Feeds:
Posts
Comments

Posts Tagged ‘internet security’

Privacy and anonymity on the Internet and in real life are under increasing assault due to companies’ and governmental agencies’ ability to capture incredible amounts of data mainly from Internet traffic, and their ability to track users across websites and services, generally without users’ knowledge.  Once it’s been captured, this data is essentially impossible to erase regardless of whether it is right or in error, and many organizations that have captured such troves of data have demonstrated a weak ability to maintain control of it.

Often this data is used “just” for commercial purposes, but could also be used to threaten to expose users of certain websites or services, or expose holders of unpopular political, social, or economic views, or to prevent people from accessing whatever websites someone in power wishes them not to access.

Privacy and anonymity are different but interrelated, and both are deeply and honorably enshrined in American legal and cultural traditions.  For our purposes,

  • Privacy means other people can’t get information about me (e.g. tax returns or medical records) that I don’t willingly give them, and it’s no business of anyone else’s what websites I go to or what I do online.  To have privacy is part of what it means to be an autonomous human being; if you have no privacy, other people can know everything about you and be able to make decisions for you or predict your actions.
  • Anonymity means I can express opinions, access Internet-based data, or visit websites without anyone knowing who I am in real life, or where I am physically (not being able to find or contact me, in other words to be able to harass, expose, or arrest me).  This should include someone not being able to identify me via some pseudo-me that they have constructed from my presence using cookies, malware, or other hidden identifiers.  Just their not knowing my real name is not enough, to be anonymous is to be unreachable.

I am disturbed by people who, in the wake of 9/11 or because of some other real or perceived terrorist activities, take the position that “only people with something to hide need to hide behind privacy.”  This is nonsense.  We all deserve privacy in our private lives, unless for a very specific reason someone gets a court order to pierce this veil.  Nor is anonymity somehow un-American.  In the early days of our Revolution, Madison, Jay, and Hamilton wrote the Federalist Papers under the name of Publius to avoid any untoward personal issues from their views.  Purer and more patriotic Americans never existed than these!

This situation has been brought about by aggressive data capture technologies, and the ability to cheaply store incredible amounts of raw data and quickly process it to correlate, trace, and extract meaning from even the tiniest pieces of it.  Governments, repressive or otherwise, have used court orders to compel Internet-based services to disgorge details on individuals’ use of these services and have also developed network-penetration techniques (hacking) to harass individuals and obstruct their access to data.  Technology has thus leapt ahead of accepted proper use of it, and indeed ahead of the common person’s ability to even comprehend what is happening.

Here is a good, and seemingly harmless example.  If a woman is a regular Target shopper, using a Red Card or consistently using a single credit or debit card, and she becomes pregnant, Target will know that fact by the third or fourth month with a very high degree of certainty, based on subtle shifts in her buying habits.  Not because she’s buying diapers, because she isn’t yet, but by other changes they won’t make public.  At this point they start biasing their ads delivered to her for the purpose of increasing her “lock in” to Target, so that Target becomes her preferred store during the next couple of years.

But if Target can do this, what if an insurance company could buy data on policyholders that would allow them to determine that you are developing some serious health problems, and raise your rates, or drop you entirely,or not take you on in the first place?  Or could the state pre-emptively revoke your driver’s license?  Or arrest you because they felt you were exhibiting signs of radicalism, whatever that may mean?  And worse yet, if any of these things happened to you, would you even know the reason, or would you think it was some accident of nature?

And now we have the evidence that the National Security Agency has for many years, without any warrant or even hint that any wrong-doing was being carried out, been recording phone call details and Internet access data (“metadata”) on a great fraction of the American public on an ongoing basis.  These governmental criminals then look you in the face and say, “we’re not listening to your calls or looking at your data, we’re just recording this ‘metadata,’ you don’t have to worry!”

Let’s look at this metadata.  For a phone call, it would include your number, where you were, were you moving, who you called, where they were, at what time of day, and how long it lasted.  You may say, “so they know I call my sister in Toledo every Friday evening.  So what?”  Well, if they have the metadata on every call you have made for the last several years, they can build a profile of your normal calling patterns to a surprising level of detail.  Now you start calling – even twice a week, say, a lover in San Antonio.  They would be able to see this as a deviation from your usual calling pattern, and they could be alerted, perhaps, and perhaps interested.

So metadata on calls and Internet accesses is far from harmless.  They don’t have to listen to the calls with this kind of stuff at their fingertips.  Indeed, the call metadata is in many ways superior to merely listening in on somebody’s line.  What Target can do with charge-card metadata, the NSA can to a thousand times over with call metadata.

So what they want to do is to record communication metadata on everybody in the country, forever, so they can go back into it at their convenience, and analyze it retro-spectively looking for some hint of wrongdoing.  At this point, we have no personal privacy any more, we are as good as naked on the street.  Even the Chinese or Russian police states don’t (yet) have this power.

So I ask: is this the kind of country we want to live in?

Advertisements

Read Full Post »

If you’ve been traveling to Pluto or somewhere recently, and are unaware of the spectacular hack carried out against Mat Honan of Wired Online, see my previous post, which also links to his own description of the whole dismal proceeding.  Read it first, so you have an appreciation for the magnitude of the damage he suffered.  Herein is my analysis and a prescription for how to reduce your chances of being subjected to the same kind of abuse.

