. A deeper cushion also means that less power is needed to keep the craft lifted.

Saunders-Roe's largest craft, the SR.N4, entered service across the Channel in 1968. It carried passengers and their cars, which were driven in through the nose, and it crossed in about half the time taken by a ferry. For a time the service was busy, but it was expensive to run: hovercraft consume large quantities of fuel and the salt water damages their structure. When the Channel Tunnel opened in 1994, and conventional ferries grew cheaper, the traffic fell away, and the last cross-Channel service closed in October 2000.

Hovercraft have survived where their peculiar qualities are worth the cost. A passenger service across the Solent, between the English mainland and the Isle of Wight, has operated since the mid-1960s and still carries foot passengers across in a few minutes. Military forces use large hovercraft as landing craft, because they can cross a beach and continue inland over wet ground. Survey companies use them over mudflats and tidal sand, and rescue teams use them over ice, where a boat would be useless. Because the pressure they exert is so low, they can also cross ground that would not support a wheeled vehicle.

Their disadvantages remain formidable. The propellers are extremely noisy, fuel consumption is high and strong winds make control difficult. The skirt is easily damaged, and a hovercraft cannot stop quickly, since it has no brakes. Yet the underlying idea has proved durable, and the same cushion of air now supports patients on hospital transfer mattresses, moves heavy machinery and drives the hover mower in a million gardens. The vehicle itself is a reminder that a good idea can be commercially disappointing and technically influential at the same time.

The gesture has become ordinary. A shopper holds a bank card a few centimetres above a terminal, a light flashes, and the transaction is complete in well under a second. Below a certain value the customer is not asked for a PIN or a signature, and in many shops no receipt is printed. The same exchange can be made with a phone or a watch. The technology behind the tap is invisible, and that invisibility is part of its success: what makes it possible is a set of physical principles and industrial standards that users almost never notice.

A contactless card contains a small silicon chip and a loop of wire that serves as an antenna, but it has no battery of any kind. Instead it draws all the power it needs from the terminal. The reader inside the terminal generates an oscillating magnetic field, and this field induces an alternating current in the card's antenna, a process known as electromagnetic induction. The chip uses that current to run its circuits. To send information back, it does not transmit a signal of its own; it alters the electrical load on its antenna, and the reader registers these alterations as tiny fluctuations in its own field. Engineers call this load modulation, and it allows a powerless card to hold a two-way conversation.

The details are governed by an international standard, ISO/IEC 14443, which specifies how such cards and readers must behave, and payment systems add a further layer of rules agreed by the card industry. The frequency used, 13.56 megahertz, was not chosen at random. It lies in a band reserved internationally for industrial, scientific and medical devices, so equipment that uses it needs no licence in most countries, and it allows an antenna small enough to be embedded in a plastic card. The whole exchange, from the terminal's first call to the card's final answer, occupies only a few hundred milliseconds.

A card does not simply broadcast a fixed account number. Its chip calculates a response from two inputs. The first is a secret key that is stored in the chip and never leaves it. The second is a random number that the terminal supplies afresh for each transaction. Because that number is different every time, the resulting response is different too, and a conversation recorded by an eavesdropper cannot be replayed later. The key is written into the chip when the card is made, which is one reason why a card's printed details are not enough to produce a working copy.

Phones add another layer. When a card is registered with a mobile wallet, the real account number is not kept on the device. Instead the phone holds a substitute number, known as a token, which is tied to that handset alone. If the phone is lost, the token can be suspended without the card itself being replaced. A fingerprint or a passcode unlocks the secure chip inside the phone before any payment is made.

Public anxiety has focused on the idea of electronic pickpocketing, in which a criminal reads a card through a pocket or a bag. The physics makes this difficult. The field falls away steeply with distance, and a card responds only when it is very close to the reader. Researchers have nevertheless shown that two devices working together, one beside the card and one beside an unwitting terminal, can relay a signal over a much greater distance, so that card and terminal behave as though they were touching. Wallets with metal linings have been sold on the strength of this fear, although tests by consumer organisations have suggested that many of them are unnecessary.

Contactless payments are not unlimited. Banks set a maximum value for a single purchase, and a cumulative total that triggers a request for a PIN. Some transactions are authorised without any contact with the bank at all: the terminal inspects counters held on the card itself and, if they fall within the limits stored there, approves the payment, with settlement following later. In that arrangement the risk rests with the bank rather than with the shop. Retailers welcome this, because it keeps queues moving even when a network connection fails.