First of all, I note that there were no bits involved in this hack — this was not a technical attack, they did not guess any passwords or execute some esoteric  bombardment of his digital assets.  No, this was purely “social engineering,” the hackers put together data they fraudulently obtained from Amazon’s and Apple’s customer service desks to take control of Honan’s Apple customer account and then leverage that to other services.  In short order they controlled every digital asset he had.  But the penetration was not “techie” and so no amount of hard-to-guess passwords or whatever would have helped him avoid it.

A great part of his problem was that the two customer-service desks the hackers contacted had procedures in place that allowed them to ignore the fact that the hackers couldn’t answer the security questions Mat had entered.  They therefore got in with relatively simple, relatively public data  they had figured out or augured out of somebody else.  You can’t fix this, Apple and Amazon (and others) have to, and to an extent they may already have. But still, there are steps you can take to help insulate yourself from their stupid procedures.

And remember, there is always a balance between security and convenience in everything you do, online as well as offline.  The problem is, most people are pretty good at evaluating and deciding how to find this balance offline, but not at all experienced at doing so online.  So, my objective is to help you find that online balance.

THE BASICS, REITERATED

First, back up your data! If it doesn’t exist in three places, you really don’t want it all that badly.  So, it’s on your machine, second, buy a terabyte external drive and copy it there once in a while, and finally subscribe to a secure online backup.  I use Carbonite, $55 per machine per year to do it automatically, but there are others.

Second, use a password-vault system  and let it generate your passwords (at least some of them), I use LastPass but there are others.   In my opinion, LastPass is the best.   If you don’t bother to do these two things, stop reading here, you have a prodigious appetite for risk.

Now I’m going to make some suggestions to help you deal with the two biggest exposures Mat had, how his accounts were linked, and how his email accounts were guessable.

TO AVOID BEING HONANED — ACCOUNT LINKING

This is the biggest convenience – security tradeoff area.  You log onto your gmail account, and lo and behold you can be logged into your calendar.  Or, you log into Facebook, and you are seemingly logged into Instagram, or any number of other services that authenticate (because you told them to “log me in using Facebook, or whatever”) through another application.  Yahoo, Facebook, Twitter, and Google are the largest authentication providers.  Well, when you do this you are linking your logon credentials among those services., so if they have a failure, or if somebody gets your credentials to the host service, they are into all of the ones that are linked.

So then, the obvious solution to this is to not do so much cross-app linking.  Unlikely to happen, linking is waaaay to convenient.  For example, I myself link Foursquare and Instagram to Facebook, so I can cross-post checkins and quickie pictures to my Facebook timeline.  And my Google services are linked, but linked through Google, not Facebook’s ID and password.

So where you link services, be aware of it.  I usually link only within the same “company,” but not always.  Figure out where you’re linked and consider unwinding some of them.  One of the reasons I use LastPass (see above) is that I can offload some of the “I’m here, log me in over there” work to LastPass instead of letting Google et.al. do it — I control LastPass myself, I don’t control Google.

TO AVOID BEING HONANED — EMAIL

All this is fine, except that even the most sophisticated passworded and unlinked-services approach is useless if their customer service desk hands out your credentials even if whoever is trying to get in can’t answer the security questions.  Their password-reset approach almost universally relies on email to send you a temporary password, so if the attackers have hacked / accessed that account, they now own you because they’ll get to set the new password on your account, and you won’t know it.  This is what happened to Mat.

So then, two suggestions.  First, set up an email address that you use for essentially nothing else, to receive any password resets you ever have.  This is the address that you usually give them when you register with the service.   Sign up with somebody’s email service and give your username as “duckspit491” or the like, not “yourname”.   And put a different password on it than any other of your email accounts.

Second, do not use the same ID or address prefix across all the email accounts you happen to have.  Don’t make it yourname@gmail.com andyourname@yahoo.com and yourname@facebook.com.  If you do this, if all the accounts have one prefix, the attackers just try all the other services to see if you’re using that name there too. And of course, don’t use the same password for the lot of them!  I have always done this, and I’m surprised that it’s not obvious to others that this is a good idea, but it’s not.  But now, for you, it IS a good idea, right?   Again, LastPass will manage these passwords for you so logging in won’t be a chore.

FINAL SUGGESTIONS

Just a few additional thoughts; if you do the above you will have already reduced your exposure by quite a bit, but here’s some more good practices:

  • Password your phone – the most likely device to be lost. Most people have their phone apps set for auto-login, so if you lose your phone you have lost 90% of your control right there.
  • Consider Gmail’s 2-factor authentication, which can tie logons to Gmail from only the devices that you personally have or use.
  • Don’t log into things you don’t have to. Google wants you to log into your browser, some other services offer that too.  Don’t.  You don’t get much benefit and they get your data. And of course a hacker will get just that little bit more leverage.

Mat Honan was in one sense extremely lucky — the hackers were out to sow chaos and destruction, not out to rob or swindle him, and indeed they didn’t.  But if that had been their intention, they could really have caused him some losses, and he wouldn’t have known where to even start looking for them.

Read Full Post »