Speed is the commercial argument. A cashier who does not have to count coins or wait for a signature serves customers faster, and a payment that fails can be retried at once. Transport systems have gained most: buses in London stopped accepting cash in 2014, largely because handling fares delayed them at every stop, and passengers now board by touching a card to a reader. The same logic has been applied to car parks, vending machines and stadiums. In each case the saving is small for the individual customer but considerable across a day.

Research now concentrates on two problems. The first is verification: some of the newest cards carry a fingerprint sensor that is powered, like everything else in the card, by the field from the terminal, so that the card itself can confirm who is using it. The second is range. Systems built on other radio technologies can detect a shopper leaving a shop with goods and charge for them automatically, but the extension of range that makes this convenient also makes unauthorised reading easier, and the balance has yet to be settled.

Every few months the same message arrives from banks, employers and websites: we are the weakest link in our own security. We are told to invent a different password for every account, to make each one long and yet easy to remember, to mix capitals with digits and symbols, and to change them regularly. This advice has been repeated so often that it has the status of common sense. It is also, in large part, bad advice, and the fact that it has survived for so long tells us something about who benefits from it.

The rules can be traced to a short set of guidelines published in 2003 by the National Institute of Standards and Technology, an American government agency. They were drafted quickly by a small group of officials and were based less on research than on intuition. The reasoning had an appealing logic: if a password contains many kinds of character, it must be hard to guess. One of those involved later remarked publicly that the advice had been mistaken, and that the complexity requirements had never been properly tested. Because the agency's guidelines were widely copied by software vendors and regulators, the rules spread around the world and became, in effect, compulsory.

The evidence against them has accumulated slowly. Human memory holds only so much, and an adult with dozens of accounts cannot keep dozens of unrelated strings of characters in mind; the average user, faced with this demand, behaves rationally. People reuse passwords across sites, or make small alterations to a familiar one, adding a digit or bumping it up by one when a system insists on a change. Studies of passwords leaked in breaches have found the same patterns again and again: names, football teams, dates of birth and the word password itself, sometimes with an exclamation mark for good measure.

Research on forced changes is particularly revealing. When a system demands a new password every few months, users do not invent something entirely fresh; they modify the old one in ways that are easy to guess, and later versions tend to be weaker than the original. The rule that was meant to limit the damage of a stolen password therefore reduces the strength of every password in the system. Length, by contrast, has a very large effect: every extra character multiplies the number of possibilities that an attacker must try.

In 2017 the American guidelines were rewritten. Periodic changes are no longer recommended, nor are rules requiring a mixture of character types. Instead, systems are told to demand a minimum length, to allow long passphrases and to check every new password against lists of those known to be common or already exposed in breaches. This is a modest, evidence-based approach, and it took fourteen years to displace advice that had never worked. Similar advice has since been adopted by several other national agencies.

Two further problems complicate the picture. The first is measurement: the 'strength' scores displayed beside a password box are produced by simple estimates, and many of them reward a short string with symbols while undervaluing a long phrase of ordinary words. The second problem is memory. Password managers, which generate and store a separate password for every site, solve this neatly, and specialists recommend them. But they concentrate risk: the master password becomes the single key to everything, and managers themselves have been attacked.

None of this is an argument for carelessness. It is an argument about where responsibility belongs. A user who is asked to remember thirty credentials, to judge which of them protects a bank and which a newsletter, and to do so without error for years, is being set an impossible task. The systems that make the demands are built by organisations with the resources to do better, and many of them still impose arbitrary limits: passwords truncated at twelve characters, symbols forbidden, security questions that ask for a mother's maiden name.

The most promising way out removes the password altogether. Under a system known as a passkey, the user's device holds a private cryptographic key, and the website holds only the matching public key. Nothing secret is typed, so there is nothing for a fake website to capture, and the technique is therefore resistant to the phishing attacks that account for a large share of breaches. A growing number of technology companies now support passkeys. The weak point is recovery: a lost phone, a broken laptop or a changed job can lock a person out of their own accounts, and the procedures for getting back in often fall back on the email address and the security question.

My conclusion is that the language of blame should be reversed. No system is perfect, and the aim should be to make the honest route the easy one. Users respond sensibly to unreasonable demands, and the unreasonable demands are made by the services they depend on. Regulation of consumer software is unfashionable, but it is the only lever likely to change the behaviour of companies that lose nothing when a customer's account is broken into. Until then, the weakest link will remain exactly where it has always been: in the design of the systems that ask us to prove who we are.